@metamask-previews/profile-sync-controller 29.0.0-preview-3866c0ff1 → 29.0.0-preview-e3275932a

package/dist/shared/encryption/encryption.js

@@ -1,202 +0,0 @@
-import { gcm } from '@noble/ciphers/aes';
-import { randomBytes } from '@noble/ciphers/webcrypto';
-import { scryptAsync } from '@noble/hashes/scrypt';
-import { sha256 } from '@noble/hashes/sha256';
-import { utf8ToBytes, concatBytes, bytesToHex } from '@noble/hashes/utils';
-import { getCachedKeyBySalt, getCachedKeyGeneratedWithSharedSalt, setCachedKey, } from './cache.js';
-import { ALGORITHM_KEY_SIZE, ALGORITHM_NONCE_SIZE, MAX_KDF_PROMISE_CACHE_SIZE, SCRYPT_N, SCRYPT_p, SCRYPT_r, SCRYPT_SALT_SIZE, SHARED_SALT, } from './constants.js';
-import { base64ToByteArray, byteArrayToBase64, bytesToUtf8, stringToByteArray, } from './utils.js';
-class EncryptorDecryptor {
-    // Promise cache for ongoing KDF operations to prevent duplicate work
-    #kdfPromiseCache = new Map();
-    async encryptString(plaintext, password, nativeScryptCrypto) {
-        try {
-            return await this.#encryptStringV1(plaintext, password, nativeScryptCrypto);
-        }
-        catch (e) {
-            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);
-            throw new Error(`Unable to encrypt string - ${errorMessage}`);
-        }
-    }
-    async decryptString(encryptedDataStr, password, nativeScryptCrypto) {
-        try {
-            const encryptedData = JSON.parse(encryptedDataStr);
-            if (encryptedData.v === '1') {
-                if (encryptedData.t === 'scrypt') {
-                    return await this.#decryptStringV1(encryptedData, password, nativeScryptCrypto);
-                }
-            }
-            throw new Error(`Unsupported encrypted data payload - ${encryptedDataStr}`);
-        }
-        catch (e) {
-            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);
-            throw new Error(`Unable to decrypt string - ${errorMessage}`);
-        }
-    }
-    async #encryptStringV1(plaintext, password, nativeScryptCrypto) {
-        const { key, salt } = await this.#getOrGenerateScryptKey(password, {
-            N: SCRYPT_N,
-            r: SCRYPT_r,
-            p: SCRYPT_p,
-            dkLen: ALGORITHM_KEY_SIZE,
-        }, undefined, nativeScryptCrypto);
-        // Encrypt and prepend salt.
-        const plaintextRaw = utf8ToBytes(plaintext);
-        const ciphertextAndNonceAndSalt = concatBytes(salt, this.#encrypt(plaintextRaw, key));
-        // Convert to Base64
-        const encryptedData = byteArrayToBase64(ciphertextAndNonceAndSalt);
-        const encryptedPayload = {
-            v: '1',
-            t: 'scrypt',
-            d: encryptedData,
-            o: {
-                N: SCRYPT_N,
-                r: SCRYPT_r,
-                p: SCRYPT_p,
-                dkLen: ALGORITHM_KEY_SIZE,
-            },
-            saltLen: SCRYPT_SALT_SIZE,
-        };
-        return JSON.stringify(encryptedPayload);
-    }
-    async #decryptStringV1(data, password, nativeScryptCrypto) {
-        const { o, d: base64CiphertextAndNonceAndSalt, saltLen } = data;
-        // Decode the base64.
-        const ciphertextAndNonceAndSalt = base64ToByteArray(base64CiphertextAndNonceAndSalt);
-        // Create buffers of salt and ciphertextAndNonce.
-        const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);
-        const ciphertextAndNonce = ciphertextAndNonceAndSalt.slice(saltLen, ciphertextAndNonceAndSalt.length);
-        // Derive the key.
-        const { key } = await this.#getOrGenerateScryptKey(password, {
-            N: o.N,
-            r: o.r,
-            p: o.p,
-            dkLen: o.dkLen,
-        }, salt, nativeScryptCrypto);
-        // Decrypt and return result.
-        return bytesToUtf8(this.#decrypt(ciphertextAndNonce, key));
-    }
-    getSalt(encryptedDataStr) {
-        try {
-            const encryptedData = JSON.parse(encryptedDataStr);
-            if (encryptedData.v === '1') {
-                if (encryptedData.t === 'scrypt') {
-                    const { d: base64CiphertextAndNonceAndSalt, saltLen } = encryptedData;
-                    // Decode the base64.
-                    const ciphertextAndNonceAndSalt = base64ToByteArray(base64CiphertextAndNonceAndSalt);
-                    // Create buffers of salt and ciphertextAndNonce.
-                    const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);
-                    return salt;
-                }
-            }
-            throw new Error(`Unsupported encrypted data payload - ${encryptedDataStr}`);
-        }
-        catch (e) {
-            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);
-            throw new Error(`Unable to get salt - ${errorMessage}`);
-        }
-    }
-    getIfEntriesHaveDifferentSalts(entries) {
-        const salts = entries
-            .map((e) => {
-            try {
-                return this.getSalt(e);
-            }
-            catch {
-                return undefined;
-            }
-        })
-            .filter((s) => s !== undefined);
-        const strSet = new Set(salts.map((arr) => arr.toString()));
-        return strSet.size === salts.length;
-    }
-    #encrypt(plaintext, key) {
-        const nonce = randomBytes(ALGORITHM_NONCE_SIZE);
-        // Encrypt and prepend nonce.
-        const ciphertext = gcm(key, nonce).encrypt(plaintext);
-        return concatBytes(nonce, ciphertext);
-    }
-    #decrypt(ciphertextAndNonce, key) {
-        // Create buffers of nonce and ciphertext.
-        const nonce = ciphertextAndNonce.slice(0, ALGORITHM_NONCE_SIZE);
-        const ciphertext = ciphertextAndNonce.slice(ALGORITHM_NONCE_SIZE, ciphertextAndNonce.length);
-        // Decrypt and return result.
-        return gcm(key, nonce).decrypt(ciphertext);
-    }
-    async #getOrGenerateScryptKey(password, o, salt, nativeScryptCrypto) {
-        const hashedPassword = createSHA256Hash(password);
-        // Check if we already have the key cached
-        const cachedKey = salt
-            ? getCachedKeyBySalt(hashedPassword, salt)
-            : getCachedKeyGeneratedWithSharedSalt(hashedPassword);
-        if (cachedKey) {
-            return {
-                key: cachedKey.key,
-                salt: cachedKey.salt,
-            };
-        }
-        // Create a unique cache key for this KDF operation
-        const newSalt = salt ?? SHARED_SALT;
-        const cacheKey = this.#createKdfCacheKey(hashedPassword, o, newSalt, nativeScryptCrypto);
-        // Check if there's already an ongoing KDF operation with the same parameters
-        const existingPromise = this.#kdfPromiseCache.get(cacheKey);
-        if (existingPromise) {
-            return existingPromise;
-        }
-        // Limit cache size to prevent unbounded growth
-        if (this.#kdfPromiseCache.size >= MAX_KDF_PROMISE_CACHE_SIZE) {
-            // Remove the oldest entry (first inserted)
-            const firstKey = this.#kdfPromiseCache.keys().next().value;
-            if (firstKey) {
-                this.#kdfPromiseCache.delete(firstKey);
-            }
-        }
-        // Create and cache the promise for the KDF operation
-        const kdfPromise = this.#performKdfOperation(password, o, newSalt, hashedPassword, nativeScryptCrypto);
-        // Cache the promise and set up cleanup
-        this.#kdfPromiseCache.set(cacheKey, kdfPromise);
-        // Clean up the cache after completion (both success and failure)
-        // eslint-disable-next-line no-void
-        void kdfPromise.finally(() => {
-            this.#kdfPromiseCache.delete(cacheKey);
-        });
-        return kdfPromise;
-    }
-    #createKdfCacheKey(hashedPassword, o, salt, nativeScryptCrypto) {
-        const saltStr = byteArrayToBase64(salt);
-        const hasNative = Boolean(nativeScryptCrypto);
-        return `${hashedPassword}:${o.N}:${o.r}:${o.p}:${o.dkLen}:${saltStr}:${hasNative}`;
-    }
-    async #performKdfOperation(password, o, salt, hashedPassword, nativeScryptCrypto) {
-        let newKey;
-        if (nativeScryptCrypto) {
-            newKey = await nativeScryptCrypto(stringToByteArray(password), salt, o.N, o.r, o.p, o.dkLen);
-        }
-        else {
-            newKey = await scryptAsync(password, salt, {
-                N: o.N,
-                r: o.r,
-                p: o.p,
-                dkLen: o.dkLen,
-            });
-        }
-        setCachedKey(hashedPassword, salt, newKey);
-        return {
-            key: newKey,
-            salt,
-        };
-    }
-}
-const encryption = new EncryptorDecryptor();
-export default encryption;
-/**
- * Receive a SHA256 hash from a given string
- *
- * @param data - input
- * @returns sha256 hash
- */
-export function createSHA256Hash(data) {
-    const hashedData = sha256(data);
-    return bytesToHex(hashedData);
-}
-//# sourceMappingURL=encryption.js.map

