@ledgerhq/revault-sdk 0.28.15 → 0.29.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/lib/bake.d.cts +2 -2
  2. package/lib/bake.d.ts +2 -2
  3. package/lib/{device-CvgFoib2.cjs → device-DgFn_PG4.cjs} +1 -11
  4. package/lib/device-DgFn_PG4.cjs.map +1 -0
  5. package/lib/{device-BnO26Hlr.js → device-FfbMtrzj.js} +1 -11
  6. package/lib/device-FfbMtrzj.js.map +1 -0
  7. package/lib/device.cjs +1 -1
  8. package/lib/device.d.cts +1 -1
  9. package/lib/device.d.ts +1 -1
  10. package/lib/device.js +1 -1
  11. package/lib/engine.cjs +1 -34
  12. package/lib/engine.cjs.map +1 -1
  13. package/lib/engine.d.cts +3 -3
  14. package/lib/engine.d.ts +3 -3
  15. package/lib/engine.js +1 -34
  16. package/lib/engine.js.map +1 -1
  17. package/lib/{index-CliA8Mh-.d.cts → index-BOztQnnW.d.cts} +1 -1
  18. package/lib/{index-BAb2WCcL.d.cts → index-IWdCAN97.d.cts} +0 -4
  19. package/lib/{index-DQgupTPR.d.ts → index-Y5QtvYI_.d.ts} +0 -4
  20. package/lib/{index-16zV3onR.d.ts → index-na1C80vO.d.ts} +1 -1
  21. package/lib/onboarding.cjs +9 -36
  22. package/lib/onboarding.cjs.map +1 -1
  23. package/lib/onboarding.d.cts +9 -133
  24. package/lib/onboarding.d.ts +9 -133
  25. package/lib/onboarding.js +9 -36
  26. package/lib/onboarding.js.map +1 -1
  27. package/lib/{types-bfqkmpgo.d.cts → types-B3xo1tFk.d.cts} +10 -8
  28. package/lib/{types-tRODcWIL.d.ts → types-CBMvQH-z.d.ts} +10 -8
  29. package/package.json +2 -2
  30. package/lib/device-BnO26Hlr.js.map +0 -1
  31. package/lib/device-CvgFoib2.cjs.map +0 -1
package/lib/onboarding.d.cts CHANGED
@@ -1,5 +1,5 @@
1
1
  import { t as Logger } from "./logger-DHtgWA66.cjs";
2
- import { d as Engine, y as WithOnboarding } from "./types-bfqkmpgo.cjs";
2
+ import { b as WithOnboarding, f as Engine } from "./types-B3xo1tFk.cjs";
3
3
  import { OnboardingFullStateResponse, OnboardingStep } from "@ledgerhq/revault-api";
4
4
  //#region src/onboarding.d.ts
5
5
  declare const STEPS: {
@@ -16,128 +16,6 @@ declare const STEPS: {
16
16
  workspaceName: string;
17
17
  hsmHostingMode: "HOSTED" | "ON_PREM";
18
18
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
19
- skipWrappingKey: boolean;
20
- claimedDevices: {
21
- pubKey: string;
22
- deviceUserId: string;
23
- deviceName: string;
24
- role: "MASTER_ADMIN" | "SHARED_OWNER" | "WRAPPING_KEY_OWNER";
25
- }[];
26
- wrappingKey: {
27
- ephemeralPubKey: string;
28
- ephemeralCertificate: import("@ledgerhq/revault-api").HsmCertificate;
29
- fragments: {
30
- pubKey: string;
31
- ephemeralPubKey: string;
32
- ephemeralCertificate: import("@ledgerhq/revault-api").HsmCertificate;
33
- blob: string;
34
- }[];
35
- } | null;
36
- masterAdmins: {
37
- name: string;
38
- psdModel: "STAX";
39
- pubKey: string;
40
- registrationChallenge: {
41
- challenge: string;
42
- ephemeralPublicKey: string;
43
- ephemeralPublicKeyAttestation: import("@ledgerhq/revault-api").HsmCertificate;
44
- handshake: string;
45
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
46
- u2fRegisterData: string;
47
- ciphertext: string;
48
- requestId: string;
49
- };
50
- registrationResponse: {
51
- certificate: import("@ledgerhq/revault-api").HsmCertificate;
52
- u2fRegister: string;
53
- u2fKeyHandle: string;
54
- registerData: string;
55
- validationKey: string;
56
- pairingPayload: string;
57
- } | null;
58
- role: "MASTER_ADMIN";
59
- review: {
60
- challenge: {
61
- challengeType: "PSD";
62
- wActions: string[];
63
- handshake: string;
64
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
65
- partitionId: string;
66
- };
67
- signature: string | null;
68
- } | null;
69
- reviewOfExternalSigners: {
70
- challenge: {
71
- challengeType: "PSD";
72
- wActions: string[];
73
- handshake: string;
74
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
75
- partitionId: string;
76
- };
77
- signature: string | null;
78
- } | null;
79
- }[];
80
- sharedOwners: {
81
- name: string;
82
- psdModel: "STAX";
83
- pubKey: string;
84
- registrationChallenge: {
85
- challenge: string;
86
- ephemeralPublicKey: string;
87
- ephemeralPublicKeyAttestation: import("@ledgerhq/revault-api").HsmCertificate;
88
- handshake: string;
89
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
90
- u2fRegisterData: string;
91
- ciphertext: string;
92
- requestId: string;
93
- };
94
- registrationResponse: {
95
- certificate: import("@ledgerhq/revault-api").HsmCertificate;
96
- u2fRegister: string;
97
- u2fKeyHandle: string;
98
- registerData: string;
99
- validationKey: string;
100
- pairingPayload: string;
101
- } | null;
102
- role: "SHARED_OWNER";
103
- review: {
104
- seedChallenge: {
105
- challengeType: "PSD";
106
- wActions: string[];
107
- handshake: string;
108
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
109
- partitionId: string;
110
- kkHandshake: string;
111
- kkHandshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
112
- ephemeralPublicKey: string;
113
- certificate: import("@ledgerhq/revault-api").HsmCertificate;
114
- blob: string;
115
- };
116
- seedFragment: {
117
- approverBlob: string;
118
- challengeResponse: string;
119
- handshake: string;
120
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
121
- } | null;
122
- } | null;
123
- }[];
124
- createdAt: Date;
125
- completedAt: Date | null;
126
- }>;
127
- /**
128
- * Wrapping Key provisioning
129
- */
130
- readonly PENDING_WRAPPING_KEY_PROVISIONING: ({ state, engine }: {
131
- engine: Engine<WithOnboarding>;
132
- state: OnboardingFullStateResponse;
133
- debugAuthToken?: string;
134
- signerSeed?: string;
135
- }, logger: Logger) => Promise<{
