@metamask-previews/profile-sync-controller 28.2.0-preview-1590150f2 → 28.2.0-preview-1f6071cd8

package/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add `AuthenticationController.getCustomerServiceToken` method and messenger action to retrieve a Customer Service specific access token ([#9442](https://github.com/MetaMask/core/pull/9442))
+  - Exchanges the OIDC access token for a short-lived token scoped to the customer-service audience via `POST /api/v2/customer-service/token`, which Customer Service tooling consumes to identify and authenticate the user.
+
 ### Changed
 
 - Bump `@metamask/keyring-controller` from `^27.0.0` to `^27.1.0` ([#9129](https://github.com/MetaMask/core/pull/9129))

package/dist/controllers/authentication/AuthenticationController-method-action-types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerIsSignedInAction;\n"]}
+{"version":3,"file":"AuthenticationController-method-action-types.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.cts

@@ -76,6 +76,21 @@ export type AuthenticationControllerGetUserProfileLineageAction = {
     type: `AuthenticationController:getUserProfileLineage`;
     handler: AuthenticationController['getUserProfileLineage'];
 };
+/**
+ * Returns a Customer Service specific access token for the specified SRP,
+ * logging in if needed.
+ *
+ * Exchanges the OIDC access token for a short-lived token scoped to the
+ * customer-service audience. Customer Service tooling consumes this token to
+ * identify and authenticate the user.
+ *
+ * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+ * @returns The customer-service access token.
+ */
+export type AuthenticationControllerGetCustomerServiceTokenAction = {
+    type: `AuthenticationController:getCustomerServiceToken`;
+    handler: AuthenticationController['getCustomerServiceToken'];
+};
 export type AuthenticationControllerIsSignedInAction = {
     type: `AuthenticationController:isSignedIn`;
     handler: AuthenticationController['isSignedIn'];
@@ -83,5 +98,5 @@ export type AuthenticationControllerIsSignedInAction = {
 /**
  * Union of all AuthenticationController action types.
  */
-export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerIsSignedInAction;
+export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerIsSignedInAction;
 //# sourceMappingURL=AuthenticationController-method-action-types.d.cts.map

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,uCAAmC;AAE3E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,wCAAwC,CAAC"}
+{"version":3,"file":"AuthenticationController-method-action-types.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,uCAAmC;AAE3E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,wCAAwC,CAAC"}

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.mts

@@ -76,6 +76,21 @@ export type AuthenticationControllerGetUserProfileLineageAction = {
     type: `AuthenticationController:getUserProfileLineage`;
     handler: AuthenticationController['getUserProfileLineage'];
 };
+/**
+ * Returns a Customer Service specific access token for the specified SRP,
+ * logging in if needed.
+ *
+ * Exchanges the OIDC access token for a short-lived token scoped to the
+ * customer-service audience. Customer Service tooling consumes this token to
+ * identify and authenticate the user.
+ *
+ * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+ * @returns The customer-service access token.
+ */
+export type AuthenticationControllerGetCustomerServiceTokenAction = {
+    type: `AuthenticationController:getCustomerServiceToken`;
+    handler: AuthenticationController['getCustomerServiceToken'];
+};
 export type AuthenticationControllerIsSignedInAction = {
     type: `AuthenticationController:isSignedIn`;
     handler: AuthenticationController['isSignedIn'];
@@ -83,5 +98,5 @@ export type AuthenticationControllerIsSignedInAction = {
 /**
  * Union of all AuthenticationController action types.
  */
-export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerIsSignedInAction;
+export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerIsSignedInAction;
 //# sourceMappingURL=AuthenticationController-method-action-types.d.mts.map

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,uCAAmC;AAE3E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,wCAAwC,CAAC"}
+{"version":3,"file":"AuthenticationController-method-action-types.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,uCAAmC;AAE3E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,wCAAwC,CAAC"}

package/dist/controllers/authentication/AuthenticationController-method-action-types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerIsSignedInAction;\n"]}
+{"version":3,"file":"AuthenticationController-method-action-types.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}

package/dist/controllers/authentication/AuthenticationController.cjs

@@ -66,6 +66,7 @@ const MESSENGER_EXPOSED_METHODS = [
     'getSessionProfile',
     'refreshCanonicalProfileId',
     'getUserProfileLineage',
+    'getCustomerServiceToken',
     'isSignedIn',
     'requestProfilePairing',
 ];
@@ -245,6 +246,22 @@ class AuthenticationController extends base_controller_1.BaseController {
         const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
     }
+    /**
+     * Returns a Customer Service specific access token for the specified SRP,
+     * logging in if needed.
+     *
+     * Exchanges the OIDC access token for a short-lived token scoped to the
+     * customer-service audience. Customer Service tooling consumes this token to
+     * identify and authenticate the user.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The customer-service access token.
+     */
+    async getCustomerServiceToken(entropySourceId) {
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
+        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
+    }
     isSignedIn() {
         return this.state.isSignedIn;
     }

