@metamask-previews/profile-sync-controller 27.1.0-preview-fb0893ad9 → 27.1.0-preview-378ea32e1

package/CHANGELOG.md

@@ -26,9 +26,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Fix `AuthenticationController` silently discarding tokens when `entropySourceId` is `undefined`, which caused persistent HTTP 401 errors for `ProfileMetricsController` and other consumers ([#8144](https://github.com/MetaMask/core/pull/8144))
+- Fix `AuthenticationController` silently discarding tokens when `entropySourceId` is `undefined` ([#8144](https://github.com/MetaMask/core/pull/8144))
   - `getBearerToken`, `getSessionProfile`, and `getUserProfileLineage` now resolve `undefined` `entropySourceId` to the primary SRP entropy source ID via the message-signing snap before delegating to the auth SDK
   - This also eliminates a login deduplication race condition where `getBearerToken(undefined)` and `getBearerToken("primary-srp-id")` would trigger two independent OIDC logins for the same identity
+- Add client-side JWT `exp` claim validation to prevent stale cached tokens from being returned ([#8144](https://github.com/MetaMask/core/pull/8144))
+  - `#getAuthSession` in both `SRPJwtBearerAuth` and `SIWEJwtBearerAuth` now decodes the JWT `exp` claim and rejects tokens that have actually expired, regardless of client-side TTL tracking (`obtainedAt`/`expiresIn`)
 - Update `getUserProfileLineage` to accept an optional `entropySourceId` parameter ([#8144](https://github.com/MetaMask/core/pull/8144))
 
 ## [27.1.0]

package/dist/sdk/authentication-jwt-bearer/flow-srp.cjs

@@ -166,25 +166,22 @@ async function _SRPJwtBearerAuth_getAuthSession(entropySourceId) {
     await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").storage.setLoginResponse(result, entropySourceId);
     return result;
 }, _SRPJwtBearerAuth_deferredLogin = async function _SRPJwtBearerAuth_deferredLogin(entropySourceId) {
-    // Use a key that accounts for undefined entropySourceId
-    const loginKey = entropySourceId ?? '__default__';
     // Check if there's already an ongoing login for this entropySourceId
-    const existingLogin = __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").get(loginKey);
+    const existingLogin = __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").get(entropySourceId);
     if (existingLogin) {
         return existingLogin;
     }
     // Create a new login promise
     const loginPromise = __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_loginWithRetry).call(this, entropySourceId);
     // Store the promise in the map
-    __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").set(loginKey, loginPromise);
+    __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").set(entropySourceId, loginPromise);
     try {
         // Wait for the login to complete
-        const result = await loginPromise;
-        return result;
+        return await loginPromise;
     }
     finally {
         // Always clean up the ongoing login promise when done
-        __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").delete(loginKey);
+        __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").delete(entropySourceId);
     }
 }, _SRPJwtBearerAuth_loginWithRetry = async function _SRPJwtBearerAuth_loginWithRetry(entropySourceId) {
     // Allow max attempts: initial + maxLoginRetries on 429

