@metamask-previews/profile-sync-controller 29.0.0-preview-3866c0ff1 → 29.0.0-preview-e3275932a

package/dist/sdk/authentication-jwt-bearer/services.cjs

@@ -0,0 +1,400 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCustomerServiceToken = exports.getUserProfileLineage = exports.authenticate = exports.authorizeOIDC = exports.getNonce = exports.pairProfiles = exports.pairIdentifiers = exports.CUSTOMER_SERVICE_TOKEN_URL = exports.PROFILE_LINEAGE_URL = exports.PAIR_PROFILES_URL = exports.SIWE_LOGIN_URL = exports.SRP_LOGIN_URL = exports.OIDC_TOKEN_URL = exports.PAIR_IDENTIFIERS = exports.NONCE_URL = void 0;
+const env_js_1 = require("../../shared/env.cjs");
+const constants_js_1 = require("../constants.cjs");
+const errors_js_1 = require("../errors.cjs");
+const validate_pair_response_js_1 = require("../utils/validate-pair-response.cjs");
+const types_js_1 = require("./types.cjs");
+/**
+ * Parse Retry-After header into milliseconds if possible.
+ * Supports seconds or HTTP-date formats.
+ *
+ * @param retryAfterHeader - The Retry-After header value (seconds or HTTP-date)
+ * @returns The retry delay in milliseconds, or null if parsing fails
+ */
+function parseRetryAfter(retryAfterHeader) {
+    if (!retryAfterHeader) {
+        return null;
+    }
+    const seconds = Number(retryAfterHeader);
+    if (!Number.isNaN(seconds)) {
+        return seconds * 1000;
+    }
+    const date = Date.parse(retryAfterHeader);
+    if (!Number.isNaN(date)) {
+        const diff = date - Date.now();
+        return diff > 0 ? diff : null;
+    }
+    return null;
+}
+/**
+ * Extracts error details from a Response object.
+ *
+ * @param response - The HTTP response object
+ * @returns Formatted error message with HTTP status and response body
+ */
+async function getResponseErrorMessage(response) {
+    const { status } = response;
+    const clonedResponse = response.clone();
+    let message = 'Unknown error';
+    let error = 'unknown';
+    try {
+        const responseBody = (await response.json());
+        message =
+            'message' in responseBody
+                ? responseBody.message
+                : responseBody.error_description;
+        error = responseBody.error ?? 'unknown';
+    }
+    catch {
+        try {
+            const textContent = await clonedResponse.text();
+            message = textContent
+                ? textContent.slice(0, 150)
+                : 'Non-JSON error response';
+            error = 'non_json_response';
+        }
+        catch {
+            message = 'Unable to parse error response';
+            error = 'unparseable_response';
+        }
+    }
+    return `HTTP ${status} - ${message} (error: ${error})`;
+}
+/**
+ * Type guard to check if an object is a Response-like object.
+ *
+ * @param obj - The object to check
+ * @returns True if the object is a Response-like object, false otherwise
+ */
+const isErrorResponse = (obj) => typeof obj === 'object' &&
+    obj !== null &&
+    'status' in obj &&
+    'headers' in obj;
+/**
+ * Throws a domain-specific error for service failures.
+ * Handles both HTTP error responses and regular errors (network failures, etc.).
+ * For HTTP 429, throws RateLimitedError with Retry-After header parsing.
+ *
+ * @param error - The error (Response object or caught error)
+ * @param errorPrefix - Context prefix for the error message
+ * @param ErrorClass - The domain-specific error class to throw
+ * @throws RateLimitedError for 429, otherwise ErrorClass
+ */
+async function throwServiceError(error, errorPrefix, ErrorClass) {
+    // Re-throw RateLimitedError or matching ErrorClass as-is (don't double-wrap)
+    if (error instanceof errors_js_1.RateLimitedError || error instanceof ErrorClass) {
+        throw error;
+    }
+    // Not a Response-like object - handle as regular error
+    if (!isErrorResponse(error)) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        throw new ErrorClass(`${errorPrefix}: ${errorMessage}`);
+    }
+    // Handle HTTP error response
+    const response = error;
+    const { status } = response;
+    const responseMessage = await getResponseErrorMessage(response);
+    if (status === constants_js_1.HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
+        const retryAfterHeader = response.headers.get('Retry-After');
+        const retryAfterMs = parseRetryAfter(retryAfterHeader);
+        throw new errors_js_1.RateLimitedError(`${errorPrefix}: ${responseMessage}`, retryAfterMs ?? undefined);
+    }
+    throw new ErrorClass(`${errorPrefix}: ${responseMessage}`);
+}
+const NONCE_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/nonce`;
+exports.NONCE_URL = NONCE_URL;
+const PAIR_IDENTIFIERS = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/identifiers/pair`;
+exports.PAIR_IDENTIFIERS = PAIR_IDENTIFIERS;
+const OIDC_TOKEN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).oidcApiUrl}/oauth2/token`;
+exports.OIDC_TOKEN_URL = OIDC_TOKEN_URL;
+const SRP_LOGIN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/srp/login`;
+exports.SRP_LOGIN_URL = SRP_LOGIN_URL;
+const SIWE_LOGIN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/siwe/login`;
+exports.SIWE_LOGIN_URL = SIWE_LOGIN_URL;
+const PAIR_PROFILES_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/pair`;
+exports.PAIR_PROFILES_URL = PAIR_PROFILES_URL;
+const PROFILE_LINEAGE_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/lineage`;
+exports.PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL;
+const CUSTOMER_SERVICE_TOKEN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/customer-service/token`;
+exports.CUSTOMER_SERVICE_TOKEN_URL = CUSTOMER_SERVICE_TOKEN_URL;
+const getAuthenticationUrl = (authType, env) => {
+    switch (authType) {
+        case types_js_1.AuthType.SRP:
+            return (0, exports.SRP_LOGIN_URL)(env);
+        case types_js_1.AuthType.SiWE:
+            return (0, exports.SIWE_LOGIN_URL)(env);
+        /* istanbul ignore next */
+        default:
+            throw new errors_js_1.ValidationError(`Invalid AuthType: ${authType} - unable to create Auth URL`);
+    }
+};
+const parseProfileAliases = (raw) => {
+    return raw.map((alias) => ({
+        aliasProfileId: alias.alias_profile_id,
+        canonicalProfileId: alias.canonical_profile_id,
+        identifierIds: alias.identifier_ids ?? [],
+    }));
+};
+/**
+ * Pair multiple identifiers under a single profile
+ *
+ * @param nonce - session nonce
+ * @param logins - pairing request payload
+ * @param accessToken - JWT access token used to access protected resources
+ * @param env - server environment
+ * @returns void.