package/dist/controllers/authentication/AuthenticationController.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,+DAA2D;AAsB3D,6CAKmB;AAEnB,iEAI8B;AAG9B,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAmBrC,QAAA,YAAY,GAAkC;IACzD,UAAU,EAAE,KAAK;IACjB,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AACF,MAAM,QAAQ,GAAiD;IAC7D,UAAU,EAAE;QACV,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,mBAAmB,EAAE;QACnB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,cAAc,EAAE;QACd,sCAAsC;QACtC,kBAAkB,EAAE,CAAC,cAAc,EAAE,EAAE;YACrC,4FAA4F;YAC5F,2FAA2F;YAC3F,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAC1C,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,uBAAuB,EAAE,GACxD,KAAK,CAAC,KAAK,CAAC;gBACd,uBAAuB,CAAC,GAAG,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC,EACD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAMF,MAAM,yBAAyB,GAAG;IAChC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,uBAAuB;IACvB,YAAY;IACZ,uBAAuB;CACf,CAAC;AA8CX;;;GAGG;AACH,MAAa,wBAAyB,SAAQ,gCAI7C;IAiCC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GAUZ;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,oBAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QApDI,wDAA8B;QAE9B,iDAAoB;QAEpB,2CAA4B;YACnC,GAAG,EAAE,SAAG,CAAC,GAAG;SACb,EAAC;QAEF,+CAAc,KAAK,EAAC;QAEpB,yEAAuC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,iDAAiD;QACjD,+DAA8B,CAAC,EAAC;QAEvB,sDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,wCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,wCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,wCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QAyZF,0DAA+D,EAAE,EAAC;QAjYhE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,uBAAA,IAAI,oCAAW;YACb,GAAG,uBAAA,IAAI,wCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QAEF,uBAAA,IAAI,yCAAgB,WAAW,MAAA,CAAC;QAEhC,uBAAA,IAAI,kCAAS,IAAI,mBAAa,CAC5B;YACE,GAAG,EAAE,uBAAA,IAAI,wCAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,WAAW,CAAC,KAAK;YAC3B,IAAI,EAAE,cAAQ,CAAC,GAAG;SACnB,EACD;YACE,OAAO,EAAE;gBACP,gBAAgB,EAAE,uBAAA,IAAI,gGAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,gBAAgB,EAAE,uBAAA,IAAI,8FAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D;YACD,OAAO,EAAE;gBACP,aAAa,EAAE,uBAAA,IAAI,uFAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,WAAW,EAAE,uBAAA,IAAI,sFAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC9C;YACD,WAAW,EAAE,uBAAA,IAAI,6CAAa;SAC/B,CACF,MAAA,CAAC;QAEF,uBAAA,IAAI,mDAAmB,CAAC,6BAA6B,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAgEM,KAAK,CAAC,aAAa;QACxB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,uBAAA,IAAI,4DAA4B,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;QACzD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,mEAAmE;QACnE,oCAAoC;QACpC,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACrE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,sCAAsC;YACtC,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,uBAAA,IAAI,6EAAQ,MAAZ,IAAI,EAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,qBAAqB;QAC1B,6KAAoC,CAAC,MAAA,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAuGM,cAAc;QACnB,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,eAAwB;QAClD,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,gBAAgB,CAAC,CAAC;QACzC,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,iBAAiB,CAC5B,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;QAC5C,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,yBAAyB;QACpC,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,2BAA2B,CAAC,CAAC;QAEpD,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACvE,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,EAAuB,sBAAsB,CAAC,CAAC;QACnD,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAcM,KAAK,CAAC,qBAAqB,CAChC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CAmEF;AA3dD,4DA2dC;skBA1XC,KAAK,8DACH,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC,sDAED,KAAK,4DACH,aAA4B,EAC5B,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6CAAa,CAAC,gBAAgB,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;YACjC,GAAG,aAAa;YAChB,OAAO,EAAE;gBACP,GAAG,aAAa,CAAC,OAAO;gBACxB,aAAa;aACd;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,mGAEiB,UAAkB;IAClC,IAAI,CAAC,uBAAA,IAAI,4CAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,wCAAwC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,wDAED,KAAK;IACH,IAAI,uBAAA,IAAI,8DAA8B,EAAE,CAAC;QACvC,OAAO,uBAAA,IAAI,8DAA8B,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;IAEzD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;IAC/C,OAAO,uBAAA,IAAI,8DAA8B,CAAC;AAC5C,CAAC,yHAoD4B,YAAoB;IAC/C,IAAI,uBAAA,IAAI,4DAA4B,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,2CAAS,YAAsB,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAE9D,MAAM,cAAc,GAAG,MAAM,uBAAA,IAAI,sFAAiB,MAArB,IAAI,EAAkB,YAAY,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAEzD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,YAAY,CAAC;IAC5D,MAAM,4BAA4B,GAChC,gBAAgB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,IAAI,4BAA4B,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC/D,SAAS,EAAE,YAAY;YACvB,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,8CAED,KAAK,oDAAkB,YAAsB;IAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IAC3E,MAAM,EACJ,cAAc,EACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,GAChC,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACvE,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,kBAAkB,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC,uGAEmB,kBAA0B;IAC5C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK;IACH,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACvE,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO;QAC1D,EAAE,kBAAkB,IAAI,IAAI,CAC/B,CAAC;AACJ,CAAC,2GAoFqB,eAAuB;IAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YACnB,iEAAiE;YACjE,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAeD;;;;;;GAMG;AACH,KAAK,qDAAmB,eAAwB;IAC9C,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,IAAA,+CAA0B,EAAC,eAAe,CAAC,CAC5C,CAAW,CAAC;IAEb,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK;IACH,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,IAAA,mDAA8B,GAAE,CACjC,CAAuB,CAAC;IAEzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAID;;;;;;;GAOG;AACH,KAAK,oDACH,OAAe,EACf,eAAwB;IAExB,IAAA,qCAA+B,EAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,kBAAkB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,IAAA,iDAA4B,EAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\nimport type { Json } from '@metamask/utils';\n\nimport type {\n  LoginResponse,\n  ProfileAlias,\n  SRPInterface,\n  UserProfile,\n  UserProfileLineage,\n} from '../../sdk';\nimport {\n  assertMessageStartsWithMetamask,\n  AuthType,\n  Env,\n  JwtBearerAuth,\n} from '../../sdk';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport {\n  createSnapPublicKeyRequest,\n  createSnapAllPublicKeysRequest,\n  createSnapSignMessageRequest,\n} from './auth-snap-requests';\nimport { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types';\n\nconst controllerName = 'AuthenticationController';\n\n// State\nexport type AuthenticationControllerState = {\n  isSignedIn: boolean;\n  srpSessionData?: Record<string, LoginResponse>;\n  /**\n   * Client gate for profile pairing. Defaults to `true` (fresh install /\n   * upgrade), set to `false` after a successful `performSignIn` pair, set\n   * back to `true` via `requestProfilePairing()` when the SRP set changes,\n   * and left `true` on pair failure so the next state shift retries.\n   *\n   * Optional in the type so partial-state selectors stay assignable to\n   * `AuthenticationControllerState`. The controller seeds it via\n   * `defaultState` at construction; consumers should read `undefined` as\n   * `true` to mirror that runtime default.\n   */\n  needsProfilePairing?: boolean;\n};\nexport const defaultState: AuthenticationControllerState = {\n  isSignedIn: false,\n  needsProfilePairing: true,\n};\nconst metadata: StateMetadata<AuthenticationControllerState> = {\n  isSignedIn: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  needsProfilePairing: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  srpSessionData: {\n    // Remove access token from state logs\n    includeInStateLogs: (srpSessionData) => {\n      // Unreachable branch, included just to fix a type error for the case where this property is\n      // unset. The type gets collapsed to include `| undefined` even though `undefined` is never\n      // set here, because we don't yet use `exactOptionalPropertyTypes`.\n      // TODO: Remove branch after enabling `exactOptionalPropertyTypes`\n      // ref: https://github.com/MetaMask/core/issues/6565\n      if (srpSessionData === null || srpSessionData === undefined) {\n        return null;\n      }\n      return Object.entries(srpSessionData).reduce<Record<string, Json>>(\n        (sanitizedSrpSessionData, [key, value]) => {\n          const { accessToken: _unused, ...tokenWithoutAccessToken } =\n            value.token;\n          sanitizedSrpSessionData[key] = {\n            ...value,\n            token: tokenWithoutAccessToken,\n          };\n          return sanitizedSrpSessionData;\n        },\n        {},\n      );\n    },\n    persist: true,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performSignIn',\n  'performSignOut',\n  'getBearerToken',\n  'getSessionProfile',\n  'refreshCanonicalProfileId',\n  'getUserProfileLineage',\n  'isSignedIn',\n  'requestProfilePairing',\n] as const;\n\nexport type Actions =\n  | AuthenticationControllerGetStateAction\n  | AuthenticationControllerMethodActions;\n\nexport type AuthenticationControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  AuthenticationControllerState\n>;\n\nexport type AuthenticationControllerStateChangeEvent =\n  ControllerStateChangeEvent<\n    typeof controllerName,\n    AuthenticationControllerState\n  >;\n\nexport type ProfileSignInInfo = {\n  profileId: string;\n  profileAliases: ProfileAlias[];\n  profileIdChanged: boolean;\n};\n\nexport type AuthenticationControllerProfileSignInEvent = {\n  type: `${typeof controllerName}:profileSignIn`;\n  payload: [ProfileSignInInfo];\n};\n\nexport type Events =\n  | AuthenticationControllerStateChangeEvent\n  | AuthenticationControllerProfileSignInEvent;\n\n// Allowed Actions\ntype AllowedActions =\n  | KeyringControllerGetStateAction\n  | SnapControllerHandleRequestAction;\n\ntype AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;\n\n// Messenger\nexport type AuthenticationControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Controller that enables authentication for restricted endpoints.\n * Used for Backup & Sync, Notifications, and other services.\n */\nexport class AuthenticationController extends BaseController<\n  typeof controllerName,\n  AuthenticationControllerState,\n  AuthenticationControllerMessenger\n> {\n  readonly #metametrics: MetaMetricsAuth;\n\n  readonly #auth: SRPInterface;\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  #isUnlocked = false;\n\n  #cachedPrimaryEntropySourceId?: string;\n\n  // Bumped by `requestProfilePairing`. `performSignIn` snapshots this\n  // before its first await; if it changes mid-flight we must NOT clear\n  // `needsProfilePairing` (the rearm signal wins).\n  #profilePairingRequestEpoch = 0;\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  constructor({\n    messenger,\n    state,\n    config,\n    metametrics,\n  }: {\n    messenger: AuthenticationControllerMessenger;\n    state?: AuthenticationControllerState;\n    config?: Partial<ControllerConfig>;\n    /**\n     * Not using the Messaging System as we\n     * do not want to tie this strictly to extension\n     */\n    metametrics: MetaMetricsAuth;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    if (!metametrics) {\n      throw new Error('`metametrics` field is required');\n    }\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n\n    this.#metametrics = metametrics;\n\n    this.#auth = new JwtBearerAuth(\n      {\n        env: this.#config.env,\n        platform: metametrics.agent,\n        type: AuthType.SRP,\n      },\n      {\n        storage: {\n          getLoginResponse: this.#getLoginResponseFromState.bind(this),\n          setLoginResponse: this.#setLoginResponseToState.bind(this),\n        },\n        signing: {\n          getIdentifier: this.#snapGetPublicKey.bind(this),\n          signMessage: this.#snapSignMessage.bind(this),\n        },\n        metametrics: this.#metametrics,\n      },\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  async #getLoginResponseFromState(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    if (!this.state.srpSessionData?.[resolvedId]) {\n      return null;\n    }\n    return this.state.srpSessionData[resolvedId];\n  }\n\n  async #setLoginResponseToState(\n    loginResponse: LoginResponse,\n    entropySourceId?: string,\n  ) {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    const metaMetricsId = await this.#metametrics.getMetaMetricsId();\n    this.update((state) => {\n      state.isSignedIn = true;\n      if (!state.srpSessionData) {\n        state.srpSessionData = {};\n      }\n      state.srpSessionData[resolvedId] = {\n        ...loginResponse,\n        profile: {\n          ...loginResponse.profile,\n          metaMetricsId,\n        },\n      };\n    });\n  }\n\n  #assertIsUnlocked(methodName: string): void {\n    if (!this.#isUnlocked) {\n      throw new Error(`${methodName} - unable to proceed, wallet is locked`);\n    }\n  }\n\n  async #getPrimaryEntropySourceId(): Promise<string> {\n    if (this.#cachedPrimaryEntropySourceId) {\n      return this.#cachedPrimaryEntropySourceId;\n    }\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n\n    if (allPublicKeys.length === 0) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - No entropy sources found from snap',\n      );\n    }\n\n    const primaryId = allPublicKeys[0][0];\n    if (!primaryId) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - Primary entropy source ID is undefined',\n      );\n    }\n\n    this.#cachedPrimaryEntropySourceId = primaryId;\n    return this.#cachedPrimaryEntropySourceId;\n  }\n\n  public async performSignIn(): Promise<string[]> {\n    this.#assertIsUnlocked('performSignIn');\n\n    const epochAtStart = this.#profilePairingRequestEpoch;\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n    const accessTokens: string[] = [];\n\n    // We iterate sequentially in order to be sure that the first entry\n    // is the primary SRP LoginResponse.\n    for (const [entropySourceId] of allPublicKeys) {\n      const accessToken = await this.#auth.getAccessToken(entropySourceId);\n      accessTokens.push(accessToken);\n    }\n\n    if (allPublicKeys.length < 2) {\n      // Single-SRP wallet: nothing to pair.\n      this.#tryClearNeedsProfilePairing(epochAtStart);\n    } else {\n      // Pair failures must not break sign-in; the gate stays `true` for retry.\n      try {\n        await this.#doPair(accessTokens, epochAtStart);\n      } catch {\n        // noop\n      }\n    }\n\n    return accessTokens;\n  }\n\n  /**\n   * Marks profile pairing as needed. Clients call this when the SRP set\n   * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n   * re-runs `performSignIn` and re-pairs.\n   */\n  public requestProfilePairing(): void {\n    this.#profilePairingRequestEpoch += 1;\n    if (!this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = true;\n      });\n    }\n  }\n\n  /**\n   * Clears `needsProfilePairing` only if no `requestProfilePairing` call\n   * landed since `epochAtStart` was captured. Prevents `performSignIn`\n   * from silently overwriting a concurrent rearm.\n   *\n   * @param epochAtStart - Epoch value captured at the start of `performSignIn`.\n   */\n  #tryClearNeedsProfilePairing(epochAtStart: number): void {\n    if (this.#profilePairingRequestEpoch !