package/dist/sdk/authentication-jwt-bearer/flow-srp.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,6CAKoB;AAWpB,4DAA0C;AAE1C,0CAA8D;AAC9D,wFAAiF;AACjF,kGAKkD;AAClD,kFAAyE;AAWzE,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,IAAA,uDAA0B,GAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,wBAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,sDAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,IAAA,iEAA+B,EAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,sDAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAa,gBAAgB;IAqB3B,YACE,MAA2C,EAC3C,OAGC;;QAzBM,2CAAoB;QAEpB,4CAGP;QAEO,gDAA+B;QAExC,yDAAyD;QAChD,0CAAiB,IAAI,GAAG,EAAkC,EAAC;QAEpE,sDAAsD;QAC7C,sDAA2B;QAEpC,uDAAuD;QAC9C,oDAAyB;QAElC,mDAAkC;QAShC,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,oCAAmB,OAAO,CAAC,cAAc,MAAA,CAAC;QAC9C,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,uBAAA,IAAI,wCAAgB,CAAC;SACxD,MAAA,CAAC;QACF,uBAAA,IAAI,iCAAgB,OAAO,CAAC,WAAW,MAAA,CAAC;QAExC,4CAA4C;QAC5C,uBAAA,IAAI,uCACF,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,MAAA,CAAC;QACrD,uBAAA,IAAI,qCAAoB,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,MAAA,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,uBAAA,IAAI,oCAAmB,QAAQ,MAAA,CAAC;QAChC,uBAAA,IAAI,iCAAS,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,IAAA,gCAAqB,EAAC,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAA,iDAAe,EAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,IAAA,6CAAW,EAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CA4HF;AArOD,4CAqOC;;AA1HC,0EAA0E;AAC1E,KAAK,2CACH,eAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAA,+CAAqB,EAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK,kCAAQ,eAAwB;IACnC,gDAAgD;IAChD,OAAO,MAAM,uBAAA,IAAI,oEAAe,MAAnB,IAAI,EAAgB,eAAe,CAAC,CAAC;AACpD,CAAC,mCAED,KAAK,yCAAe,eAAwB;IAC1C,QAAQ;IACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAQ,EAAC,SAAS,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtE,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,IAAA,uBAAY,EACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,qCAAa,CAClB,CAAC;IAEF,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,IAAA,wBAAa,EACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC,oCAED,KAAK,0CAAgB,eAAwB;IAC3C,wDAAwD;IACxD,MAAM,QAAQ,GAAG,eAAe,IAAI,aAAa,CAAC;IAElD,qEAAqE;IACrE,MAAM,aAAa,GAAG,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,iCAAiC;QACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,uBAAA,IAAI,uCAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;AACH,CAAC,qCAED,KAAK,2CAAiB,eAAwB;IAC5C,uDAAuD;IACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,uBAAA,IAAI,yCAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,EAAe,eAAe,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,CAAC,yBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,IAAI,uBAAA,IAAI,yCAAiB,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2CAA2C;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,uBAAA,IAAI,2CAAmB,CAAC;YACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport {\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n  getUserProfileLineage,\n} from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types';\nimport * as timeUtils from './utils/time';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { ValidationError, RateLimitedError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<string, Promise<LoginResponse>>();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a key that accounts for undefined entropySourceId\n    const loginKey = entropySourceId ?? '__default__';\n\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(loginKey);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(loginKey, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      const result = await loginPromise;\n      return result;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(loginKey);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}
+{"version":3,"file":"flow-srp.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,6CAKoB;AAWpB,4DAA0C;AAE1C,0CAA8D;AAC9D,wFAAiF;AACjF,kGAKkD;AAClD,kFAAyE;AAWzE,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,IAAA,uDAA0B,GAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,wBAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,sDAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,IAAA,iEAA+B,EAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,sDAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAa,gBAAgB;IAwB3B,YACE,MAA2C,EAC3C,OAGC;;QA5BM,2CAAoB;QAEpB,4CAGP;QAEO,gDAA+B;QAExC,yDAAyD;QAChD,0CAAiB,IAAI,GAAG,EAG9B,EAAC;QAEJ,sDAAsD;QAC7C,sDAA2B;QAEpC,uDAAuD;QAC9C,oDAAyB;QAElC,mDAAkC;QAShC,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,oCAAmB,OAAO,CAAC,cAAc,MAAA,CAAC;QAC9C,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,uBAAA,IAAI,wCAAgB,CAAC;SACxD,MAAA,CAAC;QACF,uBAAA,IAAI,iCAAgB,OAAO,CAAC,WAAW,MAAA,CAAC;QAExC,4CAA4C;QAC5C,uBAAA,IAAI,uCACF,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,MAAA,CAAC;QACrD,uBAAA,IAAI,qCAAoB,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,MAAA,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,uBAAA,IAAI,oCAAmB,QAAQ,MAAA,CAAC;QAChC,uBAAA,IAAI,iCAAS,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,IAAA,gCAAqB,EAAC,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAA,iDAAe,EAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,IAAA,6CAAW,EAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CAwHF;AApOD,4CAoOC;;AAtHC,0EAA0E;AAC1E,KAAK,2CACH,eAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAA,+CAAqB,EAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK,kCAAQ,eAAwB;IACnC,gDAAgD;IAChD,OAAO,MAAM,uBAAA,IAAI,oEAAe,MAAnB,IAAI,EAAgB,eAAe,CAAC,CAAC;AACpD,CAAC,mCAED,KAAK,yCAAe,eAAwB;IAC1C,QAAQ;IACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAQ,EAAC,SAAS,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtE,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,IAAA,uBAAY,EACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,qCAAa,CAClB,CAAC;IAEF,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,IAAA,wBAAa,EACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC,oCAED,KAAK,0CAAgB,eAAwB;IAC3C,qEAAqE;IACrE,MAAM,aAAa,GAAG,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,iCAAiC;QACjC,OAAO,MAAM,YAAY,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,uBAAA,IAAI,uCAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,qCAED,KAAK,2CAAiB,eAAwB;IAC5C,uDAAuD;IACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,uBAAA,IAAI,yCAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,EAAe,eAAe,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,CAAC,yBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,IAAI,uBAAA,IAAI,yCAAiB,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2CAA2C;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,uBAAA,IAAI,2CAAmB,CAAC;YACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport {\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n  getUserProfileLineage,\n} from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types';\nimport * as timeUtils from './utils/time';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { ValidationError, RateLimitedError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<\n    string | undefined,\n    Promise<LoginResponse>\n  >();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(entropySourceId);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      return await loginPromise;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(entropySourceId);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/flow-srp.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe;AAQ9C,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAgB;AAEjB,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAWnE,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AA+BF,qBAAa,gBAAiB,YAAW,SAAS;;gBAsB9C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;KAAE,EAC3C,OAAO,EAAE,yBAAyB,GAAG;QACnC,cAAc,CAAC,EAAE,eAAe,CAAC;QACjC,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B;IAkBH,iBAAiB,CAAC,QAAQ,EAAE,eAAe;IAMrC,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU9D,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAKxB,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAIZ,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAkIrC"}
+{"version":3,"file":"flow-srp.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe;AAQ9C,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAgB;AAEjB,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAWnE,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AA+BF,qBAAa,gBAAiB,YAAW,SAAS;;gBAyB9C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;KAAE,EAC3C,OAAO,EAAE,yBAAyB,GAAG;QACnC,cAAc,CAAC,EAAE,eAAe,CAAC;QACjC,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B;IAkBH,iBAAiB,CAAC,QAAQ,EAAE,eAAe;IAMrC,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU9D,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAKxB,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAIZ,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CA8HrC"}

package/dist/sdk/authentication-jwt-bearer/flow-srp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe;AAQ9C,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAgB;AAEjB,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAWnE,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AA+BF,qBAAa,gBAAiB,YAAW,SAAS;;gBAsB9C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;KAAE,EAC3C,OAAO,EAAE,yBAAyB,GAAG;QACnC,cAAc,CAAC,EAAE,eAAe,CAAC;QACjC,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B;IAkBH,iBAAiB,CAAC,QAAQ,EAAE,eAAe;IAMrC,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU9D,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAKxB,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAIZ,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAkIrC"}
+{"version":3,"file":"flow-srp.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe;AAQ9C,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAgB;AAEjB,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAWnE,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AA+BF,qBAAa,gBAAiB,YAAW,SAAS;;gBAyB9C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;KAAE,EAC3C,OAAO,EAAE,yBAAyB,GAAG;QACnC,cAAc,CAAC,EAAE,eAAe,CAAC;QACjC,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B;IAkBH,iBAAiB,CAAC,QAAQ,EAAE,eAAe;IAMrC,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU9D,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAKxB,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAIZ,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CA8HrC"}

