@ledgerhq/revault-sdk 0.27.9 → 0.27.11

package/lib/onboarding.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.cjs","names":["getMasterSeed"],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    debugAuthToken?: string;\n    signerSeed?: string;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  debugAuthToken: string | undefined,\n): void => {\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () => null)\n    .with(\"ON_PREM\", () => (debugAuthToken ? null : \"On-premises HSM requires a debug auth token\"))\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n    { state, engine, debugAuthToken, signerSeed },\n    logger,\n  ) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    const { id: onboardingId } = state;\n    if (debugAuthToken) {\n      const debugClient = engine.createClient({ debugAuthToken });\n      const seed =\n        signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n      await debugClient.debug.insertExternalSignerSeed.mutate({\n        workspaceName: state.workspaceName,\n        seed,\n      });\n      logger.info(\"Inserted external signer seed\");\n    }\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    debugAuthToken?: string;\n    signerSeed?: string;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, debugAuthToken, signerSeed, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, debugAuthToken);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, debugAuthToken, signerSeed }, logger);\n  }\n}\n"],"mappings":";;;;;;;AAwBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,EAAA,GAAA,UAAA,SAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAM,uBACJ,OACA,iBACS;;AAET,KAAI,MAAM,mBAAmB,aAC3B,OAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,iBAAiB;;;AAKhG,MAAM,wBACJ,OACA,mBACS;CACT,MAAM,gBAAA,GAAA,WAAA,OAAqB,MAAM,eAAe,CAC7C,KAAK,gBAAgB,KAAK,CAC1B,KAAK,iBAAkB,iBAAiB,OAAO,8CAA+C,CAC9F,YAAY;AACf,KAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,aAAa;;AAIjC,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,eACxD;;AAGF,OACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;IAChC,KAAK,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;KAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,aAAS,KAAK,QAAQ;;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YAAY;AACpE,sBAAoB,OAAO,SAAS;AACpC,SAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,IACrB,CAAC;;CAMJ,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;AACvE,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAGrF,uCAAuC,OACrC,EAAE,OAAO,QAAQ,gBAAgB,cACjC,WACG;AACH,sBAAoB,OAAO,UAAU;EACrC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,MAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,gBAAgB,CAAC;GAC3D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAMA,eAAAA,cAAc,OAAO,UAAU,KAAK,CAAC,CAAC,SAAS,SAAS;AAC1F,SAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;IACD,CAAC;AACF,UAAO,KAAK,gCAAgC;;AAE9C,UAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO,EAC7E,cACD,CAAC;EACF,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,UAC5C;AACD,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,yBAAyB;AACjD,SAAM,OAAO,gBAAgB,MAAM,CAAC,sBAAsB,UAAW;AACrE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,cAAc,CAAC;;CAM5F,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;AAC9D,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAClF;AAED,eAAsB,QACpB,MAMA,QACe;CACf,MAAM,EAAE,QAAQ,gBAAgB,YAAY,cAAc;CAE1D,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,sBAAqB,OAAO,eAAe;AAE3C,QAAO,MAAM,SAAS,aAAa;AACjC,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAEF,MAAM,OAAO,MAAM,MAAM;AACzB,SAAO,KAAK,KAAK,KAAK;AACtB,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAgB;GAAY,EAAE,OAAO"}
+{"version":3,"file":"onboarding.cjs","names":["getMasterSeed"],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    debugAuthToken?: string;\n    signerSeed?: string;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  debugAuthToken: string | undefined,\n): void => {\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () => null)\n    .with(\"ON_PREM\", () => (debugAuthToken ? null : \"On-premises HSM requires a debug auth token\"))\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n    { state, engine, debugAuthToken, signerSeed },\n    logger,\n  ) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    const { id: onboardingId } = state;\n    if (debugAuthToken) {\n      const debugClient = engine.createClient({ debugAuthToken });\n      const seed =\n        signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n      await debugClient.debug.insertExternalSignerSeed.mutate({\n        workspaceName: state.workspaceName,\n        seed,\n      });\n      logger.info(\"Inserted external signer seed\");\n    }\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    debugAuthToken?: string;\n    signerSeed?: string;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, debugAuthToken, signerSeed, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, debugAuthToken);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, debugAuthToken, signerSeed }, logger);\n  }\n}\n"],"mappings":";;;;;;;AAwBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;AAChB;AAEA,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;AACzE;AAEA,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE;CACpD,CAAA,GAAA,UAAA,QAAA,CAAU,UAAU,KAAA,GAAW,kBAAkB,MAAM;CACvD,OAAO;AACT;AAEA,MAAM,uBACJ,OACA,iBACS;;CAET,IAAI,MAAM,mBAAmB,cAC3B,MAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,gBAAgB;AAE/F;;AAGA,MAAM,wBACJ,OACA,mBACS;CACT,MAAM,gBAAA,GAAA,WAAA,MAAA,CAAqB,MAAM,cAAc,CAAC,CAC7C,KAAK,gBAAgB,IAAI,CAAC,CAC1B,KAAK,iBAAkB,iBAAiB,OAAO,6CAA8C,CAAC,CAC9F,WAAW;CACd,IAAI,iBAAiB,MACnB,MAAM,IAAI,MAAM,YAAY;AAEhC;AAEA,MAAa,QAAQ;;;;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,gBACxD;;GAGF,IACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;GACjC,MAAM,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,KAAK,CAAC,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;IAAK,CAAC,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,MAAM,CAAC;IACnD,SAAS,KAAK,OAAO;GACvB;EACF;EACA,MAAM,QAAQ,IAAI,QAAQ;EAC1B,OAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;CACtF;;;;CAKA,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,aAAa,CAAC;EAC3F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;GACnB,IAAI,QAAQ,SAAS,sBAAsB,OAAO;GAKlD,OAAO,CAAC,CAJY,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC,CAAC,CACD,KAAK,MAAM;GAEV,OADc,kBAAkB,EAAE,UACvB;EACb,CAAC;EACH,MAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,KAAK,CAAC,CACtB,2BAA2B,WAAW,CAAC,CACvC,WAAW,OAAO,KAAK,0BAA0B,OAAO,CAAC,CAC9D,CACF;EACA,OAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,aAAa,CAAC;CAC3E;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;;;;CAK1F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAK5C,OAAO,CAAC,CAJe,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAS;GAAK,CAAC;GAC1E,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YAAY;EACpE,oBAAoB,OAAO,QAAQ;EACnC,OAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,GACtB,CAAC;CACH;;;;CAKA,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAI5C,OAAO,CAAC,CAHe,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;GAChE;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAgB;GAAK,CAAC;GACjF,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,aAAa,CAAC;CACxF;;;;CAKA,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,aAAa,CAAC;EACxF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,SAAS;EAC/E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,QAAQ;GAChC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,kBAAkB,SAAU;GAChE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,aAAa,CAAC;CACpF;CAEA,uCAAuC,OACrC,EAAE,OAAO,QAAQ,gBAAgB,cACjC,WACG;EACH,oBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,IAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,eAAe,CAAC;GAC1D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAMA,eAAAA,cAAc,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ;GACzF,MAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;GACF,CAAC;GACD,OAAO,KAAK,+BAA+B;EAC7C;EACA,QAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO,EAC7E,aACF,CAAC;EACD,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,SAC7C;EACA,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,yBAAyB;GACjD,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,sBAAsB,SAAU;GACpE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,aAAa,CAAC;CAC3F;;;;CAKA,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;EAC9D,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,aAAa,CAAC;EACpF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,YAAY;EAC5E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,IAAI;GACvC,MAAM,YAAY,GAAG,QAAQ;GAC7B,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,oBAAoB,SAAU;GAClE,OAAO,KAAK,0BAA0B,GAAG,MAAM;EACjD,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;AAClF;AAEA,eAAsB,QACpB,MAMA,QACe;CACf,MAAM,EAAE,QAAQ,gBAAgB,YAAY,cAAc;CAE1D,MAAM,EAAE,mBAAmB;CAC3B,OAAO,KAAK,sBAAsB,gBAAgB;CAClD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,eAChB,CAAC;CAED,qBAAqB,OAAO,cAAc;CAE1C,OAAO,MAAM,SAAS,aAAa;EACjC,IAAI,aAAa,MAAM,SAAS,WAAW;GACzC,OAAO,KAAK,qCAAqC;GACjD;EACF;EACA,MAAM,OAAO,MAAM,MAAM;EACzB,OAAO,KAAK,KAAK,IAAI;EACrB,QAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAgB;EAAW,GAAG,MAAM;CAC1E;AACF"}