+ */
+async function pairIdentifiers(nonce, logins, accessToken, env) {
+    const pairUrl = new URL((0, exports.PAIR_IDENTIFIERS)(env));
+    try {
+        const response = await fetch(pairUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body: JSON.stringify({
+                nonce,
+                logins,
+            }),
+        });
+        if (!response.ok) {
+            return await throwServiceError(response, 'Failed to pair identifiers', errors_js_1.PairError);
+        }
+        return undefined;
+    }
+    catch (error) {
+        return await throwServiceError(error, 'Failed to pair identifiers', errors_js_1.PairError);
+    }
+}
+exports.pairIdentifiers = pairIdentifiers;
+/**
+ * Pair multiple profiles using their OIDC access tokens.
+ * Idempotent — calling with already-paired tokens is a no-op.
+ *
+ * @param accessTokens - Two or more OIDC access tokens to pair
+ * @param authAccessToken - A valid access token for the Authorization header
+ * @param env - server environment
+ * @returns The pair response containing the canonical profile and aliases
+ */
+async function pairProfiles(accessTokens, authAccessToken, env) {
+    const pairUrl = new URL((0, exports.PAIR_PROFILES_URL)(env));
+    try {
+        const response = await fetch(pairUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${authAccessToken}`,
+            },
+            body: JSON.stringify({
+                jwts: accessTokens,
+            }),
+        });
+        if (!response.ok) {
+            return await throwServiceError(response, 'Failed to pair profiles', errors_js_1.PairError);
+        }
+        const pairResponse = await response.json();
+        (0, validate_pair_response_js_1.validatePairResponse)(pairResponse);
+        return {
+            profile: {
+                identifierId: pairResponse.profile.identifier_id,
+                metaMetricsId: pairResponse.profile.metametrics_id ?? '',
+                profileId: pairResponse.profile.profile_id,
+                canonicalProfileId: pairResponse.profile.profile_id,
+            },
+            profileAliases: parseProfileAliases(pairResponse.profile_aliases ?? []),
+        };
+    }
+    catch (error) {
+        return await throwServiceError(error, 'Failed to pair profiles', errors_js_1.PairError);
+    }
+}
+exports.pairProfiles = pairProfiles;
+/**
+ * Service to Get Nonce for JWT Bearer Flow
+ *
+ * @param id - identifier ID
+ * @param env - server environment
+ * @returns the nonce.
+ */
+async function getNonce(id, env) {
+    const nonceUrl = new URL((0, exports.NONCE_URL)(env));
+    nonceUrl.searchParams.set('identifier', id);
+    try {
+        const nonceResponse = await fetch(nonceUrl.toString());
+        if (!nonceResponse.ok) {
+            return await throwServiceError(nonceResponse, 'Failed to get nonce', errors_js_1.NonceRetrievalError);
+        }
+        const nonceJson = await nonceResponse.json();
+        return {
+            nonce: nonceJson.nonce,
+            identifier: nonceJson.identifier,
+            expiresIn: nonceJson.expires_in,
+        };
+    }
+    catch (error) {
+        return await throwServiceError(error, 'Failed to get nonce', errors_js_1.NonceRetrievalError);
+    }
+}
+exports.getNonce = getNonce;
+/**
+ * Service to Authorize And perform OIDC Flow to get the Access Token
+ *
+ * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)
+ * @param env - server environment
+ * @param platform - SDK platform
+ * @returns Access Token from Authorization server
+ */
+async function authorizeOIDC(jwtToken, env, platform) {
+    const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+    };
+    const urlEncodedBody = new URLSearchParams();
+    urlEncodedBody.append('grant_type', grantType);
+    urlEncodedBody.append('client_id', (0, env_js_1.getOidcClientId)(env, platform));
+    urlEncodedBody.append('assertion', jwtToken);
+    try {
+        const response = await fetch((0, exports.OIDC_TOKEN_URL)(env), {
+            method: 'POST',
+            headers,
+            body: urlEncodedBody.toString(),
+        });
+        if (!response.ok) {
+            return await throwServiceError(response, 'Failed to get access token', errors_js_1.SignInError);
+        }
+        const accessTokenResponse = await response.json();
+        return {
+            accessToken: accessTokenResponse.access_token,
+            expiresIn: accessTokenResponse.expires_in,
+            obtainedAt: Date.now(),
+        };
+    }
+    catch (error) {
+        return await throwServiceError(error, 'Failed to get access token', errors_js_1.SignInError);
+    }
+}
+exports.authorizeOIDC = authorizeOIDC;
+/**
+ * Service to Authenticate/Login a user via SIWE or SRP derived key.