package/dist/sdk/authentication-jwt-bearer/flow-srp.mjs

@@ -139,25 +139,22 @@ async function _SRPJwtBearerAuth_getAuthSession(entropySourceId) {
     await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").storage.setLoginResponse(result, entropySourceId);
     return result;
 }, _SRPJwtBearerAuth_deferredLogin = async function _SRPJwtBearerAuth_deferredLogin(entropySourceId) {
-    // Use a key that accounts for undefined entropySourceId
-    const loginKey = entropySourceId ?? '__default__';
     // Check if there's already an ongoing login for this entropySourceId
-    const existingLogin = __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").get(loginKey);
+    const existingLogin = __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").get(entropySourceId);
     if (existingLogin) {
         return existingLogin;
     }
     // Create a new login promise
     const loginPromise = __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_loginWithRetry).call(this, entropySourceId);
     // Store the promise in the map
-    __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").set(loginKey, loginPromise);
+    __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").set(entropySourceId, loginPromise);
     try {
         // Wait for the login to complete
-        const result = await loginPromise;
-        return result;
+        return await loginPromise;
     }
     finally {
         // Always clean up the ongoing login promise when done
-        __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").delete(loginKey);
+        __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").delete(entropySourceId);
     }
 }, _SRPJwtBearerAuth_loginWithRetry = async function _SRPJwtBearerAuth_loginWithRetry(entropySourceId) {
     // Allow max attempts: initial + maxLoginRetries on 429

package/dist/sdk/authentication-jwt-bearer/flow-srp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.mjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,qBAAqB,EACtB,uBAAmB;AAWpB,OAAO,KAAK,SAAS,yBAAqB;AAE1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAkB;AAC9D,OAAO,EAAE,0BAA0B,EAAE,gDAA4C;AACjF,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,WAAW,EACX,eAAe,EAChB,qDAAiD;AAClD,OAAO,EAAE,qBAAqB,EAAE,6CAAyC;AAWzE,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IAqB3B,YACE,MAA2C,EAC3C,OAGC;;QAzBM,2CAAoB;QAEpB,4CAGP;QAEO,gDAA+B;QAExC,yDAAyD;QAChD,0CAAiB,IAAI,GAAG,EAAkC,EAAC;QAEpE,sDAAsD;QAC7C,sDAA2B;QAEpC,uDAAuD;QAC9C,oDAAyB;QAElC,mDAAkC;QAShC,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,oCAAmB,OAAO,CAAC,cAAc,MAAA,CAAC;QAC9C,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,uBAAA,IAAI,wCAAgB,CAAC;SACxD,MAAA,CAAC;QACF,uBAAA,IAAI,iCAAgB,OAAO,CAAC,WAAW,MAAA,CAAC;QAExC,4CAA4C;QAC5C,uBAAA,IAAI,uCACF,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,MAAA,CAAC;QACrD,uBAAA,IAAI,qCAAoB,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,MAAA,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,uBAAA,IAAI,oCAAmB,QAAQ,MAAA,CAAC;QAChC,uBAAA,IAAI,iCAAS,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,qBAAqB,CAAC,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CA4HF;;AA1HC,0EAA0E;AAC1E,KAAK,2CACH,eAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK,kCAAQ,eAAwB;IACnC,gDAAgD;IAChD,OAAO,MAAM,uBAAA,IAAI,oEAAe,MAAnB,IAAI,EAAgB,eAAe,CAAC,CAAC;AACpD,CAAC,mCAED,KAAK,yCAAe,eAAwB;IAC1C,QAAQ;IACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtE,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,qCAAa,CAClB,CAAC;IAEF,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC,oCAED,KAAK,0CAAgB,eAAwB;IAC3C,wDAAwD;IACxD,MAAM,QAAQ,GAAG,eAAe,IAAI,aAAa,CAAC;IAElD,qEAAqE;IACrE,MAAM,aAAa,GAAG,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,iCAAiC;QACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,uBAAA,IAAI,uCAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;AACH,CAAC,qCAED,KAAK,2CAAiB,eAAwB;IAC5C,uDAAuD;IACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,uBAAA,IAAI,yCAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,EAAe,eAAe,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,IAAI,uBAAA,IAAI,yCAAiB,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2CAA2C;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,uBAAA,IAAI,2CAAmB,CAAC;YACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport {\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n  getUserProfileLineage,\n} from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types';\nimport * as timeUtils from './utils/time';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { ValidationError, RateLimitedError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<string, Promise<LoginResponse>>();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a key that accounts for undefined entropySourceId\n    const loginKey = entropySourceId ?? '__default__';\n\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(loginKey);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(loginKey, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      const result = await loginPromise;\n      return result;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(loginKey);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}
+{"version":3,"file":"flow-srp.mjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,qBAAqB,EACtB,uBAAmB;AAWpB,OAAO,KAAK,SAAS,yBAAqB;AAE1C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAkB;AAC9D,OAAO,EAAE,0BAA0B,EAAE,gDAA4C;AACjF,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,WAAW,EACX,eAAe,EAChB,qDAAiD;AAClD,OAAO,EAAE,qBAAqB,EAAE,6CAAyC;AAWzE,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IAwB3B,YACE,MAA2C,EAC3C,OAGC;;QA5BM,2CAAoB;QAEpB,4CAGP;QAEO,gDAA+B;QAExC,yDAAyD;QAChD,0CAAiB,IAAI,GAAG,EAG9B,EAAC;QAEJ,sDAAsD;QAC7C,sDAA2B;QAEpC,uDAAuD;QAC9C,oDAAyB;QAElC,mDAAkC;QAShC,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,oCAAmB,OAAO,CAAC,cAAc,MAAA,CAAC;QAC9C,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,uBAAA,IAAI,wCAAgB,CAAC;SACxD,MAAA,CAAC;QACF,uBAAA,IAAI,iCAAgB,OAAO,CAAC,WAAW,MAAA,CAAC;QAExC,4CAA4C;QAC5C,uBAAA,IAAI,uCACF,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,MAAA,CAAC;QACrD,uBAAA,IAAI,qCAAoB,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,MAAA,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,uBAAA,IAAI,oCAAmB,QAAQ,MAAA,CAAC;QAChC,uBAAA,IAAI,iCAAS,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,qBAAqB,CAAC,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CAwHF;;AAtHC,0EAA0E;AAC1E,KAAK,2CACH,eAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK,kCAAQ,eAAwB;IACnC,gDAAgD;IAChD,OAAO,MAAM,uBAAA,IAAI,oEAAe,MAAnB,IAAI,EAAgB,eAAe,CAAC,CAAC;AACpD,CAAC,mCAED,KAAK,yCAAe,eAAwB;IAC1C,QAAQ;IACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtE,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,qCAAa,CAClB,CAAC;IAEF,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC,oCAED,KAAK,0CAAgB,eAAwB;IAC3C,qEAAqE;IACrE,MAAM,aAAa,GAAG,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,iCAAiC;QACjC,OAAO,MAAM,YAAY,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,uBAAA,IAAI,uCAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,qCAED,KAAK,2CAAiB,eAAwB;IAC5C,uDAAuD;IACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,uBAAA,IAAI,yCAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,EAAe,eAAe,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,IAAI,uBAAA,IAAI,yCAAiB,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2CAA2C;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,uBAAA,IAAI,2CAAmB,CAAC;YACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport {\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n  getUserProfileLineage,\n} from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types';\nimport * as timeUtils from './utils/time';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { ValidationError, RateLimitedError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<\n    string | undefined,\n    Promise<LoginResponse>\n  >();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(entropySourceId);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      return await loginPromise;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(entropySourceId);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}

