@metamask-previews/profile-sync-controller 29.0.0-preview-3866c0ff1 → 29.0.0-preview-e3275932a

package/dist/sdk/authentication-jwt-bearer/flow-siwe.cjs

@@ -0,0 +1,114 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _SIWEJwtBearerAuth_instances, _SIWEJwtBearerAuth_config, _SIWEJwtBearerAuth_options, _SIWEJwtBearerAuth_signer, _SIWEJwtBearerAuth_getAuthSession, _SIWEJwtBearerAuth_login, _SIWEJwtBearerAuth_createSiWELoginRawMessage, _SIWEJwtBearerAuth_assertSigner;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIWEJwtBearerAuth = void 0;
+const siwe_1 = require("siwe");
+const errors_js_1 = require("../errors.cjs");
+const validate_login_response_js_1 = require("../utils/validate-login-response.cjs");
+const services_js_1 = require("./services.cjs");
+class SIWEJwtBearerAuth {
+    constructor(config, options) {
+        _SIWEJwtBearerAuth_instances.add(this);
+        _SIWEJwtBearerAuth_config.set(this, void 0);
+        _SIWEJwtBearerAuth_options.set(this, void 0);
+        _SIWEJwtBearerAuth_signer.set(this, void 0);
+        __classPrivateFieldSet(this, _SIWEJwtBearerAuth_config, config, "f");
+        __classPrivateFieldSet(this, _SIWEJwtBearerAuth_options, options, "f");
+    }
+    async getAccessToken() {
+        const session = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_getAuthSession).call(this);
+        if (session) {
+            return session.token.accessToken;
+        }
+        const loginResponse = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_login).call(this);
+        return loginResponse.token.accessToken;
+    }
+    async getUserProfile() {
+        const session = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_getAuthSession).call(this);
+        if (session) {
+            return session.profile;
+        }
+        const loginResponse = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_login).call(this);
+        return loginResponse.profile;
+    }
+    async getIdentifier() {
+        __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_assertSigner).call(this, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f"));
+        return __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f").address;
+    }
+    async getUserProfileLineage() {
+        const accessToken = await this.getAccessToken();
+        return await (0, services_js_1.getUserProfileLineage)(__classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env, accessToken);
+    }
+    async getCustomerServiceToken() {
+        const accessToken = await this.getAccessToken();
+        return await (0, services_js_1.getCustomerServiceToken)(__classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env, accessToken);
+    }
+    async signMessage(message) {
+        __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_assertSigner).call(this, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f"));
+        return await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f").signMessage(message);
+    }
+    prepare(signer) {
+        __classPrivateFieldSet(this, _SIWEJwtBearerAuth_signer, signer, "f");
+    }
+}
+exports.SIWEJwtBearerAuth = SIWEJwtBearerAuth;
+_SIWEJwtBearerAuth_config = new WeakMap(), _SIWEJwtBearerAuth_options = new WeakMap(), _SIWEJwtBearerAuth_signer = new WeakMap(), _SIWEJwtBearerAuth_instances = new WeakSet(), _SIWEJwtBearerAuth_getAuthSession = 
+// convert expiresIn from seconds to milliseconds and use 90% of expiresIn
+async function _SIWEJwtBearerAuth_getAuthSession() {
+    const auth = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_options, "f").storage.getLoginResponse();
+    if (!(0, validate_login_response_js_1.validateLoginResponse)(auth)) {
+        return null;
+    }
+    const currentTime = Date.now();
+    const sessionAge = currentTime - auth.token.obtainedAt;
+    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;
+    if (sessionAge < refreshThreshold) {
+        return auth;
+    }
+    return null;
+}, _SIWEJwtBearerAuth_login = async function _SIWEJwtBearerAuth_login() {
+    __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_assertSigner).call(this, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f"));
+    // Nonce
+    const address = await this.getIdentifier();
+    const nonceRes = await (0, services_js_1.getNonce)(address, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env);
+    const rawMessage = __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_createSiWELoginRawMessage).call(this, nonceRes.nonce);
+    const signature = await this.signMessage(rawMessage);
+    // Authenticate
+    const authResponse = await (0, services_js_1.authenticate)(rawMessage, signature, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").type, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env);
+    // Authorize
+    const tokenResponse = await (0, services_js_1.authorizeOIDC)(authResponse.token, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").platform);
+    // Save
+    const result = {
+        profile: authResponse.profile,
+        token: tokenResponse,
+    };
+    await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_options, "f").storage.setLoginResponse(result);
+    return result;
