@ledgerhq/revault-sdk 0.28.4 → 0.28.6

package/lib/onboarding.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.cjs","names":["getMasterSeed"],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    debugAuthToken?: string;\n    signerSeed?: string;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  debugAuthToken: string | undefined,\n): void => {\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () => null)\n    .with(\"ON_PREM\", () => (debugAuthToken ? null : \"On-premises HSM requires a debug auth token\"))\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      if (state.skipWrappingKey && device.role === \"WRAPPING_KEY_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n    { state, engine, debugAuthToken, signerSeed },\n    logger,\n  ) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    const { id: onboardingId } = state;\n    if (debugAuthToken) {\n      const debugClient = engine.createClient({ debugAuthToken });\n      const seed =\n        signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n      await debugClient.debug.insertExternalSignerSeed.mutate({\n        workspaceName: state.workspaceName,\n        seed,\n      });\n      logger.info(\"Inserted external signer seed\");\n    }\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    debugAuthToken?: string;\n    signerSeed?: string;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, debugAuthToken, signerSeed, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, debugAuthToken);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, debugAuthToken, signerSeed }, logger);\n  }\n}\n"],"mappings":";;;;;;;AAwBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;AAChB;AAEA,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;AACzE;AAEA,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE;CACpD,CAAA,GAAA,UAAA,QAAA,CAAU,UAAU,KAAA,GAAW,kBAAkB,MAAM;CACvD,OAAO;AACT;AAEA,MAAM,uBACJ,OACA,iBACS;;CAET,IAAI,MAAM,mBAAmB,cAC3B,MAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,gBAAgB;AAE/F;;AAGA,MAAM,wBACJ,OACA,mBACS;CACT,MAAM,gBAAA,GAAA,WAAA,MAAA,CAAqB,MAAM,cAAc,CAAC,CAC7C,KAAK,gBAAgB,IAAI,CAAC,CAC1B,KAAK,iBAAkB,iBAAiB,OAAO,6CAA8C,CAAC,CAC9F,WAAW;CACd,IAAI,iBAAiB,MACnB,MAAM,IAAI,MAAM,YAAY;AAEhC;AAEA,MAAa,QAAQ;;;;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,gBACxD;GAEF,IAAI,MAAM,mBAAmB,OAAO,SAAS,sBAC3C;;GAGF,IACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;GACjC,MAAM,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,KAAK,CAAC,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;IAAK,CAAC,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,MAAM,CAAC;IACnD,SAAS,KAAK,OAAO;GACvB;EACF;EACA,MAAM,QAAQ,IAAI,QAAQ;EAC1B,OAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;CACtF;;;;CAKA,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,aAAa,CAAC;EAC3F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;GACnB,IAAI,QAAQ,SAAS,sBAAsB,OAAO;GAKlD,OAAO,CAAC,CAJY,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC,CAAC,CACD,KAAK,MAAM;GAEV,OADc,kBAAkB,EAAE,UACvB;EACb,CAAC;EACH,MAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,KAAK,CAAC,CACtB,2BAA2B,WAAW,CAAC,CACvC,WAAW,OAAO,KAAK,0BAA0B,OAAO,CAAC,CAC9D,CACF;EACA,OAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,aAAa,CAAC;CAC3E;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;;;;CAK1F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAK5C,OAAO,CAAC,CAJe,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAS;GAAK,CAAC;GAC1E,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YAAY;EACpE,oBAAoB,OAAO,QAAQ;EACnC,OAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,GACtB,CAAC;CACH;;;;CAKA,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAI5C,OAAO,CAAC,CAHe,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;GAChE;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAgB;GAAK,CAAC;GACjF,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,aAAa,CAAC;CACxF;;;;CAKA,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,aAAa,CAAC;EACxF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,SAAS;EAC/E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,QAAQ;GAChC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,kBAAkB,SAAU;GAChE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,aAAa,CAAC;CACpF;CAEA,uCAAuC,OACrC,EAAE,OAAO,QAAQ,gBAAgB,cACjC,WACG;EACH,oBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,IAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,eAAe,CAAC;GAC1D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAMA,eAAAA,cAAc,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ;GACzF,MAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;GACF,CAAC;GACD,OAAO,KAAK,+BAA+B;EAC7C;EACA,QAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO,EAC7E,aACF,CAAC;EACD,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,SAC7C;EACA,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,yBAAyB;GACjD,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,sBAAsB,SAAU;GACpE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,aAAa,CAAC;CAC3F;;;;CAKA,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;EAC9D,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,aAAa,CAAC;EACpF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,YAAY;EAC5E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,IAAI;GACvC,MAAM,YAAY,GAAG,QAAQ;GAC7B,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,oBAAoB,SAAU;GAClE,OAAO,KAAK,0BAA0B,GAAG,MAAM;EACjD,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;AAClF;AAEA,eAAsB,QACpB,MAMA,QACe;CACf,MAAM,EAAE,QAAQ,gBAAgB,YAAY,cAAc;CAE1D,MAAM,EAAE,mBAAmB;CAC3B,OAAO,KAAK,sBAAsB,gBAAgB;CAClD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,eAChB,CAAC;CAED,qBAAqB,OAAO,cAAc;CAE1C,OAAO,MAAM,SAAS,aAAa;EACjC,IAAI,aAAa,MAAM,SAAS,WAAW;GACzC,OAAO,KAAK,qCAAqC;GACjD;EACF;EACA,MAAM,OAAO,MAAM,MAAM;EACzB,OAAO,KAAK,KAAK,IAAI;EACrB,QAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAgB;EAAW,GAAG,MAAM;CAC1E;AACF"}
+{"version":3,"file":"onboarding.cjs","names":["match","getMasterSeed"],"sources":["../src/onboarding.ts"],"sourcesContent":["import type {\n  ClaimedRole,\n  HsmHostingMode,\n  OnboardingFullStateResponse,\n  OnboardingStep,\n} from \"@ledgerhq/revault-api\";\nimport invariant from \"invariant\";\nimport { match } from \"ts-pattern\";\n\nimport { getMasterSeed } from \"@/crypto\";\nimport type { Logger } from \"@/logger\";\n\nimport type { Engine, WithOnboarding } from \"./engine/types\";\n\ntype StepAction = (\n  options: {\n    engine: Engine<WithOnboarding>;\n    state: OnboardingFullStateResponse;\n    debugAuthToken?: string;\n    signerSeed?: string;\n  },\n  logger: Logger,\n) => Promise<OnboardingFullStateResponse>;\n\nconst roleLabels: Record<ClaimedRole, string> = {\n  WRAPPING_KEY_OWNER: \"Wrapping Key\",\n  MASTER_ADMIN: \"Admin\",\n  SHARED_OWNER: \"Shared Owner\",\n};\n\nconst devices: { index: number; role: ClaimedRole; name: string }[] = [\n  { index: 1, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 1` },\n  { index: 2, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 2` },\n  { index: 3, role: \"WRAPPING_KEY_OWNER\", name: `${roleLabels.WRAPPING_KEY_OWNER} 