package/lib/onboarding.d.cts

@@ -1,5 +1,5 @@
-import { t as Logger } from "./logger-Cme0iL1f.cjs";
-import { d as Engine, y as WithOnboarding } from "./types-DYXb0C4y.cjs";
+import { t as Logger } from "./logger-DHtgWA66.cjs";
+import { d as Engine, y as WithOnboarding } from "./types-BXAwSr1F.cjs";
 import { OnboardingFullStateResponse, OnboardingStep } from "@ledgerhq/revault-api";
 
 //#region src/onboarding.d.ts

package/lib/onboarding.d.ts

@@ -1,5 +1,5 @@
-import { t as Logger } from "./logger-DWLViq7U.js";
-import { d as Engine, y as WithOnboarding } from "./types-BclZ5rGR.js";
+import { t as Logger } from "./logger-DHtgWA66.js";
+import { d as Engine, y as WithOnboarding } from "./types-BN2MzD_5.js";
 import { OnboardingFullStateResponse, OnboardingStep } from "@ledgerhq/revault-api";
 
 //#region src/onboarding.d.ts

package/lib/onboarding.js

@@ -1,4 +1,4 @@
-import { i as getMasterSeed } from "./crypto-DdEUFJar.js";
+import { i as getMasterSeed } from "./crypto-BHYSptBe.js";
 import invariant from "invariant";
 import { match } from "ts-pattern";
 //#region src/onboarding.ts
@@ -69,6 +69,9 @@ const checkExternalSigners = (state, debugAuthToken) => {
 	if (errorMessage !== null) throw new Error(errorMessage);
 };
 const STEPS = {
+	/**
+	* Devices claiming
+	*/
 	PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {
 		const promises = [];
 		for (const device of devices) {
@@ -88,6 +91,9 @@ const STEPS = {
 		await Promise.all(promises);
 		return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });
 	},
+	/**
+	* Wrapping Key provisioning
+	*/
 	PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {
 		const { id: onboardingId } = state;
 		state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });
@@ -104,7 +110,13 @@ const STEPS = {
 		await Promise.all(toCollect.map((index) => engine.withDeviceIndex(index).collectWrappingKeyFragment(wrappingKey).then(() => logger.info(`Collected Wrapping Key ${index}`))));
 		return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });
 	},
+	/**
+	* Init Master Admins registration
+	*/
 	PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) => engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),
+	/**
+	* Master Admins registration
+	*/
 	PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {
 		const { id: onboardingId } = state;
 		const toRegister = state.claimedDevices.filter((claimed) => {
@@ -124,10 +136,16 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });
 	},
+	/**
+	* Init Shared Owners registration
+	*/
 	PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {
 		checkHsmHostingMode(state, "HOSTED");
 		return engine.client.onboarding.startSharedOwnersRegistration.mutate({ onboardingId: state.id });
 	},
+	/**
+	* Shared Owners registration
+	*/
 	PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {
 		checkHsmHostingMode(state, "HOSTED");
 		const { id: onboardingId } = state;
@@ -148,6 +166,9 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });
 	},
+	/**
+	* Review by master admins
+	*/
 	PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {
 		const { id: onboardingId } = state;
 		state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });
@@ -182,6 +203,9 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });
 	},
+	/**
+	* Seed provisioning
+	*/
 	PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {
 		checkHsmHostingMode(state, "HOSTED");
 		const { id: onboardingId } = state;
@@ -195,6 +219,9 @@ const STEPS = {
 		}));
 		return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });
 	},
+	/**
+	* Workspace initialization
+	*/
 	PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) => engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id })
 };
 async function onboard(opts, logger) {