+}, _SIWEJwtBearerAuth_createSiWELoginRawMessage = function _SIWEJwtBearerAuth_createSiWELoginRawMessage(nonce) {
+    __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_assertSigner).call(this, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f"));
+    return new siwe_1.SiweMessage({
+        domain: __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f")?.domain,
+        address: __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f")?.address,
+        uri: (0, services_js_1.SIWE_LOGIN_URL)(__classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env),
+        version: '1',
+        chainId: __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f")?.chainId,
+        nonce,
+        issuedAt: new Date().toISOString(),
+    }).prepareMessage();
+}, _SIWEJwtBearerAuth_assertSigner = function _SIWEJwtBearerAuth_assertSigner(signer) {
+    if (!signer) {
+        throw new errors_js_1.ValidationError(`you must call 'prepare()' before logging in`);
+    }
+};
+//# sourceMappingURL=flow-siwe.cjs.map

package/dist/sdk/authentication-jwt-bearer/flow-siwe.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-siwe.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-siwe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,+BAAmC;AAEnC,6CAA+C;AAC/C,qFAA4E;AAC5E,gDAOuB;AAsBvB,MAAa,iBAAiB;IAO5B,YACE,MAA4C,EAC5C,OAAmC;;QAR5B,4CAAoB;QAEpB,6CAAqC;QAE9C,4CAA+C;QAM7C,uBAAA,IAAI,6BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,8BAAY,OAAO,MAAA,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,uEAAgB,MAApB,IAAI,CAAkB,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,8DAAO,MAAX,IAAI,CAAS,CAAC;QAC1C,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,uEAAgB,MAApB,IAAI,CAAkB,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,8DAAO,MAAX,IAAI,CAAS,CAAC;QAC1C,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,uBAAA,IAAI,qEAAc,MAAlB,IAAI,EAAe,uBAAA,IAAI,iCAAQ,CAAC,CAAC;QACjC,OAAO,uBAAA,IAAI,iCAAQ,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,MAAM,IAAA,mCAAqB,EAAC,uBAAA,IAAI,iCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,MAAM,IAAA,qCAAuB,EAAC,uBAAA,IAAI,iCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,uBAAA,IAAI,qEAAc,MAAlB,IAAI,EAAe,uBAAA,IAAI,iCAAQ,CAAC,CAAC;QACjC,OAAO,MAAM,uBAAA,IAAI,iCAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,MAAiC;QACvC,uBAAA,IAAI,6BAAW,MAAM,MAAA,CAAC;IACxB,CAAC;CA2EF;AApID,8CAoIC;;AAzEC,0EAA0E;AAC1E,KAAK;IACH,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,kCAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC5D,IAAI,CAAC,IAAA,kDAAqB,EAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,6BAED,KAAK;IACH,uBAAA,IAAI,qEAAc,MAAlB,IAAI,EAAe,uBAAA,IAAI,iCAAQ,CAAC,CAAC;IAEjC,QAAQ;IACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAQ,EAAC,OAAO,EAAE,uBAAA,IAAI,iCAAQ,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,uBAAA,IAAI,kFAA2B,MAA/B,IAAI,EAA4B,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAErD,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,IAAA,0BAAY,EACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,iCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,iCAAQ,CAAC,GAAG,CACjB,CAAC;IAEF,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,IAAA,2BAAa,EACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,iCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,iCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,kCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAErD,OAAO,MAAM,CAAC;AAChB,CAAC,uGAE0B,KAAa;IACtC,uBAAA,IAAI,qEAAc,MAAlB,IAAI,EAAe,uBAAA,IAAI,iCAAQ,CAAC,CAAC;IAEjC,OAAO,IAAI,kBAAW,CAAC;QACrB,MAAM,EAAE,uBAAA,IAAI,iCAAQ,EAAE,MAAM;QAC5B,OAAO,EAAE,uBAAA,IAAI,iCAAQ,EAAE,OAAO;QAC9B,GAAG,EAAE,IAAA,4BAAc,EAAC,uBAAA,IAAI,iCAAQ,CAAC,GAAG,CAAC;QACrC,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,uBAAA,IAAI,iCAAQ,EAAE,OAAO;QAC9B,KAAK;QACL,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC,cAAc,EAAE,CAAC;AACtB,CAAC,6EAGC,MAAkC;IAElC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2BAAe,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC","sourcesContent":["import { SiweMessage } from 'siwe';\n\nimport { ValidationError } from '../errors.js';\nimport { validateLoginResponse } from '../utils/validate-login-response.js';\nimport {\n  SIWE_LOGIN_URL,\n  authenticate,\n  authorizeOIDC,\n  getCustomerServiceToken,\n  getNonce,\n  getUserProfileLineage,\n} from './services.js';\nimport type {\n  AuthConfig,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types.js';\n\ntype JwtBearerAuth_SIWE_Options = {\n  storage: AuthStorageOptions;\n};\n\ntype JwtBearerAuth_SIWE_Signer = {\n  address: string;\n  chainId: number;\n  signMessage: (message: string) => Promise<string>;\n  domain: string;\n};\n\nexport class SIWEJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: JwtBearerAuth_SIWE_Options;\n\n  #signer: JwtBearerAuth_SIWE_Signer | undefined;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SiWE },\n    options: JwtBearerAuth_SIWE_Options,\n  ) {\n    this.#config = config;\n    this.#options = options;\n  }\n\n  async getAccessToken(): Promise<string> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(): Promise<string> {\n    this.#assertSigner(this.#signer);\n    return this.