136
- id: string;
137
- workspaceName: string;
138
- hsmHostingMode: "HOSTED" | "ON_PREM";
139
- step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
140
- skipWrappingKey: boolean;
141
19
  claimedDevices: {
142
20
  pubKey: string;
143
21
  deviceUserId: string;
@@ -258,7 +136,6 @@ declare const STEPS: {
258
136
  workspaceName: string;
259
137
  hsmHostingMode: "HOSTED" | "ON_PREM";
260
138
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
261
- skipWrappingKey: boolean;
262
139
  claimedDevices: {
263
140
  pubKey: string;
264
141
  deviceUserId: string;
@@ -379,7 +256,6 @@ declare const STEPS: {
379
256
  workspaceName: string;
380
257
  hsmHostingMode: "HOSTED" | "ON_PREM";
381
258
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
382
- skipWrappingKey: boolean;
383
259
  claimedDevices: {
384
260
  pubKey: string;
385
261
  deviceUserId: string;
@@ -500,7 +376,6 @@ declare const STEPS: {
500
376
  workspaceName: string;
501
377
  hsmHostingMode: "HOSTED" | "ON_PREM";
502
378
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
503
- skipWrappingKey: boolean;
504
379
  claimedDevices: {
505
380
  pubKey: string;
506
381
  deviceUserId: string;
@@ -621,7 +496,6 @@ declare const STEPS: {
621
496
  workspaceName: string;
622
497
  hsmHostingMode: "HOSTED" | "ON_PREM";
623
498
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
624
- skipWrappingKey: boolean;
625
499
  claimedDevices: {
626
500
  pubKey: string;
627
501
  deviceUserId: string;
@@ -742,7 +616,6 @@ declare const STEPS: {
742
616
  workspaceName: string;
743
617
  hsmHostingMode: "HOSTED" | "ON_PREM";
744
618
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
745
- skipWrappingKey: boolean;
746
619
  claimedDevices: {
747
620
  pubKey: string;
748
621
  deviceUserId: string;
@@ -860,7 +733,6 @@ declare const STEPS: {
860
733
  workspaceName: string;
861
734
  hsmHostingMode: "HOSTED" | "ON_PREM";
862
735
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
863
- skipWrappingKey: boolean;
864
736
  claimedDevices: {
865
737
  pubKey: string;
866
738
  deviceUserId: string;
@@ -981,7 +853,6 @@ declare const STEPS: {
981
853
  workspaceName: string;
982
854
  hsmHostingMode: "HOSTED" | "ON_PREM";
983
855
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
984
- skipWrappingKey: boolean;
985
856
  claimedDevices: {
986
857
  pubKey: string;
987
858
  deviceUserId: string;
@@ -1102,7 +973,6 @@ declare const STEPS: {
1102
973
  workspaceName: string;
1103
974
  hsmHostingMode: "HOSTED" | "ON_PREM";
1104
975
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
1105
- skipWrappingKey: boolean;
1106
976
  claimedDevices: {
1107
977
  pubKey: string;
1108
978
  deviceUserId: string;
@@ -1211,11 +1081,17 @@ declare const STEPS: {
1211
1081
  completedAt: Date | null;
1212
1082
  }>;
1213
1083
  };
1084
+ /**
1085
+ * Steps at which `onboard` can be asked to stop. PENDING_WRAPPING_KEY_PROVISIONING is excluded:
1086
+ * the Wrapping Key Custodian ceremony is decommissioned (VG-31485) and no onboarding reaches it,
1087
+ * so it can no longer serve as a stop marker.
1088
+ */
1089
+ type OnboardUntilStep = Exclude<OnboardingStep, "PENDING_WRAPPING_KEY_PROVISIONING">;
1214
1090
  declare function onboard(opts: {
1215
1091
  engine: Engine<WithOnboarding>;
1216
1092
  debugAuthToken?: string;
1217
1093
  signerSeed?: string;
1218
- untilStep?: OnboardingStep;
1094
+ untilStep?: OnboardUntilStep;
1219
1095
  }, logger: Logger): Promise<void>;
1220
1096
  //#endregion
1221
- export { STEPS, onboard };
1097
+ export { OnboardUntilStep, STEPS, onboard };
package/lib/onboarding.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  import { t as Logger } from "./logger-DHtgWA66.js";
2
- import { d as Engine, y as WithOnboarding } from "./types-tRODcWIL.js";
2
+ import { b as WithOnboarding, f as Engine } from "./types-CBMvQH-z.js";
3
3
  import { OnboardingFullStateResponse, OnboardingStep } from "@ledgerhq/revault-api";
4
4
  //#region src/onboarding.d.ts
5
5
  declare const STEPS: {
@@ -16,128 +16,6 @@ declare const STEPS: {
16
16
  workspaceName: string;
17
17
  hsmHostingMode: "HOSTED" | "ON_PREM";
18
18
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
19
- skipWrappingKey: boolean;
20
- claimedDevices: {
21
- pubKey: string;
22
- deviceUserId: string;
23
- deviceName: string;
24
- role: "MASTER_ADMIN" | "SHARED_OWNER" | "WRAPPING_KEY_OWNER";
25
- }[];
26
- wrappingKey: {
27
- ephemeralPubKey: string;
28
- ephemeralCertificate: import("@ledgerhq/revault-api").HsmCertificate;
29
- fragments: {
30
- pubKey: string;
31
- ephemeralPubKey: string;
32
- ephemeralCertificate: import("@ledgerhq/revault-api").HsmCertificate;
33
- blob: string;
34
- }[];
35
- } | null;
36
- masterAdmins: {
37
- name: string;
38
- psdModel: "STAX";
39
- pubKey: string;
40
- registrationChallenge: {
41
- challenge: string;
42
- ephemeralPublicKey: string;
43
- ephemeralPublicKeyAttestation: import("@ledgerhq/revault-api").HsmCertificate;
44
- handshake: string;
45
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
46
- u2fRegisterData: string;
47
- ciphertext: string;
48
- requestId: string;
49
- };
50
- registrationResponse: {
51
- certificate: import("@ledgerhq/revault-api").HsmCertificate;
52
- u2fRegister: string;
53
- u2fKeyHandle: string;
54
- registerData: string;
55
- validationKey: string;
56
- pairingPayload: string;
57
- } | null;
58
- role: "MASTER_ADMIN";
59
- review: {
60
- challenge: {
61
- challengeType: "PSD";
62
- wActions: string[];
63
- handshake: string;
64