package/dist/shared/encryption/encryption.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../../src/shared/encryption/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EACL,kBAAkB,EAClB,mCAAmC,EACnC,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,0BAA0B,EAC1B,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,gBAAgB,EAChB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAwBpB,MAAM,kBAAkB;IACtB,qEAAqE;IAC5D,gBAAgB,GAAG,IAAI,GAAG,EAGhC,CAAC;IAEJ,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,QAAgB,EAChB,kBAAiC;QAEjC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAChC,SAAS,EACT,QAAQ,EACR,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,gBAAwB,EACxB,QAAgB,EAChB,kBAAiC;QAEjC,IAAI,CAAC;YACH,MAAM,aAAa,GAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,IAAI,aAAa,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAChC,aAAa,EACb,QAAQ,EACR,kBAAkB,CACnB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wCAAwC,gBAAgB,EAAE,CAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,SAAiB,EACjB,QAAgB,EAChB,kBAAiC;QAEjC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACtD,QAAQ,EACR;YACE,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,KAAK,EAAE,kBAAkB;SAC1B,EACD,SAAS,EACT,kBAAkB,CACnB,CAAC;QAEF,4BAA4B;QAC5B,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,yBAAyB,GAAG,WAAW,CAC3C,IAAI,EACJ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CACjC,CAAC;QAEF,oBAAoB;QACpB,MAAM,aAAa,GAAG,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;QAEnE,MAAM,gBAAgB,GAAqB;YACzC,CAAC,EAAE,GAAG;YACN,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,aAAa;YAChB,CAAC,EAAE;gBACD,CAAC,EAAE,QAAQ;gBACX,CAAC,EAAE,QAAQ;gBACX,CAAC,EAAE,QAAQ;gBACX,KAAK,EAAE,kBAAkB;aAC1B;YACD,OAAO,EAAE,gBAAgB;SAC1B,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,IAAsB,EACtB,QAAgB,EAChB,kBAAiC;QAEjC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,+BAA+B,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QAEhE,qBAAqB;QACrB,MAAM,yBAAyB,GAAG,iBAAiB,CACjD,+BAA+B,CAChC,CAAC;QAEF,iDAAiD;QACjD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,KAAK,CACxD,OAAO,EACP,yBAAyB,CAAC,MAAM,CACjC,CAAC;QAEF,kBAAkB;QAClB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAChD,QAAQ,EACR;YACE,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,EACD,IAAI,EACJ,kBAAkB,CACnB,CAAC;QAEF,6BAA6B;QAC7B,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,CAAC,gBAAwB;QAC9B,IAAI,CAAC;YACH,MAAM,aAAa,GAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,IAAI,aAAa,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,EAAE,CAAC,EAAE,+BAA+B,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;oBAEtE,qBAAqB;oBACrB,MAAM,yBAAyB,GAAG,iBAAiB,CACjD,+BAA+B,CAChC,CAAC;oBAEF,iDAAiD;oBACjD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACzD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wCAAwC,gBAAgB,EAAE,CAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,8BAA8B,CAAC,OAAiB;QAC9C,MAAM,KAAK,GAAG,OAAO;aAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;IACtC,CAAC;IAED,QAAQ,CAAC,SAAqB,EAAE,GAAe;QAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAEhD,6BAA6B;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEtD,OAAO,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,QAAQ,CAAC,kBAA8B,EAAE,GAAe;QACtD,0CAA0C;QAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CACzC,oBAAoB,EACpB,kBAAkB,CAAC,MAAM,CAC1B,CAAC;QAEF,6BAA6B;QAC7B,OAAO,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,QAAgB,EAChB,CAAwB,EACxB,IAAiB,EACjB,kBAAiC;QAEjC,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAElD,0CAA0C;QAC1C,MAAM,SAAS,GAAG,IAAI;YACpB,CAAC,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC;YAC1C,CAAC,CAAC,mCAAmC,CAAC,cAAc,CAAC,CAAC;QAExD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,MAAM,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CACtC,cAAc,EACd,CAAC,EACD,OAAO,EACP,kBAAkB,CACnB,CAAC;QAEF,6EAA6E;QAC7E,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,0BAA0B,EAAE,CAAC;YAC7D,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC3D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAC1C,QAAQ,EACR,CAAC,EACD,OAAO,EACP,cAAc,EACd,kBAAkB,CACnB,CAAC;QAEF,uCAAuC;QACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEhD,iEAAiE;QACjE,mCAAmC;QACnC,KAAK,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,kBAAkB,CAChB,cAAsB,EACtB,CAAwB,EACxB,IAAgB,EAChB,kBAAiC;QAEjC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9C,OAAO,GAAG,cAAc,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,QAAgB,EAChB,CAAwB,EACxB,IAAgB,EAChB,cAAsB,EACtB,kBAAiC;QAEjC,IAAI,MAAkB,CAAC;QAEvB,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,GAAG,MAAM,kBAAkB,CAC/B,iBAAiB,CAAC,QAAQ,CAAC,EAC3B,IAAI,EACJ,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,KAAK,CACR,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE;gBACzC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAED,YAAY,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE3C,OAAO;YACL,GAAG,EAAE,MAAM;YACX,IAAI;SACL,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAC5C,eAAe,UAAU,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC","sourcesContent":["import { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { scryptAsync } from '@noble/hashes/scrypt';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { utf8ToBytes, concatBytes, bytesToHex } from '@noble/hashes/utils';\n\nimport type { NativeScrypt } from '../types/encryption.js';\nimport {\n  getCachedKeyBySalt,\n  getCachedKeyGeneratedWithSharedSalt,\n  setCachedKey,\n} from './cache.js';\nimport {\n  ALGORITHM_KEY_SIZE,\n  ALGORITHM_NONCE_SIZE,\n  MAX_KDF_PROMISE_CACHE_SIZE,\n  SCRYPT_N,\n  SCRYPT_p,\n  SCRYPT_r,\n  SCRYPT_SALT_SIZE,\n  SHARED_SALT,\n} from './constants.js';\nimport {\n  base64ToByteArray,\n  byteArrayToBase64,\n  bytesToUtf8,\n  stringToByteArray,\n} from './utils.js';\n\nexport type EncryptedPayload = {\n  // version\n  v: '1';\n\n  // key derivation function algorithm - scrypt\n  t: 'scrypt';\n\n  // data\n  d: string;\n\n  // encryption options - scrypt\n  o: {\n    N: number;\n    r: number;\n    p: number;\n    dkLen: number;\n  };\n\n  // Salt options\n  saltLen: number;\n};\n\nclass EncryptorDecryptor {\n  // Promise cache for ongoing KDF operations to prevent duplicate work\n  readonly #kdfPromiseCache = new Map<\n    string,\n    Promise<{ key: Uint8Array; salt: Uint8Array }>\n  >();\n\n  async encryptString(\n    plaintext: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    try {\n      return await this.#encryptStringV1(\n        plaintext,\n        password,\n        nativeScryptCrypto,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to encrypt string - ${errorMessage}`);\n    }\n  }\n\n  async decryptString(\n    encryptedDataStr: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    try {\n      const encryptedData: EncryptedPayload = JSON.parse(encryptedDataStr);\n      if (encryptedData.v === '1') {\n        if (encryptedData.t === 'scrypt') {\n          return await this.