3` },\n  { index: 4, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 1` },\n  { index: 5, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 2` },\n  { index: 6, role: \"MASTER_ADMIN\", name: `${roleLabels.MASTER_ADMIN} 3` },\n  { index: 7, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 1` },\n  { index: 8, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 2` },\n  { index: 9, role: \"SHARED_OWNER\", name: `${roleLabels.SHARED_OWNER} 3` },\n];\n\nconst deviceNameToIndex = (name: string): number => {\n  const index = devices.find((d) => d.name === name)?.index;\n  invariant(index !== undefined, `Unknown device ${name}`);\n  return index;\n};\n\nconst checkHsmHostingMode = (\n  state: OnboardingFullStateResponse,\n  expectedMode: HsmHostingMode,\n): void => {\n  /* v8 ignore next -- @preserve */\n  if (state.hsmHostingMode !== expectedMode) {\n    throw new Error(`HSM hosting mode should be ${expectedMode} but is ${state.hsmHostingMode}`);\n  }\n};\n\n/* v8 ignore next -- @preserve */\nconst checkExternalSigners = (\n  state: OnboardingFullStateResponse,\n  debugAuthToken: string | undefined,\n): void => {\n  const errorMessage = match(state.hsmHostingMode)\n    .with(\"HOSTED\", () => null)\n    .with(\"ON_PREM\", () => (debugAuthToken ? null : \"On-premises HSM requires a debug auth token\"))\n    .exhaustive();\n  if (errorMessage !== null) {\n    throw new Error(errorMessage);\n  }\n};\n\nexport const STEPS = {\n  /**\n   * Devices claiming\n   */\n  PENDING_DEVICE_CLAIMS: async ({ state, engine }, logger) => {\n    const promises: Promise<void>[] = [];\n    for (const device of devices) {\n      if (state.hsmHostingMode === \"ON_PREM\" && device.role === \"SHARED_OWNER\") {\n        continue;\n      }\n      if (state.skipWrappingKey && device.role === \"WRAPPING_KEY_OWNER\") {\n        continue;\n      }\n      /* v8 ignore else -- @preserve */\n      if (\n        state.claimedDevices.find(\n          /* v8 ignore next -- @preserve */\n          (c) => c.deviceName === device.name,\n        ) === undefined\n      ) {\n        const promise = engine\n          .withDeviceIndex(device.index)\n          .claimDevice({ role: device.role, deviceName: device.name })\n          .then(() => logger.info(`Claimed ${device.name}`));\n        promises.push(promise);\n      }\n    }\n    await Promise.all(promises);\n    return engine.client.onboarding.commitDeviceClaims.mutate({ onboardingId: state.id });\n  },\n\n  /**\n   * Wrapping Key provisioning\n   */\n  PENDING_WRAPPING_KEY_PROVISIONING: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startWrappingKeyProvisioning.mutate({ onboardingId });\n    const wrappingKey = state.wrappingKey!;\n    const toCollect = state.claimedDevices\n      .filter((claimed) => {\n        if (claimed.role !== \"WRAPPING_KEY_OWNER\") return false;\n        const inFragment = !!state.wrappingKey?.fragments.find(\n          /* v8 ignore next -- @preserve */\n          (f) => f.pubKey === claimed.pubKey,\n        );\n        return !inFragment;\n      })\n      .map((c) => {\n        const index = deviceNameToIndex(c.deviceName);\n        return index;\n      });\n    await Promise.all(\n      toCollect.map((index) =>\n        engine\n          .withDeviceIndex(index)\n          .collectWrappingKeyFragment(wrappingKey)\n          .then(() => logger.info(`Collected Wrapping Key ${index}`)),\n      ),\n    );\n    return engine.client.onboarding.commitWrappingKey.