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
65
- partitionId: string;
66
- };
67
- signature: string | null;
68
- } | null;
69
- reviewOfExternalSigners: {
70
- challenge: {
71
- challengeType: "PSD";
72
- wActions: string[];
73
- handshake: string;
74
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
75
- partitionId: string;
76
- };
77
- signature: string | null;
78
- } | null;
79
- }[];
80
- sharedOwners: {
81
- name: string;
82
- psdModel: "STAX";
83
- pubKey: string;
84
- registrationChallenge: {
85
- challenge: string;
86
- ephemeralPublicKey: string;
87
- ephemeralPublicKeyAttestation: import("@ledgerhq/revault-api").HsmCertificate;
88
- handshake: string;
89
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
90
- u2fRegisterData: string;
91
- ciphertext: string;
92
- requestId: string;
93
- };
94
- registrationResponse: {
95
- certificate: import("@ledgerhq/revault-api").HsmCertificate;
96
- u2fRegister: string;
97
- u2fKeyHandle: string;
98
- registerData: string;
99
- validationKey: string;
100
- pairingPayload: string;
101
- } | null;
102
- role: "SHARED_OWNER";
103
- review: {
104
- seedChallenge: {
105
- challengeType: "PSD";
106
- wActions: string[];
107
- handshake: string;
108
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
109
- partitionId: string;
110
- kkHandshake: string;
111
- kkHandshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
112
- ephemeralPublicKey: string;
113
- certificate: import("@ledgerhq/revault-api").HsmCertificate;
114
- blob: string;
115
- };
116
- seedFragment: {
117
- approverBlob: string;
118
- challengeResponse: string;
119
- handshake: string;
120
- handshakeAttestation: import("@ledgerhq/revault-api").HsmCertificate;
121
- } | null;
122
- } | null;
123
- }[];
124
- createdAt: Date;
125
- completedAt: Date | null;
126
- }>;
127
- /**
128
- * Wrapping Key provisioning
129
- */
130
- readonly PENDING_WRAPPING_KEY_PROVISIONING: ({ state, engine }: {
131
- engine: Engine<WithOnboarding>;
132
- state: OnboardingFullStateResponse;
133
- debugAuthToken?: string;
134
- signerSeed?: string;
135
- }, logger: Logger) => Promise<{
136
- id: string;
137
- workspaceName: string;
138
- hsmHostingMode: "HOSTED" | "ON_PREM";
139
- step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
140
- skipWrappingKey: boolean;
141
19
  claimedDevices: {
142
20
  pubKey: string;
143
21
  deviceUserId: string;
@@ -258,7 +136,6 @@ declare const STEPS: {
258
136
  workspaceName: string;
259
137
  hsmHostingMode: "HOSTED" | "ON_PREM";
260
138
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
261
- skipWrappingKey: boolean;
262
139
  claimedDevices: {
263
140
  pubKey: string;
264
141
  deviceUserId: string;
@@ -379,7 +256,6 @@ declare const STEPS: {
379
256
  workspaceName: string;
380
257
  hsmHostingMode: "HOSTED" | "ON_PREM";
381
258
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
382
- skipWrappingKey: boolean;
383
259
  claimedDevices: {
384
260
  pubKey: string;
385
261
  deviceUserId: string;
@@ -500,7 +376,6 @@ declare const STEPS: {
500
376
  workspaceName: string;
501
377
  hsmHostingMode: "HOSTED" | "ON_PREM";
502
378
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
503
- skipWrappingKey: boolean;
504
379
  claimedDevices: {
505
380
  pubKey: string;
506
381
  deviceUserId: string;
@@ -621,7 +496,6 @@ declare const STEPS: {
621
496
  workspaceName: string;
622
497
  hsmHostingMode: "HOSTED" | "ON_PREM";
623
498
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
624
- skipWrappingKey: boolean;
625
499
  claimedDevices: {
626
500
  pubKey: string;
627
501
  deviceUserId: string;
@@ -742,7 +616,6 @@ declare const STEPS: {
742
616
  workspaceName: string;
743
617
  hsmHostingMode: "HOSTED" | "ON_PREM";
744
618
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
745
- skipWrappingKey: boolean;
746
619
  claimedDevices: {
747
620
  pubKey: string;
748
621
  deviceUserId: string;
@@ -860,7 +733,6 @@ declare const STEPS: {
860
733
  workspaceName: string;
861
734
  hsmHostingMode: "HOSTED" | "ON_PREM";
862
735
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
863
- skipWrappingKey: boolean;
864
736
  claimedDevices: {
865
737
  pubKey: string;
866
738
  deviceUserId: string;
@@ -981,7 +853,6 @@ declare const STEPS: {
981
853
  workspaceName: string;
982
854
  hsmHostingMode: "HOSTED" | "ON_PREM";
983
855
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
984
- skipWrappingKey: boolean;
985
856
  claimedDevices: {
986
857
  pubKey: string;
987
858
  deviceUserId: string;
@@ -1102,7 +973,6 @@ declare const STEPS: {
1102
973
  workspaceName: string;
1103
974
  hsmHostingMode: "HOSTED" | "ON_PREM";
1104
975
  step: "COMPLETED" | "PENDING_DEVICE_CLAIMS" | "PENDING_EXTERNAL_SIGNERS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION" | "PENDING_MASTER_ADMINS_REGISTRATION_INIT" | "PENDING_REVIEW_BY_MASTER_ADMINS" | "PENDING_SEED_PROVISIONING" | "PENDING_SHARED_OWNERS_REGISTRATION" | "PENDING_SHARED_OWNERS_REGISTRATION_INIT" | "PENDING_WORKSPACE_INITIALIZATION" | "PENDING_WRAPPING_KEY_PROVISIONING";
1105
- skipWrappingKey: boolean;
1106
976
  claimedDevices: {
1107
977
  pubKey: string;
1108
978
  deviceUserId: string;
@@ -1211,11 +1081,17 @@ declare const STEPS: {
1211
1081
  completedAt: Date | null;
1212
1082
  }>;
1213
1083
  };
1084
+ /**
1085
+ * Steps at which `onboard` can be asked to stop. PENDING_WRAPPING_KEY_PROVISIONING is excluded:
1086
+ * the Wrapping Key Custodian ceremony is decommissioned (VG-31485) and no onboarding reaches it,
1087
+ * so it can no longer serve as a stop marker.