#decryptStringV1(\n            encryptedData,\n            password,\n            nativeScryptCrypto,\n          );\n        }\n      }\n      throw new Error(\n        `Unsupported encrypted data payload - ${encryptedDataStr}`,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to decrypt string - ${errorMessage}`);\n    }\n  }\n\n  async #encryptStringV1(\n    plaintext: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    const { key, salt } = await this.#getOrGenerateScryptKey(\n      password,\n      {\n        N: SCRYPT_N,\n        r: SCRYPT_r,\n        p: SCRYPT_p,\n        dkLen: ALGORITHM_KEY_SIZE,\n      },\n      undefined,\n      nativeScryptCrypto,\n    );\n\n    // Encrypt and prepend salt.\n    const plaintextRaw = utf8ToBytes(plaintext);\n    const ciphertextAndNonceAndSalt = concatBytes(\n      salt,\n      this.#encrypt(plaintextRaw, key),\n    );\n\n    // Convert to Base64\n    const encryptedData = byteArrayToBase64(ciphertextAndNonceAndSalt);\n\n    const encryptedPayload: EncryptedPayload = {\n      v: '1',\n      t: 'scrypt',\n      d: encryptedData,\n      o: {\n        N: SCRYPT_N,\n        r: SCRYPT_r,\n        p: SCRYPT_p,\n        dkLen: ALGORITHM_KEY_SIZE,\n      },\n      saltLen: SCRYPT_SALT_SIZE,\n    };\n\n    return JSON.stringify(encryptedPayload);\n  }\n\n  async #decryptStringV1(\n    data: EncryptedPayload,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    const { o, d: base64CiphertextAndNonceAndSalt, saltLen } = data;\n\n    // Decode the base64.\n    const ciphertextAndNonceAndSalt = base64ToByteArray(\n      base64CiphertextAndNonceAndSalt,\n    );\n\n    // Create buffers of salt and ciphertextAndNonce.\n    const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);\n    const ciphertextAndNonce = ciphertextAndNonceAndSalt.slice(\n      saltLen,\n      ciphertextAndNonceAndSalt.length,\n    );\n\n    // Derive the key.\n    const { key } = await this.#getOrGenerateScryptKey(\n      password,\n      {\n        N: o.N,\n        r: o.r,\n        p: o.p,\n        dkLen: o.dkLen,\n      },\n      salt,\n      nativeScryptCrypto,\n    );\n\n    // Decrypt and return result.\n    return bytesToUtf8(this.#decrypt(ciphertextAndNonce, key));\n  }\n\n  getSalt(encryptedDataStr: string) {\n    try {\n      const encryptedData: EncryptedPayload = JSON.parse(encryptedDataStr);\n      if (encryptedData.v === '1') {\n        if (encryptedData.t === 'scrypt') {\n          const { d: base64CiphertextAndNonceAndSalt, saltLen } = encryptedData;\n\n          // Decode the base64.\n          const ciphertextAndNonceAndSalt = base64ToByteArray(\n            base64CiphertextAndNonceAndSalt,\n          );\n\n          // Create buffers of salt and ciphertextAndNonce.\n          const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);\n          return salt;\n        }\n      }\n      throw new Error(\n        `Unsupported encrypted data payload - ${encryptedDataStr}`,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to get salt - ${errorMessage}`);\n    }\n  }\n\n  getIfEntriesHaveDifferentSalts(entries: string[]): boolean {\n    const salts = entries\n      .map((e) => {\n        try {\n          return this.getSalt(e);\n        } catch {\n          return undefined;\n        }\n      })\n      .filter((s): s is Uint8Array<ArrayBuffer> => s !== undefined);\n\n    const strSet = new Set(salts.map((arr) => arr.toString()));\n    return strSet.size === salts.length;\n  }\n\n  #encrypt(plaintext: Uint8Array, key: Uint8Array): Uint8Array {\n    const nonce = randomBytes(ALGORITHM_NONCE_SIZE);\n\n    // Encrypt and prepend nonce.\n    const ciphertext = gcm(key, nonce).encrypt(plaintext);\n\n    return concatBytes(nonce, ciphertext);\n  }\n\n  #decrypt(ciphertextAndNonce: Uint8Array, key: Uint8Array): Uint8Array {\n    // Create buffers of nonce and ciphertext.\n    const nonce = ciphertextAndNonce.slice(0, ALGORITHM_NONCE_SIZE);\n    const ciphertext = ciphertextAndNonce.slice(\n      ALGORITHM_NONCE_SIZE,\n      ciphertextAndNonce.length,\n    );\n\n    // Decrypt and return result.\n    return gcm(key, nonce).decrypt(ciphertext);\n  }\n\n  async #getOrGenerateScryptKey(\n    password: string,\n    o: EncryptedPayload['o'],\n    salt?: Uint8Array,\n    nativeScryptCrypto?: NativeScrypt,\n  ) {\n    const hashedPassword = createSHA256Hash(password);\n\n    // Check if we already have the key cached\n    const cachedKey = salt\n      ? getCachedKeyBySalt(hashedPassword, salt)\n      : getCachedKeyGeneratedWithSharedSalt(hashedPassword);\n\n    if (cachedKey) {\n      return {\n        key: cachedKey.key,\n        salt: cachedKey.salt,\n      };\n    }\n\n    // Create a unique cache key for this KDF operation\n    const newSalt = salt ?? SHARED_SALT;\n    const cacheKey = this.#createKdfCacheKey(\n      hashedPassword,\n      o,\n      newSalt,\n      nativeScryptCrypto,\n    );\n\n    // Check if there's already an ongoing KDF operation with the same parameters\n    const existingPromise = this.#kdfPromiseCache.get(cacheKey);\n    if (existingPromise) {\n      return existingPromise;\n    }\n\n    // Limit cache size to prevent unbounded growth\n    if (this.#kdfPromiseCache.size >= MAX_KDF_PROMISE_CACHE_SIZE) {\n      // Remove the oldest entry (first inserted)\n      const firstKey = this.#kdfPromiseCache.keys().next().value;\n      if (firstKey) {\n        this.#kdfPromiseCache.delete(firstKey);\n      }\n    }\n\n    // Create and cache the promise for the KDF operation\n    const kdfPromise = this.#performKdfOperation(\n      password,\n      o,\n      newSalt,\n      hashedPassword,\n      nativeScryptCrypto,\n    );\n\n    // Cache the promise and set up cleanup\n    this.#kdfPromiseCache.set(cacheKey, kdfPromise);\n\n    // Clean up the cache after completion (both success and failure)\n    // eslint-disable-next-line no-void\n    void kdfPromise.finally(() => {\n      this.#kdfPromiseCache.delete(cacheKey);\n    });\n\n    return kdfPromise;\n  }\n\n  #createKdfCacheKey(\n    hashedPassword: string,\n    o: EncryptedPayload['o'],\n    salt: Uint8Array,\n    nativeScryptCrypto?: NativeScrypt,\n  ): string {\n    const saltStr = byteArrayToBase64(salt);\n    const hasNative = Boolean(nativeScryptCrypto);\n    return `${hashedPassword}:${o.N}:${o.r}:${o.p}:${o.dkLen}:${saltStr}:${hasNative}`;\n  }\n\n  async #performKdfOperation(\n    password: string,\n    o: EncryptedPayload['o'],\n    salt: Uint8Array,\n    hashedPassword: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<{ key: Uint8Array; salt: Uint8Array }> {\n    let newKey: Uint8Array;\n\n    if (nativeScryptCrypto) {\n      newKey = await nativeScryptCrypto(\n        stringToByteArray(password),\n        salt,\n        o.N,\n        o.r,\n        o.p,\n        o.dkLen,\n      );\n    } else {\n      newKey = await scryptAsync(password, salt, {\n        N: o.N,\n        r: o.r,\n        p: o.p,\n        dkLen: o.dkLen,\n      });\n    }\n\n    setCachedKey(hashedPassword, salt, newKey);\n\n    return {\n      key: newKey,\n      salt,\n    };\n  }\n}\n\nconst encryption = new EncryptorDecryptor();\nexport default encryption;\n\n/**\n * Receive a SHA256 hash from a given string\n *\n * @param data - input\n * @returns sha256 hash\n */\nexport function createSHA256Hash(data: string): string {\n  const hashedData = sha256(data);\n  return bytesToHex(hashedData);\n}\n"]}