package/lib/onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    debugAuthToken?: string;\n    signerSeed?: string;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  debugAuthToken: string | undefined,\n): void => {\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () => null)\n    .with(\"ON_PREM\", () => (debugAuthToken ? null : \"On-premises HSM requires a debug auth token\"))\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n    { state, engine, debugAuthToken, signerSeed },\n    logger,\n  ) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    const { id: onboardingId } = state;\n    if (debugAuthToken) {\n      const debugClient = engine.createClient({ debugAuthToken });\n      const seed =\n        signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n      await debugClient.debug.insertExternalSignerSeed.mutate({\n        workspaceName: state.workspaceName,\n        seed,\n      });\n      logger.info(\"Inserted external signer seed\");\n    }\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    debugAuthToken?: string;\n    signerSeed?: string;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, debugAuthToken, signerSeed, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, debugAuthToken);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, debugAuthToken, signerSeed }, logger);\n  }\n}\n"],"mappings":";;;;AAwBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;CACf;AAED,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;EAAK;CACpF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACxE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;EAAK;CACzE;AAED,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,KAAK,EAAE;AACpD,WAAU,UAAU,KAAA,GAAW,kBAAkB,OAAO;AACxD,QAAO;;AAGT,MAAM,uBACJ,OACA,iBACS;;AAET,KAAI,MAAM,mBAAmB,aAC3B,OAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,iBAAiB;;;AAKhG,MAAM,wBACJ,OACA,mBACS;CACT,MAAM,eAAe,MAAM,MAAM,eAAe,CAC7C,KAAK,gBAAgB,KAAK,CAC1B,KAAK,iBAAkB,iBAAiB,OAAO,8CAA+C,CAC9F,YAAY;AACf,KAAI,iBAAiB,KACnB,OAAM,IAAI,MAAM,aAAa;;AAIjC,MAAa,QAAQ;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,EAAE;AACpC,OAAK,MAAM,UAAU,SAAS;AAC5B,OAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,eACxD;;AAGF,OACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;IAChC,KAAK,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,MAAM,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;KAAM,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC;AACpD,aAAS,KAAK,QAAQ;;;AAG1B,QAAM,QAAQ,IAAI,SAAS;AAC3B,SAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;;CAMvF,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,cAAc,CAAC;EAC5F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;AACnB,OAAI,QAAQ,SAAS,qBAAsB,QAAO;AAKlD,UAAO,CAJY,CAAC,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED,CACD,KAAK,MAAM;AAEV,UADc,kBAAkB,EAAE,WAAW;IAE7C;AACJ,QAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,MAAM,CACtB,2BAA2B,YAAY,CACvC,WAAW,OAAO,KAAK,0BAA0B,QAAQ,CAAC,CAC9D,CACF;AACD,SAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,cAAc,CAAC;;CAM5E,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAK3F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAK5C,UAAO,CAJe,CAAC,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;IAC7B;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAS;IAAM,CAAC;AAC3E,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,yCAAyC,OAAO,EAAE,QAAQ,YAAY;AACpE,sBAAoB,OAAO,SAAS;AACpC,SAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,IACrB,CAAC;;CAMJ,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;AACvE,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;AAC1D,OAAI,QAAQ,SAAS,eAAgB,QAAO;AAI5C,UAAO,CAHe,CAAC,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;IAC/D;IAED;AACF,QAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,KAAK;AACrC,SAAM,OAAO,gBAAgB,MAAM,CAAC,eAAe;IAAE,MAAM;IAAgB;IAAM,CAAC;AAClF,UAAO,KAAK,cAAc,OAAO;IACjC,CACH;AACD,SAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,cAAc,CAAC;;CAMzF,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,cAAc,CAAC;EACzF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,UAAU;AAChF,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,QAAQ;AAChC,SAAM,OAAO,gBAAgB,MAAM,CAAC,kBAAkB,UAAW;AACjE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,cAAc,CAAC;;CAGrF,uCAAuC,OACrC,EAAE,OAAO,QAAQ,gBAAgB,cACjC,WACG;AACH,sBAAoB,OAAO,UAAU;EACrC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,MAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,gBAAgB,CAAC;GAC3D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAM,cAAc,OAAO,UAAU,KAAK,CAAC,CAAC,SAAS,SAAS;AAC1F,SAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;IACD,CAAC;AACF,UAAO,KAAK,gCAAgC;;AAE9C,UAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO,EAC7E,cACD,CAAC;EACF,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,UAC5C;AACD,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,KAAK;GAC3C,MAAM,YAAY,MAAM,yBAAyB;AACjD,SAAM,OAAO,gBAAgB,MAAM,CAAC,sBAAsB,UAAW;AACrE,UAAO,KAAK,iBAAiB,MAAM,OAAO;IAC1C,CACH;AACD,SAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,cAAc,CAAC;;CAM5F,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;AAC9D,sBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;AAC7B,UAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,cAAc,CAAC;EACrF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,aAAa;AAC7E,QAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,KAAK;GACxC,MAAM,YAAY,GAAG,QAAQ;AAC7B,SAAM,OAAO,gBAAgB,MAAM,CAAC,oBAAoB,UAAW;AACnE,UAAO,KAAK,0BAA0B,GAAG,OAAO;IAChD,CACH;AACD,SAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,cAAc,CAAC;;CAMjF,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,IAAI,CAAC;CAClF;AAED,eAAsB,QACpB,MAMA,QACe;CACf,MAAM,EAAE,QAAQ,gBAAgB,YAAY,cAAc;CAE1D,MAAM,EAAE,mBAAmB;AAC3B,QAAO,KAAK,sBAAsB,iBAAiB;CACnD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,gBACf,CAAC;AAEF,sBAAqB,OAAO,eAAe;AAE3C,QAAO,MAAM,SAAS,aAAa;AACjC,MAAI,aAAa,MAAM,SAAS,WAAW;AACzC,UAAO,KAAK,sCAAsC;AAClD;;EAEF,MAAM,OAAO,MAAM,MAAM;AACzB,SAAO,KAAK,KAAK,KAAK;AACtB,UAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAgB;GAAY,EAAE,OAAO"}
+{"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    debugAuthToken?: string;\n    signerSeed?: string;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  debugAuthToken: string | undefined,\n): void => {\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () => null)\n    .with(\"ON_PREM\", () => (debugAuthToken ? null : \"On-premises HSM requires a debug auth token\"))\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n    { state, engine, debugAuthToken, signerSeed },\n    logger,\n  ) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    const { id: onboardingId } = state;\n    if (debugAuthToken) {\n      const debugClient = engine.createClient({ debugAuthToken });\n      const seed =\n        signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n      await debugClient.debug.insertExternalSignerSeed.mutate({\n        workspaceName: state.workspaceName,\n        seed,\n      });\n      logger.info(\"Inserted external signer seed\");\n    }\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    debugAuthToken?: string;\n    signerSeed?: string;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, debugAuthToken, signerSeed, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, debugAuthToken);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, debugAuthToken, signerSeed }, logger);\n  }\n}\n"],"mappings":";;;;AAwBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;AAChB;AAEA,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;AACzE;AAEA,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE;CACpD,UAAU,UAAU,KAAA,GAAW,kBAAkB,MAAM;CACvD,OAAO;AACT;AAEA,MAAM,uBACJ,OACA,iBACS;;CAET,IAAI,MAAM,mBAAmB,cAC3B,MAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,gBAAgB;AAE/F;;AAGA,MAAM,wBACJ,OACA,mBACS;CACT,MAAM,eAAe,MAAM,MAAM,cAAc,CAAC,CAC7C,KAAK,gBAAgB,IAAI,CAAC,CAC1B,KAAK,iBAAkB,iBAAiB,OAAO,6CAA8C,CAAC,CAC9F,WAAW;CACd,IAAI,iBAAiB,MACnB,MAAM,IAAI,MAAM,YAAY;AAEhC;AAEA,MAAa,QAAQ;;;;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,gBACxD;;GAGF,IACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;GACjC,MAAM,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,KAAK,CAAC,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;IAAK,CAAC,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,MAAM,CAAC;IACnD,SAAS,KAAK,OAAO;GACvB;EACF;EACA,MAAM,QAAQ,IAAI,QAAQ;EAC1B,OAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;CACtF;;;;CAKA,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,aAAa,CAAC;EAC3F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;GACnB,IAAI,QAAQ,SAAS,sBAAsB,OAAO;GAKlD,OAAO,CAAC,CAJY,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC,CAAC,CACD,KAAK,MAAM;GAEV,OADc,kBAAkB,EAAE,UACvB;EACb,CAAC;EACH,MAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,KAAK,CAAC,CACtB,2BAA2B,WAAW,CAAC,CACvC,WAAW,OAAO,KAAK,0BAA0B,OAAO,CAAC,CAC9D,CACF;EACA,OAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,aAAa,CAAC;CAC3E;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;;;;CAK1F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAK5C,OAAO,CAAC,CAJe,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAS;GAAK,CAAC;GAC1E,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YAAY;EACpE,oBAAoB,OAAO,QAAQ;EACnC,OAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,GACtB,CAAC;CACH;;;;CAKA,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAI5C,OAAO,CAAC,CAHe,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;GAChE;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAgB;GAAK,CAAC;GACjF,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,aAAa,CAAC;CACxF;;;;CAKA,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,aAAa,CAAC;EACxF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,SAAS;EAC/E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,QAAQ;GAChC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,kBAAkB,SAAU;GAChE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,aAAa,CAAC;CACpF;CAEA,uCAAuC,OACrC,EAAE,OAAO,QAAQ,gBAAgB,cACjC,WACG;EACH,oBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,IAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,eAAe,CAAC;GAC1D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAM,cAAc,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ;GACzF,MAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;GACF,CAAC;GACD,OAAO,KAAK,+BAA+B;EAC7C;EACA,QAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO,EAC7E,aACF,CAAC;EACD,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,SAC7C;EACA,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,yBAAyB;GACjD,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,sBAAsB,SAAU;GACpE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,aAAa,CAAC;CAC3F;;;;CAKA,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;EAC9D,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,aAAa,CAAC;EACpF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,YAAY;EAC5E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,IAAI;GACvC,MAAM,YAAY,GAAG,QAAQ;GAC7B,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,oBAAoB,SAAU;GAClE,OAAO,KAAK,0BAA0B,GAAG,MAAM;EACjD,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;AAClF;AAEA,eAAsB,QACpB,MAMA,QACe;CACf,MAAM,EAAE,QAAQ,gBAAgB,YAAY,cAAc;CAE1D,MAAM,EAAE,mBAAmB;CAC3B,OAAO,KAAK,sBAAsB,gBAAgB;CAClD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,eAChB,CAAC;CAED,qBAAqB,OAAO,cAAc;CAE1C,OAAO,MAAM,SAAS,aAAa;EACjC,IAAI,aAAa,MAAM,SAAS,WAAW;GACzC,OAAO,KAAK,qCAAqC;GACjD;EACF;EACA,MAAM,OAAO,MAAM,MAAM;EACzB,OAAO,KAAK,KAAK,IAAI;EACrB,QAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAgB;EAAW,GAAG,MAAM;CAC1E;AACF"}

