@metamask-previews/profile-sync-controller 29.0.0-preview-3866c0ff1 → 29.0.0-preview-e3275932a

package/dist/controllers/authentication/AuthenticationController.d.mts

@@ -0,0 +1,130 @@
+import { BaseController } from "@metamask/base-controller";
+import type { ControllerGetStateAction, ControllerStateChangeEvent } from "@metamask/base-controller";
+import type { KeyringControllerGetStateAction, KeyringControllerLockEvent, KeyringControllerUnlockEvent, KeyringControllerWithKeyringV2UnsafeAction } from "@metamask/keyring-controller";
+import type { Messenger } from "@metamask/messenger";
+import type { SeedlessOnboardingControllerGetStateAction } from "@metamask/seedless-onboarding-controller";
+import type { LoginResponse, ProfileAlias, UserProfile, UserProfileLineage } from "../../sdk/index.mjs";
+import { Env } from "../../sdk/index.mjs";
+import type { MetaMetricsAuth } from "../../shared/types/services.mjs";
+import { AuthenticationControllerMethodActions } from "./AuthenticationController-method-action-types.mjs";
+declare const controllerName = "AuthenticationController";
+export type AuthenticationControllerState = {
+    isSignedIn: boolean;
+    srpSessionData?: Record<string, LoginResponse>;
+    /**
+     * Client gate for profile pairing. Defaults to `true` (fresh install /
+     * upgrade), set to `false` after a successful `performSignIn` pair, set
+     * back to `true` via `requestProfilePairing()` when the SRP set changes,
+     * and left `true` on pair failure so the next state shift retries.
+     *
+     * Optional in the type so partial-state selectors stay assignable to
+     * `AuthenticationControllerState`. The controller seeds it via
+     * `defaultState` at construction; consumers should read `undefined` as
+     * `true` to mirror that runtime default.
+     */
+    needsProfilePairing?: boolean;
+};
+export declare const defaultState: AuthenticationControllerState;
+type ControllerConfig = {
+    env: Env;
+};
+export type Actions = AuthenticationControllerGetStateAction | AuthenticationControllerMethodActions;
+export type AuthenticationControllerGetStateAction = ControllerGetStateAction<typeof controllerName, AuthenticationControllerState>;
+export type AuthenticationControllerStateChangeEvent = ControllerStateChangeEvent<typeof controllerName, AuthenticationControllerState>;
+export type ProfileSignInInfo = {
+    profileId: string;
+    profileAliases: ProfileAlias[];
+    profileIdChanged: boolean;
+};
+export type AuthenticationControllerProfileSignInEvent = {
+    type: `${typeof controllerName}:profileSignIn`;
+    payload: [ProfileSignInInfo];
+};
+export type Events = AuthenticationControllerStateChangeEvent | AuthenticationControllerProfileSignInEvent;
+type AllowedActions = KeyringControllerGetStateAction | KeyringControllerWithKeyringV2UnsafeAction | SeedlessOnboardingControllerGetStateAction;
+type AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;
+export type AuthenticationControllerMessenger = Messenger<typeof controllerName, Actions | AllowedActions, Events | AllowedEvents>;
+/**
+ * Controller that enables authentication for restricted endpoints.
+ * Used for Backup & Sync, Notifications, and other services.
+ */
+export declare class AuthenticationController extends BaseController<typeof controllerName, AuthenticationControllerState, AuthenticationControllerMessenger> {
+    #private;
+    constructor({ messenger, state, config, metametrics, }: {
+        messenger: AuthenticationControllerMessenger;
+        state?: AuthenticationControllerState;
+        config?: Partial<ControllerConfig>;
+        /**
+         * Not using the Messaging System as we
+         * do not want to tie this strictly to extension
+         */
+        metametrics: MetaMetricsAuth;
+    });
+    performSignIn(): Promise<string[]>;
+    /**
+     * Marks profile pairing as needed. Clients call this when the SRP set
+     * changes (e.g. a new keyring was added) so the next auto-sign-in cycle
+     * re-runs `performSignIn` and re-pairs.
+     */
+    requestProfilePairing(): void;
+    performSignOut(): void;
+    /**
+     * Returns a bearer token for the specified SRP, logging in if needed.
+     *
+     * When called without `entropySourceId`, returns the primary (first) SRP's
+     * access token, which is effectively the canonical
+     * profile's token that can be used by alias-aware consumers for cross-SRP
+     * operations.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The OIDC access token.
+     */
+    getBearerToken(entropySourceId?: string): Promise<string>;
+    /**
+     * Returns the cached session profile, logging in if no session exists.