+ *
+ * @param rawMessage - raw message for validation when authenticating
+ * @param signature - signed raw message
+ * @param authType - authentication type/flow used
+ * @param env - server environment
+ * @param metametrics - optional metametrics
+ * @param identifierType - login identifier type included in metametrics
+ *   (defaults to `SRP` when metametrics is present)
+ * @returns Authentication Token
+ */
+async function authenticate(rawMessage, signature, authType, env, metametrics, identifierType = 'SRP') {
+    const authenticationUrl = getAuthenticationUrl(authType, env);
+    try {
+        const response = await fetch(authenticationUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                ...(authType === types_js_1.AuthType.SRP
+                    ? { 'X-MetaMask-Profile-Pairing': 'enabled' }
+                    : {}),
+            },
+            body: JSON.stringify({
+                signature,
+                raw_message: rawMessage,
+                ...(metametrics
+                    ? {
+                        metametrics: {
+                            metametrics_id: await metametrics.getMetaMetricsId(),
+                            agent: metametrics.agent,
+                            app_version: await metametrics.getAppVersion?.(),
+                            identifier_type: identifierType,
+                        },
+                    }
+                    : {}),
+            }),
+        });
+        if (!response.ok) {
+            return await throwServiceError(response, `Failed to login with ${authType}`, errors_js_1.SignInError);
+        }
+        const loginResponse = await response.json();
+        return {
+            token: loginResponse.token,
+            expiresIn: loginResponse.expires_in,
+            profile: {
+                identifierId: loginResponse.profile.identifier_id,
+                metaMetricsId: loginResponse.profile.metametrics_id,
+                profileId: loginResponse.profile.profile_id,
+                canonicalProfileId: loginResponse.profile.profile_id,
+            },
+            profileAliases: parseProfileAliases(loginResponse.profile_aliases ?? []),
+        };
+    }
+    catch (error) {
+        return await throwServiceError(error, `Failed to login with ${authType}`, errors_js_1.SignInError);
+    }
+}
+exports.authenticate = authenticate;
+/**
+ * Service to get the Profile Lineage
+ *
+ * @param env - server environment
+ * @param accessToken - JWT access token used to access protected resources
+ * @returns Profile Lineage information.
+ */
+async function getUserProfileLineage(env, accessToken) {
+    const profileLineageUrl = new URL((0, exports.PROFILE_LINEAGE_URL)(env));
+    try {
+        const response = await fetch(profileLineageUrl, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+        });
+        if (!response.ok) {
+            return await throwServiceError(response, 'Failed to get profile lineage', errors_js_1.SignInError);
+        }
+        const profileJson = await response.json();
+        return profileJson;
+    }
+    catch (error) {
+        return await throwServiceError(error, 'Failed to get profile lineage', errors_js_1.SignInError);
+    }
+}
+exports.getUserProfileLineage = getUserProfileLineage;
+/**
+ * Service to get a Customer Service specific access token.
+ *
+ * Exchanges a valid OIDC access token for a short-lived token scoped to the
+ * customer-service audience, which Customer Service tooling consumes to
+ * identify and authenticate the user.
+ *
+ * @param env - server environment
+ * @param accessToken - JWT access token used to access protected resources
+ * @returns The customer-service access token.
+ */
+async function getCustomerServiceToken(env, accessToken) {
+    const customerServiceTokenUrl = new URL((0, exports.CUSTOMER_SERVICE_TOKEN_URL)(env));
+    try {
+        const response = await fetch(customerServiceTokenUrl, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+        });
+        if (!response.ok) {
+            return await throwServiceError(response, 'Failed to get customer service token', errors_js_1.SignInError);
+        }
+        const tokenResponse = await response.json();
+        if (typeof tokenResponse?.access_token !== 'string') {
+            throw new errors_js_1.SignInError('Failed to get customer service token: missing access_token');
+        }
+        return tokenResponse.access_token;
+    }
+    catch (error) {
+        return await throwServiceError(error, 'Failed to get customer service token', errors_js_1.SignInError);
+    }
+}
+exports.getCustomerServiceToken = getCustomerServiceToken;
+//# sourceMappingURL=services.cjs.map

package/dist/sdk/authentication-jwt-bearer/services.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":";;;AACA,iDAAkE;AAElE,mDAAoD;AACpD,6CAMsB;AACtB,mFAA0E;AAS1E,0CAAsC;AAEtC;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,gBAA+B;IACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;IAExC,IAAI,OAAO,GAAG,eAAe,CAAC;IAC9B,IAAI,KAAK,GAAG,SAAS,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGK,CAAC;QAEjD,OAAO;YACL,SAAS,IAAI,YAAY;gBACvB,CAAC,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;QACrC,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;YAChD,OAAO,GAAG,WAAW;gBACnB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC3B,CAAC,CAAC,yBAAyB,CAAC;YAC9B,KAAK,GAAG,mBAAmB,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,gCAAgC,CAAC;YAC3C,KAAK,GAAG,sBAAsB,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,MAAM,MAAM,OAAO,YAAY,KAAK,GAAG,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAmB,EAAE,CACxD,OAAO,GAAG,KAAK,QAAQ;IACvB,GAAG,KAAK,IAAI;IACZ,QAAQ,IAAI,GAAG;IACf,SAAS,IAAI,GAAG,CAAC;AAEnB;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,WAAmB,EACnB,UAA0C;IAE1C,6EAA6E;IAC7E,IAAI,KAAK,YAAY,4BAAgB,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,YAAY,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,eAAe,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAEhE,IAAI,MAAM,KAAK,gCAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,IAAI,4BAAgB,CACxB,GAAG,WAAW,KAAK,eAAe,EAAE,EACpC,YAAY,IAAI,SAAS,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,eAAe,EAAE,CAAC,CAAC;AAC7D,CAAC;AAEM,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC5C,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AADlC,QAAA,SAAS,aACyB;AAExC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACnD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,0BAA0B,CAAC;AAD7C,QAAA,gBAAgB,oBAC6B;AAEnD,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AADlC,QAAA,cAAc,kBACoB;AAExC,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAU,EAAE,CAChD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,mBAAmB,CAAC;AADtC,QAAA,aAAa,iBACyB;AAE5C,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AADvC,QAAA,cAAc,kBACyB;AAE7C,MAAM,iBAAiB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACpD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,sBAAsB,CAAC;AADzC,QAAA,iBAAiB,qBACwB;AAE/C,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AAD5C,QAAA,mBAAmB,uBACyB;AAElD,MAAM,0BAA0B,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC7D,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,gCAAgC,CAAC;AADnD,QAAA,0BAA0B,8BACyB;AAEhE,MAAM,oBAAoB,GAAG,CAAC,QAAkB,EAAE,GAAQ,EAAU,EAAE;IACpE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,mBAAQ,CAAC,GAAG;YACf,OAAO,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,mBAAQ,CAAC,IAAI;YAChB,OAAO,IAAA,sBAAc,EAAC,GAAG,CAAC,CAAC;QAC7B,0BAA0B;QAC1B;YACE,MAAM,IAAI,2BAAe,CACvB,qBAAqB,QAAkB,8BAA8B,CACtE,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AAiBF,MAAM,mBAAmB,GAAG,CAAC,GAAsB,EAAkB,EAAE;IACrE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzB,cAAc,EAAE,KAAK,CAAC,gBAAgB;QACtC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB;QAC9C,aAAa,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACI,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,MAAqB,EACrB,WAAmB,EACnB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAA,wBAAgB,EAAC,GAAG,CAAC,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,MAAM;aACP,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,4BAA4B,EAC5B,qBAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,4BAA4B,EAC5B,qBAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AApCD,0CAoCC;AAOD;;;;;;;;GAQG;AACI,KAAK,UAAU,YAAY,CAChC,YAAsB,EACtB,eAAuB,EACvB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAA,yBAAiB,EAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,eAAe,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,YAAY;aACnB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,yBAAyB,EACzB,qBAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,IAAA,gDAAoB,EAAC,YAAY,CAAC,CAAC;QAEnC,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa;gBAChD,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE;gBACxD,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU;gBAC1C,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU;aACpD;YACD,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,EAAE,qBAAS,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AA1CD,oCA0CC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,QAAQ,CAAC,EAAU,EAAE,GAAQ;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAA,iBAAS,EAAC,GAAG,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,MAAM,iBAAiB,CAC5B,aAAa,EACb,qBAAqB,EACrB,+BAAmB,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,SAAS,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,qBAAqB,EACrB,+BAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AA3BD,4BA2BC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,GAAQ,EACR,QAAkB;IAElB,MAAM,SAAS,GAAG,6CAA6C,CAAC;IAChE,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,mCAAmC;KACpD,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7C,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAA,sBAAc,EAAC,GAAG,CAAC,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,4BAA4B,EAC5B,uBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,WAAW,EAAE,mBAAmB,CAAC,YAAY;YAC7C,SAAS,EAAE,mBAAmB,CAAC,UAAU;YACzC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,4BAA4B,EAC5B,uBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA3CD,sCA2CC;AAQD;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,SAAiB,EACjB,QAAkB,EAClB,GAAQ,EACR,WAA6B,EAC7B,iBAAsC,KAAK;IAE3C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,QAAQ,KAAK,mBAAQ,CAAC,GAAG;oBAC3B,CAAC,CAAC,EAAE,4BAA4B,EAAE,SAAS,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,WAAW,EAAE,UAAU;gBACvB,GAAG,CAAC,WAAW;oBACb,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,cAAc,EAAE,MAAM,WAAW,CAAC,gBAAgB,EAAE;4BACpD,KAAK,EAAE,WAAW,CAAC,KAAK;4BACxB,WAAW,EAAE,MAAM,WAAW,CAAC,aAAa,EAAE,EAAE;4BAChD,eAAe,EAAE,cAAc;yBAChC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,wBAAwB,QAAQ,EAAE,EAClC,uBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,SAAS,EAAE,aAAa,CAAC,UAAU;YACnC,OAAO,EAAE;gBACP,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa;gBACjD,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc;gBACnD,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;gBAC3C,kBAAkB,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;aACrD;YACD,cAAc,EAAE,mBAAmB,CAAC,aAAa,CAAC,eAAe,IAAI,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,wBAAwB,QAAQ,EAAE,EAClC,uBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA/DD,oCA+DC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,GAAQ,EACR,WAAmB;IAEnB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,IAAA,2BAAmB,EAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,+BAA+B,EAC/B,uBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAuB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,+BAA+B,EAC/B,uBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA/BD,sDA+BC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,WAAmB;IAEnB,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,IAAA,kCAA0B,EAAC,GAAG,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,sCAAsC,EACtC,uBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,uBAAW,CACnB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,sCAAsC,EACtC,uBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AApCD,0DAoCC","sourcesContent":["import type { Env, Platform } from '../../shared/env.js';\nimport { getEnvUrls, getOidcClientId } from '../../shared/env.js';\nimport type { MetaMetricsAuth } from '../../shared/types/services.js';\nimport { HTTP_STATUS_CODES } from '../constants.js';\nimport {\n  NonceRetrievalError,\n  PairError,\n  SignInError,\n  ValidationError,\n  RateLimitedError,\n} from '../errors.js';\nimport { validatePairResponse } from '../utils/validate-pair-response.js';\nimport type {\n  AccessToken,\n  ErrorMessage,\n  LoginIdentifierType,\n  ProfileAlias,\n  UserProfile,\n  UserProfileLineage,\n} from './types.js';\nimport { AuthType } from './types.js';\n\n/**\n * Parse Retry-After header into milliseconds if possible.