package/dist/sdk/mocks/auth.cjs

@@ -10,7 +10,7 @@ exports.MOCK_SIWE_LOGIN_URL = (0, services_1.SIWE_LOGIN_URL)(env_1.Env.PRD);
 exports.MOCK_PAIR_IDENTIFIERS_URL = (0, services_1.PAIR_IDENTIFIERS)(env_1.Env.PRD);
 exports.MOCK_PROFILE_LINEAGE_URL = (0, services_1.PROFILE_LINEAGE_URL)(env_1.Env.PRD);
 exports.MOCK_JWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';
-exports.MOCK_ACCESS_JWT = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
+exports.MOCK_ACCESS_JWT = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
 exports.MOCK_NONCE_RESPONSE = {
     nonce: 'xGMm9SoihEKeAEfV',
     identifier: '0xd8641601Cb79a94FD872fE42d5b4a067A44a7e88',

package/dist/sdk/mocks/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.cjs","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":";;;AAAA,8CAAiD;AACjD,wEAO+C;AAElC,QAAA,cAAc,GAAG,IAAA,oBAAS,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AACpC,QAAA,kBAAkB,GAAG,IAAA,wBAAa,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,QAAA,mBAAmB,GAAG,IAAA,yBAAc,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,QAAA,mBAAmB,GAAG,IAAA,yBAAc,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,QAAA,yBAAyB,GAAG,IAAA,2BAAgB,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AACtD,QAAA,wBAAwB,GAAG,IAAA,8BAAmB,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAExD,QAAA,QAAQ,GACnB,opBAAopB,CAAC;AAE1oB,QAAA,eAAe,GAC1B,6JAA6J,CAAC;AAEnJ,QAAA,mBAAmB,GAAG;IACjC,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,4CAA4C;IACxD,UAAU,EAAE,GAAG;CAChB,CAAC;AAEW,QAAA,wBAAwB,GAAG;IACtC,KAAK,EAAE,gBAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,MAAM;QACvB,qBAAqB,EAAE,iCAAiC;KACzD;CACF,CAAC;AAEW,QAAA,uBAAuB,GAAG;IACrC,KAAK,EAAE,gBAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,4BAA4B;KACpD;CACF,CAAC;AAEW,QAAA,wBAAwB,GAAG;IACtC,YAAY,EAAE,uBAAe;IAC7B,UAAU,EAAE,IAAI;CACjB,CAAC;AAEW,QAAA,kCAAkC,GAAG;IAChD,UAAU,EAAE,sCAAsC;IAClD,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE;QACP;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,cAAQ,CAAC,MAAM;YACtB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;QACD;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,cAAQ,CAAC,SAAS;YACzB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;KACF;CACF,CAAC","sourcesContent":["import { Env, Platform } from '../../shared/env';\nimport {\n  NONCE_URL,\n  SIWE_LOGIN_URL,\n  SRP_LOGIN_URL,\n  OIDC_TOKEN_URL,\n  PAIR_IDENTIFIERS,\n  PROFILE_LINEAGE_URL,\n} from '../authentication-jwt-bearer/services';\n\nexport const MOCK_NONCE_URL = NONCE_URL(Env.PRD);\nexport const MOCK_SRP_LOGIN_URL = SRP_LOGIN_URL(Env.PRD);\nexport const MOCK_OIDC_TOKEN_URL = OIDC_TOKEN_URL(Env.PRD);\nexport const MOCK_SIWE_LOGIN_URL = SIWE_LOGIN_URL(Env.PRD);\nexport const MOCK_PAIR_IDENTIFIERS_URL = PAIR_IDENTIFIERS(Env.PRD);\nexport const MOCK_PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL(Env.PRD);\n\nexport const MOCK_JWT =\n  'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';\n\nexport const MOCK_ACCESS_JWT =\n  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';\n\nexport const MOCK_NONCE_RESPONSE = {\n  nonce: 'xGMm9SoihEKeAEfV',\n  identifier: '0xd8641601Cb79a94FD872fE42d5b4a067A44a7e88',\n  expires_in: 300,\n};\n\nexport const MOCK_SIWE_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'fa2bbf82-bd9a-4e6b-aabc-9ca0d0319b6e',\n    metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n    identifier_id:\n      'ec9a4e9906836497efad2fd4d4290b34d2c6a2c0d93eb174aa3cd88a133adbaf',\n    identifier_type: 'SIWE',\n    encrypted_storage_key: '2c6a2c0d93eb174aa3cd88a133adbaf',\n  },\n};\n\nexport const MOCK_SRP_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n    metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n    identifier_id:\n      'da9a9fc7b09edde9cc23cec9b7e11a71fb0ab4d2ddd8af8af905306f3e1456fb',\n    identifier_type: 'SRP',\n    encrypted_storage_key: 'd2ddd8af8af905306f3e1456fb',\n  },\n};\n\nexport const MOCK_OIDC_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  expires_in: 3600,\n};\n\nexport const MOCK_USER_PROFILE_LINEAGE_RESPONSE = {\n  profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n  created_at: '2025-10-01T12:00:00Z',\n  lineage: [\n    {\n      metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n      agent: Platform.MOBILE,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 1,\n    },\n    {\n      metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n      agent: Platform.EXTENSION,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 2,\n    },\n  ],\n};\n"]}