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION_INIT: async ({ engine, state }) =>\n    engine.client.onboarding.startMasterAdminsRegistration.mutate({ onboardingId: state.id }),\n\n  /**\n   * Master Admins registration\n   */\n  PENDING_MASTER_ADMINS_REGISTRATION: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"MASTER_ADMIN\") return false;\n      const hasRegistered = !!state.masterAdmins.find(\n        /* v8 ignore next -- @preserve */\n        (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"ADMIN\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.createMasterAdminGroup.mutate({ onboardingId });\n  },\n\n  /**\n   * Init Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION_INIT: async ({ engine, state }) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    return engine.client.onboarding.startSharedOwnersRegistration.mutate({\n      onboardingId: state.id,\n    });\n  },\n\n  /**\n   * Shared Owners registration\n   */\n  PENDING_SHARED_OWNERS_REGISTRATION: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    const toRegister = state.claimedDevices.filter((claimed) => {\n      if (claimed.role !== \"SHARED_OWNER\") return false;\n      const hasRegistered = !!state.sharedOwners.find(\n        /* v8 ignore next -- @preserve */ (a) => a.pubKey === claimed.pubKey,\n      );\n      return !hasRegistered;\n    });\n    await Promise.all(\n      toRegister.map(async ({ deviceName: name }) => {\n        const index = deviceNameToIndex(name);\n        await engine.withDeviceIndex(index).registerDevice({ role: \"SHARED_OWNER\", name });\n        logger.info(`Registered ${name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSharedOwnersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Review by master admins\n   */\n  PENDING_REVIEW_BY_MASTER_ADMINS: async ({ state, engine }, logger) => {\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startReviewByMasterAdmins.mutate({ onboardingId });\n    const toCollect = state.masterAdmins.filter((admin) => !admin.review?.signature);\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.review?.challenge;\n        await engine.withDeviceIndex(index).reviewSharedOwner(challenge!);\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitReviewByMasterAdmins.mutate({ onboardingId });\n  },\n\n  PENDING_EXTERNAL_SIGNERS_REGISTRATION: async (\n    { state, engine, debugAuthToken, signerSeed },\n    logger,\n  ) => {\n    checkHsmHostingMode(state, \"ON_PREM\");\n    const { id: onboardingId } = state;\n    if (debugAuthToken) {\n      const debugClient = engine.createClient({ debugAuthToken });\n      const seed =\n        signerSeed ?? Buffer.from(await getMasterSeed(engine.__options.salt)).toString(\"base64\");\n      await debugClient.debug.insertExternalSignerSeed.mutate({\n        workspaceName: state.workspaceName,\n        seed,\n      });\n      logger.info(\"Inserted external signer seed\");\n    }\n    state = await engine.client.onboarding.startExternalSignersRegistration.mutate({\n      onboardingId,\n    });\n    const toCollect = state.masterAdmins.filter(\n      (admin) => !admin.reviewOfExternalSigners?.signature,\n    );\n    await Promise.all(\n      toCollect.map(async (admin) => {\n        const index = deviceNameToIndex(admin.name);\n        const challenge = admin.reviewOfExternalSigners?.challenge;\n        await engine.withDeviceIndex(index).reviewExternalSigners(challenge!); // same as review for shared owner, but with different challenge\n        logger.info(`Approved with ${admin.