\n * Supports seconds or HTTP-date formats.\n *\n * @param retryAfterHeader - The Retry-After header value (seconds or HTTP-date)\n * @returns The retry delay in milliseconds, or null if parsing fails\n */\nfunction parseRetryAfter(retryAfterHeader: string | null): number | null {\n  if (!retryAfterHeader) {\n    return null;\n  }\n  const seconds = Number(retryAfterHeader);\n  if (!Number.isNaN(seconds)) {\n    return seconds * 1000;\n  }\n  const date = Date.parse(retryAfterHeader);\n  if (!Number.isNaN(date)) {\n    const diff = date - Date.now();\n    return diff > 0 ? diff : null;\n  }\n  return null;\n}\n\n/**\n * Extracts error details from a Response object.\n *\n * @param response - The HTTP response object\n * @returns Formatted error message with HTTP status and response body\n */\nasync function getResponseErrorMessage(response: Response): Promise<string> {\n  const { status } = response;\n  const clonedResponse = response.clone();\n\n  let message = 'Unknown error';\n  let error = 'unknown';\n\n  try {\n    const responseBody = (await response.json()) as\n      | ErrorMessage\n      // eslint-disable-next-line @typescript-eslint/naming-convention\n      | { error_description: string; error: string };\n\n    message =\n      'message' in responseBody\n        ? responseBody.message\n        : responseBody.error_description;\n    error = responseBody.error ?? 'unknown';\n  } catch {\n    try {\n      const textContent = await clonedResponse.text();\n      message = textContent\n        ? textContent.slice(0, 150)\n        : 'Non-JSON error response';\n      error = 'non_json_response';\n    } catch {\n      message = 'Unable to parse error response';\n      error = 'unparseable_response';\n    }\n  }\n\n  return `HTTP ${status} - ${message} (error: ${error})`;\n}\n\n/**\n * Type guard to check if an object is a Response-like object.\n *\n * @param obj - The object to check\n * @returns True if the object is a Response-like object, false otherwise\n */\nconst isErrorResponse = (obj: unknown): obj is Response =>\n  typeof obj === 'object' &&\n  obj !== null &&\n  'status' in obj &&\n  'headers' in obj;\n\n/**\n * Throws a domain-specific error for service failures.\n * Handles both HTTP error responses and regular errors (network failures, etc.).\n * For HTTP 429, throws RateLimitedError with Retry-After header parsing.\n *\n * @param error - The error (Response object or caught error)\n * @param errorPrefix - Context prefix for the error message\n * @param ErrorClass - The domain-specific error class to throw\n * @throws RateLimitedError for 429, otherwise ErrorClass\n */\nasync function throwServiceError(\n  error: unknown,\n  errorPrefix: string,\n  ErrorClass: new (message: string) => Error,\n): Promise<never> {\n  // Re-throw RateLimitedError or matching ErrorClass as-is (don't double-wrap)\n  if (error instanceof RateLimitedError || error instanceof ErrorClass) {\n    throw error;\n  }\n\n  // Not a Response-like object - handle as regular error\n  if (!isErrorResponse(error)) {\n    const errorMessage = error instanceof Error ? error.message : String(error);\n    throw new ErrorClass(`${errorPrefix}: ${errorMessage}`);\n  }\n\n  // Handle HTTP error response\n  const response = error;\n  const { status } = response;\n  const responseMessage = await getResponseErrorMessage(response);\n\n  if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n    const retryAfterHeader = response.headers.get('Retry-After');\n    const retryAfterMs = parseRetryAfter(retryAfterHeader);\n    throw new RateLimitedError(\n      `${errorPrefix}: ${responseMessage}`,\n      retryAfterMs ?? undefined,\n    );\n  }\n\n  throw new ErrorClass(`${errorPrefix}: ${responseMessage}`);\n}\n\nexport const NONCE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/nonce`;\n\nexport const PAIR_IDENTIFIERS = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/identifiers/pair`;\n\nexport const OIDC_TOKEN_URL = (env: Env): string =>\n  `${getEnvUrls(env).oidcApiUrl}/oauth2/token`;\n\nexport const SRP_LOGIN_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/srp/login`;\n\nexport const SIWE_LOGIN_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/siwe/login`;\n\nexport const PAIR_PROFILES_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/profile/pair`;\n\nexport const PROFILE_LINEAGE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/profile/lineage`;\n\nexport const CUSTOMER_SERVICE_TOKEN_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/customer-service/token`;\n\nconst getAuthenticationUrl = (authType: AuthType, env: Env): string => {\n  switch (authType) {\n    case AuthType.SRP:\n      return SRP_LOGIN_URL(env);\n    case AuthType.SiWE:\n      return SIWE_LOGIN_URL(env);\n    /* istanbul ignore next */\n    default:\n      throw new ValidationError(\n        `Invalid AuthType: ${authType as number} - unable to create Auth URL`,\n      );\n  }\n};\n\ntype NonceResponse = {\n  nonce: string;\n  identifier: string;\n  expiresIn: number;\n};\n\ntype RawProfileAlias = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  alias_profile_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  canonical_profile_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  identifier_ids: { id: string; type: string }[];\n};\n\nconst parseProfileAliases = (raw: RawProfileAlias[]): ProfileAlias[] => {\n  return raw.map((alias) => ({\n    aliasProfileId: alias.alias_profile_id,\n    canonicalProfileId: alias.canonical_profile_id,\n    identifierIds: alias.identifier_ids ?? [],\n  }));\n};\n\ntype PairRequest = {\n  signature: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  raw_message: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  encrypted_storage_key: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  identifier_type: 'SIWE' | 'SRP';\n};\n\n/**\n * Pair multiple identifiers under a single profile\n *\n * @param nonce - session nonce\n * @param logins - pairing request payload\n * @param accessToken - JWT access token used to access protected resources\n * @param env - server environment\n * @returns void.