package/dist/shared/encryption/index.d.ts

@@ -1,5 +0,0 @@
-import Encryption from './encryption.js';
-export { Encryption };
-export * from './encryption.js';
-export default Encryption;
-//# sourceMappingURL=index.d.ts.map

package/dist/shared/encryption/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/encryption/index.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,cAAc,iBAAiB,CAAC;eACjB,UAAU"}

package/dist/shared/encryption/index.js

@@ -1,5 +0,0 @@
-import Encryption from './encryption.js';
-export { Encryption };
-export * from './encryption.js';
-export default Encryption;
-//# sourceMappingURL=index.js.map

package/dist/shared/encryption/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/encryption/index.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,CAAC;AACtB,cAAc,iBAAiB,CAAC;AAChC,eAAe,UAAU,CAAC","sourcesContent":["import Encryption from './encryption.js';\n\nexport { Encryption };\nexport * from './encryption.js';\nexport default Encryption;\n"]}

package/dist/shared/encryption/utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/shared/encryption/utils.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,cAAe,UAAU,WAEtD,CAAC;AAEF,eAAO,MAAM,iBAAiB,WAAY,MAAM,4BAE/C,CAAC;AAEF,eAAO,MAAM,WAAW,cAAe,UAAU,WAGhD,CAAC;AAEF,eAAO,MAAM,iBAAiB,QAAS,MAAM,4BAE5C,CAAC"}

package/dist/shared/encryption/utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/shared/encryption/utils.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAqB,EAAE,EAAE;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,EAAE;IAClD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAqB,EAAE,EAAE;IACnD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE;IAC/C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC,CAAC","sourcesContent":["export const byteArrayToBase64 = (byteArray: Uint8Array) => {\n  return Buffer.from(byteArray).toString('base64');\n};\n\nexport const base64ToByteArray = (base64: string) => {\n  return new Uint8Array(Buffer.from(base64, 'base64'));\n};\n\nexport const bytesToUtf8 = (byteArray: Uint8Array) => {\n  const decoder = new TextDecoder('utf-8');\n  return decoder.decode(byteArray);\n};\n\nexport const stringToByteArray = (str: string) => {\n  return new TextEncoder().encode(str);\n};\n"]}