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitExternalSignersRegistration.mutate({ onboardingId });\n  },\n\n  /**\n   * Seed provisioning\n   */\n  PENDING_SEED_PROVISIONING: async ({ state, engine }, logger) => {\n    checkHsmHostingMode(state, \"HOSTED\");\n    const { id: onboardingId } = state;\n    state = await engine.client.onboarding.startSeedProvisioning.mutate({ onboardingId });\n    const toCollect = state.sharedOwners.filter((so) => !so.review?.seedFragment);\n    await Promise.all(\n      toCollect.map(async (so) => {\n        const index = deviceNameToIndex(so.name);\n        const challenge = so.review?.seedChallenge;\n        await engine.withDeviceIndex(index).collectSeedFragment(challenge!);\n        logger.info(`Collected fragment for ${so.name}`);\n      }),\n    );\n    return engine.client.onboarding.commitSeedProvisioning.mutate({ onboardingId });\n  },\n\n  /**\n   * Workspace initialization\n   */\n  PENDING_WORKSPACE_INITIALIZATION: async ({ state, engine }) =>\n    engine.client.onboarding.initializeWorkspace.mutate({ onboardingId: state.id }),\n} as const satisfies Record<Exclude<OnboardingStep, \"COMPLETED\">, StepAction>;\n\nexport async function onboard(\n  opts: {\n    engine: Engine<WithOnboarding>;\n    debugAuthToken?: string;\n    signerSeed?: string;\n    untilStep?: OnboardingStep;\n  },\n  logger: Logger,\n): Promise<void> {\n  const { engine, debugAuthToken, signerSeed, untilStep } = opts;\n\n  const { __onboardingId } = engine;\n  logger.info(`Joining onboarding ${__onboardingId}`);\n  let state = await engine.client.onboarding.getOnboarding.query({\n    onboardingId: __onboardingId,\n  });\n\n  checkExternalSigners(state, debugAuthToken);\n\n  while (state.step !== \"COMPLETED\") {\n    if (untilStep && state.step === untilStep) {\n      logger.info(\"Skipping the rest of the onboarding\");\n      break;\n    }\n    const step = STEPS[state.step];\n    logger.info(step.name);\n    state = await step({ engine, state, debugAuthToken, signerSeed }, logger);\n  }\n}\n"],"mappings":";;;;;;;AAwBA,MAAM,aAA0C;CAC9C,oBAAoB;CACpB,cAAc;CACd,cAAc;AAChB;AAEA,MAAM,UAAgE;CACpE;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAsB,MAAM,GAAG,WAAW,mBAAmB;CAAI;CACnF;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;CACvE;EAAE,OAAO;EAAG,MAAM;EAAgB,MAAM,GAAG,WAAW,aAAa;CAAI;AACzE;AAEA,MAAM,qBAAqB,SAAyB;CAClD,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,SAAS,IAAI,CAAC,EAAE;CACpD,CAAA,GAAA,UAAA,QAAA,CAAU,UAAU,KAAA,GAAW,kBAAkB,MAAM;CACvD,OAAO;AACT;AAEA,MAAM,uBACJ,OACA,iBACS;;CAET,IAAI,MAAM,mBAAmB,cAC3B,MAAM,IAAI,MAAM,8BAA8B,aAAa,UAAU,MAAM,gBAAgB;AAE/F;;AAGA,MAAM,wBACJ,OACA,mBACS;CACT,MAAM,gBAAA,GAAeA,WAAAA,MAAAA,CAAM,MAAM,cAAc,CAAC,CAC7C,KAAK,gBAAgB,IAAI,CAAC,CAC1B,KAAK,iBAAkB,iBAAiB,OAAO,6CAA8C,CAAC,CAC9F,WAAW;CACd,IAAI,iBAAiB,MACnB,MAAM,IAAI,MAAM,YAAY;AAEhC;AAEA,MAAa,QAAQ;;;;CAInB,uBAAuB,OAAO,EAAE,OAAO,UAAU,WAAW;EAC1D,MAAM,WAA4B,CAAC;EACnC,KAAK,MAAM,UAAU,SAAS;GAC5B,IAAI,MAAM,mBAAmB,aAAa,OAAO,SAAS,gBACxD;GAEF,IAAI,MAAM,mBAAmB,OAAO,SAAS,sBAC3C;;GAGF,IACE,MAAM,eAAe;;KAElB,MAAM,EAAE,eAAe,OAAO;GACjC,MAAM,KAAA,GACN;IACA,MAAM,UAAU,OACb,gBAAgB,OAAO,KAAK,CAAC,CAC7B,YAAY;KAAE,MAAM,OAAO;KAAM,YAAY,OAAO;IAAK,CAAC,CAAC,CAC3D,WAAW,OAAO,KAAK,WAAW,OAAO,MAAM,CAAC;IACnD,SAAS,KAAK,OAAO;GACvB;EACF;EACA,MAAM,QAAQ,IAAI,QAAQ;EAC1B,OAAO,OAAO,OAAO,WAAW,mBAAmB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;CACtF;;;;CAKA,mCAAmC,OAAO,EAAE,OAAO,UAAU,WAAW;EACtE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,6BAA6B,OAAO,EAAE,aAAa,CAAC;EAC3F,MAAM,cAAc,MAAM;EAC1B,MAAM,YAAY,MAAM,eACrB,QAAQ,YAAY;GACnB,IAAI,QAAQ,SAAS,sBAAsB,OAAO;GAKlD,OAAO,CAAC,CAJY,CAAC,MAAM,aAAa,UAAU;