+     *
+     * The returned `canonicalProfileId` reflects the value from the most recent
+     * login or pairing. In the rare event where a canonical changed because of
+     * a pairing that happened on another device, the cached value may be stale
+     * until the next login. For guaranteed freshness, call
+     * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.
+     *
+     * @param entropySourceId - The entropy source ID used to derive the key,
+     * when multiple sources are available (Multi-SRP).
+     * @returns profile for the session.
+     */
+    getSessionProfile(entropySourceId?: string): Promise<UserProfile>;
+    /**
+     * Forces a fresh retrieval of the canonical profile ID from the server
+     * and propagates it to all cached SRP sessions.
+     *
+     * This method invalidates the primary SRP's cached session and forces a
+     * re-login. Use it before operations that require a guaranteed-fresh
+     * canonical (e.g. storage key derivation for Accounts ADR 0005). For
+     * best-effort reads, use
+     * `getSessionProfile().canonicalProfileId` instead.
+     *
+     * Only the primary SRP is re-logged-in regardless of how many SRPs exist —
+     * the server returns the current canonical for the entire pairing group
+     * from any single SRP login.
+     *
+     * @returns The refreshed canonical profile ID.
+     */
+    refreshCanonicalProfileId(): Promise<string>;
+    getUserProfileLineage(entropySourceId?: string): Promise<UserProfileLineage>;
+    /**
+     * Returns a Customer Service specific access token for the specified SRP,
+     * logging in if needed.
+     *
+     * Exchanges the OIDC access token for a short-lived token scoped to the
+     * customer-service audience. Customer Service tooling consumes this token to
+     * identify and authenticate the user.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The customer-service access token.
+     */
+    getCustomerServiceToken(entropySourceId?: string): Promise<string>;
+    isSignedIn(): boolean;
+}
+export {};
+//# sourceMappingURL=AuthenticationController.d.mts.map

package/dist/controllers/authentication/AuthenticationController.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationController.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EAAE,0CAA0C,EAAE,iDAAiD;AAG3G,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAGZ,WAAW,EACX,kBAAkB,EACnB,4BAA2B;AAC5B,OAAO,EAGL,GAAG,EAEJ,4BAA2B;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAUtE,OAAO,EAAE,qCAAqC,EAAE,2DAA0D;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAG1B,CAAC;AA4CF,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAcF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,0CAA0C,GAC1C,0CAA0C,CAAC;AAE/C,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;gBA+Ba,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;KAC9B;IAiMY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA6B/C;;;;OAIG;IACI,qBAAqB,IAAI,IAAI;IA8G7B,cAAc,IAAI,IAAI;IAO7B;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMtE;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC;IA8B5C,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAM9B;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAMX,UAAU,IAAI,OAAO;CAgF7B"}

package/dist/controllers/authentication/AuthenticationController.mjs

@@ -0,0 +1,485 @@
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getHdKeyringEntropySourceIds, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_getHdKeyringSeed, _AuthenticationController_getPublicKey, _AuthenticationController__signMessageCache, _AuthenticationController_scopedCacheKey, _AuthenticationController_signMessage;
+import { BaseController } from "@metamask/base-controller";
+import { assertMessageStartsWithMetamask, AuthType, Env, JwtBearerAuth } from "../../sdk/index.mjs";
+import { getHdKeyringEntropySourceIds, getPrimaryHdKeyringEntropySourceId } from "../../shared/utils/entropy-source.mjs";
+import { getHdKeyringSeed } from "../../shared/utils/hd-keyring-seed.mjs";
+import { getMessageSigningPublicKey, signMessageWithMessageSigningKey } from "../../shared/utils/message-signing.mjs";
+const controllerName = 'AuthenticationController';
+export const defaultState = {
+    isSignedIn: false,
+    needsProfilePairing: true,
+};
+const metadata = {
+    isSignedIn: {
+        includeInStateLogs: true,
+        persist: true,
+        includeInDebugSnapshot: true,
+        usedInUi: true,
+    },
+    needsProfilePairing: {
+        includeInStateLogs: true,
+        persist: true,
+        includeInDebugSnapshot: true,
+        usedInUi: true,
+    },
+    srpSessionData: {
+        // Remove access token from state logs
+        includeInStateLogs: (srpSessionData) => {
+            // Unreachable branch, included just to fix a type error for the case where this property is
+            // unset. The type gets collapsed to include `| undefined` even though `undefined` is never
+            // set here, because we don't yet use `exactOptionalPropertyTypes`.