#signer.address;\n  }\n\n  async getUserProfileLineage(): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken();\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async getCustomerServiceToken(): Promise<string> {\n    const accessToken = await this.getAccessToken();\n    return await getCustomerServiceToken(this.#config.env, accessToken);\n  }\n\n  async signMessage(message: string): Promise<string> {\n    this.#assertSigner(this.#signer);\n    return await this.#signer.signMessage(message);\n  }\n\n  prepare(signer: JwtBearerAuth_SIWE_Signer) {\n    this.#signer = signer;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse();\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(): Promise<LoginResponse> {\n    this.#assertSigner(this.#signer);\n\n    // Nonce\n    const address = await this.getIdentifier();\n    const nonceRes = await getNonce(address, this.#config.env);\n    const rawMessage = this.#createSiWELoginRawMessage(nonceRes.nonce);\n    const signature = await this.signMessage(rawMessage);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result);\n\n    return result;\n  }\n\n  #createSiWELoginRawMessage(nonce: string): string {\n    this.#assertSigner(this.#signer);\n\n    return new SiweMessage({\n      domain: this.#signer?.domain,\n      address: this.#signer?.address,\n      uri: SIWE_LOGIN_URL(this.#config.env),\n      version: '1',\n      chainId: this.#signer?.chainId,\n      nonce,\n      issuedAt: new Date().toISOString(),\n    }).prepareMessage();\n  }\n\n  #assertSigner(\n    signer?: JwtBearerAuth_SIWE_Signer,\n  ): asserts signer is JwtBearerAuth_SIWE_Signer {\n    if (!signer) {\n      throw new ValidationError(`you must call 'prepare()' before logging in`);\n    }\n  }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/{flow-siwe.d.ts → flow-siwe.d.cts}

@@ -1,4 +1,4 @@
-import type { AuthConfig, AuthStorageOptions, AuthType, IBaseAuth, UserProfile, UserProfileLineage } from './types.js';
+import type { AuthConfig, AuthStorageOptions, AuthType, IBaseAuth, UserProfile, UserProfileLineage } from "./types.cjs";
 type JwtBearerAuth_SIWE_Options = {
     storage: AuthStorageOptions;
 };
@@ -22,4 +22,4 @@ export declare class SIWEJwtBearerAuth implements IBaseAuth {
     prepare(signer: JwtBearerAuth_SIWE_Signer): void;
 }
 export {};
-//# sourceMappingURL=flow-siwe.d.ts.map
+//# sourceMappingURL=flow-siwe.d.cts.map

package/dist/sdk/authentication-jwt-bearer/flow-siwe.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-siwe.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-siwe.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAmB;AAEpB,KAAK,0BAA0B,GAAG;IAChC,OAAO,EAAE,kBAAkB,CAAC;CAC7B,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,SAAS;;gBAQ/C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAA;KAAE,EAC5C,OAAO,EAAE,0BAA0B;IAM/B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAUjC,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAUtC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAKhC,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAKpD,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAK1C,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,OAAO,CAAC,MAAM,EAAE,yBAAyB;CA6E1C"}

package/dist/sdk/authentication-jwt-bearer/flow-siwe.d.mts

@@ -0,0 +1,25 @@
+import type { AuthConfig, AuthStorageOptions, AuthType, IBaseAuth, UserProfile, UserProfileLineage } from "./types.mjs";
+type JwtBearerAuth_SIWE_Options = {
+    storage: AuthStorageOptions;
+};
+type JwtBearerAuth_SIWE_Signer = {
+    address: string;
+    chainId: number;
+    signMessage: (message: string) => Promise<string>;
+    domain: string;
+};
+export declare class SIWEJwtBearerAuth implements IBaseAuth {
+    #private;
+    constructor(config: AuthConfig & {
+        type: AuthType.SiWE;
+    }, options: JwtBearerAuth_SIWE_Options);
+    getAccessToken(): Promise<string>;
+    getUserProfile(): Promise<UserProfile>;
+    getIdentifier(): Promise<string>;
+    getUserProfileLineage(): Promise<UserProfileLineage>;
+    getCustomerServiceToken(): Promise<string>;
+    signMessage(message: string): Promise<string>;
+    prepare(signer: JwtBearerAuth_SIWE_Signer): void;
+}
+export {};
+//# sourceMappingURL=flow-siwe.d.mts.map

package/dist/sdk/authentication-jwt-bearer/flow-siwe.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-siwe.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-siwe.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAmB;AAEpB,KAAK,0BAA0B,GAAG;IAChC,OAAO,EAAE,kBAAkB,CAAC;CAC7B,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,qBAAa,iBAAkB,YAAW,SAAS;;gBAQ/C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAA;KAAE,EAC5C,OAAO,EAAE,0BAA0B;IAM/B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAUjC,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAUtC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAKhC,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAKpD,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAK1C,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,OAAO,CAAC,MAAM,EAAE,yBAAyB;CA6E1C"}

package/dist/sdk/authentication-jwt-bearer/flow-siwe.mjs