== epochAtStart) {\n      return;\n    }\n    if (this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = false;\n      });\n    }\n  }\n\n  /**\n   * Pairs all SRPs via `POST /profile/pair`, propagates the canonical\n   * profile ID, clears `needsProfilePairing`, and emits\n   * `AuthenticationController:profileSignIn` when the canonical changes or\n   * new aliases are returned. Throws on failure.\n   *\n   * @param accessTokens - Per-SRP access tokens, primary first.\n   * @param epochAtStart - Pairing-request epoch captured by the caller.\n   * Used to skip the gate clear if `requestProfilePairing` ran while the\n   * pair API call was in-flight.\n   */\n  async #doPair(accessTokens: string[], epochAtStart: number): Promise<void> {\n    const previousCanonical = await this.#getCanonicalProfileId();\n\n    const profileAliases = await this.#pairSrpProfiles(accessTokens);\n    const newCanonical = await this.#getCanonicalProfileId();\n\n    // If somehow we cannot compute the new canonical profile ID after pairing,\n    // we just return now and do not update the `needsProfilePairing` flag.\n    if (!newCanonical) {\n      return;\n    }\n\n    this.#tryClearNeedsProfilePairing(epochAtStart);\n\n    const profileIdChanged = previousCanonical !== newCanonical;\n    const shouldEmitProfileSignInEvent =\n      profileIdChanged || profileAliases.length > 0;\n\n    if (shouldEmitProfileSignInEvent) {\n      this.messenger.publish('AuthenticationController:profileSignIn', {\n        profileId: newCanonical,\n        profileAliases,\n        profileIdChanged,\n      });\n    }\n  }\n\n  async #pairSrpProfiles(accessTokens: string[]): Promise<ProfileAlias[]> {\n    if (accessTokens.length < 2) {\n      return [];\n    }\n    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.\n    const {\n      profileAliases,\n      profile: { canonicalProfileId },\n    } = await this.#auth.pairSrpProfiles(accessTokens, primaryAccessToken);\n    this.#propagateCanonical(canonicalProfileId);\n    return profileAliases;\n  }\n\n  #propagateCanonical(canonicalProfileId: string): void {\n    const { srpSessionData } = this.state;\n    if (!srpSessionData) {\n      return;\n    }\n\n    this.update((state) => {\n      for (const entry of Object.values(state.srpSessionData ?? {})) {\n        if (entry?.profile) {\n          entry.profile.canonicalProfileId = canonicalProfileId;\n        }\n      }\n    });\n  }\n\n  /**\n   * Returns the canonical profile id from the primary SRP's cached session.\n   * Returns `null` when no session exists yet for the primary SRP.\n   *\n   * Always reads from the primary SRP because the canonical is shared across\n   * all paired SRPs after `#propagateCanonical`.\n   *\n   * @returns The canonical profile id, or `null` if unavailable.\n   */\n  async #getCanonicalProfileId(): Promise<string | null> {\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    return (\n      this.state.srpSessionData?.[primaryEntropySourceId]?.profile\n        ?.canonicalProfileId ?? null\n    );\n  }\n\n  public performSignOut(): void {\n    this.#cachedPrimaryEntropySourceId = undefined;\n    this.update((state) => {\n      state.isSignedIn = false;\n      state.srpSessionData = undefined;\n    });\n  }\n\n  /**\n   * Returns a bearer token for the specified SRP, logging in if needed.\n   *\n   * When called without `entropySourceId`, returns the primary (first) SRP's\n   * access token, which is effectively the canonical\n   * profile's token that can be used by alias-aware consumers for cross-SRP\n   * operations.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The OIDC access token.\n   */\n  public async getBearerToken(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('getBearerToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getAccessToken(resolvedId);\n  }\n\n  /**\n   * Returns the cached session profile, logging in if no session exists.\n   *\n   * The returned `canonicalProfileId` reflects the value from the most recent\n   * login or pairing. In the rare event where a canonical changed because of\n   * a pairing that happened on another device, the cached value may be stale\n   * until the next login. For guaranteed freshness, call\n   * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns profile for the session.\n   */\n  public async getSessionProfile(\n    entropySourceId?: string,\n  ): Promise<UserProfile> {\n    this.#assertIsUnlocked('getSessionProfile');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfile(resolvedId);\n  }\n\n  /**\n   * Forces a fresh retrieval of the canonical profile ID from the server\n   * and propagates it to all cached SRP sessions.\n   *\n   * This method invalidates the primary SRP's cached session and forces a\n   * re-login. Use it before operations that require a guaranteed-fresh\n   * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n   * best-effort reads, use\n   * `getSessionProfile().canonicalProfileId` instead.\n   *\n   * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n   * the server returns the current canonical for the entire pairing group\n   * from any single SRP login.\n   *\n   * @returns The refreshed canonical profile ID.\n   */\n  public async refreshCanonicalProfileId(): Promise<string> {\n    this.#assertIsUnlocked('refreshCanonicalProfileId');\n\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    this.#invalidateSrpSession(primaryEntropySourceId);\n    await this.#auth.getAccessToken(primaryEntropySourceId);\n\n    const canonical = await this.#getCanonicalProfileId();\n    if (!canonical) {\n      throw new Error(\n        'refreshCanonicalProfileId - Unable to resolve canonical profile ID',\n      );\n    }\n\n    this.#propagateCanonical(canonical);\n    return canonical;\n  }\n\n  #invalidateSrpSession(entropySourceId: string): void {\n    this.update((state) => {\n      const entry = state.srpSessionData?.[entropySourceId];\n      if (entry?.profile) {\n        // Setting canonicalProfileId to '' forces a re-fetch on the next\n        // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)\n        // treats '' the same as undefined/null — all signal an invalid session.\n        entry.profile.canonicalProfileId = '';\n      }\n    });\n  }\n\n  public async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    this.#assertIsUnlocked('getUserProfileLineage');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfileLineage(resolvedId);\n  }\n\n  public isSignedIn(): boolean {\n    return this.state.isSignedIn;\n  }\n\n  /**\n   * Returns the auth snap public key.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns The snap public key.\n   */\n  async #snapGetPublicKey(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('#snapGetPublicKey');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapPublicKeyRequest(entropySourceId),\n    )) as string;\n\n    return result;\n  }\n\n  /**\n   * Returns a mapping of entropy source IDs to auth snap public keys.\n   *\n   * @returns A mapping of entropy source IDs to public keys.\n   */\n  async #snapGetAllPublicKeys(): Promise<[string, string][]> {\n    this.#assertIsUnlocked('#snapGetAllPublicKeys');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapAllPublicKeysRequest(),\n    )) as [string, string][];\n\n    return result;\n  }\n\n  #_snapSignMessageCache: Record<`metamask:${string}`, string> = {};\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    assertMessageStartsWithMetamask(message);\n\n    if (this.#_snapSignMessageCache[message]) {\n      return this.#_snapSignMessageCache[message];\n    }\n\n    this.#assertIsUnlocked('#snapSignMessage');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#_snapSignMessageCache[message] = result;\n\n    return result;\n  }\n}\n"]}
+{"version":3,"file":"AuthenticationController.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,+DAA2D;AAsB3D,6CAKmB;AAEnB,iEAI8B;AAG9B,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAmBrC,QAAA,YAAY,GAAkC;IACzD,UAAU,EAAE,KAAK;IACjB,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AACF,MAAM,QAAQ,GAAiD;IAC7D,UAAU,EAAE;QACV,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,mBAAmB,EAAE;QACnB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,cAAc,EAAE;QACd,sCAAsC;QACtC,kBAAkB,EAAE,CAAC,cAAc,EAAE,EAAE;YACrC,4FAA4F;YAC5F,2FAA2F;YAC3F,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAC1C,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,uBAAuB,EAAE,GACxD,KAAK,CAAC,KAAK,CAAC;gBACd,uBAAuB,CAAC,GAAG,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC,EACD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAMF,MAAM,yBAAyB,GAAG;IAChC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,YAAY;IACZ,uBAAuB;CACf,CAAC;AA8CX;;;GAGG;AACH,MAAa,wBAAyB,SAAQ,gCAI7C;IAiCC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GAUZ;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,oBAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QApDI,wDAA8B;QAE9B,iDAAoB;QAEpB,2CAA4B;YACnC,GAAG,EAAE,SAAG,CAAC,GAAG;SACb,EAAC;QAEF,+CAAc,KAAK,EAAC;QAEpB,yEAAuC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,iDAAiD;QACjD,+DAA8B,CAAC,EAAC;QAEvB,sDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,wCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,wCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,wCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QA6aF,0DAA+D,EAAE,EAAC;QArZhE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,uBAAA,IAAI,oCAAW;YACb,GAAG,uBAAA,IAAI,wCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QAEF,uBAAA,IAAI,yCAAgB,WAAW,MAAA,CAAC;QAEhC,uBAAA,IAAI,kCAAS,IAAI,mBAAa,CAC5B;YACE,GAAG,EAAE,uBAAA,IAAI,wCAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,WAAW,CAAC,KAAK;YAC3B,IAAI,EAAE,cAAQ,CAAC,GAAG;SACnB,EACD;YACE,OAAO,EAAE;gBACP,gBAAgB,EAAE,uBAAA,IAAI,gGAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,gBAAgB,EAAE,uBAAA,IAAI,8FAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D;YACD,OAAO,EAAE;gBACP,aAAa,EAAE,uBAAA,IAAI,uFAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,WAAW,EAAE,uBAAA,IAAI,sFAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC9C;YACD,WAAW,EAAE,uBAAA,IAAI,6CAAa;SAC/B,CACF,MAAA,CAAC;QAEF,uBAAA,IAAI,mDAAmB,CAAC,6BAA6B,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAgEM,KAAK,CAAC,aAAa;QACxB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,uBAAA,IAAI,4DAA4B,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;QACzD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,mEAAmE;QACnE,oCAAoC;QACpC,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACrE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,sCAAsC;YACtC,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,uBAAA,IAAI,6EAAQ,MAAZ,IAAI,EAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,qBAAqB;QAC1B,6KAAoC,CAAC,MAAA,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAuGM,cAAc;QACnB,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,eAAwB;QAClD,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,gBAAgB,CAAC,CAAC;QACzC,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,iBAAiB,CAC5B,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;QAC5C,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,yBAAyB;QACpC,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,2BAA2B,CAAC,CAAC;QAEpD,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACvE,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,EAAuB,sBAAsB,CAAC,CAAC;QACnD,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAcM,KAAK,CAAC,qBAAqB,CAChC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAClC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,yBAAyB,CAAC,CAAC;QAClD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CAmEF;AA/eD,4DA+eC;skBA9YC,KAAK,8DACH,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC,sDAED,KAAK,4DACH,aAA4B,EAC5B,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6CAAa,CAAC,gBAAgB,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;YACjC,GAAG,aAAa;YAChB,OAAO,EAAE;gBACP,GAAG,aAAa,CAAC,OAAO;gBACxB,aAAa;aACd;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,mGAEiB,UAAkB;IAClC,IAAI,CAAC,uBAAA,IAAI,4CAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,wCAAwC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,wDAED,KAAK;IACH,IAAI,uBAAA,IAAI,8DAA8B,EAAE,CAAC;QACvC,OAAO,uBAAA,IAAI,8DAA8B,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;IAEzD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;IAC/C,OAAO,uBAAA,IAAI,8DAA8B,CAAC;AAC5C,CAAC,yHAoD4B,YAAoB;IAC/C,IAAI,uBAAA,IAAI,4DAA4B,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,2CAAS,YAAsB,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAE9D,MAAM,cAAc,GAAG,MAAM,uBAAA,IAAI,sFAAiB,MAArB,IAAI,EAAkB,YAAY,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAEzD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,YAAY,CAAC;IAC5D,MAAM,4BAA4B,GAChC,gBAAgB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,IAAI,4BAA4B,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC/D,SAAS,EAAE,YAAY;YACvB,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,8CAED,KAAK,oDAAkB,YAAsB;IAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IAC3E,MAAM,EACJ,cAAc,EACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,GAChC,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACvE,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,kBAAkB,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC,uGAEmB,kBAA0B;IAC5C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK;IACH,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACvE,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO;QAC1D,EAAE,kBAAkB,IAAI,IAAI,CAC/B,CAAC;AACJ,CAAC,2GAoFqB,eAAuB;IAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YACnB,iEAAiE;YACjE,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAmCD;;;;;;GAMG;AACH,KAAK,qDAAmB,eAAwB;IAC9C,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,IAAA,+CAA0B,EAAC,eAAe,CAAC,CAC5C,CAAW,CAAC;IAEb,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK;IACH,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,IAAA,mDAA8B,GAAE,CACjC,CAAuB,CAAC;IAEzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAID;;;;;;;GAOG;AACH,KAAK,oDACH,OAAe,EACf,eAAwB;IAExB,IAAA,qCAA+B,EAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,kBAAkB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,IAAA,iDAA4B,EAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\nimport type { Json } from '@metamask/utils';\n\nimport type {\n  LoginResponse,\n  ProfileAlias,\n  SRPInterface,\n  UserProfile,\n  UserProfileLineage,\n} from '../../sdk';\nimport {\n  assertMessageStartsWithMetamask,\n  AuthType,\n  Env,\n  JwtBearerAuth,\n} from '../../sdk';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport {\n  createSnapPublicKeyRequest,\n  createSnapAllPublicKeysRequest,\n  createSnapSignMessageRequest,\n} from './auth-snap-requests';\nimport { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types';\n\nconst controllerName = 'AuthenticationController';\n\n// State\nexport type AuthenticationControllerState = {\n  isSignedIn: boolean;\n  srpSessionData?: Record<string, LoginResponse>;\n  /**\n   * Client gate for profile pairing. Defaults to `true` (fresh install /\n   * upgrade), set to `false` after a successful `performSignIn` pair, set\n   * back to `true` via `requestProfilePairing()` when the SRP set changes,\n   * and left `true` on pair failure so the next state shift retries.\n   *\n   * Optional in the type so partial-state selectors stay assignable to\n   * `AuthenticationControllerState`. The controller seeds it via\n   * `defaultState` at construction; consumers should read `undefined` as\n   * `true` to mirror that runtime default.\n   */\n  needsProfilePairing?: boolean;\n};\nexport const defaultState: AuthenticationControllerState = {\n  isSignedIn: false,\n  needsProfilePairing: true,\n};\nconst metadata: StateMetadata<AuthenticationControllerState> = {\n  isSignedIn: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  needsProfilePairing: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  srpSessionData: {\n    // Remove access token from state logs\n    includeInStateLogs: (srpSessionData) => {\n      // Unreachable branch, included just to fix a type error for the case where this property is\n      // unset. The type gets collapsed to include `| undefined` even though `undefined` is never\n      // set here, because we don't yet use `exactOptionalPropertyTypes`.