package/dist/shared/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/shared/env.ts"],"names":[],"mappings":"AAAA,oBAAY,GAAG;IACb,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAED,oBAAY,QAAQ;IAClB,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAoBF;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,YAAY,CAKjD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAiCpE"}

package/dist/shared/env.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/shared/env.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,GAIX;AAJD,WAAY,GAAG;IACb,kBAAW,CAAA;IACX,kBAAW,CAAA;IACX,kBAAW,CAAA;AACb,CAAC,EAJW,GAAG,KAAH,GAAG,QAId;AAED,MAAM,CAAN,IAAY,QAKX;AALD,WAAY,QAAQ;IAClB,6BAAiB,CAAA;IACjB,mCAAuB,CAAA;IACvB,mCAAuB,CAAA;IACvB,6BAAiB,CAAA;AACnB,CAAC,EALW,QAAQ,KAAR,QAAQ,QAKnB;AAQD,MAAM,QAAQ,GAA8B;IAC1C,GAAG,EAAE;QACH,UAAU,EAAE,+CAA+C;QAC3D,UAAU,EAAE,qCAAqC;QACjD,iBAAiB,EAAE,6CAA6C;KACjE;IACD,GAAG,EAAE;QACH,UAAU,EAAE,+CAA+C;QAC3D,UAAU,EAAE,qCAAqC;QACjD,iBAAiB,EAAE,6CAA6C;KACjE;IACD,GAAG,EAAE;QACH,UAAU,EAAE,2CAA2C;QACvD,UAAU,EAAE,iCAAiC;QAC7C,iBAAiB,EAAE,yCAAyC;KAC7D;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAQ,EAAE,QAAkB;IAC1D,MAAM,SAAS,GAAG;QAChB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YACT,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,sCAAsC;YAC5D,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,sCAAsC;YACzD,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,sCAAsC;YAC5D,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,sCAAsC;SAC1D;QACD,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YACT,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,sCAAsC;YAC5D,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,sCAAsC;YACzD,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,sCAAsC;YAC5D,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,sCAAsC;SAC1D;QACD,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YACT,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,sCAAsC;YAC5D,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,sCAAsC;YACzD,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,sCAAsC;YAC5D,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,sCAAsC;SAC1D;KACF,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,mCAAmC,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,iBAAiB,QAAQ,+CAA+C,CAC3F,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC","sourcesContent":["export enum Env {\n  DEV = 'dev',\n  UAT = 'uat',\n  PRD = 'prd',\n}\n\nexport enum Platform {\n  MOBILE = 'mobile',\n  EXTENSION = 'extension',\n  PORTFOLIO = 'portfolio',\n  INFURA = 'infura',\n}\n\ntype EnvUrlsEntry = {\n  authApiUrl: string;\n  oidcApiUrl: string;\n  userStorageApiUrl: string;\n};\n\nconst ENV_URLS: Record<Env, EnvUrlsEntry> = {\n  dev: {\n    authApiUrl: 'https://authentication.dev-api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.dev-api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.dev-api.cx.metamask.io',\n  },\n  uat: {\n    authApiUrl: 'https://authentication.uat-api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.uat-api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.uat-api.cx.metamask.io',\n  },\n  prd: {\n    authApiUrl: 'https://authentication.api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.api.cx.metamask.io',\n  },\n};\n\n/**\n * Validates and returns correct environment endpoints\n *\n * @param env - environment field\n * @returns the correct environment url\n * @throws on invalid environment passed\n */\nexport function getEnvUrls(env: Env): EnvUrlsEntry {\n  if (!ENV_URLS[env]) {\n    throw new Error('invalid environment configuration');\n  }\n  return ENV_URLS[env];\n}\n\n/**\n * Returns the valid OIDC Client ID (used during authorization)\n *\n * @param env - environment field\n * @param platform - platform field\n * @returns the OIDC client id for the environment\n */\nexport function getOidcClientId(env: Env, platform: Platform): string {\n  const clientIds = {\n    [Env.DEV]: {\n      [Platform.PORTFOLIO]: 'c7ca94a0-5d52-4635-9502-1a50a9c410cc',\n      [Platform.MOBILE]: 'e83c7cc9-267d-4fb4-8fec-f0e3bbe5ae8e',\n      [Platform.EXTENSION]: 'f1a963d7-50dc-4cb5-8d81-f1f3654f0df3',\n      [Platform.INFURA]: 'bd887006-0d55-481a-a395-5ff9a0dc52c9',\n    },\n    [Env.UAT]: {\n      [Platform.PORTFOLIO]: '8f2dd4ac-db07-4819-9ba5-1ee0ec1b56d1',\n      [Platform.MOBILE]: 'c3cfdcd2-51d6-4fae-ad2c-ff238c8fef53',\n      [Platform.EXTENSION]: 'a9de167c-c9a6-43d8-af39-d301fd44c485',\n      [Platform.INFURA]: '01929890-7002-4c97-9913-8f6c09a6d674',\n    },\n    [Env.PRD]: {\n      [Platform.PORTFOLIO]: '35e1cd62-49c5-4be8-8b6e-a5212f2d2cfb',\n      [Platform.MOBILE]: '75fa62a3-9ca0-4b91-9fe5-76bec86b0257',\n      [Platform.EXTENSION]: '1132f10a-b4e5-4390-a5f2-d9c6022db564',\n      [Platform.INFURA]: 'fdde9417-e193-4d23-9943-a8346b18d097',\n    },\n  };\n\n  if (!clientIds[env]) {\n    throw new Error(`invalid env ${env}: cannot determine oidc client id`);\n  }\n\n  if (!clientIds[env][platform]) {\n    throw new Error(\n      `invalid env ${env} and platform ${platform} combination: cannot determine oidc client id`,\n    );\n  }\n\n  return clientIds[env][platform];\n}\n"]}

package/dist/shared/storage-schema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"storage-schema.d.ts","sourceRoot":"","sources":["../../src/shared/storage-schema.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;IACrC,aAAa;IACb,QAAQ;IACR,WAAW;CACZ,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACnD,MAAM,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAClD,MAAM,MAAM,uCAAuC,GACjD,GAAG,6BAA6B,IAAI,4BAA4B,EAAE,CAAC;AACrE,MAAM,MAAM,qCAAqC,GAC/C,6BAA6B,CAAC;AAEhC,KAAK,+BAA+B,GAAG;IACrC,OAAO,EAAE,6BAA6B,CAAC;IACvC,GAAG,EAAE,4BAA4B,CAAC;CACnC,CAAC;AAEF,eAAO,MAAM,wBAAwB,SAC7B,uCAAuC,KAC5C,+BAYF,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,uCAAuC,EAC7C,UAAU,EAAE,MAAM,GACjB,MAAM,CAKR"}