package/lib/{chunk-CKQMccvm.cjs → rolldown-runtime-emK7D4bc.cjs}

@@ -5,6 +5,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -20,6 +21,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
+Object.defineProperty(exports, "__commonJSMin", {
+	enumerable: true,
+	get: function() {
+		return __commonJSMin;
+	}
+});
 Object.defineProperty(exports, "__toESM", {
 	enumerable: true,
 	get: function() {

package/lib/{types-BclZ5rGR.d.ts → types-BN2MzD_5.d.ts}

@@ -1,5 +1,5 @@
-import { o as Device } from "./index--fscLDTT.js";
-import { i as TRPCClientOptions, r as RouterOutputs, t as RevaultApiTRPCClient } from "./trpc-CWGPr8Ox.js";
+import { o as Device } from "./index-CuWiM97X.js";
+import { i as TRPCClientOptions, r as RouterOutputs, t as RevaultApiTRPCClient } from "./trpc-DBU35NJq.js";
 import { ApiChallenge, ClaimedRole, OnboardingSeedChallenge, PsdChallenge, UserRegistrationResponse, VaultRequestResponse, WrappingKeyResponse } from "@ledgerhq/revault-api";
 
 //#region src/engine/types.d.ts

package/lib/{types-DYXb0C4y.d.cts → types-BXAwSr1F.d.cts}

@@ -1,5 +1,5 @@
-import { o as Device } from "./index-BE7oUpCb.cjs";
-import { i as TRPCClientOptions, r as RouterOutputs, t as RevaultApiTRPCClient } from "./trpc-C_dUOB1u.cjs";
+import { o as Device } from "./index-sWTlrbOl.cjs";
+import { i as TRPCClientOptions, r as RouterOutputs, t as RevaultApiTRPCClient } from "./trpc-DBU35NJq.cjs";
 import { ApiChallenge, ClaimedRole, OnboardingSeedChallenge, PsdChallenge, UserRegistrationResponse, VaultRequestResponse, WrappingKeyResponse } from "@ledgerhq/revault-api";
 