+{"version":3,"file":"auth.cjs","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":";;;AAAA,8CAAiD;AACjD,wEAO+C;AAElC,QAAA,cAAc,GAAG,IAAA,oBAAS,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AACpC,QAAA,kBAAkB,GAAG,IAAA,wBAAa,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,QAAA,mBAAmB,GAAG,IAAA,yBAAc,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,QAAA,mBAAmB,GAAG,IAAA,yBAAc,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,QAAA,yBAAyB,GAAG,IAAA,2BAAgB,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AACtD,QAAA,wBAAwB,GAAG,IAAA,8BAAmB,EAAC,SAAG,CAAC,GAAG,CAAC,CAAC;AAExD,QAAA,QAAQ,GACnB,opBAAopB,CAAC;AAE1oB,QAAA,eAAe,GAC1B,mLAAmL,CAAC;AAEzK,QAAA,mBAAmB,GAAG;IACjC,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,4CAA4C;IACxD,UAAU,EAAE,GAAG;CAChB,CAAC;AAEW,QAAA,wBAAwB,GAAG;IACtC,KAAK,EAAE,gBAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,MAAM;QACvB,qBAAqB,EAAE,iCAAiC;KACzD;CACF,CAAC;AAEW,QAAA,uBAAuB,GAAG;IACrC,KAAK,EAAE,gBAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,4BAA4B;KACpD;CACF,CAAC;AAEW,QAAA,wBAAwB,GAAG;IACtC,YAAY,EAAE,uBAAe;IAC7B,UAAU,EAAE,IAAI;CACjB,CAAC;AAEW,QAAA,kCAAkC,GAAG;IAChD,UAAU,EAAE,sCAAsC;IAClD,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE;QACP;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,cAAQ,CAAC,MAAM;YACtB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;QACD;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,cAAQ,CAAC,SAAS;YACzB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;KACF;CACF,CAAC","sourcesContent":["import { Env, Platform } from '../../shared/env';\nimport {\n  NONCE_URL,\n  SIWE_LOGIN_URL,\n  SRP_LOGIN_URL,\n  OIDC_TOKEN_URL,\n  PAIR_IDENTIFIERS,\n  PROFILE_LINEAGE_URL,\n} from '../authentication-jwt-bearer/services';\n\nexport const MOCK_NONCE_URL = NONCE_URL(Env.PRD);\nexport const MOCK_SRP_LOGIN_URL = SRP_LOGIN_URL(Env.PRD);\nexport const MOCK_OIDC_TOKEN_URL = OIDC_TOKEN_URL(Env.PRD);\nexport const MOCK_SIWE_LOGIN_URL = SIWE_LOGIN_URL(Env.PRD);\nexport const MOCK_PAIR_IDENTIFIERS_URL = PAIR_IDENTIFIERS(Env.PRD);\nexport const MOCK_PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL(Env.PRD);\n\nexport const MOCK_JWT =\n  'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';\n\nexport const MOCK_ACCESS_JWT =\n  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';\n\nexport const MOCK_NONCE_RESPONSE = {\n  nonce: 'xGMm9SoihEKeAEfV',\n  identifier: '0xd8641601Cb79a94FD872fE42d5b4a067A44a7e88',\n  expires_in: 300,\n};\n\nexport const MOCK_SIWE_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'fa2bbf82-bd9a-4e6b-aabc-9ca0d0319b6e',\n    metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n    identifier_id:\n      'ec9a4e9906836497efad2fd4d4290b34d2c6a2c0d93eb174aa3cd88a133adbaf',\n    identifier_type: 'SIWE',\n    encrypted_storage_key: '2c6a2c0d93eb174aa3cd88a133adbaf',\n  },\n};\n\nexport const MOCK_SRP_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n    metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n    identifier_id:\n      'da9a9fc7b09edde9cc23cec9b7e11a71fb0ab4d2ddd8af8af905306f3e1456fb',\n    identifier_type: 'SRP',\n    encrypted_storage_key: 'd2ddd8af8af905306f3e1456fb',\n  },\n};\n\nexport const MOCK_OIDC_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  expires_in: 3600,\n};\n\nexport const MOCK_USER_PROFILE_LINEAGE_RESPONSE = {\n  profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n  created_at: '2025-10-01T12:00:00Z',\n  lineage: [\n    {\n      metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n      agent: Platform.MOBILE,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 1,\n    },\n    {\n      metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n      agent: Platform.EXTENSION,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 2,\n    },\n  ],\n};\n"]}

package/dist/sdk/mocks/auth.d.cts

@@ -6,7 +6,7 @@ export declare const MOCK_SIWE_LOGIN_URL: string;
 export declare const MOCK_PAIR_IDENTIFIERS_URL: string;
 export declare const MOCK_PROFILE_LINEAGE_URL: string;
 export declare const MOCK_JWT = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ";
-export declare const MOCK_ACCESS_JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
+export declare const MOCK_ACCESS_JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
 export declare const MOCK_NONCE_RESPONSE: {
     nonce: string;
     identifier: string;

package/dist/sdk/mocks/auth.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.cts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,6BAAyB;AAUjD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AAErE,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,gKACmI,CAAC;AAEhK,eAAO,MAAM,mBAAmB;;;;CAI/B,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;CAWpC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;CAWnC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}
+{"version":3,"file":"auth.d.cts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,6BAAyB;AAUjD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AAErE,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,sLACyJ,CAAC;AAEtL,eAAO,MAAM,mBAAmB;;;;CAI/B,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;CAWpC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;CAWnC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}

package/dist/sdk/mocks/auth.d.mts

@@ -6,7 +6,7 @@ export declare const MOCK_SIWE_LOGIN_URL: string;
 export declare const MOCK_PAIR_IDENTIFIERS_URL: string;
 export declare const MOCK_PROFILE_LINEAGE_URL: string;
 export declare const MOCK_JWT = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ";
-export declare const MOCK_ACCESS_JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
+export declare const MOCK_ACCESS_JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
 export declare const MOCK_NONCE_RESPONSE: {
     nonce: string;
     identifier: string;