package/dist/shared/storage-schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"storage-schema.js","sourceRoot":"","sources":["../../src/shared/storage-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;;GAGG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,aAAa,EAAE,eAAe;IAC9B,QAAQ,EAAE,aAAa;IACvB,WAAW,EAAE,aAAa;CAC3B,CAAC;AAcF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,IAA6C,EACZ,EAAE;IACnC,MAAM,SAAS,GAAG,aAAa,CAAC;IAEhC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAqC,CAAC;AAC7D,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6C,EAC7C,UAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC;IAErD,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC","sourcesContent":["import { createSHA256Hash } from './encryption/index.js';\n\n/**\n * The User Storage Endpoint requires a feature name and a namespace key.\n * Any user storage path should be in the form of `feature.key`.\n */\n\n/**\n * Helper object that contains the feature names used in the controllers and SDK.\n * Developers don't need to add new feature names to this object anymore, as the schema enforcement has been deprecated.\n */\nexport const USER_STORAGE_FEATURE_NAMES = {\n  notifications: 'notifications',\n  accounts: 'accounts_v2',\n  addressBook: 'addressBook',\n};\n\nexport type UserStorageGenericFeatureName = string;\nexport type UserStorageGenericFeatureKey = string;\nexport type UserStorageGenericPathWithFeatureAndKey =\n  `${UserStorageGenericFeatureName}.${UserStorageGenericFeatureKey}`;\nexport type UserStorageGenericPathWithFeatureOnly =\n  UserStorageGenericFeatureName;\n\ntype UserStorageGenericFeatureAndKey = {\n  feature: UserStorageGenericFeatureName;\n  key: UserStorageGenericFeatureKey;\n};\n\nexport const getFeatureAndKeyFromPath = (\n  path: UserStorageGenericPathWithFeatureAndKey,\n): UserStorageGenericFeatureAndKey => {\n  const pathRegex = /^\\w+\\.\\w+$/u;\n\n  if (!pathRegex.test(path)) {\n    throw new Error(\n      `user-storage - path is not in the correct format. Correct format: 'feature.key'`,\n    );\n  }\n\n  const [feature, key] = path.split('.');\n\n  return { feature, key } as UserStorageGenericFeatureAndKey;\n};\n\n/**\n * Constructs a unique entry path for a user.\n * This can be done due to the uniqueness of the storage key (no users will share the same storage key).\n * The users entry is a unique hash that cannot be reversed.\n *\n * @param path - string in the form of `${feature}.${key}` that matches schema\n * @param storageKey - users storage key\n * @returns path to store entry\n */\nexport function createEntryPath(\n  path: UserStorageGenericPathWithFeatureAndKey,\n  storageKey: string,\n): string {\n  const { feature, key } = getFeatureAndKeyFromPath(path);\n  const hashedKey = createSHA256Hash(key + storageKey);\n\n  return `${feature}/${hashedKey}`;\n}\n"]}

package/dist/shared/types/encryption.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../../src/shared/types/encryption.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,OAAO,MAAM,YAAY,GAAG,CACjC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,EAChB,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,UAAU,CAAC,CAAC"}

package/dist/shared/types/encryption.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=encryption.js.map

package/dist/shared/types/encryption.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../../src/shared/types/encryption.ts"],"names":[],"mappings":"","sourcesContent":["export declare type NativeScrypt = (\n  passwd: Uint8Array,\n  salt: Uint8Array,\n  N: number,\n  r: number,\n  p: number,\n  size: number,\n) => Promise<Uint8Array>;\n"]}

package/dist/shared/types/services.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../src/shared/types/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gBAAgB,EAAE,MACd,iBAAiB,CAAC,eAAe,CAAC,GAClC,OAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC;IAChD,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MACZ,iBAAiB,CAAC,YAAY,CAAC,GAC/B,SAAS,GACT,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC;CAC1D,CAAC"}

package/dist/shared/types/services.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=services.js.map

package/dist/shared/types/services.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../src/shared/types/services.ts"],"names":[],"mappings":"","sourcesContent":["import type { Platform } from '../env.js';\n\nexport type ClientMetaMetrics = {\n  metametricsId: string;\n  agent: Platform.EXTENSION | Platform.MOBILE;\n  appVersion: string;\n};\n\nexport type MetaMetricsAuth = {\n  getMetaMetricsId: () =>\n    | ClientMetaMetrics['metametricsId']\n    | Promise<ClientMetaMetrics['metametricsId']>;\n  agent: ClientMetaMetrics['agent'];\n  /**\n   * Optional callback returning the current client app version (e.g. extension\n   * or mobile build version). Forwarded as `metametrics.app_version` in the\n   * `POST /api/v2/srp/login` payload.\n   */\n  getAppVersion?: () =>\n    | ClientMetaMetrics['appVersion']\n    | undefined\n    | Promise<ClientMetaMetrics['appVersion'] | undefined>;\n};\n"]}

package/dist/shared/utils/entropy-source.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"entropy-source.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/entropy-source.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,GAAG,SAAS,GAC3C,MAAM,EAAE,CAIV;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,GAAG,SAAS,GAC3C,MAAM,CAQR"}

package/dist/shared/utils/entropy-source.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"entropy-source.js","sourceRoot":"","sources":["../../../src/shared/utils/entropy-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA4C;IAE5C,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;SAChE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAA4C;IAE5C,MAAM,CAAC,sBAAsB,CAAC,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC","sourcesContent":["import { KeyringTypes } from '@metamask/keyring-controller';\nimport type { KeyringObject } from '@metamask/keyring-controller';\n\n/**\n * Reads HD keyring entropy source IDs (metadata IDs) from KeyringController\n * keyrings, primary first. Returns an empty array when none are available\n * (e.g. the wallet is locked, where `keyrings` is cleared).\n *\n * @param keyrings - Keyrings from `KeyringController:getState`.\n * @returns The HD keyring metadata IDs, primary first.\n */\nexport function getHdKeyringEntropySourceIds(\n  keyrings: KeyringObject[] | null | undefined,\n): string[] {\n  return (keyrings ?? [])\n    .filter((keyring) => keyring.type === KeyringTypes.hd.toString())\n    .map((keyring) => keyring.metadata.id);\n}\n\n/**\n * Resolves the primary SRP's entropy source ID (the first HD keyring's\n * metadata ID). The ID is randomly regenerated whenever the vault is\n * recreated (e.g. on restore).\n *\n * @param keyrings - Keyrings from `KeyringController:getState`.\n * @returns The primary HD keyring metadata ID.\n * @throws If no HD keyring is available; callers must only resolve while\n * the wallet is unlocked.\n */\nexport function getPrimaryHdKeyringEntropySourceId(\n  keyrings: KeyringObject[] | null | undefined,\n): string {\n  const [primaryEntropySourceId] = getHdKeyringEntropySourceIds(keyrings);\n  if (!primaryEntropySourceId) {\n    throw new Error(\n      'getPrimaryHdKeyringEntropySourceId - no HD keyring available',\n    );\n  }\n  return primaryEntropySourceId;\n}\n"]}