 //#region src/engine/types.d.ts

package/lib/types.d.cts

@@ -1,3 +1,7 @@
-import { a as TRPCContext, n as RouterInputs, r as RouterOutputs } from "./trpc-C_dUOB1u.cjs";
-export * from "@ledgerhq/revault-api";
-export { RouterInputs, RouterOutputs, TRPCContext };
+import { a as TRPCContext, n as RouterInputs, r as RouterOutputs } from "./trpc-DBU35NJq.cjs";
+export type * from "@ledgerhq/revault-api";
+
+//#region \0rolldown/runtime.js
+
+//#endregion
+export { type RouterInputs, type RouterOutputs, type TRPCContext, __reExport as n, __exportAll as t };

package/lib/types.d.ts

@@ -1,3 +1,7 @@
-import { a as TRPCContext, n as RouterInputs, r as RouterOutputs } from "./trpc-CWGPr8Ox.js";
-export * from "@ledgerhq/revault-api";
-export { RouterInputs, RouterOutputs, TRPCContext };
+import { a as TRPCContext, n as RouterInputs, r as RouterOutputs } from "./trpc-DBU35NJq.js";
+export type * from "@ledgerhq/revault-api";
+
+//#region \0rolldown/runtime.js
+
+//#endregion
+export { type RouterInputs, type RouterOutputs, type TRPCContext, __reExport as n, __exportAll as t };

package/lib/{utils-BGbdjOP9.js → utils-CW0gdJME.js}

@@ -58,4 +58,4 @@ function buildTrpcContext(opts) {
 //#endregion
 export { fetchAllCursor as i, createDeviceIndexResolver as n, fetchAll as r, buildTrpcContext as t };
 
-//# sourceMappingURL=utils-BGbdjOP9.js.map
+//# sourceMappingURL=utils-CW0gdJME.js.map