package/dist/sdk/mocks/auth.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.mts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,6BAAyB;AAUjD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AAErE,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,gKACmI,CAAC;AAEhK,eAAO,MAAM,mBAAmB;;;;CAI/B,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;CAWpC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;CAWnC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}
+{"version":3,"file":"auth.d.mts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,6BAAyB;AAUjD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AAErE,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,sLACyJ,CAAC;AAEtL,eAAO,MAAM,mBAAmB;;;;CAI/B,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;CAWpC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;CAWnC,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}

package/dist/sdk/mocks/auth.mjs

@@ -7,7 +7,7 @@ export const MOCK_SIWE_LOGIN_URL = SIWE_LOGIN_URL(Env.PRD);
 export const MOCK_PAIR_IDENTIFIERS_URL = PAIR_IDENTIFIERS(Env.PRD);
 export const MOCK_PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL(Env.PRD);
 export const MOCK_JWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';
-export const MOCK_ACCESS_JWT = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
+export const MOCK_ACCESS_JWT = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
 export const MOCK_NONCE_RESPONSE = {
     nonce: 'xGMm9SoihEKeAEfV',
     identifier: '0xd8641601Cb79a94FD872fE42d5b4a067A44a7e88',

package/dist/sdk/mocks/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,6BAAyB;AACjD,OAAO,EACL,SAAS,EACT,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACpB,kDAA8C;AAE/C,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,QAAQ,GACnB,opBAAopB,CAAC;AAEvpB,MAAM,CAAC,MAAM,eAAe,GAC1B,6JAA6J,CAAC;AAEhK,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,4CAA4C;IACxD,UAAU,EAAE,GAAG;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,MAAM;QACvB,qBAAqB,EAAE,iCAAiC;KACzD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,4BAA4B;KACpD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,UAAU,EAAE,sCAAsC;IAClD,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE;QACP;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;QACD;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,QAAQ,CAAC,SAAS;YACzB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;KACF;CACF,CAAC","sourcesContent":["import { Env, Platform } from '../../shared/env';\nimport {\n  NONCE_URL,\n  SIWE_LOGIN_URL,\n  SRP_LOGIN_URL,\n  OIDC_TOKEN_URL,\n  PAIR_IDENTIFIERS,\n  PROFILE_LINEAGE_URL,\n} from '../authentication-jwt-bearer/services';\n\nexport const MOCK_NONCE_URL = NONCE_URL(Env.PRD);\nexport const MOCK_SRP_LOGIN_URL = SRP_LOGIN_URL(Env.PRD);\nexport const MOCK_OIDC_TOKEN_URL = OIDC_TOKEN_URL(Env.PRD);\nexport const MOCK_SIWE_LOGIN_URL = SIWE_LOGIN_URL(Env.PRD);\nexport const MOCK_PAIR_IDENTIFIERS_URL = PAIR_IDENTIFIERS(Env.PRD);\nexport const MOCK_PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL(Env.PRD);\n\nexport const MOCK_JWT =\n  'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';\n\nexport const MOCK_ACCESS_JWT =\n  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';\n\nexport const MOCK_NONCE_RESPONSE = {\n  nonce: 'xGMm9SoihEKeAEfV',\n  identifier: '0xd8641601Cb79a94FD872fE42d5b4a067A44a7e88',\n  expires_in: 300,\n};\n\nexport const MOCK_SIWE_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'fa2bbf82-bd9a-4e6b-aabc-9ca0d0319b6e',\n    metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n    identifier_id:\n      'ec9a4e9906836497efad2fd4d4290b34d2c6a2c0d93eb174aa3cd88a133adbaf',\n    identifier_type: 'SIWE',\n    encrypted_storage_key: '2c6a2c0d93eb174aa3cd88a133adbaf',\n  },\n};\n\nexport const MOCK_SRP_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n    metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n    identifier_id:\n      'da9a9fc7b09edde9cc23cec9b7e11a71fb0ab4d2ddd8af8af905306f3e1456fb',\n    identifier_type: 'SRP',\n    encrypted_storage_key: 'd2ddd8af8af905306f3e1456fb',\n  },\n};\n\nexport const MOCK_OIDC_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  expires_in: 3600,\n};\n\nexport const MOCK_USER_PROFILE_LINEAGE_RESPONSE = {\n  profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n  created_at: '2025-10-01T12:00:00Z',\n  lineage: [\n    {\n      metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n      agent: Platform.MOBILE,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 1,\n    },\n    {\n      metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n      agent: Platform.EXTENSION,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 2,\n    },\n  ],\n};\n"]}
+{"version":3,"file":"auth.mjs","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,6BAAyB;AACjD,OAAO,EACL,SAAS,EACT,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACpB,kDAA8C;AAE/C,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,QAAQ,GACnB,opBAAopB,CAAC;AAEvpB,MAAM,CAAC,MAAM,eAAe,GAC1B,mLAAmL,CAAC;AAEtL,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,4CAA4C;IACxD,UAAU,EAAE,GAAG;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,MAAM;QACvB,qBAAqB,EAAE,iCAAiC;KACzD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,4BAA4B;KACpD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,UAAU,EAAE,sCAAsC;IAClD,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE;QACP;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;QACD;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,QAAQ,CAAC,SAAS;YACzB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;KACF;CACF,CAAC","sourcesContent":["import { Env, Platform } from '../../shared/env';\nimport {\n  NONCE_URL,\n  SIWE_LOGIN_URL,\n  SRP_LOGIN_URL,\n  OIDC_TOKEN_URL,\n  PAIR_IDENTIFIERS,\n  PROFILE_LINEAGE_URL,\n} from '../authentication-jwt-bearer/services';\n\nexport const MOCK_NONCE_URL = NONCE_URL(Env.PRD);\nexport const MOCK_SRP_LOGIN_URL = SRP_LOGIN_URL(Env.PRD);\nexport const MOCK_OIDC_TOKEN_URL = OIDC_TOKEN_URL(Env.PRD);\nexport const MOCK_SIWE_LOGIN_URL = SIWE_LOGIN_URL(Env.PRD);\nexport const MOCK_PAIR_IDENTIFIERS_URL = PAIR_IDENTIFIERS(Env.PRD);\nexport const MOCK_PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL(Env.PRD);\n\nexport const MOCK_JWT =\n  'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';\n\nexport const MOCK_ACCESS_JWT =\n  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';\n\nexport const MOCK_NONCE_RESPONSE = {\n  nonce: 'xGMm9SoihEKeAEfV',\n  identifier: '0xd8641601Cb79a94FD872fE42d5b4a067A44a7e88',\n  expires_in: 300,\n};\n\nexport const MOCK_SIWE_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'fa2bbf82-bd9a-4e6b-aabc-9ca0d0319b6e',\n    metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n    identifier_id:\n      'ec9a4e9906836497efad2fd4d4290b34d2c6a2c0d93eb174aa3cd88a133adbaf',\n    identifier_type: 'SIWE',\n    encrypted_storage_key: '2c6a2c0d93eb174aa3cd88a133adbaf',\n  },\n};\n\nexport const MOCK_SRP_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n    metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n    identifier_id:\n      'da9a9fc7b09edde9cc23cec9b7e11a71fb0ab4d2ddd8af8af905306f3e1456fb',\n    identifier_type: 'SRP',\n    encrypted_storage_key: 'd2ddd8af8af905306f3e1456fb',\n  },\n};\n\nexport const MOCK_OIDC_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  expires_in: 3600,\n};\n\nexport const MOCK_USER_PROFILE_LINEAGE_RESPONSE = {\n  profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n  created_at: '2025-10-01T12:00:00Z',\n  lineage: [\n    {\n      metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n      agent: Platform.MOBILE,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 1,\n    },\n    {\n      metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n      agent: Platform.EXTENSION,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 2,\n    },\n  ],\n};\n"]}