\n */\nexport async function pairIdentifiers(\n  nonce: string,\n  logins: PairRequest[],\n  accessToken: string,\n  env: Env,\n): Promise<void> {\n  const pairUrl = new URL(PAIR_IDENTIFIERS(env));\n\n  try {\n    const response = await fetch(pairUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${accessToken}`,\n      },\n      body: JSON.stringify({\n        nonce,\n        logins,\n      }),\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to pair identifiers',\n        PairError,\n      );\n    }\n    return undefined;\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to pair identifiers',\n      PairError,\n    );\n  }\n}\n\nexport type PairProfilesResponse = {\n  profile: UserProfile;\n  profileAliases: ProfileAlias[];\n};\n\n/**\n * Pair multiple profiles using their OIDC access tokens.\n * Idempotent — calling with already-paired tokens is a no-op.\n *\n * @param accessTokens - Two or more OIDC access tokens to pair\n * @param authAccessToken - A valid access token for the Authorization header\n * @param env - server environment\n * @returns The pair response containing the canonical profile and aliases\n */\nexport async function pairProfiles(\n  accessTokens: string[],\n  authAccessToken: string,\n  env: Env,\n): Promise<PairProfilesResponse> {\n  const pairUrl = new URL(PAIR_PROFILES_URL(env));\n\n  try {\n    const response = await fetch(pairUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${authAccessToken}`,\n      },\n      body: JSON.stringify({\n        jwts: accessTokens,\n      }),\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to pair profiles',\n        PairError,\n      );\n    }\n\n    const pairResponse: unknown = await response.json();\n    validatePairResponse(pairResponse);\n\n    return {\n      profile: {\n        identifierId: pairResponse.profile.identifier_id,\n        metaMetricsId: pairResponse.profile.metametrics_id ?? '',\n        profileId: pairResponse.profile.profile_id,\n        canonicalProfileId: pairResponse.profile.profile_id,\n      },\n      profileAliases: parseProfileAliases(pairResponse.profile_aliases ?? []),\n    };\n  } catch (error) {\n    return await throwServiceError(error, 'Failed to pair profiles', PairError);\n  }\n}\n\n/**\n * Service to Get Nonce for JWT Bearer Flow\n *\n * @param id - identifier ID\n * @param env - server environment\n * @returns the nonce.\n */\nexport async function getNonce(id: string, env: Env): Promise<NonceResponse> {\n  const nonceUrl = new URL(NONCE_URL(env));\n  nonceUrl.searchParams.set('identifier', id);\n\n  try {\n    const nonceResponse = await fetch(nonceUrl.toString());\n    if (!nonceResponse.ok) {\n      return await throwServiceError(\n        nonceResponse,\n        'Failed to get nonce',\n        NonceRetrievalError,\n      );\n    }\n\n    const nonceJson = await nonceResponse.json();\n    return {\n      nonce: nonceJson.nonce,\n      identifier: nonceJson.identifier,\n      expiresIn: nonceJson.expires_in,\n    };\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to get nonce',\n      NonceRetrievalError,\n    );\n  }\n}\n\n/**\n * Service to Authorize And perform OIDC Flow to get the Access Token\n *\n * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)\n * @param env - server environment\n * @param platform - SDK platform\n * @returns Access Token from Authorization server\n */\nexport async function authorizeOIDC(\n  jwtToken: string,\n  env: Env,\n  platform: Platform,\n): Promise<AccessToken> {\n  const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n  const headers = {\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  const urlEncodedBody = new URLSearchParams();\n  urlEncodedBody.append('grant_type', grantType);\n  urlEncodedBody.append('client_id', getOidcClientId(env, platform));\n  urlEncodedBody.append('assertion', jwtToken);\n\n  try {\n    const response = await fetch(OIDC_TOKEN_URL(env), {\n      method: 'POST',\n      headers,\n      body: urlEncodedBody.toString(),\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to get access token',\n        SignInError,\n      );\n    }\n\n    const accessTokenResponse = await response.json();\n    return {\n      accessToken: accessTokenResponse.access_token,\n      expiresIn: accessTokenResponse.expires_in,\n      obtainedAt: Date.now(),\n    };\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to get access token',\n      SignInError,\n    );\n  }\n}\n\ntype Authentication = {\n  token: string;\n  expiresIn: number;\n  profile: UserProfile;\n  profileAliases: ProfileAlias[];\n};\n/**\n * Service to Authenticate/Login a user via SIWE or SRP derived key.\n *\n * @param rawMessage - raw message for validation when authenticating\n * @param signature - signed raw message\n * @param authType - authentication type/flow used\n * @param env - server environment\n * @param metametrics - optional metametrics\n * @param identifierType - login identifier type included in metametrics\n *   (defaults to `SRP` when metametrics is present)\n * @returns Authentication Token\n */\nexport async function authenticate(\n  rawMessage: string,\n  signature: string,\n  authType: AuthType,\n  env: Env,\n  metametrics?: MetaMetricsAuth,\n  identifierType: LoginIdentifierType = 'SRP',\n): Promise<Authentication> {\n  const authenticationUrl = getAuthenticationUrl(authType, env);\n\n  try {\n    const response = await fetch(authenticationUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...(authType === AuthType.SRP\n          ? { 'X-MetaMask-Profile-Pairing': 'enabled' }\n          : {}),\n      },\n      body: JSON.stringify({\n        signature,\n        raw_message: rawMessage,\n        ...(metametrics\n          ? {\n              metametrics: {\n                metametrics_id: await metametrics.getMetaMetricsId(),\n                agent: metametrics.agent,\n                app_version: await metametrics.getAppVersion?.