+            // TODO: Remove branch after enabling `exactOptionalPropertyTypes`
+            // ref: https://github.com/MetaMask/core/issues/6565
+            if (srpSessionData === null || srpSessionData === undefined) {
+                return null;
+            }
+            return Object.entries(srpSessionData).reduce((sanitizedSrpSessionData, [key, value]) => {
+                const { accessToken: _unused, ...tokenWithoutAccessToken } = value.token;
+                sanitizedSrpSessionData[key] = {
+                    ...value,
+                    token: tokenWithoutAccessToken,
+                };
+                return sanitizedSrpSessionData;
+            }, {});
+        },
+        persist: true,
+        includeInDebugSnapshot: false,
+        usedInUi: true,
+    },
+};
+const MESSENGER_EXPOSED_METHODS = [
+    'performSignIn',
+    'performSignOut',
+    'getBearerToken',
+    'getSessionProfile',
+    'refreshCanonicalProfileId',
+    'getUserProfileLineage',
+    'getCustomerServiceToken',
+    'isSignedIn',
+    'requestProfilePairing',
+];
+/**
+ * Controller that enables authentication for restricted endpoints.
+ * Used for Backup & Sync, Notifications, and other services.
+ */
+export class AuthenticationController extends BaseController {
+    constructor({ messenger, state, config, metametrics, }) {
+        super({
+            messenger,
+            metadata,
+            name: controllerName,
+            state: { ...defaultState, ...state },
+        });
+        _AuthenticationController_instances.add(this);
+        _AuthenticationController_metametrics.set(this, void 0);
+        _AuthenticationController_auth.set(this, void 0);
+        _AuthenticationController_config.set(this, {
+            env: Env.PRD,
+        });
+        _AuthenticationController_isUnlocked.set(this, false);
+        // Bumped by `requestProfilePairing`. `performSignIn` snapshots this
+        // before its first await; if it changes mid-flight we must NOT clear
+        // `needsProfilePairing` (the rearm signal wins).
+        _AuthenticationController_profilePairingRequestEpoch.set(this, 0);
+        _AuthenticationController_keyringController.set(this, {
+            setupLockedStateSubscriptions: () => {
+                const { isUnlocked } = this.messenger.call('KeyringController:getState');
+                __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, isUnlocked, "f");
+                this.messenger.subscribe('KeyringController:unlock', () => {
+                    __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, true, "f");
+                });
+                this.messenger.subscribe('KeyringController:lock', () => {
+                    __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, false, "f");
+                });
+            },
+        });
+        _AuthenticationController__signMessageCache.set(this, {});
+        if (!metametrics) {
+            throw new Error('`metametrics` field is required');
+        }
+        __classPrivateFieldSet(this, _AuthenticationController_config, {
+            ...__classPrivateFieldGet(this, _AuthenticationController_config, "f"),
+            ...config,
+        }, "f");
+        __classPrivateFieldSet(this, _AuthenticationController_metametrics, metametrics, "f");
+        __classPrivateFieldSet(this, _AuthenticationController_auth, new JwtBearerAuth({
+            env: __classPrivateFieldGet(this, _AuthenticationController_config, "f").env,
+            platform: metametrics.agent,
+            type: AuthType.SRP,
+        }, {
+            storage: {
+                getLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginResponseFromState).bind(this),
+                setLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_setLoginResponseToState).bind(this),
+            },
+            signing: {
+                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPublicKey).bind(this),
+                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_signMessage).bind(this),
+            },
+            getLoginTag: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginTag).bind(this),
+            getLoginIdentifierType: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginIdentifierType).bind(this),
+            metametrics: __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f"),
+        }), "f");
+        __classPrivateFieldGet(this, _AuthenticationController_keyringController, "f").setupLockedStateSubscriptions();
+        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
+    }
+    async performSignIn() {
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'performSignIn');
+        const epochAtStart = __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f");
+        const entropySourceIds = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringEntropySourceIds).call(this);
+        const accessTokens = [];
+        // We iterate sequentially in order to be sure that the first entry
+        // is the primary SRP LoginResponse.
+        for (const entropySourceId of entropySourceIds) {
+            const accessToken = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(entropySourceId);
+            accessTokens.push(accessToken);
+        }
+        if (entropySourceIds.length < 2) {
+            // Single-SRP wallet: nothing to pair.
+            __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
+        }
+        else {
+            // Pair failures must not break sign-in; the gate stays `true` for retry.
+            try {
+                await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_doPair).call(this, accessTokens, epochAtStart);
+            }
+            catch {
+                // noop
+            }
+        }
+        return accessTokens;
+    }
+    /**
+     * Marks profile pairing as needed. Clients call this when the SRP set
+     * changes (e.g. a new keyring was added) so the next auto-sign-in cycle
+     * re-runs `performSignIn` and re-pairs.