package/dist/shared/utils/event-queue.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-queue.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/event-queue.ts"],"names":[],"mappings":"AAAA,qBAAa,UAAU;IACrB,KAAK,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAM;IAE7B,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,QAExC;IAEY,GAAG,kBAUf;CACF"}

package/dist/shared/utils/event-queue.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-queue.js","sourceRoot":"","sources":["../../../src/shared/utils/event-queue.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,UAAU;IACrB,KAAK,GAA4B,EAAE,CAAC;IAE7B,IAAI,CAAC,QAA6B;QACvC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,GAAG;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAE5B,IAAI,CAAC;gBACH,MAAM,KAAK,EAAE,CAAC;YAChB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;CACF","sourcesContent":["export class EventQueue {\n  queue: (() => Promise<void>)[] = [];\n\n  public push(callback: () => Promise<void>) {\n    this.queue.push(callback);\n  }\n\n  public async run() {\n    while (this.queue.length > 0) {\n      const event = this.queue[0];\n\n      try {\n        await event();\n      } finally {\n        this.queue = this.queue.filter((e) => e !== event);\n      }\n    }\n  }\n}\n"]}

package/dist/shared/utils/hd-keyring-seed.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hd-keyring-seed.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/hd-keyring-seed.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAuBrD;;;;;;GAMG;AACH,KAAK,4BAA4B,GAAG;IAClC,IAAI,EAAE,CACJ,GAAG,IAAI,EAAE,UAAU,CACjB,SAAS,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC,MAAM,CAAC,CACtE,KACE,OAAO,CAAC;CACd,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,4BAA4B,EACvC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAmBrB"}

package/dist/shared/utils/hd-keyring-seed.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hd-keyring-seed.js","sourceRoot":"","sources":["../../../src/shared/utils/hd-keyring-seed.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAwB,IAAI,CAAC;AAElD,MAAM,8BAA8B,GAClC,mDAAmD,CAAC;AAiBtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAuC,EACvC,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CACvC,uCAAuC,EACvC,EAAE,EAAE,EAAE,eAAe,EAAE,EACvB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACpB,MAAM,SAAS,GAAG,OAAoB,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC,CACF,CAA+C,CAAC;QAEjD,IAAI,WAAW,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,WAAW,CAAC,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC","sourcesContent":["import type { HdKeyring } from '@metamask/eth-hd-keyring/v2';\nimport type { KeyringType } from '@metamask/keyring-api/v2';\nimport type { KeyringControllerWithKeyringV2UnsafeAction } from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\n\n/**\n * HD keyring seed access for native SIP-6 message signing.\n *\n * This mirrors `@metamask/snaps-rpc-methods` `getMnemonicSeed` (when called\n * with an entropy source id):\n * `KeyringController:withKeyringV2Unsafe` → assert HD → return `keyring.seed`.\n *\n * Those helpers are not a public export of snaps-rpc-methods, so this thin wrapper lives here.\n *\n * @see https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts\n */\n\n/**\n * V2 HD keyring type (`KeyringType.Hd`). The template type keeps the literal\n * aligned with `@metamask/keyring-api/v2` without a runtime dependency.\n */\nconst HD_KEYRING_TYPE: `${KeyringType.Hd}` = 'hd';\n\nconst ENTROPY_SOURCE_NOT_FOUND_ERROR =\n  'Entropy source not found or is not an HD keyring.';\n\n/**\n * Structural messenger shape for `withKeyringV2Unsafe`.\n *\n * Not `Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>` because\n * `Messenger` is invariant in its action union — Auth / UserStorage messengers\n * (which allow additional actions) are not assignable to that narrow type.\n */\ntype MessengerWithKeyringV2Unsafe = {\n  call: (\n    ...args: Parameters<\n      Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>['call']\n    >\n  ) => unknown;\n};\n\n/**\n * Reads the BIP-39 seed for an HD keyring entropy source via\n * `KeyringController:withKeyringV2Unsafe`.\n *\n * Equivalent to snaps-rpc-methods `getMnemonicSeed(messenger, source)` for a\n * concrete entropy source id.\n *\n * @param messenger - Messenger that can call `withKeyringV2Unsafe`.\n * @param entropySourceId - Keyring metadata ID (SIP-30 entropy source).\n * @returns The HD keyring seed.\n * @throws If the keyring is missing or is not an HD keyring with a seed.\n */\nexport async function getHdKeyringSeed(\n  messenger: MessengerWithKeyringV2Unsafe,\n  entropySourceId: string,\n): Promise<Uint8Array> {\n  try {\n    const keyringData = (await messenger.call(\n      'KeyringController:withKeyringV2Unsafe',\n      { id: entropySourceId },\n      async ({ keyring }) => {\n        const hdKeyring = keyring as HdKeyring;\n        return { type: hdKeyring.type, seed: hdKeyring.seed };\n      },\n    )) as { type: string; seed?: Uint8Array | null };\n\n    if (keyringData.type !== HD_KEYRING_TYPE || !keyringData.seed) {\n      throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);\n    }\n\n    return keyringData.seed;\n  } catch {\n    throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);\n  }\n}\n"]}

package/dist/shared/utils/message-signing.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"message-signing.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,uCAAuC,CAAC;AA+C5E;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,IAAI,EACJ,KAAK,EACL,IAAS,GACV,EAAE;IACD,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAKjB"}