package/lib/{utils-BGbdjOP9.js.map → utils-CW0gdJME.js.map}

@@ -1 +1 @@
-{"version":3,"file":"utils-BGbdjOP9.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import type { CursorPaginated, Paginated } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport type { CorrelationIdOpts, Engine, WithWorkspace } from \"./engine/types\";\nimport type { TRPCContext } from \"./trpc\";\n\n/**\n * Utility function that collect results on all pages until there is no more next page\n */\nexport async function fetchAll<TData, TQuery extends { page?: number }>(\n  queryFn: (query: TQuery, trpcContext?: TRPCContext) => Promise<Paginated<TData>>,\n  query: TQuery,\n  trpcContext?: TRPCContext,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let page: number | null = 1;\n  while (page) {\n    const partial = await queryFn({ ...query, page }, trpcContext);\n    res.push(...partial.results);\n    page = partial.next;\n  }\n  return res;\n}\n\n/**\n * Utility function that collect results on all cursors until cursor is null\n */\nexport async function fetchAllCursor<TData, TQuery extends { cursor?: number | string }>(\n  queryFn: (query: TQuery) => Promise<CursorPaginated<TData>>,\n  query: TQuery,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let cursor: number | string | null = null;\n  do {\n    const partial = await queryFn({ ...query, ...(cursor === null ? {} : { cursor }) });\n    res.push(...partial.results);\n    cursor = partial.next;\n  } while (cursor);\n  return res;\n}\n\n/**\n * Return a function that retrieve a device index based on a given deviceUserId\n * Holds a cache of found indexes to avoid spamming device-api\n */\nexport function createDeviceIndexResolver(engine: Engine<WithWorkspace>) {\n  // Cache to avoid spamming device-api when seeking for same index multiple times\n  const _deviceUserIdByDeviceIndexCache: Record<string, Promise<string>> = {};\n\n  return async function findDeviceIndex(deviceUserId: string): Promise<number> {\n    let deviceIndex: number | null = null;\n    for (let i = 4; i < 50; i++) {\n      const promise =\n        i in _deviceUserIdByDeviceIndexCache\n          ? _deviceUserIdByDeviceIndexCache[i]!\n          : engine.withDeviceIndex(i).device.getDeviceUserId();\n      _deviceUserIdByDeviceIndexCache[i] = promise;\n      const candidate = await promise;\n      // /!\\ we need to decide in which casing we want this information\n      // -> device-api returns it in uppercase\n      // -> we save it in lowercase in revault-api DB\n      // -> doing \"safe\" comparison here by always user the uppercase version, but hey!\n      if (candidate.toUpperCase() === deviceUserId.toUpperCase()) {\n        deviceIndex = i;\n        break;\n      }\n    }\n    invariant(deviceIndex, `Could not find index for device user id ${deviceUserId}`);\n    return deviceIndex;\n  };\n}\n\nexport function buildTrpcContext(opts?: CorrelationIdOpts) {\n  return opts?.correlationId\n    ? { context: { headers: { \"x-correlation-id\": opts.correlationId } } }\n    : undefined;\n}\n"],"mappings":";;;;;AASA,eAAsB,SACpB,SACA,OACA,aACkB;CAClB,MAAM,MAAe,EAAE;CACvB,IAAI,OAAsB;AAC1B,QAAO,MAAM;EACX,MAAM,UAAU,MAAM,QAAQ;GAAE,GAAG;GAAO;GAAM,EAAE,YAAY;AAC9D,MAAI,KAAK,GAAG,QAAQ,QAAQ;AAC5B,SAAO,QAAQ;;AAEjB,QAAO;;;;;AAMT,eAAsB,eACpB,SACA,OACkB;CAClB,MAAM,MAAe,EAAE;CACvB,IAAI,SAAiC;AACrC,IAAG;EACD,MAAM,UAAU,MAAM,QAAQ;GAAE,GAAG;GAAO,GAAI,WAAW,OAAO,EAAE,GAAG,EAAE,QAAQ;GAAG,CAAC;AACnF,MAAI,KAAK,GAAG,QAAQ,QAAQ;AAC5B,WAAS,QAAQ;UACV;AACT,QAAO;;;;;;AAOT,SAAgB,0BAA0B,QAA+B;CAEvE,MAAM,kCAAmE,EAAE;AAE3E,QAAO,eAAe,gBAAgB,cAAuC;EAC3E,IAAI,cAA6B;AACjC,OAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GAC3B,MAAM,UACJ,KAAK,kCACD,gCAAgC,KAChC,OAAO,gBAAgB,EAAE,CAAC,OAAO,iBAAiB;AACxD,mCAAgC,KAAK;AAMrC,QALkB,MAAM,SAKV,aAAa,KAAK,aAAa,aAAa,EAAE;AAC1D,kBAAc;AACd;;;AAGJ,YAAU,aAAa,2CAA2C,eAAe;AACjF,SAAO;;;AAIX,SAAgB,iBAAiB,MAA0B;AACzD,QAAO,MAAM,gBACT,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,KAAK,eAAe,EAAE,EAAE,GACpE,KAAA"}
+{"version":3,"file":"utils-CW0gdJME.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import type { CursorPaginated, Paginated } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport type { CorrelationIdOpts, Engine, WithWorkspace } from \"./engine/types\";\nimport type { TRPCContext } from \"./trpc\";\n\n/**\n * Utility function that collect results on all pages until there is no more next page\n */\nexport async function fetchAll<TData, TQuery extends { page?: number }>(\n  queryFn: (query: TQuery, trpcContext?: TRPCContext) => Promise<Paginated<TData>>,\n  query: TQuery,\n  trpcContext?: TRPCContext,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let page: number | null = 1;\n  while (page) {\n    const partial = await queryFn({ ...query, page }, trpcContext);\n    res.push(...partial.results);\n    page = partial.next;\n  }\n  return res;\n}\n\n/**\n * Utility function that collect results on all cursors until cursor is null\n */\nexport async function fetchAllCursor<TData, TQuery extends { cursor?: number | string }>(\n  queryFn: (query: TQuery) => Promise<CursorPaginated<TData>>,\n  query: TQuery,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let cursor: number | string | null = null;\n  do {\n    const partial = await queryFn({ ...query, ...(cursor === null ? {} : { cursor }) });\n    res.push(...partial.results);\n    cursor = partial.next;\n  } while (cursor);\n  return res;\n}\n\n/**\n * Return a function that retrieve a device index based on a given deviceUserId\n * Holds a cache of found indexes to avoid spamming device-api\n */\nexport function createDeviceIndexResolver(engine: Engine<WithWorkspace>) {\n  // Cache to avoid spamming device-api when seeking for same index multiple times\n  const _deviceUserIdByDeviceIndexCache: Record<string, Promise<string>> = {};\n\n  return async function findDeviceIndex(deviceUserId: string): Promise<number> {\n    let deviceIndex: number | null = null;\n    for (let i = 4; i < 50; i++) {\n      const promise =\n        i in _deviceUserIdByDeviceIndexCache\n          ? _deviceUserIdByDeviceIndexCache[i]!\n          : engine.withDeviceIndex(i).device.getDeviceUserId();\n      _deviceUserIdByDeviceIndexCache[i] = promise;\n      const candidate = await promise;\n      // /!\\ we need to decide in which casing we want this information\n      // -> device-api returns it in uppercase\n      // -> we save it in lowercase in revault-api DB\n      // -> doing \"safe\" comparison here by always user the uppercase version, but hey!\n      if (candidate.toUpperCase() === deviceUserId.toUpperCase()) {\n        deviceIndex = i;\n        break;\n      }\n    }\n    invariant(deviceIndex, `Could not find index for device user id ${deviceUserId}`);\n    return deviceIndex;\n  };\n}\n\nexport function buildTrpcContext(opts?: CorrelationIdOpts) {\n  return opts?.correlationId\n    ? { context: { headers: { \"x-correlation-id\": opts.correlationId } } }\n    : undefined;\n}\n"],"mappings":";;;;;AASA,eAAsB,SACpB,SACA,OACA,aACkB;CAClB,MAAM,MAAe,CAAC;CACtB,IAAI,OAAsB;CAC1B,OAAO,MAAM;EACX,MAAM,UAAU,MAAM,QAAQ;GAAE,GAAG;GAAO;EAAK,GAAG,WAAW;EAC7D,IAAI,KAAK,GAAG,QAAQ,OAAO;EAC3B,OAAO,QAAQ;CACjB;CACA,OAAO;AACT;;;;AAKA,eAAsB,eACpB,SACA,OACkB;CAClB,MAAM,MAAe,CAAC;CACtB,IAAI,SAAiC;CACrC,GAAG;EACD,MAAM,UAAU,MAAM,QAAQ;GAAE,GAAG;GAAO,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,OAAO;EAAG,CAAC;EAClF,IAAI,KAAK,GAAG,QAAQ,OAAO;EAC3B,SAAS,QAAQ;CACnB,SAAS;CACT,OAAO;AACT;;;;;AAMA,SAAgB,0BAA0B,QAA+B;CAEvE,MAAM,kCAAmE,CAAC;CAE1E,OAAO,eAAe,gBAAgB,cAAuC;EAC3E,IAAI,cAA6B;EACjC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GAC3B,MAAM,UACJ,KAAK,kCACD,gCAAgC,KAChC,OAAO,gBAAgB,CAAC,CAAC,CAAC,OAAO,gBAAgB;GACvD,gCAAgC,KAAK;GAMrC,KAAI,MALoB,QAAA,CAKV,YAAY,MAAM,aAAa,YAAY,GAAG;IAC1D,cAAc;IACd;GACF;EACF;EACA,UAAU,aAAa,2CAA2C,cAAc;EAChF,OAAO;CACT;AACF;AAEA,SAAgB,iBAAiB,MAA0B;CACzD,OAAO,MAAM,gBACT,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,KAAK,cAAc,EAAE,EAAE,IACnE,KAAA;AACN"}

package/lib/{utils-DbSFXp4c.cjs → utils-CavXJGCh.cjs}

@@ -1,6 +1,6 @@
-const require_chunk = require("./chunk-CKQMccvm.cjs");
+const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
 let invariant = require("invariant");
-invariant = require_chunk.__toESM(invariant);
+invariant = require_rolldown_runtime.__toESM(invariant, 1);
 //#region src/utils.ts
 /**
 * Utility function that collect results on all pages until there is no more next page
@@ -82,3 +82,5 @@ Object.defineProperty(exports, "fetchAllCursor", {
 		return fetchAllCursor;
 	}
 });
+
+//# sourceMappingURL=utils-CavXJGCh.cjs.map