1088
+ */
1089
+ type OnboardUntilStep = Exclude<OnboardingStep, "PENDING_WRAPPING_KEY_PROVISIONING">;
1214
1090
  declare function onboard(opts: {
1215
1091
  engine: Engine<WithOnboarding>;
1216
1092
  debugAuthToken?: string;
1217
1093
  signerSeed?: string;
1218
- untilStep?: OnboardingStep;
1094
+ untilStep?: OnboardUntilStep;
1219
1095
  }, logger: Logger): Promise<void>;
1220
1096
  //#endregion
1221
- export { STEPS, onboard };
1097
+ export { OnboardUntilStep, STEPS, onboard };
package/lib/onboarding.js CHANGED
@@ -3,26 +3,16 @@ import invariant from "invariant";
3
3
  import { match } from "ts-pattern";
4
4
  //#region src/onboarding.ts
5
5
  const roleLabels = {
6
- WRAPPING_KEY_OWNER: "Wrapping Key",
7
6
  MASTER_ADMIN: "Admin",
8
7
  SHARED_OWNER: "Shared Owner"
9
8
  };
9
+ /**
10
+ * Indices deliberately start at 4: `withDeviceIndex` feeds `genSeed({ salt, index })`, so an
11
+ * index determines a device's seed and therefore its identity. Indices 1-3 belonged to the
12
+ * decommissioned Wrapping Key Custodian devices and are left unused so that every Master Admin
13
+ * and Shared Owner device keeps the identity it has in already-provisioned workspaces.
14
+ */
10
15
  const devices = [
11
- {
12
- index: 1,
13
- role: "WRAPPING_KEY_OWNER",
14
- name: `${roleLabels.WRAPPING_KEY_OWNER} 1`
15
- },
16
- {
17
- index: 2,
18
- role: "WRAPPING_KEY_OWNER",
19
- name: `${roleLabels.WRAPPING_KEY_OWNER} 2`
20
- },
21
- {
22
- index: 3,
23
- role: "WRAPPING_KEY_OWNER",
24
- name: `${roleLabels.WRAPPING_KEY_OWNER} 3`
25
- },
26
16
  {
27
17
  index: 4,
28
18
  role: "MASTER_ADMIN",
@@ -76,7 +66,6 @@ const STEPS = {
76
66
  const promises = [];
77
67
  for (const device of devices) {
78
68
  if (state.hsmHostingMode === "ON_PREM" && device.role === "SHARED_OWNER") continue;
79
- if (state.skipWrappingKey && device.role === "WRAPPING_KEY_OWNER") continue;
80
69
  /* v8 ignore else -- @preserve */
81
70
  if (state.claimedDevices.find(
82
71
  /* v8 ignore next -- @preserve */
@@ -93,25 +82,6 @@ const STEPS = {
93
82
  return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });
94
83
  },
95
84
  /**
96
- * Wrapping Key provisioning
97
- */
98
- PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {
99
- const { id: onboardingId } = state;
100
- state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });
101
- const wrappingKey = state.wrappingKey;
102
- const toCollect = state.claimedDevices.filter((claimed) => {
103
- if (claimed.role !== "WRAPPING_KEY_OWNER") return false;
104
- return !!!state.wrappingKey?.fragments.find(
105
- /* v8 ignore next -- @preserve */
106
- (f) => f.pubKey === claimed.pubKey
107
- );
108
- }).map((c) => {
109
- return deviceNameToIndex(c.deviceName);
110
- });
111
- await Promise.all(toCollect.map((index) => engine.withDeviceIndex(index).collectWrappingKeyFragment(wrappingKey).then(() => logger.info(`Collected Wrapping Key ${index}`))));
112
- return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });
113
- },
114
- /**
115
85
  * Init Master Admins registration
116
86
  */
117
87
  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) => engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),
@@ -231,6 +201,7 @@ const STEPS = {
231
201
  };
232
202
  async function onboard(opts, logger) {
233
203
  const { engine, debugAuthToken, signerSeed, untilStep } = opts;
204
+ if (untilStep === "PENDING_WRAPPING_KEY_PROVISIONING") throw new Error("untilStep PENDING_WRAPPING_KEY_PROVISIONING is decommissioned; use PENDING_MASTER_ADMINS_REGISTRATION_INIT to stop after device claims");
234
205
  const { __onboardingId } = engine;
235
206
  logger.info(`Joining onboarding ${__onboardingId}`);
236
207
  let state = await engine.client.onboarding.getOnboarding.query({ onboardingId: __onboardingId });
@@ -240,6 +211,8 @@ async function onboard(opts, logger) {
240
211
  logger.info("Skipping the rest of the onboarding");
241
212
  break;
242
213
  }
214
+ /* v8 ignore next 5 -- @preserve */
215
+ if (state.step === "PENDING_WRAPPING_KEY_PROVISIONING") throw new Error("Onboarding is parked at PENDING_WRAPPING_KEY_PROVISIONING, a decommissioned step");
243
216
  const step = STEPS[state.step];
244
217
  logger.info(step.name);
245
218
  state = await step({
package/lib/onboarding.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n ClaimedRole,\n HsmHostingMode,\n OnboardingFullStateResponse,\n OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n options: {\n engine: Engine<WithOnboarding>;\n state: OnboardingFullStateResponse;\n debugAuthToken?: string;\n signerSeed?: string;\n },\n logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n WRAPPING_KEY_OWNER: \"Wrapping Key\",\n MASTER_ADMIN: \"Admin\",\n SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n const index = devices.find((d) => d.name === name)?.index;\n invariant(index !== undefined, `Unknown device ${name}`);\n return index;\n};\n\nconst checkHsmHostingMode = (\n state: OnboardingFullStateResponse,\n expectedMode: HsmHostingMode,\n): void => {\n /* v8 ignore next -- @preserve */\n if (state.hsmHostingMode !== expectedMode) {\n throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n state: OnboardingFullStateResponse,\n debugAuthToken: string | undefined,\n): void => {\n const errorMessage = match(state.hsmHostingMode)\n .with(\"HOSTED\", () => null)\n .with(\"ON_PREM\", () => (debugAuthToken ? null : \"On-premises HSM requires a debug auth token\"))\n .exhaustive();\n if (errorMessage !== null) {\n throw new Error(errorMessage);\n }\n};\n\nexport const STEPS = {\n /**\n * Devices claiming\n */\n PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n const promises: Promise<void>[] = [];\n for (const device of devices) {\n if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n continue;\n }\n if (state.skipWrappingKey && device.role === \"WRAPPING_KEY_OWNER\") {\n continue;\n }\n /* v8 ignore else -- @preserve */\n if (\n state.claimedDevices.find(\n /* v8 ignore next -- @preserve */\n (c) => c.deviceName === device.name,\n ) === undefined\n ) {\n const promise = engine\n .withDeviceIndex(device.index)\n .claimDevice({ role: device.role, deviceName: device.name })\n .then(() => logger.info(`Claimed ${device.name}`));\n promises.push(promise);\n }\n }\n await Promise.all(promises);\n return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n },\n\n /**\n * Wrapping Key provisioning\n */\n PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n const { id: onboardingId } = state;\n state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n const wrappingKey = state.wrappingKey!;\n const toCollect = state.claimedDevices\n .filter((claimed) => {\n if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n const inFragment = !!state.wrappingKey?.fragments.find(\n /* v8 ignore next -- @preserve */\n (f) => f.pubKey === claimed.pubKey,\n );\n return !inFragment;\n })\n .map((c) => {\n const index = deviceNameToIndex(c.deviceName);\n return index;\n });\n await Promise.all(\n toCollect.map((index) =>\n engine\n .withDeviceIndex(index)\n .collectWrappingKeyFragment(wrappingKey)\n .