(),\n                identifier_type: identifierType,\n              },\n            }\n          : {}),\n      }),\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        `Failed to login with ${authType}`,\n        SignInError,\n      );\n    }\n\n    const loginResponse = await response.json();\n\n    return {\n      token: loginResponse.token,\n      expiresIn: loginResponse.expires_in,\n      profile: {\n        identifierId: loginResponse.profile.identifier_id,\n        metaMetricsId: loginResponse.profile.metametrics_id,\n        profileId: loginResponse.profile.profile_id,\n        canonicalProfileId: loginResponse.profile.profile_id,\n      },\n      profileAliases: parseProfileAliases(loginResponse.profile_aliases ?? []),\n    };\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      `Failed to login with ${authType}`,\n      SignInError,\n    );\n  }\n}\n\n/**\n * Service to get the Profile Lineage\n *\n * @param env - server environment\n * @param accessToken - JWT access token used to access protected resources\n * @returns Profile Lineage information.\n */\nexport async function getUserProfileLineage(\n  env: Env,\n  accessToken: string,\n): Promise<UserProfileLineage> {\n  const profileLineageUrl = new URL(PROFILE_LINEAGE_URL(env));\n\n  try {\n    const response = await fetch(profileLineageUrl, {\n      method: 'GET',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to get profile lineage',\n        SignInError,\n      );\n    }\n\n    const profileJson: UserProfileLineage = await response.json();\n    return profileJson;\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to get profile lineage',\n      SignInError,\n    );\n  }\n}\n\n/**\n * Service to get a Customer Service specific access token.\n *\n * Exchanges a valid OIDC access token for a short-lived token scoped to the\n * customer-service audience, which Customer Service tooling consumes to\n * identify and authenticate the user.\n *\n * @param env - server environment\n * @param accessToken - JWT access token used to access protected resources\n * @returns The customer-service access token.\n */\nexport async function getCustomerServiceToken(\n  env: Env,\n  accessToken: string,\n): Promise<string> {\n  const customerServiceTokenUrl = new URL(CUSTOMER_SERVICE_TOKEN_URL(env));\n\n  try {\n    const response = await fetch(customerServiceTokenUrl, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to get customer service token',\n        SignInError,\n      );\n    }\n\n    const tokenResponse = await response.json();\n    if (typeof tokenResponse?.access_token !== 'string') {\n      throw new SignInError(\n        'Failed to get customer service token: missing access_token',\n      );\n    }\n    return tokenResponse.access_token;\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to get customer service token',\n      SignInError,\n    );\n  }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/{services.d.ts → services.d.cts}

@@ -1,7 +1,7 @@
-import type { Env, Platform } from '../../shared/env.js';
-import type { MetaMetricsAuth } from '../../shared/types/services.js';
-import type { AccessToken, LoginIdentifierType, ProfileAlias, UserProfile, UserProfileLineage } from './types.js';
-import { AuthType } from './types.js';
+import type { Env, Platform } from "../../shared/env.cjs";
+import type { MetaMetricsAuth } from "../../shared/types/services.cjs";
+import type { AccessToken, LoginIdentifierType, ProfileAlias, UserProfile, UserProfileLineage } from "./types.cjs";
+import { AuthType } from "./types.cjs";
 export declare const NONCE_URL: (env: Env) => string;
 export declare const PAIR_IDENTIFIERS: (env: Env) => string;
 export declare const OIDC_TOKEN_URL: (env: Env) => string;
@@ -102,4 +102,4 @@ export declare function getUserProfileLineage(env: Env, accessToken: string): Pr
  */
 export declare function getCustomerServiceToken(env: Env, accessToken: string): Promise<string>;
 export {};
-//# sourceMappingURL=services.d.ts.map
+//# sourceMappingURL=services.d.cts.map

package/dist/sdk/authentication-jwt-bearer/services.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,6BAA4B;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAUtE,OAAO,KAAK,EACV,WAAW,EAEX,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,kBAAkB,EACnB,oBAAmB;AACpB,OAAO,EAAE,QAAQ,EAAE,oBAAmB;AAwHtC,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,MACS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG,MACa,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,KAAG,MACS,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,iBAAiB,QAAS,GAAG,KAAG,MACQ,CAAC;AAEtD,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACS,CAAC;AAgBhE,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmBF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,oBAAoB,CAAC,CAsC/B;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CA2B3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AACF;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,WAAW,CAAC,EAAE,eAAe,EAC7B,cAAc,GAAE,mBAA2B,GAC1C,OAAO,CAAC,cAAc,CAAC,CAwDzB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAiCjB"}

package/dist/sdk/authentication-jwt-bearer/services.d.mts

@@ -0,0 +1,105 @@
+import type { Env, Platform } from "../../shared/env.mjs";
+import type { MetaMetricsAuth } from "../../shared/types/services.mjs";
+import type { AccessToken, LoginIdentifierType, ProfileAlias, UserProfile, UserProfileLineage } from "./types.mjs";
+import { AuthType } from "./types.mjs";
+export declare const NONCE_URL: (env: Env) => string;
+export declare const PAIR_IDENTIFIERS: (env: Env) => string;
+export declare const OIDC_TOKEN_URL: (env: Env) => string;
+export declare const SRP_LOGIN_URL: (env: Env) => string;
+export declare const SIWE_LOGIN_URL: (env: Env) => string;
+export declare const PAIR_PROFILES_URL: (env: Env) => string;
+export declare const PROFILE_LINEAGE_URL: (env: Env) => string;
+export declare const CUSTOMER_SERVICE_TOKEN_URL: (env: Env) => string;
+type NonceResponse = {
+    nonce: string;
+    identifier: string;
+    expiresIn: number;
+};
+type PairRequest = {
+    signature: string;
+    raw_message: string;
+    encrypted_storage_key: string;
+    identifier_type: 'SIWE' | 'SRP';
+};
+/**
+ * Pair multiple identifiers under a single profile
+ *
+ * @param nonce - session nonce
+ * @param logins - pairing request payload
+ * @param accessToken - JWT access token used to access protected resources
+ * @param env - server environment
+ * @returns void.