@@ -0,0 +1,110 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _SIWEJwtBearerAuth_instances, _SIWEJwtBearerAuth_config, _SIWEJwtBearerAuth_options, _SIWEJwtBearerAuth_signer, _SIWEJwtBearerAuth_getAuthSession, _SIWEJwtBearerAuth_login, _SIWEJwtBearerAuth_createSiWELoginRawMessage, _SIWEJwtBearerAuth_assertSigner;
+import { SiweMessage } from "siwe";
+import { ValidationError } from "../errors.mjs";
+import { validateLoginResponse } from "../utils/validate-login-response.mjs";
+import { SIWE_LOGIN_URL, authenticate, authorizeOIDC, getCustomerServiceToken, getNonce, getUserProfileLineage } from "./services.mjs";
+export class SIWEJwtBearerAuth {
+    constructor(config, options) {
+        _SIWEJwtBearerAuth_instances.add(this);
+        _SIWEJwtBearerAuth_config.set(this, void 0);
+        _SIWEJwtBearerAuth_options.set(this, void 0);
+        _SIWEJwtBearerAuth_signer.set(this, void 0);
+        __classPrivateFieldSet(this, _SIWEJwtBearerAuth_config, config, "f");
+        __classPrivateFieldSet(this, _SIWEJwtBearerAuth_options, options, "f");
+    }
+    async getAccessToken() {
+        const session = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_getAuthSession).call(this);
+        if (session) {
+            return session.token.accessToken;
+        }
+        const loginResponse = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_login).call(this);
+        return loginResponse.token.accessToken;
+    }
+    async getUserProfile() {
+        const session = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_getAuthSession).call(this);
+        if (session) {
+            return session.profile;
+        }
+        const loginResponse = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_login).call(this);
+        return loginResponse.profile;
+    }
+    async getIdentifier() {
+        __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_assertSigner).call(this, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f"));
+        return __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f").address;
+    }
+    async getUserProfileLineage() {
+        const accessToken = await this.getAccessToken();
+        return await getUserProfileLineage(__classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env, accessToken);
+    }
+    async getCustomerServiceToken() {
+        const accessToken = await this.getAccessToken();
+        return await getCustomerServiceToken(__classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env, accessToken);
+    }
+    async signMessage(message) {
+        __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_assertSigner).call(this, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f"));
+        return await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f").signMessage(message);
+    }
+    prepare(signer) {
+        __classPrivateFieldSet(this, _SIWEJwtBearerAuth_signer, signer, "f");
+    }
+}
+_SIWEJwtBearerAuth_config = new WeakMap(), _SIWEJwtBearerAuth_options = new WeakMap(), _SIWEJwtBearerAuth_signer = new WeakMap(), _SIWEJwtBearerAuth_instances = new WeakSet(), _SIWEJwtBearerAuth_getAuthSession = 
+// convert expiresIn from seconds to milliseconds and use 90% of expiresIn
+async function _SIWEJwtBearerAuth_getAuthSession() {
+    const auth = await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_options, "f").storage.getLoginResponse();
+    if (!validateLoginResponse(auth)) {
+        return null;
+    }
+    const currentTime = Date.now();
+    const sessionAge = currentTime - auth.token.obtainedAt;
+    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;
+    if (sessionAge < refreshThreshold) {
+        return auth;
+    }
+    return null;
+}, _SIWEJwtBearerAuth_login = async function _SIWEJwtBearerAuth_login() {
+    __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_assertSigner).call(this, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f"));
+    // Nonce
+    const address = await this.getIdentifier();
+    const nonceRes = await getNonce(address, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env);
+    const rawMessage = __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_createSiWELoginRawMessage).call(this, nonceRes.nonce);
+    const signature = await this.signMessage(rawMessage);
+    // Authenticate
+    const authResponse = await authenticate(rawMessage, signature, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").type, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env);
+    // Authorize
+    const tokenResponse = await authorizeOIDC(authResponse.token, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").platform);
+    // Save
+    const result = {
+        profile: authResponse.profile,
+        token: tokenResponse,
+    };
+    await __classPrivateFieldGet(this, _SIWEJwtBearerAuth_options, "f").storage.setLoginResponse(result);
+    return result;
+}, _SIWEJwtBearerAuth_createSiWELoginRawMessage = function _SIWEJwtBearerAuth_createSiWELoginRawMessage(nonce) {
+    __classPrivateFieldGet(this, _SIWEJwtBearerAuth_instances, "m", _SIWEJwtBearerAuth_assertSigner).call(this, __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f"));
+    return new SiweMessage({
+        domain: __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f")?.domain,
+        address: __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f")?.address,