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n ),\n );\n return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n },\n\n /**\n * Init Master Admins registration\n */\n PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n /**\n * Master Admins registration\n */\n PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n const { id: onboardingId } = state;\n const toRegister = state.claimedDevices.filter((claimed) => {\n if (claimed.role !== \"MASTER_ADMIN\") return false;\n const hasRegistered = !!state.masterAdmins.find(\n /* v8 ignore next -- @preserve */\n (a) => a.pubKey === claimed.pubKey,\n );\n return !hasRegistered;\n });\n await Promise.all(\n toRegister.map(async ({ deviceName: name }) => {\n const index = deviceNameToIndex(name);\n await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n logger.info(`Registered ${name}`);\n }),\n );\n return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n },\n\n /**\n * Init Shared Owners registration\n */\n PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n checkHsmHostingMode(state, \"HOSTED\");\n return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n onboardingId: state.id,\n });\n },\n\n /**\n * Shared Owners registration\n */\n PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n checkHsmHostingMode(state, \"HOSTED\");\n const { id: onboardingId } = state;\n const toRegister = state.claimedDevices.filter((claimed) => {\n if (claimed.role !== \"SHARED_OWNER\") return false;\n const hasRegistered = !!state.sharedOwners.find(\n /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n );\n return !hasRegistered;\n });\n await Promise.all(\n toRegister.map(async ({ deviceName: name }) => {\n const index = deviceNameToIndex(name);\n await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n logger.info(`Registered ${name}`);\n }),\n );\n return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n },\n\n /**\n * Review by master admins\n */\n PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n const { id: onboardingId } = state;\n state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n await Promise.all(\n toCollect.map(async (admin) => {\n const index = deviceNameToIndex(admin.name);\n const challenge = admin.review?.challenge;\n await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n logger.info(`Approved with ${admin.name}`);\n }),\n );\n return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n },\n\n PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n { state, engine, debugAuthToken, signerSeed },\n logger,\n ) => {\n checkHsmHostingMode(state, \"ON_PREM\");\n const { id: onboardingId } = state;\n if (debugAuthToken) {\n const debugClient = engine.createClient({ debugAuthToken });\n const seed =\n signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n await debugClient.debug.insertExternalSignerSeed.mutate({\n workspaceName: state.workspaceName,\n seed,\n });\n logger.info(\"Inserted external signer seed\");\n }\n state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n onboardingId,\n });\n const toCollect = state.masterAdmins.filter(\n (admin) => !admin.reviewOfExternalSigners?.signature,\n );\n await Promise.all(\n toCollect.map(async (admin) => {\n const index = deviceNameToIndex(admin.name);\n const challenge = admin.reviewOfExternalSigners?.challenge;\n await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n logger.info(`Approved with ${admin.name}`);\n }),\n );\n return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n },\n\n /**\n * Seed provisioning\n */\n PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n checkHsmHostingMode(state, \"HOSTED\");\n const { id: onboardingId } = state;\n state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n await Promise.all(\n toCollect.map(async (so) => {\n const index = deviceNameToIndex(so.name);\n const challenge = so.review?.seedChallenge;\n await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n logger.info(`Collected fragment for ${so.name}`);\n }),\n );\n return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n },\n\n /**\n * Workspace initialization\n */\n PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }, logger) => {\n const result = await engine.client.onboarding.initializeWorkspace.mutate({\n onboardingId: state.id,\n });\n logger.info(\"Workspace initialized\");\n return result;\n },\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n opts: {\n engine: Engine<WithOnboarding>;\n debugAuthToken?: string;\n signerSeed?: string;\n untilStep?: OnboardingStep;\n },\n logger: Logger,\n): Promise<void> {\n const { engine, debugAuthToken, signerSeed, untilStep } = opts;\n\n const { __onboardingId } = engine;\n logger.info(`Joining onboarding ${__onboardingId}`);\n let state = await engine.client.onboarding.getOnboarding.query({\n onboardingId: __onboardingId,\n });\n\n checkExternalSigners(state, debugAuthToken);\n\n while (state.step !== \"COMPLETED\") {\n if (untilStep && state.step === untilStep) {\n logger.info(\"Skipping the rest of the onboarding\");\n break;\n }\n const step = STEPS[state.step];\n logger.info(step.name);\n state = await step({ engine, state, debugAuthToken, signerSeed }, logger);\n }\n}\n"],"mappings":";;;;AAwBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;AAChB;AAEA,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;AACzE;AAEA,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE;CACpD,UAAU,UAAU,KAAA,GAAW,kBAAkB,MAAM;CACvD,OAAO;AACT;AAEA,MAAM,uBACJ,OACA,iBACS;;CAET,IAAI,MAAM,mBAAmB,cAC3B,MAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,gBAAgB;AAE/F;;AAGA,MAAM,wBACJ,OACA,mBACS;CACT,MAAM,eAAe,MAAM,MAAM,cAAc,CAAC,CAC7C,KAAK,gBAAgB,IAAI,CAAC,CAC1B,KAAK,iBAAkB,iBAAiB,OAAO,6CAA8C,CAAC,CAC9F,WAAW;CACd,IAAI,iBAAiB,MACnB,MAAM,IAAI,MAAM,YAAY;AAEhC;AAEA,MAAa,QAAQ;;;;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,gBACxD;GAEF,IAAI,MAAM,mBAAmB,OAAO,SAAS,sBAC3C;;GAGF,IACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;GACjC,MAAM,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,KAAK,CAAC,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;IAAK,CAAC,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,MAAM,CAAC;IACnD,SAAS,KAAK,OAAO;GACvB;EACF;EACA,MAAM,QAAQ,IAAI,QAAQ;EAC1B,OAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;CACtF;;;;CAKA,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,aAAa,CAAC;EAC3F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;GACnB,IAAI,QAAQ,SAAS,sBAAsB,OAAO;GAKlD,OAAO,CAAC,CAJY,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC,CAAC,CACD,KAAK,MAAM;GAEV,OADc,kBAAkB,EAAE,UACvB;EACb,CAAC;EACH,MAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,KAAK,CAAC,CACtB,2BAA2B,WAAW,CAAC,CACvC,WAAW,OAAO,KAAK,0BAA0B,OAAO,CAAC,CAC9D,CACF;EACA,OAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,aAAa,CAAC;CAC3E;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;;;;CAK1F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAK5C,OAAO,CAAC,CAJe,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAS;GAAK,CAAC;GAC1E,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YAAY;EACpE,oBAAoB,OAAO,QAAQ;EACnC,OAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,GACtB,CAAC;CACH;;;;CAKA,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAI5C,OAAO,CAAC,CAHe,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;GAChE;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAgB;GAAK,CAAC;GACjF,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,aAAa,CAAC;CACxF;;;;CAKA,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,aAAa,CAAC;EACxF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,SAAS;EAC/E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,QAAQ;GAChC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,kBAAkB,SAAU;GAChE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,aAAa,CAAC;CACpF;CAEA,uCAAuC,OACrC,EAAE,OAAO,QAAQ,gBAAgB,cACjC,WACG;EACH,oBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,IAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,eAAe,CAAC;GAC1D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAM,cAAc,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ;GACzF,MAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;GACF,CAAC;GACD,OAAO,KAAK,+BAA+B;EAC7C;EACA,QAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO,EAC7E,aACF,CAAC;EACD,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,SAC7C;EACA,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,yBAAyB;GACjD,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,sBAAsB,SAAU;GACpE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,aAAa,CAAC;CAC3F;;;;CAKA,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;EAC9D,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,aAAa,CAAC;EACpF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,YAAY;EAC5E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,IAAI;GACvC,MAAM,YAAY,GAAG,QAAQ;GAC7B,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,oBAAoB,SAAU;GAClE,OAAO,KAAK,0BAA0B,GAAG,MAAM;EACjD,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,kCAAkC,OAAO,EAAE,OAAO,UAAU,WAAW;EACrE,MAAM,SAAS,MAAM,OAAO,OAAO,WAAW,oBAAoB,OAAO,EACvE,cAAc,MAAM,GACtB,CAAC;EACD,OAAO,KAAK,uBAAuB;EACnC,OAAO;CACT;AACF;AAEA,eAAsB,QACpB,MAMA,QACe;CACf,MAAM,EAAE,QAAQ,gBAAgB,YAAY,cAAc;CAE1D,MAAM,EAAE,mBAAmB;CAC3B,OAAO,KAAK,sBAAsB,gBAAgB;CAClD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,eAChB,CAAC;CAED,qBAAqB,OAAO,cAAc;CAE1C,OAAO,MAAM,SAAS,aAAa;EACjC,IAAI,aAAa,MAAM,SAAS,WAAW;GACzC,OAAO,KAAK,qCAAqC;GACjD;EACF;EACA,MAAM,OAAO,MAAM,MAAM;EACzB,OAAO,KAAK,KAAK,IAAI;EACrB,QAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAgB;EAAW,GAAG,MAAM;CAC1E;AACF"}
1
+ {"version":3,"file":"onboarding.js","names":[],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n HsmHostingMode,\n OnboardingFullStateResponse,\n OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { ClaimableRole, Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n options: {\n engine: Engine<WithOnboarding>;\n state: OnboardingFullStateResponse;\n debugAuthToken?: string;\n signerSeed?: string;\n },\n logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimableRole, string> = {\n MASTER_ADMIN: \"Admin\",\n SHARED_OWNER: \"Shared Owner\",\n};\n\n/**\n * Indices deliberately start at 4: `withDeviceIndex` feeds `genSeed({ salt, index })`, so an\n * index determines a device's seed and therefore its identity. Indices 1-3 belonged to the\n * decommissioned Wrapping Key Custodian devices and are left unused so that every Master Admin\n * and Shared Owner device keeps the identity it has in already-provisioned workspaces.\n */\nconst devices: { index: number; role: ClaimableRole; name: string }[] = [\n { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n const index = devices.find((d) => d.name === name)?.index;\n invariant(index !== undefined, `Unknown device ${name}`);\n return index;\n};\n\nconst checkHsmHostingMode = (\n state: OnboardingFullStateResponse,\n expectedMode: HsmHostingMode,\n): void => {\n /* v8 ignore next -- @preserve */\n if (state.hsmHostingMode !== expectedMode) {\n throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n state: OnboardingFullStateResponse,\n debugAuthToken: string | undefined,\n): void => {\n const errorMessage = match(state.hsmHostingMode)\n .with(\"HOSTED\", () => null)\n .with(\"ON_PREM\", () => (debugAuthToken ? null : \"On-premises HSM requires a debug auth token\"))\n .exhaustive();\n if (errorMessage !== null) {\n throw new Error(errorMessage);\n }\n};\n\nexport const STEPS = {\n /**\n * Devices claiming\n */\n PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n const promises: Promise<void>[] = [];\n for (const device of devices) {\n if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n continue;\n }\n /* v8 ignore else -- @preserve */\n if (\n state.claimedDevices.find(\n /* v8 ignore next -- @preserve */\n (c) => c.deviceName === device.name,\n ) === undefined\n ) {\n const promise = engine\n .withDeviceIndex(device.index)\n .claimDevice({ role: device.role, deviceName: device.name })\n .then(() => logger.info(`Claimed ${device.name}`));\n promises.push(promise);\n }\n }\n await Promise.all(promises);\n return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n },\n\n /**\n * Init Master Admins registration\n */\n PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n /**\n * Master Admins registration\n */\n PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n const { id: onboardingId } = state;\n const toRegister = state.claimedDevices.filter((claimed) => {\n if (claimed.role !