package/lib/{utils-DbSFXp4c.cjs.map → utils-CavXJGCh.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"utils-DbSFXp4c.cjs","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import type { CursorPaginated, Paginated } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport type { CorrelationIdOpts, Engine, WithWorkspace } from \"./engine/types\";\nimport type { TRPCContext } from \"./trpc\";\n\n/**\n * Utility function that collect results on all pages until there is no more next page\n */\nexport async function fetchAll<TData, TQuery extends { page?: number }>(\n  queryFn: (query: TQuery, trpcContext?: TRPCContext) => Promise<Paginated<TData>>,\n  query: TQuery,\n  trpcContext?: TRPCContext,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let page: number | null = 1;\n  while (page) {\n    const partial = await queryFn({ ...query, page }, trpcContext);\n    res.push(...partial.results);\n    page = partial.next;\n  }\n  return res;\n}\n\n/**\n * Utility function that collect results on all cursors until cursor is null\n */\nexport async function fetchAllCursor<TData, TQuery extends { cursor?: number | string }>(\n  queryFn: (query: TQuery) => Promise<CursorPaginated<TData>>,\n  query: TQuery,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let cursor: number | string | null = null;\n  do {\n    const partial = await queryFn({ ...query, ...(cursor === null ? {} : { cursor }) });\n    res.push(...partial.results);\n    cursor = partial.next;\n  } while (cursor);\n  return res;\n}\n\n/**\n * Return a function that retrieve a device index based on a given deviceUserId\n * Holds a cache of found indexes to avoid spamming device-api\n */\nexport function createDeviceIndexResolver(engine: Engine<WithWorkspace>) {\n  // Cache to avoid spamming device-api when seeking for same index multiple times\n  const _deviceUserIdByDeviceIndexCache: Record<string, Promise<string>> = {};\n\n  return async function findDeviceIndex(deviceUserId: string): Promise<number> {\n    let deviceIndex: number | null = null;\n    for (let i = 4; i < 50; i++) {\n      const promise =\n        i in _deviceUserIdByDeviceIndexCache\n          ? _deviceUserIdByDeviceIndexCache[i]!\n          : engine.withDeviceIndex(i).device.getDeviceUserId();\n      _deviceUserIdByDeviceIndexCache[i] = promise;\n      const candidate = await promise;\n      // /!\\ we need to decide in which casing we want this information\n      // -> device-api returns it in uppercase\n      // -> we save it in lowercase in revault-api DB\n      // -> doing \"safe\" comparison here by always user the uppercase version, but hey!\n      if (candidate.toUpperCase() === deviceUserId.toUpperCase()) {\n        deviceIndex = i;\n        break;\n      }\n    }\n    invariant(deviceIndex, `Could not find index for device user id ${deviceUserId}`);\n    return deviceIndex;\n  };\n}\n\nexport function buildTrpcContext(opts?: CorrelationIdOpts) {\n  return opts?.correlationId\n    ? { context: { headers: { \"x-correlation-id\": opts.correlationId } } }\n    : undefined;\n}\n"],"mappings":";;;;;;;AASA,eAAsB,SACpB,SACA,OACA,aACkB;CAClB,MAAM,MAAe,EAAE;CACvB,IAAI,OAAsB;AAC1B,QAAO,MAAM;EACX,MAAM,UAAU,MAAM,QAAQ;GAAE,GAAG;GAAO;GAAM,EAAE,YAAY;AAC9D,MAAI,KAAK,GAAG,QAAQ,QAAQ;AAC5B,SAAO,QAAQ;;AAEjB,QAAO;;;;;AAMT,eAAsB,eACpB,SACA,OACkB;CAClB,MAAM,MAAe,EAAE;CACvB,IAAI,SAAiC;AACrC,IAAG;EACD,MAAM,UAAU,MAAM,QAAQ;GAAE,GAAG;GAAO,GAAI,WAAW,OAAO,EAAE,GAAG,EAAE,QAAQ;GAAG,CAAC;AACnF,MAAI,KAAK,GAAG,QAAQ,QAAQ;AAC5B,WAAS,QAAQ;UACV;AACT,QAAO;;;;;;AAOT,SAAgB,0BAA0B,QAA+B;CAEvE,MAAM,kCAAmE,EAAE;AAE3E,QAAO,eAAe,gBAAgB,cAAuC;EAC3E,IAAI,cAA6B;AACjC,OAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GAC3B,MAAM,UACJ,KAAK,kCACD,gCAAgC,KAChC,OAAO,gBAAgB,EAAE,CAAC,OAAO,iBAAiB;AACxD,mCAAgC,KAAK;AAMrC,QALkB,MAAM,SAKV,aAAa,KAAK,aAAa,aAAa,EAAE;AAC1D,kBAAc;AACd;;;AAGJ,GAAA,GAAA,UAAA,SAAU,aAAa,2CAA2C,eAAe;AACjF,SAAO;;;AAIX,SAAgB,iBAAiB,MAA0B;AACzD,QAAO,MAAM,gBACT,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,KAAK,eAAe,EAAE,EAAE,GACpE,KAAA"}
+{"version":3,"file":"utils-CavXJGCh.cjs","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import type { CursorPaginated, Paginated } from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\n\nimport type { CorrelationIdOpts, Engine, WithWorkspace } from \"./engine/types\";\nimport type { TRPCContext } from \"./trpc\";\n\n/**\n * Utility function that collect results on all pages until there is no more next page\n */\nexport async function fetchAll<TData, TQuery extends { page?: number }>(\n  queryFn: (query: TQuery, trpcContext?: TRPCContext) => Promise<Paginated<TData>>,\n  query: TQuery,\n  trpcContext?: TRPCContext,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let page: number | null = 1;\n  while (page) {\n    const partial = await queryFn({ ...query, page }, trpcContext);\n    res.push(...partial.results);\n    page = partial.next;\n  }\n  return res;\n}\n\n/**\n * Utility function that collect results on all cursors until cursor is null\n */\nexport async function fetchAllCursor<TData, TQuery extends { cursor?: number | string }>(\n  queryFn: (query: TQuery) => Promise<CursorPaginated<TData>>,\n  query: TQuery,\n): Promise<TData[]> {\n  const res: TData[] = [];\n  let cursor: number | string | null = null;\n  do {\n    const partial = await queryFn({ ...query, ...