package/dist/shared/utils/message-signing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"message-signing.js","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,MAAM,EACN,UAAU,EACV,WAAW,EACX,cAAc,EACd,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,UAAU,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oCAAoC,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,aAA6B,CAAC;AAExD,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG;IACxB,UAAU,EAAE,KAAK,EAAE,GAAe,EAAE,IAAgB,EAAuB,EAAE,CAC3E,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAAgB;IAC9C,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,sCAAsC;QACtC,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,GAAG,cAAc,GAAY,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,IAAI,EACJ,KAAK,EACL,IAAI,GAAG,EAAE,GAKV;IACC,MAAM,IAAI,GAAG,SAAS,CACpB,WAAW,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;IACF,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE5D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAC9C;QACE,cAAc,EAAE;YACd,IAAI;YACJ,SAAS,iBAAiB,EAAE;YAC5B,GAAG,sBAAsB;SAC1B;QACD,KAAK,EAAE,WAAW;KACnB,EACD,iBAAiB,CAClB,CAAC;IAEF,MAAM,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,OAAO,oBAAoB,CAAC;QAC1B,IAAI;QACJ,KAAK,EAAE,uBAAuB;QAC9B,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAe,EACf,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrD,OAAO,KAAK,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;AACzC,CAAC","sourcesContent":["import type { HardenedBIP32Node } from '@metamask/key-tree';\nimport { SLIP10Node } from '@metamask/key-tree';\nimport {\n  assert,\n  bytesToHex,\n  concatBytes,\n  createDataView,\n  hexToBytes,\n  stringToBytes,\n} from '@metamask/utils';\nimport { secp256k1 } from '@noble/curves/secp256k1';\nimport { hmac } from '@noble/hashes/hmac';\nimport { sha256, sha512 } from '@noble/hashes/sha2';\nimport { keccak_256 as keccak256 } from '@noble/hashes/sha3';\n\n/**\n * Native SIP-6 message-signing helpers for AuthenticationController /\n * UserStorageController.\n *\n * These are intentional copies of the message-signing snap crypto path so auth\n * and user-storage can derive/sign without booting\n * `npm:@metamask/message-signing-snap`. Behavior must stay byte-identical to:\n *\n * - SIP-6 derivation:\n *   `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` /\n *   `getEntropyDerivationPath` / `getDerivationPathArray`\n *   (https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts)\n * - Magic constant:\n *   `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`\n * - Pubkey + `metamask:…` signing:\n *   `@metamask/message-signing-snap` `getPublicEntropyKey` /\n *   `signMessageWithEntropyKey`\n *   (https://github.com/MetaMask/message-signing-snap/blob/main/src/entropy-keys.ts)\n *\n * `deriveEntropyFromSeed` is not a public export of\n * `@metamask/snaps-rpc-methods` today (and no core package depends on that\n * package), so the SIP-6 math is vendored here rather than imported.\n */\n\n/**\n * Snap ID used as the SIP-6 `input` so derived keys match\n * `@metamask/message-signing-snap` (`snap_getEntropy` origin).\n */\nexport const MESSAGE_SIGNING_SNAP_ID = 'npm:@metamask/message-signing-snap';\n\n/**\n * Copy of `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`\n * (`0xd36e6170 - 0x80000000`).\n *\n * @see https://metamask.github.io/SIPs/SIPS/sip-6\n */\nconst SIP_6_MAGIC_VALUE = `1399742832'` as `${number}'`;\n\nconst HARDENED_VALUE = 0x80000000;\n\n/**\n * HMAC-SHA-512 for `@metamask/key-tree`.\n *\n * Passed into `SLIP10Node.fromSeed` so SIP-6 never uses Web Crypto.\n * `@metamask/key-tree` treats any `crypto.subtle` as complete and then HMAC\n * via `importKey` / `sign`. React Native only implements `digest`; its\n * SubtleCrypto cannot HMAC. Noble HMAC is byte-identical without SubtleCrypto.\n */\nconst NOBLE_HMAC_SHA512 = {\n  hmacSha512: async (key: Uint8Array, data: Uint8Array): Promise<Uint8Array> =>\n    hmac(sha512, key, data),\n};\n\n/**\n * Copy of `@metamask/snaps-rpc-methods` `getDerivationPathArray`.\n *\n * Maps a 32-byte hash to eight hardened BIP-32 indices for `@metamask/key-tree`.\n *\n * @param hash - 32-byte hash.\n * @returns Hardened BIP-32 path nodes.\n */\nfunction getDerivationPathArray(hash: Uint8Array): HardenedBIP32Node[] {\n  const array: HardenedBIP32Node[] = [];\n  const view = createDataView(hash);\n\n  for (let index = 0; index < 8; index++) {\n    const uint32 = view.getUint32(index * 4);\n    // eslint-disable-next-line no-bitwise\n    const pathIndex = (uint32 | HARDENED_VALUE) >>> 0;\n    array.push(`bip32:${pathIndex - HARDENED_VALUE}'` as const);\n  }\n\n  return array;\n}\n\n/**\n * Copy of `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` (SIP-6),\n * returning raw private-key bytes instead of a `0x`-prefixed hex string.\n *\n * @param options - Derivation options.\n * @param options.seed - BIP-39 mnemonic seed.\n * @param options.input - SIP-6 input (snap ID for `snap_getEntropy`).\n * @param options.salt - Optional salt. Internal auth uses `''`.\n * @returns 32-byte private key.\n */\nexport async function deriveSip6PrivateKey({\n  seed,\n  input,\n  salt = '',\n}: {\n  seed: Uint8Array;\n  input: string;\n  salt?: string;\n}): Promise<Uint8Array> {\n  const hash = keccak256(\n    concatBytes([stringToBytes(input), keccak256(stringToBytes(salt))]),\n  );\n  const computedDerivationPath = getDerivationPathArray(hash);\n\n  const { privateKey } = await SLIP10Node.fromSeed(\n    {\n      derivationPath: [\n        seed,\n        `bip32:${SIP_6_MAGIC_VALUE}`,\n        ...computedDerivationPath,\n      ],\n      curve: 'secp256k1',\n    },\n    NOBLE_HMAC_SHA512,\n  );\n\n  assert(privateKey, 'Failed to derive SIP-6 entropy.');\n  return hexToBytes(privateKey);\n}\n\n/**\n * Derives the message-signing private key via SIP-6, matching\n * `snap_getEntropy` for the message-signing snap with empty salt\n * (internal `metamask` origin).\n *\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns 32-byte private key.\n */\nexport async function deriveMessageSigningPrivateKey(\n  seed: Uint8Array,\n  salt = '',\n): Promise<Uint8Array> {\n  return deriveSip6PrivateKey({\n    seed,\n    input: MESSAGE_SIGNING_SNAP_ID,\n    salt,\n  });\n}\n\n/**\n * Copy of message-signing-snap `getPublicEntropyKey`: secp256k1 pubkey hex\n * for the SIP-6 message-signing private key.\n *\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns Public key hex with `0x` prefix.\n */\nexport async function getMessageSigningPublicKey(\n  seed: Uint8Array,\n  salt = '',\n): Promise<string> {\n  const privateKey = await deriveMessageSigningPrivateKey(seed, salt);\n  return bytesToHex(secp256k1.getPublicKey(privateKey));\n}\n\n/**\n * Copy of message-signing-snap `signMessageWithEntropyKey`: sha256(message)\n * then compact secp256k1 signature.\n *\n * @param message - Message to sign (must be validated by the caller).\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns Compact secp256k1 signature hex with `0x` prefix.\n */\nexport async function signMessageWithMessageSigningKey(\n  message: string,\n  seed: Uint8Array,\n  salt = '',\n): Promise<string> {\n  const privateKey = await deriveMessageSigningPrivateKey(seed, salt);\n  const digest = sha256(message);\n  const signature = secp256k1.sign(digest, privateKey);\n  return `0x${signature.toCompactHex()}`;\n}\n"]}