== \"MASTER_ADMIN\") return false;\n const hasRegistered = !!state.masterAdmins.find(\n /* v8 ignore next -- @preserve */\n (a) => a.pubKey === claimed.pubKey,\n );\n return !hasRegistered;\n });\n await Promise.all(\n toRegister.map(async ({ deviceName: name }) => {\n const index = deviceNameToIndex(name);\n await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n logger.info(`Registered ${name}`);\n }),\n );\n return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n },\n\n /**\n * Init Shared Owners registration\n */\n PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n checkHsmHostingMode(state, \"HOSTED\");\n return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n onboardingId: state.id,\n });\n },\n\n /**\n * Shared Owners registration\n */\n PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n checkHsmHostingMode(state, \"HOSTED\");\n const { id: onboardingId } = state;\n const toRegister = state.claimedDevices.filter((claimed) => {\n if (claimed.role !== \"SHARED_OWNER\") return false;\n const hasRegistered = !!state.sharedOwners.find(\n /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n );\n return !hasRegistered;\n });\n await Promise.all(\n toRegister.map(async ({ deviceName: name }) => {\n const index = deviceNameToIndex(name);\n await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n logger.info(`Registered ${name}`);\n }),\n );\n return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n },\n\n /**\n * Review by master admins\n */\n PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n const { id: onboardingId } = state;\n state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n await Promise.all(\n toCollect.map(async (admin) => {\n const index = deviceNameToIndex(admin.name);\n const challenge = admin.review?.challenge;\n await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n logger.info(`Approved with ${admin.name}`);\n }),\n );\n return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n },\n\n PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n { state, engine, debugAuthToken, signerSeed },\n logger,\n ) => {\n checkHsmHostingMode(state, \"ON_PREM\");\n const { id: onboardingId } = state;\n if (debugAuthToken) {\n const debugClient = engine.createClient({ debugAuthToken });\n const seed =\n signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n await debugClient.debug.insertExternalSignerSeed.mutate({\n workspaceName: state.workspaceName,\n seed,\n });\n logger.info(\"Inserted external signer seed\");\n }\n state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n onboardingId,\n });\n const toCollect = state.masterAdmins.filter(\n (admin) => !admin.reviewOfExternalSigners?.signature,\n );\n await Promise.all(\n toCollect.map(async (admin) => {\n const index = deviceNameToIndex(admin.name);\n const challenge = admin.reviewOfExternalSigners?.challenge;\n await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n logger.info(`Approved with ${admin.name}`);\n }),\n );\n return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n },\n\n /**\n * Seed provisioning\n */\n PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n checkHsmHostingMode(state, \"HOSTED\");\n const { id: onboardingId } = state;\n state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n await Promise.all(\n toCollect.map(async (so) => {\n const index = deviceNameToIndex(so.name);\n const challenge = so.review?.seedChallenge;\n await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n logger.info(`Collected fragment for ${so.name}`);\n }),\n );\n return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n },\n\n /**\n * Workspace initialization\n */\n PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }, logger) => {\n const result = await engine.client.onboarding.initializeWorkspace.mutate({\n onboardingId: state.id,\n });\n logger.info(\"Workspace initialized\");\n return result;\n },\n} as const satisfies Record<\n Exclude<OnboardingStep, \"COMPLETED\" | \"PENDING_WRAPPING_KEY_PROVISIONING\">,\n StepAction\n>;\n\n/**\n * Steps at which `onboard` can be asked to stop. PENDING_WRAPPING_KEY_PROVISIONING is excluded:\n * the Wrapping Key Custodian ceremony is decommissioned (VG-31485) and no onboarding reaches it,\n * so it can no longer serve as a stop marker.\n */\nexport type OnboardUntilStep = Exclude<OnboardingStep, \"PENDING_WRAPPING_KEY_PROVISIONING\">;\n\nexport async function onboard(\n opts: {\n engine: Engine<WithOnboarding>;\n debugAuthToken?: string;\n signerSeed?: string;\n untilStep?: OnboardUntilStep;\n },\n logger: Logger,\n): Promise<void> {\n const { engine, debugAuthToken, signerSeed, untilStep } = opts;\n\n // PENDING_WRAPPING_KEY_PROVISIONING was a valid stop marker until the Wrapping Key Custodian\n // ceremony was decommissioned (VG-31485). No onboarding reaches it any more, so a caller still\n // passing it would never meet the stop condition and would silently run the whole ceremony.\n // The option type rules it out, so this only guards untyped callers.\n if ((untilStep as OnboardingStep | undefined) === \"PENDING_WRAPPING_KEY_PROVISIONING\") {\n throw new Error(\n \"untilStep PENDING_WRAPPING_KEY_PROVISIONING is decommissioned; use PENDING_MASTER_ADMINS_REGISTRATION_INIT to stop after device claims\",\n );\n }\n\n const { __onboardingId } = engine;\n logger.info(`Joining onboarding ${__onboardingId}`);\n let state = await engine.client.onboarding.getOnboarding.query({\n onboardingId: __onboardingId,\n });\n\n checkExternalSigners(state, debugAuthToken);\n\n while (state.step !