+        uri: SIWE_LOGIN_URL(__classPrivateFieldGet(this, _SIWEJwtBearerAuth_config, "f").env),
+        version: '1',
+        chainId: __classPrivateFieldGet(this, _SIWEJwtBearerAuth_signer, "f")?.chainId,
+        nonce,
+        issuedAt: new Date().toISOString(),
+    }).prepareMessage();
+}, _SIWEJwtBearerAuth_assertSigner = function _SIWEJwtBearerAuth_assertSigner(signer) {
+    if (!signer) {
+        throw new ValidationError(`you must call 'prepare()' before logging in`);
+    }
+};
+//# sourceMappingURL=flow-siwe.mjs.map

package/dist/sdk/authentication-jwt-bearer/flow-siwe.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-siwe.mjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-siwe.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,aAAa;AAEnC,OAAO,EAAE,eAAe,EAAE,sBAAqB;AAC/C,OAAO,EAAE,qBAAqB,EAAE,6CAA4C;AAC5E,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,QAAQ,EACR,qBAAqB,EACtB,uBAAsB;AAsBvB,MAAM,OAAO,iBAAiB;IAO5B,YACE,MAA4C,EAC5C,OAAmC;;QAR5B,4CAAoB;QAEpB,6CAAqC;QAE9C,4CAA+C;QAM7C,uBAAA,IAAI,6BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,8BAAY,OAAO,MAAA,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,uEAAgB,MAApB,IAAI,CAAkB,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,8DAAO,MAAX,IAAI,CAAS,CAAC;QAC1C,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,uEAAgB,MAApB,IAAI,CAAkB,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,8DAAO,MAAX,IAAI,CAAS,CAAC;QAC1C,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,uBAAA,IAAI,qEAAc,MAAlB,IAAI,EAAe,uBAAA,IAAI,iCAAQ,CAAC,CAAC;QACjC,OAAO,uBAAA,IAAI,iCAAQ,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,MAAM,qBAAqB,CAAC,uBAAA,IAAI,iCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,OAAO,MAAM,uBAAuB,CAAC,uBAAA,IAAI,iCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,uBAAA,IAAI,qEAAc,MAAlB,IAAI,EAAe,uBAAA,IAAI,iCAAQ,CAAC,CAAC;QACjC,OAAO,MAAM,uBAAA,IAAI,iCAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,MAAiC;QACvC,uBAAA,IAAI,6BAAW,MAAM,MAAA,CAAC;IACxB,CAAC;CA2EF;;AAzEC,0EAA0E;AAC1E,KAAK;IACH,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,kCAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC5D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,6BAED,KAAK;IACH,uBAAA,IAAI,qEAAc,MAAlB,IAAI,EAAe,uBAAA,IAAI,iCAAQ,CAAC,CAAC;IAEjC,QAAQ;IACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,uBAAA,IAAI,iCAAQ,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,uBAAA,IAAI,kFAA2B,MAA/B,IAAI,EAA4B,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAErD,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,iCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,iCAAQ,CAAC,GAAG,CACjB,CAAC;IAEF,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,iCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,iCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,kCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAErD,OAAO,MAAM,CAAC;AAChB,CAAC,uGAE0B,KAAa;IACtC,uBAAA,IAAI,qEAAc,MAAlB,IAAI,EAAe,uBAAA,IAAI,iCAAQ,CAAC,CAAC;IAEjC,OAAO,IAAI,WAAW,CAAC;QACrB,MAAM,EAAE,uBAAA,IAAI,iCAAQ,EAAE,MAAM;QAC5B,OAAO,EAAE,uBAAA,IAAI,iCAAQ,EAAE,OAAO;QAC9B,GAAG,EAAE,cAAc,CAAC,uBAAA,IAAI,iCAAQ,CAAC,GAAG,CAAC;QACrC,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,uBAAA,IAAI,iCAAQ,EAAE,OAAO;QAC9B,KAAK;QACL,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC,cAAc,EAAE,CAAC;AACtB,CAAC,6EAGC,MAAkC;IAElC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC","sourcesContent":["import { SiweMessage } from 'siwe';\n\nimport { ValidationError } from '../errors.js';\nimport { validateLoginResponse } from '../utils/validate-login-response.js';\nimport {\n  SIWE_LOGIN_URL,\n  authenticate,\n  authorizeOIDC,\n  getCustomerServiceToken,\n  getNonce,\n  getUserProfileLineage,\n} from './services.js';\nimport type {\n  AuthConfig,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types.js';\n\ntype JwtBearerAuth_SIWE_Options = {\n  storage: AuthStorageOptions;\n};\n\ntype JwtBearerAuth_SIWE_Signer = {\n  address: string;\n  chainId: number;\n  signMessage: (message: string) => Promise<string>;\n  domain: string;\n};\n\nexport class SIWEJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: JwtBearerAuth_SIWE_Options;\n\n  #signer: JwtBearerAuth_SIWE_Signer | undefined;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SiWE },\n    options: JwtBearerAuth_SIWE_Options,\n  ) {\n    this.#config = config;\n    this.#options = options;\n  }\n\n  async getAccessToken(): Promise<string> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(): Promise<string> {\n    this.#assertSigner(this.#signer);\n    return this.#signer.address;\n  }\n\n  async getUserProfileLineage(): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken();\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async getCustomerServiceToken(): Promise<string> {\n    const accessToken = await this.getAccessToken();\n    return await getCustomerServiceToken(this.#config.env, accessToken);\n  }\n\n  async signMessage(message: string): Promise<string> {\n    this.#assertSigner(this.#signer);\n    return await this.#signer.signMessage(message);\n  }\n\n  prepare(signer: JwtBearerAuth_SIWE_Signer) {\n    this.