\n      // TODO: Remove branch after enabling `exactOptionalPropertyTypes`\n      // ref: https://github.com/MetaMask/core/issues/6565\n      if (srpSessionData === null || srpSessionData === undefined) {\n        return null;\n      }\n      return Object.entries(srpSessionData).reduce<Record<string, Json>>(\n        (sanitizedSrpSessionData, [key, value]) => {\n          const { accessToken: _unused, ...tokenWithoutAccessToken } =\n            value.token;\n          sanitizedSrpSessionData[key] = {\n            ...value,\n            token: tokenWithoutAccessToken,\n          };\n          return sanitizedSrpSessionData;\n        },\n        {},\n      );\n    },\n    persist: true,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performSignIn',\n  'performSignOut',\n  'getBearerToken',\n  'getSessionProfile',\n  'refreshCanonicalProfileId',\n  'getUserProfileLineage',\n  'getCustomerServiceToken',\n  'isSignedIn',\n  'requestProfilePairing',\n] as const;\n\nexport type Actions =\n  | AuthenticationControllerGetStateAction\n  | AuthenticationControllerMethodActions;\n\nexport type AuthenticationControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  AuthenticationControllerState\n>;\n\nexport type AuthenticationControllerStateChangeEvent =\n  ControllerStateChangeEvent<\n    typeof controllerName,\n    AuthenticationControllerState\n  >;\n\nexport type ProfileSignInInfo = {\n  profileId: string;\n  profileAliases: ProfileAlias[];\n  profileIdChanged: boolean;\n};\n\nexport type AuthenticationControllerProfileSignInEvent = {\n  type: `${typeof controllerName}:profileSignIn`;\n  payload: [ProfileSignInInfo];\n};\n\nexport type Events =\n  | AuthenticationControllerStateChangeEvent\n  | AuthenticationControllerProfileSignInEvent;\n\n// Allowed Actions\ntype AllowedActions =\n  | KeyringControllerGetStateAction\n  | SnapControllerHandleRequestAction;\n\ntype AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;\n\n// Messenger\nexport type AuthenticationControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Controller that enables authentication for restricted endpoints.\n * Used for Backup & Sync, Notifications, and other services.\n */\nexport class AuthenticationController extends BaseController<\n  typeof controllerName,\n  AuthenticationControllerState,\n  AuthenticationControllerMessenger\n> {\n  readonly #metametrics: MetaMetricsAuth;\n\n  readonly #auth: SRPInterface;\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  #isUnlocked = false;\n\n  #cachedPrimaryEntropySourceId?: string;\n\n  // Bumped by `requestProfilePairing`. `performSignIn` snapshots this\n  // before its first await; if it changes mid-flight we must NOT clear\n  // `needsProfilePairing` (the rearm signal wins).\n  #profilePairingRequestEpoch = 0;\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  constructor({\n    messenger,\n    state,\n    config,\n    metametrics,\n  }: {\n    messenger: AuthenticationControllerMessenger;\n    state?: AuthenticationControllerState;\n    config?: Partial<ControllerConfig>;\n    /**\n     * Not using the Messaging System as we\n     * do not want to tie this strictly to extension\n     */\n    metametrics: MetaMetricsAuth;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    if (!metametrics) {\n      throw new Error('`metametrics` field is required');\n    }\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n\n    this.#metametrics = metametrics;\n\n    this.#auth = new JwtBearerAuth(\n      {\n        env: this.#config.env,\n        platform: metametrics.agent,\n        type: AuthType.SRP,\n      },\n      {\n        storage: {\n          getLoginResponse: this.#getLoginResponseFromState.bind(this),\n          setLoginResponse: this.#setLoginResponseToState.bind(this),\n        },\n        signing: {\n          getIdentifier: this.#snapGetPublicKey.bind(this),\n          signMessage: this.#snapSignMessage.bind(this),\n        },\n        metametrics: this.#metametrics,\n      },\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  async #getLoginResponseFromState(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    if (!this.state.srpSessionData?.[resolvedId]) {\n      return null;\n    }\n    return this.state.srpSessionData[resolvedId];\n  }\n\n  async #setLoginResponseToState(\n    loginResponse: LoginResponse,\n    entropySourceId?: string,\n  ) {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    const metaMetricsId = await this.#metametrics.getMetaMetricsId();\n    this.update((state) => {\n      state.isSignedIn = true;\n      if (!state.srpSessionData) {\n        state.srpSessionData = {};\n      }\n      state.srpSessionData[resolvedId] = {\n        ...loginResponse,\n        profile: {\n          ...loginResponse.profile,\n          metaMetricsId,\n        },\n      };\n    });\n  }\n\n  #assertIsUnlocked(methodName: string): void {\n    if (!this.#isUnlocked) {\n      throw new Error(`${methodName} - unable to proceed, wallet is locked`);\n    }\n  }\n\n  async #getPrimaryEntropySourceId(): Promise<string> {\n    if (this.#cachedPrimaryEntropySourceId) {\n      return this.#cachedPrimaryEntropySourceId;\n    }\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n\n    if (allPublicKeys.length === 0) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - No entropy sources found from snap',\n      );\n    }\n\n    const primaryId = allPublicKeys[0][0];\n    if (!primaryId) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - Primary entropy source ID is undefined',\n      );\n    }\n\n    this.#cachedPrimaryEntropySourceId = primaryId;\n    return this.#cachedPrimaryEntropySourceId;\n  }\n\n  public async performSignIn(): Promise<string[]> {\n    this.#assertIsUnlocked('performSignIn');\n\n    const epochAtStart = this.#profilePairingRequestEpoch;\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n    const accessTokens: string[] = [];\n\n    // We iterate sequentially in order to be sure that the first entry\n    // is the primary SRP LoginResponse.\n    for (const [entropySourceId] of allPublicKeys) {\n      const accessToken = await this.#auth.getAccessToken(entropySourceId);\n      accessTokens.push(accessToken);\n    }\n\n    if (allPublicKeys.length < 2) {\n      // Single-SRP wallet: nothing to pair.\n      this.#tryClearNeedsProfilePairing(epochAtStart);\n    } else {\n      // Pair failures must not break sign-in; the gate stays `true` for retry.\n      try {\n        await this.#doPair(accessTokens, epochAtStart);\n      } catch {\n        // noop\n      }\n    }\n\n    return accessTokens;\n  }\n\n  /**\n   * Marks profile pairing as needed. Clients call this when the SRP set\n   * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n   * re-runs `performSignIn` and re-pairs.\n   */\n  public requestProfilePairing(): void {\n    this.#profilePairingRequestEpoch += 1;\n    if (!this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = true;\n      });\n    }\n  }\n\n  /**\n   * Clears `needsProfilePairing` only if no `requestProfilePairing` call\n   * landed since `epochAtStart` was captured. Prevents `performSignIn`\n   * from silently overwriting a concurrent rearm.\n   *\n   * @param epochAtStart - Epoch value captured at the start of `performSignIn`.\n   */\n  #tryClearNeedsProfilePairing(epochAtStart: number): void {\n    if (this.#profilePairingRequestEpoch !== epochAtStart) {\n      return;\n    }\n    if (this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = false;\n      });\n    }\n  }\n\n  /**\n   * Pairs all SRPs via `POST /profile/pair`, propagates the canonical\n   * profile ID, clears `needsProfilePairing`, and emits\n   * `AuthenticationController:profileSignIn` when the canonical changes or\n   * new aliases are returned. Throws on failure.\n   *\n   * @param accessTokens - Per-SRP access tokens, primary first.\n   * @param epochAtStart - Pairing-request epoch captured by the caller.\n   * Used to skip the gate clear if `requestProfilePairing` ran while the\n   * pair API call was in-flight.\n   */\n  async #doPair(accessTokens: string[], epochAtStart: number): Promise<void> {\n    const previousCanonical = await this.#getCanonicalProfileId();\n\n    const profileAliases = await this.#pairSrpProfiles(accessTokens);\n    const newCanonical = await this.#getCanonicalProfileId();\n\n    // If somehow we cannot compute the new canonical profile ID after pairing,\n    // we just return now and do not update the `needsProfilePairing` flag.\n    if (!newCanonical) {\n      return;\n    }\n\n    this.#tryClearNeedsProfilePairing(epochAtStart);\n\n    const profileIdChanged = previousCanonical !== newCanonical;\n    const shouldEmitProfileSignInEvent =\n      profileIdChanged || profileAliases.length > 0;\n\n    if (shouldEmitProfileSignInEvent) {\n      this.messenger.publish('AuthenticationController:profileSignIn', {\n        profileId: newCanonical,\n        profileAliases,\n        profileIdChanged,\n      });\n    }\n  }\n\n  async #pairSrpProfiles(accessTokens: string[]): Promise<ProfileAlias[]> {\n    if (accessTokens.length < 2) {\n      return [];\n    }\n    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.\n    const {\n      profileAliases,\n      profile: { canonicalProfileId },\n    } = await this.#auth.pairSrpProfiles(accessTokens, primaryAccessToken);\n    this.#propagateCanonical(canonicalProfileId);\n    return profileAliases;\n  }\n\n  #propagateCanonical(canonicalProfileId: string): void {\n    const { srpSessionData } = this.state;\n    if (!srpSessionData) {\n      return;\n    }\n\n    this.update((state) => {\n      for (const entry of Object.values(state.srpSessionData ?? {})) {\n        if (entry?.profile) {\n          entry.profile.canonicalProfileId = canonicalProfileId;\n        }\n      }\n    });\n  }\n\n  /**\n   * Returns the canonical profile id from the primary SRP's cached session.\n   * Returns `null` when no session exists yet for the primary SRP.\n   *\n   * Always reads from the primary SRP because the canonical is shared across\n   * all paired SRPs after `#propagateCanonical`.\n   *\n   * @returns The canonical profile id, or `null` if unavailable.\n   */\n  async #getCanonicalProfileId(): Promise<string | null> {\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    return (\n      this.state.srpSessionData?.[primaryEntropySourceId]?.profile\n        ?.canonicalProfileId ?? null\n    );\n  }\n\n  public performSignOut(): void {\n    this.#cachedPrimaryEntropySourceId = undefined;\n    this.update((state) => {\n      state.isSignedIn = false;\n      state.srpSessionData = undefined;\n    });\n  }\n\n  /**\n   * Returns a bearer token for the specified SRP, logging in if needed.\n   *\n   * When called without `entropySourceId`, returns the primary (first) SRP's\n   * access token, which is effectively the canonical\n   * profile's token that can be used by alias-aware consumers for cross-SRP\n   * operations.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The OIDC access token.\n   */\n  public async getBearerToken(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('getBearerToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getAccessToken(resolvedId);\n  }\n\n  /**\n   * Returns the cached session profile, logging in if no session exists.\n   *\n   * The returned `canonicalProfileId` reflects the value from the most recent\n   * login or pairing. In the rare event where a canonical changed because of\n   * a pairing that happened on another device, the cached value may be stale\n   * until the next login. For guaranteed freshness, call\n   * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns profile for the session.\n   */\n  public async getSessionProfile(\n    entropySourceId?: string,\n  ): Promise<UserProfile> {\n    this.#assertIsUnlocked('getSessionProfile');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfile(resolvedId);\n  }\n\n  /**\n   * Forces a fresh retrieval of the canonical profile ID from the server\n   * and propagates it to all cached SRP sessions.\n   *\n   * This method invalidates the primary SRP's cached session and forces a\n   * re-login. Use it before operations that require a guaranteed-fresh\n   * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n   * best-effort reads, use\n   * `getSessionProfile().canonicalProfileId` instead.\n   *\n   * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n   * the server returns the current canonical for the entire pairing group\n   * from any single SRP login.\n   *\n   * @returns The refreshed canonical profile ID.\n   */\n  public async refreshCanonicalProfileId(): Promise<string> {\n    this.#assertIsUnlocked('refreshCanonicalProfileId');\n\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    this.#invalidateSrpSession(primaryEntropySourceId);\n    await this.#auth.getAccessToken(primaryEntropySourceId);\n\n    const canonical = await this.#getCanonicalProfileId();\n    if (!canonical) {\n      throw new Error(\n        'refreshCanonicalProfileId - Unable to resolve canonical profile ID',\n      );\n    }\n\n    this.#propagateCanonical(canonical);\n    return canonical;\n  }\n\n  #invalidateSrpSession(entropySourceId: string): void {\n    this.update((state) => {\n      const entry = state.srpSessionData?.[entropySourceId];\n      if (entry?.profile) {\n        // Setting canonicalProfileId to '' forces a re-fetch on the next\n        // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)\n        // treats '' the same as undefined/null — all signal an invalid session.\n        entry.profile.canonicalProfileId = '';\n      }\n    });\n  }\n\n  public async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    this.#assertIsUnlocked('getUserProfileLineage');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfileLineage(resolvedId);\n  }\n\n  /**\n   * Returns a Customer Service specific access token for the specified SRP,\n   * logging in if needed.\n   *\n   * Exchanges the OIDC access token for a short-lived token scoped to the\n   * customer-service audience. Customer Service tooling consumes this token to\n   * identify and authenticate the user.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The customer-service access token.\n   */\n  public async getCustomerServiceToken(\n    entropySourceId?: string,\n  ): Promise<string> {\n    this.#assertIsUnlocked('getCustomerServiceToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getCustomerServiceToken(resolvedId);\n  }\n\n  public isSignedIn(): boolean {\n    return this.state.isSignedIn;\n  }\n\n  /**\n   * Returns the auth snap public key.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns The snap public key.\n   */\n  async #snapGetPublicKey(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('#snapGetPublicKey');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapPublicKeyRequest(entropySourceId),\n    )) as string;\n\n    return result;\n  }\n\n  /**\n   * Returns a mapping of entropy source IDs to auth snap public keys.\n   *\n   * @returns A mapping of entropy source IDs to public keys.\n   */\n  async #snapGetAllPublicKeys(): Promise<[string, string][]> {\n    this.#assertIsUnlocked('#snapGetAllPublicKeys');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapAllPublicKeysRequest(),\n    )) as [string, string][];\n\n    return result;\n  }\n\n  #_snapSignMessageCache: Record<`metamask:${string}`, string> = {};\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    assertMessageStartsWithMetamask(message);\n\n    if (this.#_snapSignMessageCache[message]) {\n      return this.#_snapSignMessageCache[message];\n    }\n\n    this.#assertIsUnlocked('#snapSignMessage');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#_snapSignMessageCache[message] = result;\n\n    return result;\n  }\n}\n"]}