;KAE/C,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC,CAAC,CACD,KAAK,MAAM;GAEV,OADc,kBAAkB,EAAE,UACvB;EACb,CAAC;EACH,MAAM,QAAQ,IACZ,UAAU,KAAK,UACb,OACG,gBAAgB,KAAK,CAAC,CACtB,2BAA2B,WAAW,CAAC,CACvC,WAAW,OAAO,KAAK,0BAA0B,OAAO,CAAC,CAC9D,CACF;EACA,OAAO,OAAO,OAAO,WAAW,kBAAkB,OAAO,EAAE,aAAa,CAAC;CAC3E;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YACxD,OAAO,OAAO,WAAW,8BAA8B,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;;;;CAK1F,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAK5C,OAAO,CAAC,CAJe,CAAC,MAAM,aAAa;;KAExC,MAAM,EAAE,WAAW,QAAQ;GAC9B;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAS;GAAK,CAAC;GAC1E,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,yCAAyC,OAAO,EAAE,QAAQ,YAAY;EACpE,oBAAoB,OAAO,QAAQ;EACnC,OAAO,OAAO,OAAO,WAAW,8BAA8B,OAAO,EACnE,cAAc,MAAM,GACtB,CAAC;CACH;;;;CAKA,oCAAoC,OAAO,EAAE,OAAO,UAAU,WAAW;EACvE,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,MAAM,aAAa,MAAM,eAAe,QAAQ,YAAY;GAC1D,IAAI,QAAQ,SAAS,gBAAgB,OAAO;GAI5C,OAAO,CAAC,CAHe,CAAC,MAAM,aAAa;;KACN,MAAM,EAAE,WAAW,QAAQ;GAChE;EAEF,CAAC;EACD,MAAM,QAAQ,IACZ,WAAW,IAAI,OAAO,EAAE,YAAY,WAAW;GAC7C,MAAM,QAAQ,kBAAkB,IAAI;GACpC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,eAAe;IAAE,MAAM;IAAgB;GAAK,CAAC;GACjF,OAAO,KAAK,cAAc,MAAM;EAClC,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,+BAA+B,OAAO,EAAE,aAAa,CAAC;CACxF;;;;CAKA,iCAAiC,OAAO,EAAE,OAAO,UAAU,WAAW;EACpE,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,0BAA0B,OAAO,EAAE,aAAa,CAAC;EACxF,MAAM,YAAY,MAAM,aAAa,QAAQ,UAAU,CAAC,MAAM,QAAQ,SAAS;EAC/E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,QAAQ;GAChC,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,kBAAkB,SAAU;GAChE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,2BAA2B,OAAO,EAAE,aAAa,CAAC;CACpF;CAEA,uCAAuC,OACrC,EAAE,OAAO,QAAQ,gBAAgB,cACjC,WACG;EACH,oBAAoB,OAAO,SAAS;EACpC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,IAAI,gBAAgB;GAClB,MAAM,cAAc,OAAO,aAAa,EAAE,eAAe,CAAC;GAC1D,MAAM,OACJ,cAAc,OAAO,KAAK,MAAMC,eAAAA,cAAc,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,QAAQ;GACzF,MAAM,YAAY,MAAM,yBAAyB,OAAO;IACtD,eAAe,MAAM;IACrB;GACF,CAAC;GACD,OAAO,KAAK,+BAA+B;EAC7C;EACA,QAAQ,MAAM,OAAO,OAAO,WAAW,iCAAiC,OAAO,EAC7E,aACF,CAAC;EACD,MAAM,YAAY,MAAM,aAAa,QAClC,UAAU,CAAC,MAAM,yBAAyB,SAC7C;EACA,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,UAAU;GAC7B,MAAM,QAAQ,kBAAkB,MAAM,IAAI;GAC1C,MAAM,YAAY,MAAM,yBAAyB;GACjD,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,sBAAsB,SAAU;GACpE,OAAO,KAAK,iBAAiB,MAAM,MAAM;EAC3C,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,kCAAkC,OAAO,EAAE,aAAa,CAAC;CAC3F;;;;CAKA,2BAA2B,OAAO,EAAE,OAAO,UAAU,WAAW;EAC9D,oBAAoB,OAAO,QAAQ;EACnC,MAAM,EAAE,IAAI,iBAAiB;EAC7B,QAAQ,MAAM,OAAO,OAAO,WAAW,sBAAsB,OAAO,EAAE,aAAa,CAAC;EACpF,MAAM,YAAY,MAAM,aAAa,QAAQ,OAAO,CAAC,GAAG,QAAQ,YAAY;EAC5E,MAAM,QAAQ,IACZ,UAAU,IAAI,OAAO,OAAO;GAC1B,MAAM,QAAQ,kBAAkB,GAAG,IAAI;GACvC,MAAM,YAAY,GAAG,QAAQ;GAC7B,MAAM,OAAO,gBAAgB,KAAK,CAAC,CAAC,oBAAoB,SAAU;GAClE,OAAO,KAAK,0BAA0B,GAAG,MAAM;EACjD,CAAC,CACH;EACA,OAAO,OAAO,OAAO,WAAW,uBAAuB,OAAO,EAAE,aAAa,CAAC;CAChF;;;;CAKA,kCAAkC,OAAO,EAAE,OAAO,aAChD,OAAO,OAAO,WAAW,oBAAoB,OAAO,EAAE,cAAc,MAAM,GAAG,CAAC;AAClF;AAEA,eAAsB,QACpB,MAMA,QACe;CACf,MAAM,EAAE,QAAQ,gBAAgB,YAAY,cAAc;CAE1D,MAAM,EAAE,mBAAmB;CAC3B,OAAO,KAAK,sBAAsB,gBAAgB;CAClD,IAAI,QAAQ,MAAM,OAAO,OAAO,WAAW,cAAc,MAAM,EAC7D,cAAc,eAChB,CAAC;CAED,qBAAqB,OAAO,cAAc;CAE1C,OAAO,MAAM,SAAS,aAAa;EACjC,IAAI,aAAa,MAAM,SAAS,WAAW;GACzC,OAAO,KAAK,qCAAqC;GACjD;EACF;EACA,MAAM,OAAO,MAAM,MAAM;EACzB,OAAO,KAAK,KAAK,IAAI;EACrB,QAAQ,MAAM,KAAK;GAAE;GAAQ;GAAO;GAAgB;EAAW,GAAG,MAAM;CAC1E;AACF"}