#signer = signer;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse();\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(): Promise<LoginResponse> {\n    this.#assertSigner(this.#signer);\n\n    // Nonce\n    const address = await this.getIdentifier();\n    const nonceRes = await getNonce(address, this.#config.env);\n    const rawMessage = this.#createSiWELoginRawMessage(nonceRes.nonce);\n    const signature = await this.signMessage(rawMessage);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result);\n\n    return result;\n  }\n\n  #createSiWELoginRawMessage(nonce: string): string {\n    this.#assertSigner(this.#signer);\n\n    return new SiweMessage({\n      domain: this.#signer?.domain,\n      address: this.#signer?.address,\n      uri: SIWE_LOGIN_URL(this.#config.env),\n      version: '1',\n      chainId: this.#signer?.chainId,\n      nonce,\n      issuedAt: new Date().toISOString(),\n    }).prepareMessage();\n  }\n\n  #assertSigner(\n    signer?: JwtBearerAuth_SIWE_Signer,\n  ): asserts signer is JwtBearerAuth_SIWE_Signer {\n    if (!signer) {\n      throw new ValidationError(`you must call 'prepare()' before logging in`);\n    }\n  }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/flow-srp.cjs

@@ -0,0 +1,290 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _SRPJwtBearerAuth_instances, _SRPJwtBearerAuth_config, _SRPJwtBearerAuth_options, _SRPJwtBearerAuth_metametrics, _SRPJwtBearerAuth_ongoingLogins, _SRPJwtBearerAuth_ongoingPairings, _SRPJwtBearerAuth_cooldownDefaultMs, _SRPJwtBearerAuth_maxLoginRetries, _SRPJwtBearerAuth_getLoginTag, _SRPJwtBearerAuth_getLoginIdentifierType, _SRPJwtBearerAuth_customProvider, _SRPJwtBearerAuth_getAuthSession, _SRPJwtBearerAuth_login, _SRPJwtBearerAuth_performLogin, _SRPJwtBearerAuth_deferredLogin, _SRPJwtBearerAuth_loginWithRetry, _SRPJwtBearerAuth_createSrpLoginRawMessage;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SRPJwtBearerAuth = exports.PAIR_DEDUPE_TTL_MS = void 0;
+const errors_js_1 = require("../errors.cjs");
+const eip_6963_metamask_provider_js_1 = require("../utils/eip-6963-metamask-provider.cjs");
+const messaging_signing_snap_requests_js_1 = require("../utils/messaging-signing-snap-requests.cjs");
+const validate_login_response_js_1 = require("../utils/validate-login-response.cjs");
+const services_js_1 = require("./services.cjs");
+const identifier_js_1 = require("./utils/identifier.cjs");
+const timeUtils = __importStar(require("./utils/time.cjs"));
+// How long a successful pairing result stays cached so identical payloads
+// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.
+exports.PAIR_DEDUPE_TTL_MS = 30000;
+const getDefaultEIP6963Provider = async () => {
+    const provider = await (0, eip_6963_metamask_provider_js_1.getMetaMaskProviderEIP6963)();
+    if (!provider) {
+        throw new errors_js_1.ValidationError('No MetaMask wallet connected');
+    }
+    return provider;
+};
+const getDefaultEIP6963SigningOptions = (customProvider) => ({
+    getIdentifier: async (entropySourceId) => {
+        const provider = customProvider ?? (await getDefaultEIP6963Provider());
+        return await messaging_signing_snap_requests_js_1.MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);
+    },
+    signMessage: async (message, entropySourceId) => {
+        const provider = customProvider ?? (await getDefaultEIP6963Provider());
+        (0, messaging_signing_snap_requests_js_1.assertMessageStartsWithMetamask)(message);
+        return await messaging_signing_snap_requests_js_1.MESSAGE_SIGNING_SNAP.signMessage(provider, message, entropySourceId);
+    },
+});
+class SRPJwtBearerAuth {
+    constructor(config, options) {
+        _SRPJwtBearerAuth_instances.add(this);
+        _SRPJwtBearerAuth_config.set(this, void 0);
+        _SRPJwtBearerAuth_options.set(this, void 0);
+        _SRPJwtBearerAuth_metametrics.set(this, void 0);
+        // Map to store ongoing login promises by entropySourceId
+        _SRPJwtBearerAuth_ongoingLogins.set(this, new Map());
+        // Map to dedupe pairing calls by an order-insensitive token-set key.
+        // Holds the in-flight promise (coalescing concurrent callers) and keeps it
+        // for a short TTL after success (collapsing sequential retries).
+        _SRPJwtBearerAuth_ongoingPairings.set(this, new Map());
+        // Default cooldown when 429 has no Retry-After header
+        _SRPJwtBearerAuth_cooldownDefaultMs.set(this, void 0);
+        // Maximum number of login retries on rate limit errors
+        _SRPJwtBearerAuth_maxLoginRetries.set(this, void 0);
+        _SRPJwtBearerAuth_getLoginTag.set(this, void 0);
+        _SRPJwtBearerAuth_getLoginIdentifierType.set(this, void 0);
+        _SRPJwtBearerAuth_customProvider.set(this, void 0);
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_config, config, "f");
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_customProvider, options.customProvider, "f");
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_getLoginTag, options.getLoginTag, "f");
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_getLoginIdentifierType, options.getLoginIdentifierType, "f");
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_options, {
+            storage: options.storage,
+            signing: options.signing ??