package/dist/controllers/authentication/AuthenticationController.d.cts

@@ -112,6 +112,18 @@ export declare class AuthenticationController extends BaseController<typeof cont
      */
     refreshCanonicalProfileId(): Promise<string>;
     getUserProfileLineage(entropySourceId?: string): Promise<UserProfileLineage>;
+    /**
+     * Returns a Customer Service specific access token for the specified SRP,
+     * logging in if needed.
+     *
+     * Exchanges the OIDC access token for a short-lived token scoped to the
+     * customer-service audience. Customer Service tooling consumes this token to
+     * identify and authenticate the user.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The customer-service access token.
+     */
+    getCustomerServiceToken(entropySourceId?: string): Promise<string>;
     isSignedIn(): boolean;
 }
 export {};

package/dist/controllers/authentication/AuthenticationController.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC7B,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EAAE,iCAAiC,EAAE,oCAAoC;AAGrF,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EAEZ,WAAW,EACX,kBAAkB,EACnB,4BAAkB;AACnB,OAAO,EAGL,GAAG,EAEJ,4BAAkB;AACnB,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAMnE,OAAO,EAAE,qCAAqC,EAAE,2DAAuD;AAEvG,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAG1B,CAAC;AA4CF,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAaF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,iCAAiC,CAAC;AAEtC,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;gBAiCa,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;KAC9B;IA4GY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA6B/C;;;;OAIG;IACI,qBAAqB,IAAI,IAAI;IA8G7B,cAAc,IAAI,IAAI;IAQ7B;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtE;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC;IAOvB;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC;IA8B5C,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAOvB,UAAU,IAAI,OAAO;CAqE7B"}
+{"version":3,"file":"AuthenticationController.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC7B,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EAAE,iCAAiC,EAAE,oCAAoC;AAGrF,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EAEZ,WAAW,EACX,kBAAkB,EACnB,4BAAkB;AACnB,OAAO,EAGL,GAAG,EAEJ,4BAAkB;AACnB,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAMnE,OAAO,EAAE,qCAAqC,EAAE,2DAAuD;AAEvG,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAG1B,CAAC;AA4CF,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAcF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,iCAAiC,CAAC;AAEtC,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;gBAiCa,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;KAC9B;IA4GY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA6B/C;;;;OAIG;IACI,qBAAqB,IAAI,IAAI;IA8G7B,cAAc,IAAI,IAAI;IAQ7B;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtE;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC;IAOvB;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC;IA8B5C,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAO9B;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAOX,UAAU,IAAI,OAAO;CAqE7B"}

package/dist/controllers/authentication/AuthenticationController.d.mts

@@ -112,6 +112,18 @@ export declare class AuthenticationController extends BaseController<typeof cont
      */
     refreshCanonicalProfileId(): Promise<string>;
     getUserProfileLineage(entropySourceId?: string): Promise<UserProfileLineage>;
+    /**
+     * Returns a Customer Service specific access token for the specified SRP,
+     * logging in if needed.
+     *
+     * Exchanges the OIDC access token for a short-lived token scoped to the
+     * customer-service audience. Customer Service tooling consumes this token to
+     * identify and authenticate the user.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The customer-service access token.
+     */
+    getCustomerServiceToken(entropySourceId?: string): Promise<string>;
     isSignedIn(): boolean;
 }
 export {};

package/dist/controllers/authentication/AuthenticationController.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC7B,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EAAE,iCAAiC,EAAE,oCAAoC;AAGrF,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EAEZ,WAAW,EACX,kBAAkB,EACnB,4BAAkB;AACnB,OAAO,EAGL,GAAG,EAEJ,4BAAkB;AACnB,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAMnE,OAAO,EAAE,qCAAqC,EAAE,2DAAuD;AAEvG,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAG1B,CAAC;AA4CF,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAaF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,iCAAiC,CAAC;AAEtC,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;gBAiCa,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;KAC9B;IA4GY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA6B/C;;;;OAIG;IACI,qBAAqB,IAAI,IAAI;IA8G7B,cAAc,IAAI,IAAI;IAQ7B;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtE;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC;IAOvB;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC;IA8B5C,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAOvB,UAAU,IAAI,OAAO;CAqE7B"}
+{"version":3,"file":"AuthenticationController.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC7B,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EAAE,iCAAiC,EAAE,oCAAoC;AAGrF,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EAEZ,WAAW,EACX,kBAAkB,EACnB,4BAAkB;AACnB,OAAO,EAGL,GAAG,EAEJ,4BAAkB;AACnB,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAMnE,OAAO,EAAE,qCAAqC,EAAE,2DAAuD;AAEvG,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAG1B,CAAC;AA4CF,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAcF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,iCAAiC,CAAC;AAEtC,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;gBAiCa,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;KAC9B;IA4GY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA6B/C;;;;OAIG;IACI,qBAAqB,IAAI,IAAI;IA8G7B,cAAc,IAAI,IAAI;IAQ7B;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtE;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC;IAOvB;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC;IA8B5C,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAO9B;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAOX,UAAU,IAAI,OAAO;CAqE7B"}

package/dist/controllers/authentication/AuthenticationController.mjs

@@ -63,6 +63,7 @@ const MESSENGER_EXPOSED_METHODS = [
     'getSessionProfile',
     'refreshCanonicalProfileId',
     'getUserProfileLineage',
+    'getCustomerServiceToken',
     'isSignedIn',
     'requestProfilePairing',
 ];
@@ -242,6 +243,22 @@ export class AuthenticationController extends BaseController {
         const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
     }
+    /**
+     * Returns a Customer Service specific access token for the specified SRP,
+     * logging in if needed.
+     *
+     * Exchanges the OIDC access token for a short-lived token scoped to the
+     * customer-service audience. Customer Service tooling consumes this token to
+     * identify and authenticate the user.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The customer-service access token.
+     */
+    async getCustomerServiceToken(entropySourceId) {
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
+        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
+    }
     isSignedIn() {
         return this.state.isSignedIn;
     }