package/dist/sdk/utils/validate-login-response.cjs

@@ -2,11 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateLoginResponse = void 0;
 /**
- * Validates Shape is LoginResponse
- * NOTE - validation is pretty loose, we can improve this by using external libs like Zod for improved/tighter validation
+ * Validates that the input is a well-formed, non-expired LoginResponse.
+ *
+ * Checks structural shape (token + profile objects exist) and verifies
+ * the JWT access token's `exp` claim is still in the future. This acts
+ * as a hard guard against stale cached tokens regardless of client-side
+ * TTL tracking (obtainedAt / expiresIn), which can be corrupted.
  *
  * @param input - unknown/untyped input
- * @returns boolean if input is LoginResponse
+ * @returns boolean if input is a valid, non-expired LoginResponse
  */
 function validateLoginResponse(input) {
     const assumedInput = input;
@@ -16,7 +20,30 @@ function validateLoginResponse(input) {
     if (!assumedInput?.token || !assumedInput?.profile) {
         return false;
     }
+    if (isJwtExpired(assumedInput.token.accessToken)) {
+        return false;
+    }
     return true;
 }
 exports.validateLoginResponse = validateLoginResponse;
+/**
+ * Checks whether a JWT has expired by decoding its `exp` claim.
+ *
+ * @param token - A JWT string.
+ * @returns true if the token is expired or cannot be decoded; false if still valid.
+ */
+function isJwtExpired(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return true;
+        }
+        const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');
+        const { exp } = JSON.parse(atob(base64));
+        return typeof exp !== 'number' || exp * 1000 <= Date.now();
+    }
+    catch {
+        return true;
+    }
+}
 //# sourceMappingURL=validate-login-response.cjs.map

package/dist/sdk/utils/validate-login-response.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"validate-login-response.cjs","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,KAAc;IAClD,MAAM,YAAY,GAAG,KAAsB,CAAC;IAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAZD,sDAYC","sourcesContent":["import type { LoginResponse } from '../authentication';\n\n/**\n * Validates Shape is LoginResponse\n * NOTE - validation is pretty loose, we can improve this by using external libs like Zod for improved/tighter validation\n *\n * @param input - unknown/untyped input\n * @returns boolean if input is LoginResponse\n */\nexport function validateLoginResponse(input: unknown): input is LoginResponse {\n  const assumedInput = input as LoginResponse;\n\n  if (!assumedInput) {\n    return false;\n  }\n\n  if (!assumedInput?.token || !assumedInput?.profile) {\n    return false;\n  }\n\n  return true;\n}\n"]}
+{"version":3,"file":"validate-login-response.cjs","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,KAAc;IAClD,MAAM,YAAY,GAAG,KAAsB,CAAC;IAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAhBD,sDAgBC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { LoginResponse } from '../authentication';\n\n/**\n * Validates that the input is a well-formed, non-expired LoginResponse.\n *\n * Checks structural shape (token + profile objects exist) and verifies\n * the JWT access token's `exp` claim is still in the future. This acts\n * as a hard guard against stale cached tokens regardless of client-side\n * TTL tracking (obtainedAt / expiresIn), which can be corrupted.\n *\n * @param input - unknown/untyped input\n * @returns boolean if input is a valid, non-expired LoginResponse\n */\nexport function validateLoginResponse(input: unknown): input is LoginResponse {\n  const assumedInput = input as LoginResponse;\n\n  if (!assumedInput) {\n    return false;\n  }\n\n  if (!assumedInput?.token || !assumedInput?.profile) {\n    return false;\n  }\n\n  if (isJwtExpired(assumedInput.token.accessToken)) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Checks whether a JWT has expired by decoding its `exp` claim.\n *\n * @param token - A JWT string.\n * @returns true if the token is expired or cannot be decoded; false if still valid.\n */\nfunction isJwtExpired(token: string): boolean {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      return true;\n    }\n    const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');\n    const { exp } = JSON.parse(atob(base64));\n    return typeof exp !== 'number' || exp * 1000 <= Date.now();\n  } catch {\n    return true;\n  }\n}\n"]}