== \"COMPLETED\") {\n if (untilStep && state.step === untilStep) {\n logger.info(\"Skipping the rest of the onboarding\");\n break;\n }\n /* v8 ignore next 5 -- @preserve */\n if (state.step === \"PENDING_WRAPPING_KEY_PROVISIONING\") {\n throw new Error(\n \"Onboarding is parked at PENDING_WRAPPING_KEY_PROVISIONING, a decommissioned step\",\n );\n }\n const step = STEPS[state.step];\n logger.info(step.name);\n state = await step({ engine, state, debugAuthToken, signerSeed }, logger);\n }\n}\n"],"mappings":";;;;AAuBA,MAAM,aAA4C;CAChD,cAAc;CACd,cAAc;AAChB;;;;;;;AAQA,MAAM,UAAkE;CACtE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;AACzE;AAEA,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE;CACpD,UAAU,UAAU,KAAA,GAAW,kBAAkB,MAAM;CACvD,OAAO;AACT;AAEA,MAAM,uBACJ,OACA,iBACS;;CAET,IAAI,MAAM,mBAAmB,cAC3B,MAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,gBAAgB;AAE/F;;AAGA,MAAM,wBACJ,OACA,mBACS;CACT,MAAM,eAAe,MAAM,MAAM,cAAc,CAAC,CAC7C,KAAK,gBAAgB,IAAI,CAAC,CAC1B,KAAK,iBAAkB,iBAAiB,OAAO,6CAA8C,CAAC,CAC9F,WAAW;CACd,IAAI,iBAAiB,MACnB,MAAM,IAAI,MAAM,YAAY;AAEhC;AAEA,MAAa,QAAQ;;;;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,gBACxD;;GAGF,IACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;GACjC,MAAM,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,KAAK,CAAC,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;IAAK,CAAC,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,MAAM,CAAC;IACnD,SAAS,KAAK,OAAO;GACvB;EACF;EACA,MAAM,QAAQ,IAAI,QAAQ;EAC1B,OAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;CACtF;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;;;;CAK1F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAK5C,OAAO,CAAC,CAJe,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAS;GAAK,CAAC;GAC1E,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YAAY;EACpE,oBAAoB,OAAO,QAAQ;EACnC,OAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,GACtB,CAAC;CACH;;;;CAKA,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAI5C,OAAO,CAAC,CAHe,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;GAChE;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAgB;GAAK,CAAC;GACjF,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,aAAa,CAAC;CACxF;;;;CAKA,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,aAAa,CAAC;EACxF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,SAAS;EAC/E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,QAAQ;GAChC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,kBAAkB,SAAU;GAChE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,aAAa,CAAC;CACpF;CAEA,uCAAuC,OACrC,EAAE,OAAO,QAAQ,gBAAgB,cACjC,WACG;EACH,oBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,IAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,eAAe,CAAC;GAC1D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAM,cAAc,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ;GACzF,MAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;GACF,CAAC;GACD,OAAO,KAAK,+BAA+B;EAC7C;EACA,QAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO,EAC7E,aACF,CAAC;EACD,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,SAC7C;EACA,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,yBAAyB;GACjD,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,sBAAsB,SAAU;GACpE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,aAAa,CAAC;CAC3F;;;;CAKA,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;EAC9D,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,aAAa,CAAC;EACpF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,YAAY;EAC5E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,IAAI;GACvC,MAAM,YAAY,GAAG,QAAQ;GAC7B,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,oBAAoB,SAAU;GAClE,OAAO,KAAK,0BAA0B,GAAG,MAAM;EACjD,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,kCAAkC,OAAO,EAAE,OAAO,UAAU,WAAW;EACrE,MAAM,SAAS,MAAM,OAAO,OAAO,WAAW,oBAAoB,OAAO,EACvE,cAAc,MAAM,GACtB,CAAC;EACD,OAAO,KAAK,uBAAuB;EACnC,OAAO;CACT;AACF;AAYA,eAAsB,QACpB,MAMA,QACe;CACf,MAAM,EAAE,QAAQ,gBAAgB,YAAY,cAAc;CAM1D,IAAK,cAA6C,qCAChD,MAAM,IAAI,MACR,wIACF;CAGF,MAAM,EAAE,mBAAmB;CAC3B,OAAO,KAAK,sBAAsB,gBAAgB;CAClD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,eAChB,CAAC;CAED,qBAAqB,OAAO,cAAc;CAE1C,OAAO,MAAM,SAAS,aAAa;EACjC,IAAI,aAAa,MAAM,SAAS,WAAW;GACzC,OAAO,KAAK,qCAAqC;GACjD;EACF;;EAEA,IAAI,MAAM,SAAS,qCACjB,MAAM,IAAI,MACR,kFACF;EAEF,MAAM,OAAO,MAAM,MAAM;EACzB,OAAO,KAAK,KAAK,IAAI;EACrB,QAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAgB;EAAW,GAAG,MAAM;CAC1E;AACF"}
package/lib/{types-bfqkmpgo.d.cts → types-B3xo1tFk.d.cts} RENAMED
@@ -1,7 +1,13 @@
1
- import { u as Device } from "./index-BAb2WCcL.cjs";
1
+ import { u as Device } from "./index-IWdCAN97.cjs";
2
2
  import { i as TRPCClientOptions, r as RouterOutputs, t as RevaultApiTRPCClient } from "./trpc-BCwyqVKi.cjs";
3
- import { ApiChallenge, ClaimedRole, OnboardingSeedChallenge, PsdChallenge, UserRegistrationResponse, VaultRequestResponse, WrappingKeyResponse } from "@ledgerhq/revault-api";
3
+ import { ApiChallenge, ClaimedRole, OnboardingSeedChallenge, PsdChallenge, UserRegistrationResponse, VaultRequestResponse } from "@ledgerhq/revault-api";
4
4
  //#region src/engine/types.d.ts
5
+ /**
6
+ * Roles a device can be claimed as. WRAPPING_KEY_OWNER is excluded: the Wrapping Key Custodian
7
+ * ceremony is decommissioned (VG-31485) and the role can no longer be claimed, but the enum
8
+ * value is retained for historical onboardings.
9
+ */
10
+ type ClaimableRole = Exclude<ClaimedRole, "WRAPPING_KEY_OWNER">;
5
11
  type EngineOptions = {
6
12
  /**
7
13
  * revault-api URL
@@ -98,13 +104,9 @@ type DecorateWithDeviceAndOnboarding = {
98
104
  * Claim the device as part of the onboarding
99
105
  */
100
106
  claimDevice: (p: {
101
- role: ClaimedRole;
107
+ role: ClaimableRole;
102
108
  deviceName: string;
103
109
  }) => Promise<void>;
104
- /**
105
- * Collect fragment of wrapping key
106
- */
107
- collectWrappingKeyFragment: (wrappingKey: WrappingKeyResponse, params?: OnboardingOperationParams) => Promise<void>;
108
110
  /**
109
111
  * Register device (either Admin or Shared-Owner)
110
112
  */
@@ -204,4 +206,4 @@ type WithApiAuth = {
204
206
  __apiAuth: RouterOutputs["auth"]["authenticate"];
205
207
  };
206
208
  //#endregion
207
- export { WithApiUser as _, DecorateWithDeviceAndOnboarding as a, WithPsdAuth as b, DecorateWithWorkspaceApiAuthenticated as c, Engine as d, EngineBase as f, WithApiAuth as g, RegisterOnboardingDeviceParams as h, DecorateWithDevice as i, DecorateWithWorkspacePsdAuthenticated as l, OnboardingOperationParams as m, CorrelationIdOpts as n, DecorateWithDeviceAndWorkspaceUnauthenticated as o, EngineOptions as p, DecorateWithApiUserAndWorkspaceUnauthenticated as r, DecorateWithWorkspace as s, ApproveRequestParams as t, DecorateWithWorkspaceUnauthenticated as u, WithDevice as v, WithWorkspace as x, WithOnboarding as y };
209
+ export { WithWorkspace as S, WithApiAuth as _, DecorateWithDevice as a, WithOnboarding as b, DecorateWithWorkspace as c, DecorateWithWorkspaceUnauthenticated as d, Engine as f, RegisterOnboardingDeviceParams as g, OnboardingOperationParams as h, DecorateWithApiUserAndWorkspaceUnauthenticated as i, DecorateWithWorkspaceApiAuthenticated as l, EngineOptions as m, ClaimableRole as n, DecorateWithDeviceAndOnboarding as o, EngineBase as p, CorrelationIdOpts as r, DecorateWithDeviceAndWorkspaceUnauthenticated as s, ApproveRequestParams as t, DecorateWithWorkspacePsdAuthenticated as u, WithApiUser as v, WithPsdAuth as x, WithDevice as y };