package/dist/controllers/authentication/AuthenticationController.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAsB3D,OAAO,EACL,+BAA+B,EAC/B,QAAQ,EACR,GAAG,EACH,aAAa,EACd,4BAAkB;AAEnB,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,EAC7B,iCAA6B;AAG9B,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAmBlD,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,UAAU,EAAE,KAAK;IACjB,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AACF,MAAM,QAAQ,GAAiD;IAC7D,UAAU,EAAE;QACV,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,mBAAmB,EAAE;QACnB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,cAAc,EAAE;QACd,sCAAsC;QACtC,kBAAkB,EAAE,CAAC,cAAc,EAAE,EAAE;YACrC,4FAA4F;YAC5F,2FAA2F;YAC3F,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAC1C,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,uBAAuB,EAAE,GACxD,KAAK,CAAC,KAAK,CAAC;gBACd,uBAAuB,CAAC,GAAG,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC,EACD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAMF,MAAM,yBAAyB,GAAG;IAChC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,uBAAuB;IACvB,YAAY;IACZ,uBAAuB;CACf,CAAC;AA8CX;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,cAI7C;IAiCC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GAUZ;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QApDI,wDAA8B;QAE9B,iDAAoB;QAEpB,2CAA4B;YACnC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,EAAC;QAEF,+CAAc,KAAK,EAAC;QAEpB,yEAAuC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,iDAAiD;QACjD,+DAA8B,CAAC,EAAC;QAEvB,sDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,wCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,wCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,wCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QAyZF,0DAA+D,EAAE,EAAC;QAjYhE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,uBAAA,IAAI,oCAAW;YACb,GAAG,uBAAA,IAAI,wCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QAEF,uBAAA,IAAI,yCAAgB,WAAW,MAAA,CAAC;QAEhC,uBAAA,IAAI,kCAAS,IAAI,aAAa,CAC5B;YACE,GAAG,EAAE,uBAAA,IAAI,wCAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,WAAW,CAAC,KAAK;YAC3B,IAAI,EAAE,QAAQ,CAAC,GAAG;SACnB,EACD;YACE,OAAO,EAAE;gBACP,gBAAgB,EAAE,uBAAA,IAAI,gGAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,gBAAgB,EAAE,uBAAA,IAAI,8FAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D;YACD,OAAO,EAAE;gBACP,aAAa,EAAE,uBAAA,IAAI,uFAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,WAAW,EAAE,uBAAA,IAAI,sFAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC9C;YACD,WAAW,EAAE,uBAAA,IAAI,6CAAa;SAC/B,CACF,MAAA,CAAC;QAEF,uBAAA,IAAI,mDAAmB,CAAC,6BAA6B,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAgEM,KAAK,CAAC,aAAa;QACxB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,uBAAA,IAAI,4DAA4B,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;QACzD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,mEAAmE;QACnE,oCAAoC;QACpC,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACrE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,sCAAsC;YACtC,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,uBAAA,IAAI,6EAAQ,MAAZ,IAAI,EAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,qBAAqB;QAC1B,6KAAoC,CAAC,MAAA,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAuGM,cAAc;QACnB,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,eAAwB;QAClD,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,gBAAgB,CAAC,CAAC;QACzC,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,iBAAiB,CAC5B,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;QAC5C,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,yBAAyB;QACpC,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,2BAA2B,CAAC,CAAC;QAEpD,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACvE,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,EAAuB,sBAAsB,CAAC,CAAC;QACnD,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAcM,KAAK,CAAC,qBAAqB,CAChC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CAmEF;skBA1XC,KAAK,8DACH,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC,sDAED,KAAK,4DACH,aAA4B,EAC5B,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6CAAa,CAAC,gBAAgB,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;YACjC,GAAG,aAAa;YAChB,OAAO,EAAE;gBACP,GAAG,aAAa,CAAC,OAAO;gBACxB,aAAa;aACd;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,mGAEiB,UAAkB;IAClC,IAAI,CAAC,uBAAA,IAAI,4CAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,wCAAwC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,wDAED,KAAK;IACH,IAAI,uBAAA,IAAI,8DAA8B,EAAE,CAAC;QACvC,OAAO,uBAAA,IAAI,8DAA8B,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;IAEzD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;IAC/C,OAAO,uBAAA,IAAI,8DAA8B,CAAC;AAC5C,CAAC,yHAoD4B,YAAoB;IAC/C,IAAI,uBAAA,IAAI,4DAA4B,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,2CAAS,YAAsB,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAE9D,MAAM,cAAc,GAAG,MAAM,uBAAA,IAAI,sFAAiB,MAArB,IAAI,EAAkB,YAAY,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAEzD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,YAAY,CAAC;IAC5D,MAAM,4BAA4B,GAChC,gBAAgB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,IAAI,4BAA4B,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC/D,SAAS,EAAE,YAAY;YACvB,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,8CAED,KAAK,oDAAkB,YAAsB;IAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IAC3E,MAAM,EACJ,cAAc,EACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,GAChC,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACvE,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,kBAAkB,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC,uGAEmB,kBAA0B;IAC5C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK;IACH,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACvE,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO;QAC1D,EAAE,kBAAkB,IAAI,IAAI,CAC/B,CAAC;AACJ,CAAC,2GAoFqB,eAAuB;IAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YACnB,iEAAiE;YACjE,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAeD;;;;;;GAMG;AACH,KAAK,qDAAmB,eAAwB;IAC9C,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,0BAA0B,CAAC,eAAe,CAAC,CAC5C,CAAW,CAAC;IAEb,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK;IACH,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,8BAA8B,EAAE,CACjC,CAAuB,CAAC;IAEzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAID;;;;;;;GAOG;AACH,KAAK,oDACH,OAAe,EACf,eAAwB;IAExB,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,kBAAkB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,4BAA4B,CAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\nimport type { Json } from '@metamask/utils';\n\nimport type {\n  LoginResponse,\n  ProfileAlias,\n  SRPInterface,\n  UserProfile,\n  UserProfileLineage,\n} from '../../sdk';\nimport {\n  assertMessageStartsWithMetamask,\n  AuthType,\n  Env,\n  JwtBearerAuth,\n} from '../../sdk';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport {\n  createSnapPublicKeyRequest,\n  createSnapAllPublicKeysRequest,\n  createSnapSignMessageRequest,\n} from './auth-snap-requests';\nimport { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types';\n\nconst controllerName = 'AuthenticationController';\n\n// State\nexport type AuthenticationControllerState = {\n  isSignedIn: boolean;\n  srpSessionData?: Record<string, LoginResponse>;\n  /**\n   * Client gate for profile pairing. Defaults to `true` (fresh install /\n   * upgrade), set to `false` after a successful `performSignIn` pair, set\n   * back to `true` via `requestProfilePairing()` when the SRP set changes,\n   * and left `true` on pair failure so the next state shift retries.\n   *\n   * Optional in the type so partial-state selectors stay assignable to\n   * `AuthenticationControllerState`. The controller seeds it via\n   * `defaultState` at construction; consumers should read `undefined` as\n   * `true` to mirror that runtime default.\n   */\n  needsProfilePairing?: boolean;\n};\nexport const defaultState: AuthenticationControllerState = {\n  isSignedIn: false,\n  needsProfilePairing: true,\n};\nconst metadata: StateMetadata<AuthenticationControllerState> = {\n  isSignedIn: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  needsProfilePairing: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  srpSessionData: {\n    // Remove access token from state logs\n    includeInStateLogs: (srpSessionData) => {\n      // Unreachable branch, included just to fix a type error for the case where this property is\n      // unset. The type gets collapsed to include `| undefined` even though `undefined` is never\n      // set here, because we don't yet use `exactOptionalPropertyTypes`.\n      // TODO: Remove branch after enabling `exactOptionalPropertyTypes`\n      // ref: https://github.com/MetaMask/core/issues/6565\n      if (srpSessionData === null || srpSessionData === undefined) {\n        return null;\n      }\n      return Object.entries(srpSessionData).reduce<Record<string, Json>>(\n        (sanitizedSrpSessionData, [key, value]) => {\n          const { accessToken: _unused, ...tokenWithoutAccessToken } =\n            value.token;\n          sanitizedSrpSessionData[key] = {\n            ...value,\n            token: tokenWithoutAccessToken,\n          };\n          return sanitizedSrpSessionData;\n        },\n        {},\n      );\n    },\n    persist: true,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performSignIn',\n  'performSignOut',\n  'getBearerToken',\n  'getSessionProfile',\n  'refreshCanonicalProfileId',\n  'getUserProfileLineage',\n  'isSignedIn',\n  'requestProfilePairing',\n] as const;\n\nexport type Actions =\n  | AuthenticationControllerGetStateAction\n  | AuthenticationControllerMethodActions;\n\nexport type AuthenticationControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  AuthenticationControllerState\n>;\n\nexport type AuthenticationControllerStateChangeEvent =\n  ControllerStateChangeEvent<\n    typeof controllerName,\n    AuthenticationControllerState\n  >;\n\nexport type ProfileSignInInfo = {\n  profileId: string;\n  profileAliases: ProfileAlias[];\n  profileIdChanged: boolean;\n};\n\nexport type AuthenticationControllerProfileSignInEvent = {\n  type: `${typeof controllerName}:profileSignIn`;\n  payload: [ProfileSignInInfo];\n};\n\nexport type Events =\n  | AuthenticationControllerStateChangeEvent\n  | AuthenticationControllerProfileSignInEvent;\n\n// Allowed Actions\ntype AllowedActions =\n  | KeyringControllerGetStateAction\n  | SnapControllerHandleRequestAction;\n\ntype AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;\n\n// Messenger\nexport type AuthenticationControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Controller that enables authentication for restricted endpoints.\n * Used for Backup & Sync, Notifications, and other services.\n */\nexport class AuthenticationController extends BaseController<\n  typeof controllerName,\n  AuthenticationControllerState,\n  AuthenticationControllerMessenger\n> {\n  readonly #metametrics: MetaMetricsAuth;\n\n  readonly #auth: SRPInterface;\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  #isUnlocked = false;\n\n  #cachedPrimaryEntropySourceId?: string;\n\n  // Bumped by `requestProfilePairing`. `performSignIn` snapshots this\n  // before its first await; if it changes mid-flight we must NOT clear\n  // `needsProfilePairing` (the rearm signal wins).\n  #profilePairingRequestEpoch = 0;\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  constructor({\n    messenger,\n    state,\n    config,\n    metametrics,\n  }: {\n    messenger: AuthenticationControllerMessenger;\n    state?: AuthenticationControllerState;\n    config?: Partial<ControllerConfig>;\n    /**\n     * Not using the Messaging System as we\n     * do not want to tie this strictly to extension\n     */\n    metametrics: MetaMetricsAuth;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    if (!metametrics) {\n      throw new Error('`metametrics` field is required');\n    }\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n\n    this.#metametrics = metametrics;\n\n    this.#auth = new JwtBearerAuth(\n      {\n        env: this.#config.env,\n        platform: metametrics.agent,\n        type: AuthType.SRP,\n      },\n      {\n        storage: {\n          getLoginResponse: this.#getLoginResponseFromState.bind(this),\n          setLoginResponse: this.#setLoginResponseToState.bind(this),\n        },\n        signing: {\n          getIdentifier: this.#snapGetPublicKey.bind(this),\n          signMessage: this.#snapSignMessage.bind(this),\n        },\n        metametrics: this.#metametrics,\n      },\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  async #getLoginResponseFromState(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    if (!this.state.srpSessionData?.[resolvedId]) {\n      return null;\n    }\n    return this.state.srpSessionData[resolvedId];\n  }\n\n  async #setLoginResponseToState(\n    loginResponse: LoginResponse,\n    entropySourceId?: string,\n  ) {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    const metaMetricsId = await this.#metametrics.getMetaMetricsId();\n    this.update((state) => {\n      state.isSignedIn = true;\n      if (!state.srpSessionData) {\n        state.srpSessionData = {};\n      }\n      state.srpSessionData[resolvedId] = {\n        ...loginResponse,\n        profile: {\n          ...loginResponse.profile,\n          metaMetricsId,\n        },\n      };\n    });\n  }\n\n  #assertIsUnlocked(methodName: string): void {\n    if (!this.#isUnlocked) {\n      throw new Error(`${methodName} - unable to proceed, wallet is locked`);\n    }\n  }\n\n  async #getPrimaryEntropySourceId(): Promise<string> {\n    if (this.#cachedPrimaryEntropySourceId) {\n      return this.#cachedPrimaryEntropySourceId;\n    }\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n\n    if (allPublicKeys.length === 0) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - No entropy sources found from snap',\n      );\n    }\n\n    const primaryId = allPublicKeys[0][0];\n    if (!primaryId) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - Primary entropy source ID is undefined',\n      );\n    }\n\n    this.#cachedPrimaryEntropySourceId = primaryId;\n    return this.#cachedPrimaryEntropySourceId;\n  }\n\n  public async performSignIn(): Promise<string[]> {\n    this.#assertIsUnlocked('performSignIn');\n\n    const epochAtStart = this.#profilePairingRequestEpoch;\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n    const accessTokens: string[] = [];\n\n    // We iterate sequentially in order to be sure that the first entry\n    // is the primary SRP LoginResponse.\n    for (const [entropySourceId] of allPublicKeys) {\n      const accessToken = await this.#auth.getAccessToken(entropySourceId);\n      accessTokens.push(accessToken);\n    }\n\n    if (allPublicKeys.length < 2) {\n      // Single-SRP wallet: nothing to pair.\n      this.#tryClearNeedsProfilePairing(epochAtStart);\n    } else {\n      // Pair failures must not break sign-in; the gate stays `true` for retry.\n      try {\n        await this.#doPair(accessTokens, epochAtStart);\n      } catch {\n        // noop\n      }\n    }\n\n    return accessTokens;\n  }\n\n  /**\n   * Marks profile pairing as needed. Clients call this when the SRP set\n   * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n   * re-runs `performSignIn` and re-pairs.\n   */\n  public requestProfilePairing(): void {\n    this.#profilePairingRequestEpoch += 1;\n    if (!this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = true;\n      });\n    }\n  }\n\n  /**\n   * Clears `needsProfilePairing` only if no `requestProfilePairing` call\n   * landed since `epochAtStart` was captured. Prevents `performSignIn`\n   * from silently overwriting a concurrent rearm.\n   *\n   * @param epochAtStart - Epoch value captured at the start of `performSignIn`.\n   */\n  #tryClearNeedsProfilePairing(epochAtStart: number): void {\n    if (this.#profilePairingRequestEpoch !== epochAtStart) {\n      return;\n    }\n    if (this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = false;\n      });\n    }\n  }\n\n  /**\n   * Pairs all SRPs via `POST /profile/pair`, propagates the canonical\n   * profile ID, clears `needsProfilePairing`, and emits\n   * `AuthenticationController:profileSignIn` when the canonical changes or\n   * new aliases are returned. Throws on failure.