+ */
+export declare function pairIdentifiers(nonce: string, logins: PairRequest[], accessToken: string, env: Env): Promise<void>;
+export type PairProfilesResponse = {
+    profile: UserProfile;
+    profileAliases: ProfileAlias[];
+};
+/**
+ * Pair multiple profiles using their OIDC access tokens.
+ * Idempotent — calling with already-paired tokens is a no-op.
+ *
+ * @param accessTokens - Two or more OIDC access tokens to pair
+ * @param authAccessToken - A valid access token for the Authorization header
+ * @param env - server environment
+ * @returns The pair response containing the canonical profile and aliases
+ */
+export declare function pairProfiles(accessTokens: string[], authAccessToken: string, env: Env): Promise<PairProfilesResponse>;
+/**
+ * Service to Get Nonce for JWT Bearer Flow
+ *
+ * @param id - identifier ID
+ * @param env - server environment
+ * @returns the nonce.
+ */
+export declare function getNonce(id: string, env: Env): Promise<NonceResponse>;
+/**
+ * Service to Authorize And perform OIDC Flow to get the Access Token
+ *
+ * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)
+ * @param env - server environment
+ * @param platform - SDK platform
+ * @returns Access Token from Authorization server
+ */
+export declare function authorizeOIDC(jwtToken: string, env: Env, platform: Platform): Promise<AccessToken>;
+type Authentication = {
+    token: string;
+    expiresIn: number;
+    profile: UserProfile;
+    profileAliases: ProfileAlias[];
+};
+/**
+ * Service to Authenticate/Login a user via SIWE or SRP derived key.
+ *
+ * @param rawMessage - raw message for validation when authenticating
+ * @param signature - signed raw message
+ * @param authType - authentication type/flow used
+ * @param env - server environment
+ * @param metametrics - optional metametrics
+ * @param identifierType - login identifier type included in metametrics
+ *   (defaults to `SRP` when metametrics is present)
+ * @returns Authentication Token
+ */
+export declare function authenticate(rawMessage: string, signature: string, authType: AuthType, env: Env, metametrics?: MetaMetricsAuth, identifierType?: LoginIdentifierType): Promise<Authentication>;
+/**
+ * Service to get the Profile Lineage
+ *
+ * @param env - server environment
+ * @param accessToken - JWT access token used to access protected resources
+ * @returns Profile Lineage information.
+ */
+export declare function getUserProfileLineage(env: Env, accessToken: string): Promise<UserProfileLineage>;
+/**
+ * Service to get a Customer Service specific access token.
+ *
+ * Exchanges a valid OIDC access token for a short-lived token scoped to the
+ * customer-service audience, which Customer Service tooling consumes to
+ * identify and authenticate the user.
+ *
+ * @param env - server environment
+ * @param accessToken - JWT access token used to access protected resources
+ * @returns The customer-service access token.
+ */
+export declare function getCustomerServiceToken(env: Env, accessToken: string): Promise<string>;
+export {};
+//# sourceMappingURL=services.d.mts.map

package/dist/sdk/authentication-jwt-bearer/services.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,6BAA4B;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAUtE,OAAO,KAAK,EACV,WAAW,EAEX,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,kBAAkB,EACnB,oBAAmB;AACpB,OAAO,EAAE,QAAQ,EAAE,oBAAmB;AAwHtC,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,MACS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG,MACa,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,KAAG,MACS,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,iBAAiB,QAAS,GAAG,KAAG,MACQ,CAAC;AAEtD,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACS,CAAC;AAgBhE,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmBF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,oBAAoB,CAAC,CAsC/B;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CA2B3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AACF;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,WAAW,CAAC,EAAE,eAAe,EAC7B,cAAc,GAAE,mBAA2B,GAC1C,OAAO,CAAC,cAAc,CAAC,CAwDzB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAiCjB"}

package/dist/sdk/authentication-jwt-bearer/{services.js → services.mjs}

@@ -1,8 +1,8 @@
-import { getEnvUrls, getOidcClientId } from '../../shared/env.js';
-import { HTTP_STATUS_CODES } from '../constants.js';
-import { NonceRetrievalError, PairError, SignInError, ValidationError, RateLimitedError, } from '../errors.js';
-import { validatePairResponse } from '../utils/validate-pair-response.js';
-import { AuthType } from './types.js';
+import { getEnvUrls, getOidcClientId } from "../../shared/env.mjs";
+import { HTTP_STATUS_CODES } from "../constants.mjs";
+import { NonceRetrievalError, PairError, SignInError, ValidationError, RateLimitedError } from "../errors.mjs";
+import { validatePairResponse } from "../utils/validate-pair-response.mjs";
+import { AuthType } from "./types.mjs";
 /**
  * Parse Retry-After header into milliseconds if possible.
  * Supports seconds or HTTP-date formats.
@@ -379,4 +379,4 @@ export async function getCustomerServiceToken(env, accessToken) {
         return await throwServiceError(error, 'Failed to get customer service token', SignInError);
     }
 }
-//# sourceMappingURL=services.js.map
+//# sourceMappingURL=services.mjs.map