+                getDefaultEIP6963SigningOptions(__classPrivateFieldGet(this, _SRPJwtBearerAuth_customProvider, "f")),
+        }, "f");
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_metametrics, options.metametrics, "f");
+        // Apply rate limit retry config if provided
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_cooldownDefaultMs, options.rateLimitRetry?.cooldownDefaultMs ?? 10000, "f");
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_maxLoginRetries, options.rateLimitRetry?.maxLoginRetries ?? 1, "f");
+    }
+    setCustomProvider(provider) {
+        __classPrivateFieldSet(this, _SRPJwtBearerAuth_customProvider, provider, "f");
+        __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").signing = getDefaultEIP6963SigningOptions(provider);
+    }
+    // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed
+    async getAccessToken(entropySourceId) {
+        const session = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_getAuthSession).call(this, entropySourceId);
+        if (session) {
+            return session.token.accessToken;
+        }
+        const loginResponse = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_login).call(this, entropySourceId);
+        return loginResponse.token.accessToken;
+    }
+    async getUserProfile(entropySourceId) {
+        const session = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_getAuthSession).call(this, entropySourceId);
+        if (session) {
+            return session.profile;
+        }
+        const loginResponse = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_login).call(this, entropySourceId);
+        return loginResponse.profile;
+    }
+    async getIdentifier(entropySourceId) {
+        return await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").signing.getIdentifier(entropySourceId);
+    }
+    async getUserProfileLineage(entropySourceId) {
+        const accessToken = await this.getAccessToken(entropySourceId);
+        return await (0, services_js_1.getUserProfileLineage)(__classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env, accessToken);
+    }
+    async getCustomerServiceToken(entropySourceId) {
+        const accessToken = await this.getAccessToken(entropySourceId);
+        return await (0, services_js_1.getCustomerServiceToken)(__classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env, accessToken);
+    }
+    async pairSrpProfiles(accessTokens, authAccessToken) {
+        // Order-insensitive key: the same token set in any order maps to the same
+        // entry. Sort a copy so the request payload itself stays primary-first.
+        const key = JSON.stringify([...accessTokens].sort());
+        const cached = __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").get(key);
+        if (cached && cached.expiresAt > Date.now()) {
+            return await cached.promise;
+        }
+        const promise = (0, services_js_1.pairProfiles)(accessTokens, authAccessToken, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+        // Store the in-flight promise immediately so concurrent callers coalesce
+        // regardless of how long the request takes.
+        __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").set(key, {
+            promise,
+            expiresAt: Number.MAX_SAFE_INTEGER,
+        });
+        try {
+            const result = await promise;
+            // Keep the resolved result cached for a short window so sequential
+            // retries with the same payload reuse it.
+            __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").set(key, {
+                promise,
+                expiresAt: Date.now() + exports.PAIR_DEDUPE_TTL_MS,
+            });
+            return result;
+        }
+        catch (error) {
+            // Never cache failures: the pairing retry loop must be able to re-hit
+            // the endpoint on the next attempt.
+            __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").delete(key);
+            throw error;
+        }
+    }
+    async signMessage(message, entropySourceId) {
+        return await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").signing.signMessage(message, entropySourceId);
+    }
+    async isSnapConnected() {
+        const provider = __classPrivateFieldGet(this, _SRPJwtBearerAuth_customProvider, "f") ?? (await getDefaultEIP6963Provider());
+        if (!provider) {
+            return false;
+        }
+        const isConnected = await (0, messaging_signing_snap_requests_js_1.isSnapConnected)(provider);
+        return isConnected;
+    }
+    async connectSnap() {
+        const provider = __classPrivateFieldGet(this, _SRPJwtBearerAuth_customProvider, "f") ?? (await getDefaultEIP6963Provider());
+        const res = await (0, messaging_signing_snap_requests_js_1.connectSnap)(provider);
+        return res;
+    }
+}
+exports.SRPJwtBearerAuth = SRPJwtBearerAuth;
+_SRPJwtBearerAuth_config = new WeakMap(), _SRPJwtBearerAuth_options = new WeakMap(), _SRPJwtBearerAuth_metametrics = new WeakMap(), _SRPJwtBearerAuth_ongoingLogins = new WeakMap(), _SRPJwtBearerAuth_ongoingPairings = new WeakMap(), _SRPJwtBearerAuth_cooldownDefaultMs = new WeakMap(), _SRPJwtBearerAuth_maxLoginRetries = new WeakMap(), _SRPJwtBearerAuth_getLoginTag = new WeakMap(), _SRPJwtBearerAuth_getLoginIdentifierType = new WeakMap(), _SRPJwtBearerAuth_customProvider = new WeakMap(), _SRPJwtBearerAuth_instances = new WeakSet(), _SRPJwtBearerAuth_getAuthSession = 
+// convert expiresIn from seconds to milliseconds and use 90% of expiresIn
+async function _SRPJwtBearerAuth_getAuthSession(entropySourceId) {
+    const auth = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").storage.getLoginResponse(entropySourceId);
+    if (!(0, validate_login_response_js_1.validateLoginResponse)(auth)) {
+        return null;
+    }
+    // get canonical profile id from server if not present in the cached session
+    if (!auth.profile.canonicalProfileId) {
+        return null;
+    }
+    const currentTime = Date.now();
+    const sessionAge = currentTime - auth.token.obtainedAt;
+    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;
+    if (sessionAge < refreshThreshold) {
+        return auth;
+    }
+    return null;
+}, _SRPJwtBearerAuth_login = async function _SRPJwtBearerAuth_login(entropySourceId) {
+    // Use a deferred login to avoid race conditions
+    return await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_deferredLogin).call(this, entropySourceId);
+}, _SRPJwtBearerAuth_performLogin = async function _SRPJwtBearerAuth_performLogin(entropySourceId) {
+    // Nonce
+    const publicKey = await this.getIdentifier(entropySourceId);
+    const nonceRes = await (0, services_js_1.getNonce)(publicKey, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+    // Tag only when the wallet supplies getLoginTag. SDK callers keep the
+    // legacy 3-part message rather than guessing `primary`.