\n   *\n   * @param accessTokens - Per-SRP access tokens, primary first.\n   * @param epochAtStart - Pairing-request epoch captured by the caller.\n   * Used to skip the gate clear if `requestProfilePairing` ran while the\n   * pair API call was in-flight.\n   */\n  async #doPair(accessTokens: string[], epochAtStart: number): Promise<void> {\n    const previousCanonical = await this.#getCanonicalProfileId();\n\n    const profileAliases = await this.#pairSrpProfiles(accessTokens);\n    const newCanonical = await this.#getCanonicalProfileId();\n\n    // If somehow we cannot compute the new canonical profile ID after pairing,\n    // we just return now and do not update the `needsProfilePairing` flag.\n    if (!newCanonical) {\n      return;\n    }\n\n    this.#tryClearNeedsProfilePairing(epochAtStart);\n\n    const profileIdChanged = previousCanonical !== newCanonical;\n    const shouldEmitProfileSignInEvent =\n      profileIdChanged || profileAliases.length > 0;\n\n    if (shouldEmitProfileSignInEvent) {\n      this.messenger.publish('AuthenticationController:profileSignIn', {\n        profileId: newCanonical,\n        profileAliases,\n        profileIdChanged,\n      });\n    }\n  }\n\n  async #pairSrpProfiles(accessTokens: string[]): Promise<ProfileAlias[]> {\n    if (accessTokens.length < 2) {\n      return [];\n    }\n    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.\n    const {\n      profileAliases,\n      profile: { canonicalProfileId },\n    } = await this.#auth.pairSrpProfiles(accessTokens, primaryAccessToken);\n    this.#propagateCanonical(canonicalProfileId);\n    return profileAliases;\n  }\n\n  #propagateCanonical(canonicalProfileId: string): void {\n    const { srpSessionData } = this.state;\n    if (!srpSessionData) {\n      return;\n    }\n\n    this.update((state) => {\n      for (const entry of Object.values(state.srpSessionData ?? {})) {\n        if (entry?.profile) {\n          entry.profile.canonicalProfileId = canonicalProfileId;\n        }\n      }\n    });\n  }\n\n  /**\n   * Returns the canonical profile id from the primary SRP's cached session.\n   * Returns `null` when no session exists yet for the primary SRP.\n   *\n   * Always reads from the primary SRP because the canonical is shared across\n   * all paired SRPs after `#propagateCanonical`.\n   *\n   * @returns The canonical profile id, or `null` if unavailable.\n   */\n  async #getCanonicalProfileId(): Promise<string | null> {\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    return (\n      this.state.srpSessionData?.[primaryEntropySourceId]?.profile\n        ?.canonicalProfileId ?? null\n    );\n  }\n\n  public performSignOut(): void {\n    this.#cachedPrimaryEntropySourceId = undefined;\n    this.update((state) => {\n      state.isSignedIn = false;\n      state.srpSessionData = undefined;\n    });\n  }\n\n  /**\n   * Returns a bearer token for the specified SRP, logging in if needed.\n   *\n   * When called without `entropySourceId`, returns the primary (first) SRP's\n   * access token, which is effectively the canonical\n   * profile's token that can be used by alias-aware consumers for cross-SRP\n   * operations.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The OIDC access token.\n   */\n  public async getBearerToken(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('getBearerToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getAccessToken(resolvedId);\n  }\n\n  /**\n   * Returns the cached session profile, logging in if no session exists.\n   *\n   * The returned `canonicalProfileId` reflects the value from the most recent\n   * login or pairing. In the rare event where a canonical changed because of\n   * a pairing that happened on another device, the cached value may be stale\n   * until the next login. For guaranteed freshness, call\n   * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns profile for the session.\n   */\n  public async getSessionProfile(\n    entropySourceId?: string,\n  ): Promise<UserProfile> {\n    this.#assertIsUnlocked('getSessionProfile');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfile(resolvedId);\n  }\n\n  /**\n   * Forces a fresh retrieval of the canonical profile ID from the server\n   * and propagates it to all cached SRP sessions.\n   *\n   * This method invalidates the primary SRP's cached session and forces a\n   * re-login. Use it before operations that require a guaranteed-fresh\n   * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n   * best-effort reads, use\n   * `getSessionProfile().canonicalProfileId` instead.\n   *\n   * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n   * the server returns the current canonical for the entire pairing group\n   * from any single SRP login.\n   *\n   * @returns The refreshed canonical profile ID.\n   */\n  public async refreshCanonicalProfileId(): Promise<string> {\n    this.#assertIsUnlocked('refreshCanonicalProfileId');\n\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    this.#invalidateSrpSession(primaryEntropySourceId);\n    await this.#auth.getAccessToken(primaryEntropySourceId);\n\n    const canonical = await this.#getCanonicalProfileId();\n    if (!canonical) {\n      throw new Error(\n        'refreshCanonicalProfileId - Unable to resolve canonical profile ID',\n      );\n    }\n\n    this.#propagateCanonical(canonical);\n    return canonical;\n  }\n\n  #invalidateSrpSession(entropySourceId: string): void {\n    this.update((state) => {\n      const entry = state.srpSessionData?.[entropySourceId];\n      if (entry?.profile) {\n        // Setting canonicalProfileId to '' forces a re-fetch on the next\n        // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)\n        // treats '' the same as undefined/null — all signal an invalid session.\n        entry.profile.canonicalProfileId = '';\n      }\n    });\n  }\n\n  public async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    this.#assertIsUnlocked('getUserProfileLineage');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfileLineage(resolvedId);\n  }\n\n  public isSignedIn(): boolean {\n    return this.state.isSignedIn;\n  }\n\n  /**\n   * Returns the auth snap public key.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns The snap public key.\n   */\n  async #snapGetPublicKey(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('#snapGetPublicKey');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapPublicKeyRequest(entropySourceId),\n    )) as string;\n\n    return result;\n  }\n\n  /**\n   * Returns a mapping of entropy source IDs to auth snap public keys.\n   *\n   * @returns A mapping of entropy source IDs to public keys.\n   */\n  async #snapGetAllPublicKeys(): Promise<[string, string][]> {\n    this.#assertIsUnlocked('#snapGetAllPublicKeys');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapAllPublicKeysRequest(),\n    )) as [string, string][];\n\n    return result;\n  }\n\n  #_snapSignMessageCache: Record<`metamask:${string}`, string> = {};\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    assertMessageStartsWithMetamask(message);\n\n    if (this.#_snapSignMessageCache[message]) {\n      return this.#_snapSignMessageCache[message];\n    }\n\n    this.#assertIsUnlocked('#snapSignMessage');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#_snapSignMessageCache[message] = result;\n\n    return result;\n  }\n}\n"]}
+{"version":3,"file":"AuthenticationController.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAsB3D,OAAO,EACL,+BAA+B,EAC/B,QAAQ,EACR,GAAG,EACH,aAAa,EACd,4BAAkB;AAEnB,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,EAC7B,iCAA6B;AAG9B,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAmBlD,MAAM,CAAC,MAAM,YAAY,GAAkC;IACzD,UAAU,EAAE,KAAK;IACjB,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AACF,MAAM,QAAQ,GAAiD;IAC7D,UAAU,EAAE;QACV,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,mBAAmB,EAAE;QACnB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,cAAc,EAAE;QACd,sCAAsC;QACtC,kBAAkB,EAAE,CAAC,cAAc,EAAE,EAAE;YACrC,4FAA4F;YAC5F,2FAA2F;YAC3F,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAC1C,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,uBAAuB,EAAE,GACxD,KAAK,CAAC,KAAK,CAAC;gBACd,uBAAuB,CAAC,GAAG,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC,EACD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAMF,MAAM,yBAAyB,GAAG;IAChC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,YAAY;IACZ,uBAAuB;CACf,CAAC;AA8CX;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,cAI7C;IAiCC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GAUZ;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QApDI,wDAA8B;QAE9B,iDAAoB;QAEpB,2CAA4B;YACnC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,EAAC;QAEF,+CAAc,KAAK,EAAC;QAEpB,yEAAuC;QAEvC,oEAAoE;QACpE,qEAAqE;QACrE,iDAAiD;QACjD,+DAA8B,CAAC,EAAC;QAEvB,sDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,wCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,wCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,wCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QA6aF,0DAA+D,EAAE,EAAC;QArZhE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,uBAAA,IAAI,oCAAW;YACb,GAAG,uBAAA,IAAI,wCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QAEF,uBAAA,IAAI,yCAAgB,WAAW,MAAA,CAAC;QAEhC,uBAAA,IAAI,kCAAS,IAAI,aAAa,CAC5B;YACE,GAAG,EAAE,uBAAA,IAAI,wCAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,WAAW,CAAC,KAAK;YAC3B,IAAI,EAAE,QAAQ,CAAC,GAAG;SACnB,EACD;YACE,OAAO,EAAE;gBACP,gBAAgB,EAAE,uBAAA,IAAI,gGAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,gBAAgB,EAAE,uBAAA,IAAI,8FAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D;YACD,OAAO,EAAE;gBACP,aAAa,EAAE,uBAAA,IAAI,uFAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,WAAW,EAAE,uBAAA,IAAI,sFAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC9C;YACD,WAAW,EAAE,uBAAA,IAAI,6CAAa;SAC/B,CACF,MAAA,CAAC;QAEF,uBAAA,IAAI,mDAAmB,CAAC,6BAA6B,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAgEM,KAAK,CAAC,aAAa;QACxB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,uBAAA,IAAI,4DAA4B,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;QACzD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,mEAAmE;QACnE,oCAAoC;QACpC,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACrE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,sCAAsC;YACtC,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,uBAAA,IAAI,6EAAQ,MAAZ,IAAI,EAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,qBAAqB;QAC1B,6KAAoC,CAAC,MAAA,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAuGM,cAAc;QACnB,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,eAAwB;QAClD,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,gBAAgB,CAAC,CAAC;QACzC,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,iBAAiB,CAC5B,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;QAC5C,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,yBAAyB;QACpC,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,2BAA2B,CAAC,CAAC;QAEpD,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACvE,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,EAAuB,sBAAsB,CAAC,CAAC;QACnD,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAcM,KAAK,CAAC,qBAAqB,CAChC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;QAChD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAClC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,yBAAyB,CAAC,CAAC;QAClD,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CAmEF;skBA9YC,KAAK,8DACH,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC,sDAED,KAAK,4DACH,aAA4B,EAC5B,eAAwB;IAExB,MAAM,UAAU,GACd,eAAe,IAAI,CAAC,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6CAAa,CAAC,gBAAgB,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;YACjC,GAAG,aAAa;YAChB,OAAO,EAAE;gBACP,GAAG,aAAa,CAAC,OAAO;gBACxB,aAAa;aACd;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,mGAEiB,UAAkB;IAClC,IAAI,CAAC,uBAAA,IAAI,4CAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,wCAAwC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,wDAED,KAAK;IACH,IAAI,uBAAA,IAAI,8DAA8B,EAAE,CAAC;QACvC,OAAO,uBAAA,IAAI,8DAA8B,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,CAAwB,CAAC;IAEzD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,uBAAA,IAAI,0DAAiC,SAAS,MAAA,CAAC;IAC/C,OAAO,uBAAA,IAAI,8DAA8B,CAAC;AAC5C,CAAC,yHAoD4B,YAAoB;IAC/C,IAAI,uBAAA,IAAI,4DAA4B,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,2CAAS,YAAsB,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAE9D,MAAM,cAAc,GAAG,MAAM,uBAAA,IAAI,sFAAiB,MAArB,IAAI,EAAkB,YAAY,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAEzD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,YAAY,CAAC;IAC5D,MAAM,4BAA4B,GAChC,gBAAgB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,IAAI,4BAA4B,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC/D,SAAS,EAAE,YAAY;YACvB,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,8CAED,KAAK,oDAAkB,YAAsB;IAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IAC3E,MAAM,EACJ,cAAc,EACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,GAChC,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACvE,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,kBAAkB,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC,uGAEmB,kBAA0B;IAC5C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK;IACH,MAAM,sBAAsB,GAAG,MAAM,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACvE,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO;QAC1D,EAAE,kBAAkB,IAAI,IAAI,CAC/B,CAAC;AACJ,CAAC,2GAoFqB,eAAuB;IAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YACnB,iEAAiE;YACjE,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAmCD;;;;;;GAMG;AACH,KAAK,qDAAmB,eAAwB;IAC9C,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,0BAA0B,CAAC,eAAe,CAAC,CAC5C,CAAW,CAAC;IAEb,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK;IACH,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,8BAA8B,EAAE,CACjC,CAAuB,CAAC;IAEzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAID;;;;;;;GAOG;AACH,KAAK,oDACH,OAAe,EACf,eAAwB;IAExB,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,kBAAkB,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,4BAA4B,CAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,uDAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\nimport type { Json } from '@metamask/utils';\n\nimport type {\n  LoginResponse,\n  ProfileAlias,\n  SRPInterface,\n  UserProfile,\n  UserProfileLineage,\n} from '../../sdk';\nimport {\n  assertMessageStartsWithMetamask,\n  AuthType,\n  Env,\n  JwtBearerAuth,\n} from '../../sdk';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport {\n  createSnapPublicKeyRequest,\n  createSnapAllPublicKeysRequest,\n  createSnapSignMessageRequest,\n} from './auth-snap-requests';\nimport { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types';\n\nconst controllerName = 'AuthenticationController';\n\n// State\nexport type AuthenticationControllerState = {\n  isSignedIn: boolean;\n  srpSessionData?: Record<string, LoginResponse>;\n  /**\n   * Client gate for profile pairing. Defaults to `true` (fresh install /\n   * upgrade), set to `false` after a successful `performSignIn` pair, set\n   * back to `true` via `requestProfilePairing()` when the SRP set changes,\n   * and left `true` on pair failure so the next state shift retries.\n   *\n   * Optional in the type so partial-state selectors stay assignable to\n   * `AuthenticationControllerState`. The controller seeds it via\n   * `defaultState` at construction; consumers should read `undefined` as\n   * `true` to mirror that runtime default.\n   */\n  needsProfilePairing?: boolean;\n};\nexport const defaultState: AuthenticationControllerState = {\n  isSignedIn: false,\n  needsProfilePairing: true,\n};\nconst metadata: StateMetadata<AuthenticationControllerState> = {\n  isSignedIn: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  needsProfilePairing: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  srpSessionData: {\n    // Remove access token from state logs\n    includeInStateLogs: (srpSessionData) => {\n      // Unreachable branch, included just to fix a type error for the case where this property is\n      // unset. The type gets collapsed to include `| undefined` even though `undefined` is never\n      // set here, because we don't yet use `exactOptionalPropertyTypes`.