package/dist/sdk/utils/validate-login-response.d.cts

@@ -1,10 +1,14 @@
 import type { LoginResponse } from "../authentication.cjs";
 /**
- * Validates Shape is LoginResponse
- * NOTE - validation is pretty loose, we can improve this by using external libs like Zod for improved/tighter validation
+ * Validates that the input is a well-formed, non-expired LoginResponse.
+ *
+ * Checks structural shape (token + profile objects exist) and verifies
+ * the JWT access token's `exp` claim is still in the future. This acts
+ * as a hard guard against stale cached tokens regardless of client-side
+ * TTL tracking (obtainedAt / expiresIn), which can be corrupted.
  *
  * @param input - unknown/untyped input
- * @returns boolean if input is LoginResponse
+ * @returns boolean if input is a valid, non-expired LoginResponse
  */
 export declare function validateLoginResponse(input: unknown): input is LoginResponse;
 //# sourceMappingURL=validate-login-response.d.cts.map

package/dist/sdk/utils/validate-login-response.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-login-response.d.cts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,8BAA0B;AAEvD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAY5E"}
+{"version":3,"file":"validate-login-response.d.cts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,8BAA0B;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAgB5E"}

package/dist/sdk/utils/validate-login-response.d.mts

@@ -1,10 +1,14 @@
 import type { LoginResponse } from "../authentication.mjs";
 /**
- * Validates Shape is LoginResponse
- * NOTE - validation is pretty loose, we can improve this by using external libs like Zod for improved/tighter validation
+ * Validates that the input is a well-formed, non-expired LoginResponse.
+ *
+ * Checks structural shape (token + profile objects exist) and verifies
+ * the JWT access token's `exp` claim is still in the future. This acts
+ * as a hard guard against stale cached tokens regardless of client-side
+ * TTL tracking (obtainedAt / expiresIn), which can be corrupted.
  *
  * @param input - unknown/untyped input
- * @returns boolean if input is LoginResponse
+ * @returns boolean if input is a valid, non-expired LoginResponse
  */
 export declare function validateLoginResponse(input: unknown): input is LoginResponse;
 //# sourceMappingURL=validate-login-response.d.mts.map

package/dist/sdk/utils/validate-login-response.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-login-response.d.mts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,8BAA0B;AAEvD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAY5E"}
+{"version":3,"file":"validate-login-response.d.mts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,8BAA0B;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAgB5E"}

package/dist/sdk/utils/validate-login-response.mjs

@@ -1,9 +1,13 @@
 /**
- * Validates Shape is LoginResponse
- * NOTE - validation is pretty loose, we can improve this by using external libs like Zod for improved/tighter validation
+ * Validates that the input is a well-formed, non-expired LoginResponse.
+ *
+ * Checks structural shape (token + profile objects exist) and verifies
+ * the JWT access token's `exp` claim is still in the future. This acts
+ * as a hard guard against stale cached tokens regardless of client-side
+ * TTL tracking (obtainedAt / expiresIn), which can be corrupted.
  *
  * @param input - unknown/untyped input
- * @returns boolean if input is LoginResponse
+ * @returns boolean if input is a valid, non-expired LoginResponse
  */
 export function validateLoginResponse(input) {
     const assumedInput = input;
@@ -13,6 +17,29 @@ export function validateLoginResponse(input) {
     if (!assumedInput?.token || !assumedInput?.profile) {
         return false;
     }
+    if (isJwtExpired(assumedInput.token.accessToken)) {
+        return false;
+    }
     return true;
 }
+/**
+ * Checks whether a JWT has expired by decoding its `exp` claim.
+ *
+ * @param token - A JWT string.
+ * @returns true if the token is expired or cannot be decoded; false if still valid.
+ */
+function isJwtExpired(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return true;
+        }
+        const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');
+        const { exp } = JSON.parse(atob(base64));
+        return typeof exp !== 'number' || exp * 1000 <= Date.now();
+    }
+    catch {
+        return true;
+    }
+}
 //# sourceMappingURL=validate-login-response.mjs.map

package/dist/sdk/utils/validate-login-response.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validate-login-response.mjs","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,YAAY,GAAG,KAAsB,CAAC;IAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import type { LoginResponse } from '../authentication';\n\n/**\n * Validates Shape is LoginResponse\n * NOTE - validation is pretty loose, we can improve this by using external libs like Zod for improved/tighter validation\n *\n * @param input - unknown/untyped input\n * @returns boolean if input is LoginResponse\n */\nexport function validateLoginResponse(input: unknown): input is LoginResponse {\n  const assumedInput = input as LoginResponse;\n\n  if (!assumedInput) {\n    return false;\n  }\n\n  if (!assumedInput?.token || !assumedInput?.profile) {\n    return false;\n  }\n\n  return true;\n}\n"]}
+{"version":3,"file":"validate-login-response.mjs","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,YAAY,GAAG,KAAsB,CAAC;IAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { LoginResponse } from '../authentication';\n\n/**\n * Validates that the input is a well-formed, non-expired LoginResponse.\n *\n * Checks structural shape (token + profile objects exist) and verifies\n * the JWT access token's `exp` claim is still in the future. This acts\n * as a hard guard against stale cached tokens regardless of client-side\n * TTL tracking (obtainedAt / expiresIn), which can be corrupted.\n *\n * @param input - unknown/untyped input\n * @returns boolean if input is a valid, non-expired LoginResponse\n */\nexport function validateLoginResponse(input: unknown): input is LoginResponse {\n  const assumedInput = input as LoginResponse;\n\n  if (!assumedInput) {\n    return false;\n  }\n\n  if (!assumedInput?.token || !assumedInput?.profile) {\n    return false;\n  }\n\n  if (isJwtExpired(assumedInput.token.accessToken)) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Checks whether a JWT has expired by decoding its `exp` claim.\n *\n * @param token - A JWT string.\n * @returns true if the token is expired or cannot be decoded; false if still valid.\n */\nfunction isJwtExpired(token: string): boolean {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      return true;\n    }\n    const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');\n    const { exp } = JSON.parse(atob(base64));\n    return typeof exp !== 'number' || exp * 1000 <= Date.now();\n  } catch {\n    return true;\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask-previews/profile-sync-controller",
-  "version": "27.1.0-preview-fb0893ad9",
+  "version": "27.1.0-preview-378ea32e1",
   "description": "The profile sync helps developers synchronize data across multiple clients and devices in a privacy-preserving way. All data saved in the user storage database is encrypted client-side to preserve privacy. The user storage provides a modular design, giving developers the flexibility to construct and manage their storage spaces in a way that best suits their needs",
   "keywords": [
     "MetaMask",