+    const tag = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_getLoginTag, "f")?.call(this, entropySourceId);
+    const identifierType = (await __classPrivateFieldGet(this, _SRPJwtBearerAuth_getLoginIdentifierType, "f")?.call(this, entropySourceId)) ?? 'SRP';
+    const rawMessage = __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_createSrpLoginRawMessage).call(this, nonceRes.nonce, publicKey, tag);
+    const signature = await this.signMessage(rawMessage, entropySourceId);
+    // Authenticate
+    const authResponse = await (0, services_js_1.authenticate)(rawMessage, signature, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").type, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env, __classPrivateFieldGet(this, _SRPJwtBearerAuth_metametrics, "f"), identifierType);
+    // Resolve original profileId from aliases.
+    // This is done mainly to preserve the original profileId for storage key derivation
+    // until we migrate to the canonical profileId storage system.
+    const canonicalProfileId = authResponse.profile.profileId;
+    const profile = { ...authResponse.profile };
+    if (authResponse.profileAliases?.length > 0) {
+        const targetIdentifierId = (0, identifier_js_1.computeIdentifierId)(publicKey, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+        const matchingAliases = authResponse.profileAliases.filter((alias) => alias.identifierIds.some((id) => id.id === targetIdentifierId));
+        // Prefer the leaf alias (single identifier) — it's the original profile
+        // created for this SRP. Multi-identifier aliases are former canonicals
+        // that absorbed other profiles; they are correct only when this SRP's
+        // original profile was itself a canonical before being absorbed.
+        const targetAlias = matchingAliases.find((alias) => alias.identifierIds.length === 1) ??
+            matchingAliases[0];
+        if (targetAlias) {
+            profile.profileId = targetAlias.aliasProfileId;
+        }
+    }
+    profile.canonicalProfileId = canonicalProfileId;
+    // Authorize
+    const tokenResponse = await (0, services_js_1.authorizeOIDC)(authResponse.token, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").platform);
+    // Save
+    const result = {
+        profile,
+        token: tokenResponse,
+    };
+    await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").storage.setLoginResponse(result, entropySourceId);
+    return result;
+}, _SRPJwtBearerAuth_deferredLogin = async function _SRPJwtBearerAuth_deferredLogin(entropySourceId) {
+    // Check if there's already an ongoing login for this entropySourceId
+    const existingLogin = __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").get(entropySourceId);
+    if (existingLogin) {
+        return existingLogin;
+    }
+    // Create a new login promise
+    const loginPromise = __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_loginWithRetry).call(this, entropySourceId);
+    // Store the promise in the map
+    __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").set(entropySourceId, loginPromise);
+    try {
+        // Wait for the login to complete
+        return await loginPromise;
+    }
+    finally {
+        // Always clean up the ongoing login promise when done
+        __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingLogins, "f").delete(entropySourceId);
+    }
+}, _SRPJwtBearerAuth_loginWithRetry = async function _SRPJwtBearerAuth_loginWithRetry(entropySourceId) {
+    // Allow max attempts: initial + maxLoginRetries on 429
+    for (let attempt = 0; attempt < 1 + __classPrivateFieldGet(this, _SRPJwtBearerAuth_maxLoginRetries, "f"); attempt += 1) {
+        try {
+            return await __classPrivateFieldGet(this, _SRPJwtBearerAuth_instances, "m", _SRPJwtBearerAuth_performLogin).call(this, entropySourceId);
+        }
+        catch (e) {
+            // Only retry on rate-limit (429) errors
+            if (!errors_js_1.RateLimitedError.isRateLimitError(e)) {
+                throw e;
+            }
+            // If we've exhausted attempts, rethrow
+            if (attempt >= __classPrivateFieldGet(this, _SRPJwtBearerAuth_maxLoginRetries, "f")) {
+                throw e;
+            }
+            // Wait for Retry-After or default cooldown
+            const waitMs = e.retryAfterMs ?? __classPrivateFieldGet(this, _SRPJwtBearerAuth_cooldownDefaultMs, "f");
+            await timeUtils.delay(waitMs);
+            // Loop continues to retry
+        }
+    }
+    // Should never reach here due to loop logic, but TypeScript needs a return
+    throw new Error('Unexpected: login loop exhausted without result');
+}, _SRPJwtBearerAuth_createSrpLoginRawMessage = function _SRPJwtBearerAuth_createSrpLoginRawMessage(nonce, publicKey, tag) {
+    if (tag) {
+        return `metamask:${nonce}:${publicKey}:${tag}`;
+    }
+    return `metamask:${nonce}:${publicKey}`;
+};
+//# sourceMappingURL=flow-srp.cjs.map