(cursor === null ? {} : { cursor }) });\n    res.push(...partial.results);\n    cursor = partial.next;\n  } while (cursor);\n  return res;\n}\n\n/**\n * Return a function that retrieve a device index based on a given deviceUserId\n * Holds a cache of found indexes to avoid spamming device-api\n */\nexport function createDeviceIndexResolver(engine: Engine<WithWorkspace>) {\n  // Cache to avoid spamming device-api when seeking for same index multiple times\n  const _deviceUserIdByDeviceIndexCache: Record<string, Promise<string>> = {};\n\n  return async function findDeviceIndex(deviceUserId: string): Promise<number> {\n    let deviceIndex: number | null = null;\n    for (let i = 4; i < 50; i++) {\n      const promise =\n        i in _deviceUserIdByDeviceIndexCache\n          ? _deviceUserIdByDeviceIndexCache[i]!\n          : engine.withDeviceIndex(i).device.getDeviceUserId();\n      _deviceUserIdByDeviceIndexCache[i] = promise;\n      const candidate = await promise;\n      // /!\\ we need to decide in which casing we want this information\n      // -> device-api returns it in uppercase\n      // -> we save it in lowercase in revault-api DB\n      // -> doing \"safe\" comparison here by always user the uppercase version, but hey!\n      if (candidate.toUpperCase() === deviceUserId.toUpperCase()) {\n        deviceIndex = i;\n        break;\n      }\n    }\n    invariant(deviceIndex, `Could not find index for device user id ${deviceUserId}`);\n    return deviceIndex;\n  };\n}\n\nexport function buildTrpcContext(opts?: CorrelationIdOpts) {\n  return opts?.correlationId\n    ? { context: { headers: { \"x-correlation-id\": opts.correlationId } } }\n    : undefined;\n}\n"],"mappings":";;;;;;;AASA,eAAsB,SACpB,SACA,OACA,aACkB;CAClB,MAAM,MAAe,CAAC;CACtB,IAAI,OAAsB;CAC1B,OAAO,MAAM;EACX,MAAM,UAAU,MAAM,QAAQ;GAAE,GAAG;GAAO;EAAK,GAAG,WAAW;EAC7D,IAAI,KAAK,GAAG,QAAQ,OAAO;EAC3B,OAAO,QAAQ;CACjB;CACA,OAAO;AACT;;;;AAKA,eAAsB,eACpB,SACA,OACkB;CAClB,MAAM,MAAe,CAAC;CACtB,IAAI,SAAiC;CACrC,GAAG;EACD,MAAM,UAAU,MAAM,QAAQ;GAAE,GAAG;GAAO,GAAI,WAAW,OAAO,CAAC,IAAI,EAAE,OAAO;EAAG,CAAC;EAClF,IAAI,KAAK,GAAG,QAAQ,OAAO;EAC3B,SAAS,QAAQ;CACnB,SAAS;CACT,OAAO;AACT;;;;;AAMA,SAAgB,0BAA0B,QAA+B;CAEvE,MAAM,kCAAmE,CAAC;CAE1E,OAAO,eAAe,gBAAgB,cAAuC;EAC3E,IAAI,cAA6B;EACjC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK;GAC3B,MAAM,UACJ,KAAK,kCACD,gCAAgC,KAChC,OAAO,gBAAgB,CAAC,CAAC,CAAC,OAAO,gBAAgB;GACvD,gCAAgC,KAAK;GAMrC,KAAI,MALoB,QAAA,CAKV,YAAY,MAAM,aAAa,YAAY,GAAG;IAC1D,cAAc;IACd;GACF;EACF;EACA,CAAA,GAAA,UAAA,QAAA,CAAU,aAAa,2CAA2C,cAAc;EAChF,OAAO;CACT;AACF;AAEA,SAAgB,iBAAiB,MAA0B;CACzD,OAAO,MAAM,gBACT,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,KAAK,cAAc,EAAE,EAAE,IACnE,KAAA;AACN"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ledgerhq/revault-sdk",
-  "version": "0.27.9",
+  "version": "0.27.11",
   "license": "Apache-2.0",
   "type": "module",
   "files": [
@@ -44,15 +44,15 @@
     }
   },
   "dependencies": {
-    "@ledgerhq/errors": "^6.32.0",
-    "@ledgerhq/hw-transport": "^6.34.1",
+    "@ledgerhq/errors": "^6.36.0",
+    "@ledgerhq/hw-transport": "^6.35.4",
     "@noble/hashes": "^2.0.1",
     "@scure/bip32": "^2.0.1",
     "@scure/bip39": "^2.0.1",
-    "@trpc/client": "11.16.0",
-    "@trpc/server": "11.16.0",
+    "@trpc/client": "11.17.0",
+    "@trpc/server": "11.17.0",
     "asn1.js": "^5.4.1",
-    "axios": "^1.15.1",
+    "axios": "^1.17.0",
     "axios-retry": "^4.5.0",
     "bn.js": "^5.2.3",
     "elliptic": "^6.6.1",
@@ -63,8 +63,8 @@
     "superjson": "^2.2.6",
     "ts-pattern": "^5.9.0",
     "uuid": "^14.0.0",
-    "zod": "^4.3.6",
-    "@ledgerhq/revault-api": "1.66.2"
+    "zod": "^4.4.3",
+    "@ledgerhq/revault-api": "1.68.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",
@@ -73,17 +73,17 @@
     "@types/elliptic": "^6.4.18",
     "@types/invariant": "^2.2.37",
     "@types/lodash": "^4.17.24",
-    "@types/node": "^22.19.19",
-    "@vitest/coverage-v8": "^4.1.3",
-    "@vitest/ui": "^4.1.3",
+    "@types/node": "^25.9.3",
+    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/ui": "^4.1.8",
     "eslint": "^9.39.4",
     "eslint-plugin-unicorn": "^62.0.0",
-    "tsdown": "^0.21.7",
-    "tsx": "^4.21.0",
+    "tsdown": "^0.22.2",
+    "tsx": "^4.22.4",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.58.1",
     "vite-plugin-node-polyfills": "^0.26.0",
-    "vitest": "^4.1.3",
+    "vitest": "^4.1.8",
     "vitest-mock-extended": "^4.0.0"
   },
   "scripts": {