\n      // TODO: Remove branch after enabling `exactOptionalPropertyTypes`\n      // ref: https://github.com/MetaMask/core/issues/6565\n      if (srpSessionData === null || srpSessionData === undefined) {\n        return null;\n      }\n      return Object.entries(srpSessionData).reduce<Record<string, Json>>(\n        (sanitizedSrpSessionData, [key, value]) => {\n          const { accessToken: _unused, ...tokenWithoutAccessToken } =\n            value.token;\n          sanitizedSrpSessionData[key] = {\n            ...value,\n            token: tokenWithoutAccessToken,\n          };\n          return sanitizedSrpSessionData;\n        },\n        {},\n      );\n    },\n    persist: true,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performSignIn',\n  'performSignOut',\n  'getBearerToken',\n  'getSessionProfile',\n  'refreshCanonicalProfileId',\n  'getUserProfileLineage',\n  'getCustomerServiceToken',\n  'isSignedIn',\n  'requestProfilePairing',\n] as const;\n\nexport type Actions =\n  | AuthenticationControllerGetStateAction\n  | AuthenticationControllerMethodActions;\n\nexport type AuthenticationControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  AuthenticationControllerState\n>;\n\nexport type AuthenticationControllerStateChangeEvent =\n  ControllerStateChangeEvent<\n    typeof controllerName,\n    AuthenticationControllerState\n  >;\n\nexport type ProfileSignInInfo = {\n  profileId: string;\n  profileAliases: ProfileAlias[];\n  profileIdChanged: boolean;\n};\n\nexport type AuthenticationControllerProfileSignInEvent = {\n  type: `${typeof controllerName}:profileSignIn`;\n  payload: [ProfileSignInInfo];\n};\n\nexport type Events =\n  | AuthenticationControllerStateChangeEvent\n  | AuthenticationControllerProfileSignInEvent;\n\n// Allowed Actions\ntype AllowedActions =\n  | KeyringControllerGetStateAction\n  | SnapControllerHandleRequestAction;\n\ntype AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;\n\n// Messenger\nexport type AuthenticationControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Controller that enables authentication for restricted endpoints.\n * Used for Backup & Sync, Notifications, and other services.\n */\nexport class AuthenticationController extends BaseController<\n  typeof controllerName,\n  AuthenticationControllerState,\n  AuthenticationControllerMessenger\n> {\n  readonly #metametrics: MetaMetricsAuth;\n\n  readonly #auth: SRPInterface;\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  #isUnlocked = false;\n\n  #cachedPrimaryEntropySourceId?: string;\n\n  // Bumped by `requestProfilePairing`. `performSignIn` snapshots this\n  // before its first await; if it changes mid-flight we must NOT clear\n  // `needsProfilePairing` (the rearm signal wins).\n  #profilePairingRequestEpoch = 0;\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  constructor({\n    messenger,\n    state,\n    config,\n    metametrics,\n  }: {\n    messenger: AuthenticationControllerMessenger;\n    state?: AuthenticationControllerState;\n    config?: Partial<ControllerConfig>;\n    /**\n     * Not using the Messaging System as we\n     * do not want to tie this strictly to extension\n     */\n    metametrics: MetaMetricsAuth;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    if (!metametrics) {\n      throw new Error('`metametrics` field is required');\n    }\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n\n    this.#metametrics = metametrics;\n\n    this.#auth = new JwtBearerAuth(\n      {\n        env: this.#config.env,\n        platform: metametrics.agent,\n        type: AuthType.SRP,\n      },\n      {\n        storage: {\n          getLoginResponse: this.#getLoginResponseFromState.bind(this),\n          setLoginResponse: this.#setLoginResponseToState.bind(this),\n        },\n        signing: {\n          getIdentifier: this.#snapGetPublicKey.bind(this),\n          signMessage: this.#snapSignMessage.bind(this),\n        },\n        metametrics: this.#metametrics,\n      },\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  async #getLoginResponseFromState(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    if (!this.state.srpSessionData?.[resolvedId]) {\n      return null;\n    }\n    return this.state.srpSessionData[resolvedId];\n  }\n\n  async #setLoginResponseToState(\n    loginResponse: LoginResponse,\n    entropySourceId?: string,\n  ) {\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    const metaMetricsId = await this.#metametrics.getMetaMetricsId();\n    this.update((state) => {\n      state.isSignedIn = true;\n      if (!state.srpSessionData) {\n        state.srpSessionData = {};\n      }\n      state.srpSessionData[resolvedId] = {\n        ...loginResponse,\n        profile: {\n          ...loginResponse.profile,\n          metaMetricsId,\n        },\n      };\n    });\n  }\n\n  #assertIsUnlocked(methodName: string): void {\n    if (!this.#isUnlocked) {\n      throw new Error(`${methodName} - unable to proceed, wallet is locked`);\n    }\n  }\n\n  async #getPrimaryEntropySourceId(): Promise<string> {\n    if (this.#cachedPrimaryEntropySourceId) {\n      return this.#cachedPrimaryEntropySourceId;\n    }\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n\n    if (allPublicKeys.length === 0) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - No entropy sources found from snap',\n      );\n    }\n\n    const primaryId = allPublicKeys[0][0];\n    if (!primaryId) {\n      throw new Error(\n        '#getPrimaryEntropySourceId - Primary entropy source ID is undefined',\n      );\n    }\n\n    this.#cachedPrimaryEntropySourceId = primaryId;\n    return this.#cachedPrimaryEntropySourceId;\n  }\n\n  public async performSignIn(): Promise<string[]> {\n    this.#assertIsUnlocked('performSignIn');\n\n    const epochAtStart = this.#profilePairingRequestEpoch;\n    const allPublicKeys = await this.#snapGetAllPublicKeys();\n    const accessTokens: string[] = [];\n\n    // We iterate sequentially in order to be sure that the first entry\n    // is the primary SRP LoginResponse.\n    for (const [entropySourceId] of allPublicKeys) {\n      const accessToken = await this.#auth.getAccessToken(entropySourceId);\n      accessTokens.push(accessToken);\n    }\n\n    if (allPublicKeys.length < 2) {\n      // Single-SRP wallet: nothing to pair.\n      this.#tryClearNeedsProfilePairing(epochAtStart);\n    } else {\n      // Pair failures must not break sign-in; the gate stays `true` for retry.\n      try {\n        await this.#doPair(accessTokens, epochAtStart);\n      } catch {\n        // noop\n      }\n    }\n\n    return accessTokens;\n  }\n\n  /**\n   * Marks profile pairing as needed. Clients call this when the SRP set\n   * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n   * re-runs `performSignIn` and re-pairs.\n   */\n  public requestProfilePairing(): void {\n    this.#profilePairingRequestEpoch += 1;\n    if (!this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = true;\n      });\n    }\n  }\n\n  /**\n   * Clears `needsProfilePairing` only if no `requestProfilePairing` call\n   * landed since `epochAtStart` was captured. Prevents `performSignIn`\n   * from silently overwriting a concurrent rearm.\n   *\n   * @param epochAtStart - Epoch value captured at the start of `performSignIn`.\n   */\n  #tryClearNeedsProfilePairing(epochAtStart: number): void {\n    if (this.#profilePairingRequestEpoch !== epochAtStart) {\n      return;\n    }\n    if (this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = false;\n      });\n    }\n  }\n\n  /**\n   * Pairs all SRPs via `POST /profile/pair`, propagates the canonical\n   * profile ID, clears `needsProfilePairing`, and emits\n   * `AuthenticationController:profileSignIn` when the canonical changes or\n   * new aliases are returned. Throws on failure.\n   *\n   * @param accessTokens - Per-SRP access tokens, primary first.\n   * @param epochAtStart - Pairing-request epoch captured by the caller.\n   * Used to skip the gate clear if `requestProfilePairing` ran while the\n   * pair API call was in-flight.\n   */\n  async #doPair(accessTokens: string[], epochAtStart: number): Promise<void> {\n    const previousCanonical = await this.#getCanonicalProfileId();\n\n    const profileAliases = await this.#pairSrpProfiles(accessTokens);\n    const newCanonical = await this.#getCanonicalProfileId();\n\n    // If somehow we cannot compute the new canonical profile ID after pairing,\n    // we just return now and do not update the `needsProfilePairing` flag.\n    if (!newCanonical) {\n      return;\n    }\n\n    this.#tryClearNeedsProfilePairing(epochAtStart);\n\n    const profileIdChanged = previousCanonical !== newCanonical;\n    const shouldEmitProfileSignInEvent =\n      profileIdChanged || profileAliases.length > 0;\n\n    if (shouldEmitProfileSignInEvent) {\n      this.messenger.publish('AuthenticationController:profileSignIn', {\n        profileId: newCanonical,\n        profileAliases,\n        profileIdChanged,\n      });\n    }\n  }\n\n  async #pairSrpProfiles(accessTokens: string[]): Promise<ProfileAlias[]> {\n    if (accessTokens.length < 2) {\n      return [];\n    }\n    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.\n    const {\n      profileAliases,\n      profile: { canonicalProfileId },\n    } = await this.#auth.pairSrpProfiles(accessTokens, primaryAccessToken);\n    this.#propagateCanonical(canonicalProfileId);\n    return profileAliases;\n  }\n\n  #propagateCanonical(canonicalProfileId: string): void {\n    const { srpSessionData } = this.state;\n    if (!srpSessionData) {\n      return;\n    }\n\n    this.update((state) => {\n      for (const entry of Object.values(state.srpSessionData ?? {})) {\n        if (entry?.profile) {\n          entry.profile.canonicalProfileId = canonicalProfileId;\n        }\n      }\n    });\n  }\n\n  /**\n   * Returns the canonical profile id from the primary SRP's cached session.\n   * Returns `null` when no session exists yet for the primary SRP.\n   *\n   * Always reads from the primary SRP because the canonical is shared across\n   * all paired SRPs after `#propagateCanonical`.\n   *\n   * @returns The canonical profile id, or `null` if unavailable.\n   */\n  async #getCanonicalProfileId(): Promise<string | null> {\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    return (\n      this.state.srpSessionData?.[primaryEntropySourceId]?.profile\n        ?.canonicalProfileId ?? null\n    );\n  }\n\n  public performSignOut(): void {\n    this.#cachedPrimaryEntropySourceId = undefined;\n    this.update((state) => {\n      state.isSignedIn = false;\n      state.srpSessionData = undefined;\n    });\n  }\n\n  /**\n   * Returns a bearer token for the specified SRP, logging in if needed.\n   *\n   * When called without `entropySourceId`, returns the primary (first) SRP's\n   * access token, which is effectively the canonical\n   * profile's token that can be used by alias-aware consumers for cross-SRP\n   * operations.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The OIDC access token.\n   */\n  public async getBearerToken(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('getBearerToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getAccessToken(resolvedId);\n  }\n\n  /**\n   * Returns the cached session profile, logging in if no session exists.\n   *\n   * The returned `canonicalProfileId` reflects the value from the most recent\n   * login or pairing. In the rare event where a canonical changed because of\n   * a pairing that happened on another device, the cached value may be stale\n   * until the next login. For guaranteed freshness, call\n   * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns profile for the session.\n   */\n  public async getSessionProfile(\n    entropySourceId?: string,\n  ): Promise<UserProfile> {\n    this.#assertIsUnlocked('getSessionProfile');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfile(resolvedId);\n  }\n\n  /**\n   * Forces a fresh retrieval of the canonical profile ID from the server\n   * and propagates it to all cached SRP sessions.\n   *\n   * This method invalidates the primary SRP's cached session and forces a\n   * re-login. Use it before operations that require a guaranteed-fresh\n   * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n   * best-effort reads, use\n   * `getSessionProfile().canonicalProfileId` instead.\n   *\n   * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n   * the server returns the current canonical for the entire pairing group\n   * from any single SRP login.\n   *\n   * @returns The refreshed canonical profile ID.\n   */\n  public async refreshCanonicalProfileId(): Promise<string> {\n    this.#assertIsUnlocked('refreshCanonicalProfileId');\n\n    const primaryEntropySourceId = await this.#getPrimaryEntropySourceId();\n    this.#invalidateSrpSession(primaryEntropySourceId);\n    await this.#auth.getAccessToken(primaryEntropySourceId);\n\n    const canonical = await this.#getCanonicalProfileId();\n    if (!canonical) {\n      throw new Error(\n        'refreshCanonicalProfileId - Unable to resolve canonical profile ID',\n      );\n    }\n\n    this.#propagateCanonical(canonical);\n    return canonical;\n  }\n\n  #invalidateSrpSession(entropySourceId: string): void {\n    this.update((state) => {\n      const entry = state.srpSessionData?.[entropySourceId];\n      if (entry?.profile) {\n        // Setting canonicalProfileId to '' forces a re-fetch on the next\n        // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)\n        // treats '' the same as undefined/null — all signal an invalid session.\n        entry.profile.canonicalProfileId = '';\n      }\n    });\n  }\n\n  public async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    this.#assertIsUnlocked('getUserProfileLineage');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getUserProfileLineage(resolvedId);\n  }\n\n  /**\n   * Returns a Customer Service specific access token for the specified SRP,\n   * logging in if needed.\n   *\n   * Exchanges the OIDC access token for a short-lived token scoped to the\n   * customer-service audience. Customer Service tooling consumes this token to\n   * identify and authenticate the user.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The customer-service access token.\n   */\n  public async getCustomerServiceToken(\n    entropySourceId?: string,\n  ): Promise<string> {\n    this.#assertIsUnlocked('getCustomerServiceToken');\n    const resolvedId =\n      entropySourceId ?? (await this.#getPrimaryEntropySourceId());\n    return await this.#auth.getCustomerServiceToken(resolvedId);\n  }\n\n  public isSignedIn(): boolean {\n    return this.state.isSignedIn;\n  }\n\n  /**\n   * Returns the auth snap public key.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns The snap public key.\n   */\n  async #snapGetPublicKey(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('#snapGetPublicKey');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapPublicKeyRequest(entropySourceId),\n    )) as string;\n\n    return result;\n  }\n\n  /**\n   * Returns a mapping of entropy source IDs to auth snap public keys.\n   *\n   * @returns A mapping of entropy source IDs to public keys.\n   */\n  async #snapGetAllPublicKeys(): Promise<[string, string][]> {\n    this.#assertIsUnlocked('#snapGetAllPublicKeys');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapAllPublicKeysRequest(),\n    )) as [string, string][];\n\n    return result;\n  }\n\n  #_snapSignMessageCache: Record<`metamask:${string}`, string> = {};\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    assertMessageStartsWithMetamask(message);\n\n    if (this.#_snapSignMessageCache[message]) {\n      return this.#_snapSignMessageCache[message];\n    }\n\n    this.#assertIsUnlocked('#snapSignMessage');\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#_snapSignMessageCache[message] = result;\n\n    return result;\n  }\n}\n"]}