+     */
+    requestProfilePairing() {
+        __classPrivateFieldSet(this, _AuthenticationController_profilePairingRequestEpoch, __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") + 1, "f");
+        if (!this.state.needsProfilePairing) {
+            this.update((state) => {
+                state.needsProfilePairing = true;
+            });
+        }
+    }
+    performSignOut() {
+        this.update((state) => {
+            state.isSignedIn = false;
+            state.srpSessionData = undefined;
+        });
+    }
+    /**
+     * Returns a bearer token for the specified SRP, logging in if needed.
+     *
+     * When called without `entropySourceId`, returns the primary (first) SRP's
+     * access token, which is effectively the canonical
+     * profile's token that can be used by alias-aware consumers for cross-SRP
+     * operations.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The OIDC access token.
+     */
+    async getBearerToken(entropySourceId) {
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getBearerToken');
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(resolvedId);
+    }
+    /**
+     * Returns the cached session profile, logging in if no session exists.
+     *
+     * The returned `canonicalProfileId` reflects the value from the most recent
+     * login or pairing. In the rare event where a canonical changed because of
+     * a pairing that happened on another device, the cached value may be stale
+     * until the next login. For guaranteed freshness, call
+     * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.
+     *
+     * @param entropySourceId - The entropy source ID used to derive the key,
+     * when multiple sources are available (Multi-SRP).
+     * @returns profile for the session.
+     */
+    async getSessionProfile(entropySourceId) {
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getSessionProfile');
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfile(resolvedId);
+    }
+    /**
+     * Forces a fresh retrieval of the canonical profile ID from the server
+     * and propagates it to all cached SRP sessions.
+     *
+     * This method invalidates the primary SRP's cached session and forces a
+     * re-login. Use it before operations that require a guaranteed-fresh
+     * canonical (e.g. storage key derivation for Accounts ADR 0005). For
+     * best-effort reads, use
+     * `getSessionProfile().canonicalProfileId` instead.
+     *
+     * Only the primary SRP is re-logged-in regardless of how many SRPs exist —
+     * the server returns the current canonical for the entire pairing group
+     * from any single SRP login.
+     *
+     * @returns The refreshed canonical profile ID.
+     */
+    async refreshCanonicalProfileId() {
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'refreshCanonicalProfileId');
+        const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_invalidateSrpSession).call(this, primaryEntropySourceId);
+        await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(primaryEntropySourceId);
+        const canonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+        if (!canonical) {
+            throw new Error('refreshCanonicalProfileId - Unable to resolve canonical profile ID');
+        }
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_propagateCanonical).call(this, canonical);
+        return canonical;
+    }
+    async getUserProfileLineage(entropySourceId) {
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getUserProfileLineage');
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
+    }
+    /**
+     * Returns a Customer Service specific access token for the specified SRP,
+     * logging in if needed.
+     *
+     * Exchanges the OIDC access token for a short-lived token scoped to the
+     * customer-service audience. Customer Service tooling consumes this token to
+     * identify and authenticate the user.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The customer-service access token.
+     */
+    async getCustomerServiceToken(entropySourceId) {
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
+    }
+    isSignedIn() {
+        return this.state.isSignedIn;
+    }
+}
+_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__signMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    if (!this.state.srpSessionData?.[resolvedId]) {
+        return null;
+    }
+    return this.state.srpSessionData[resolvedId];
+}, _AuthenticationController_setLoginResponseToState = async function _AuthenticationController_setLoginResponseToState(loginResponse, entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const metaMetricsId = await __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f").getMetaMetricsId();
+    this.update((state) => {
+        state.isSignedIn = true;
+        if (!state.srpSessionData) {
+            state.srpSessionData = {};
+        }
+        state.srpSessionData[resolvedId] = {
+            ...loginResponse,
+            profile: {
+                ...loginResponse.profile,
+                metaMetricsId,
+            },
+        };
+    });
+}, _AuthenticationController_assertIsUnlocked = function _AuthenticationController_assertIsUnlocked(methodName) {
+    if (!__classPrivateFieldGet(this, _AuthenticationController_isUnlocked, "f")) {
+        throw new Error(`${methodName} - unable to proceed, wallet is locked`);
+    }
+}, _AuthenticationController_getHdKeyringEntropySourceIds = function _AuthenticationController_getHdKeyringEntropySourceIds() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return getHdKeyringEntropySourceIds(keyrings);
+}, _AuthenticationController_getPrimaryEntropySourceId = function _AuthenticationController_getPrimaryEntropySourceId() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return getPrimaryHdKeyringEntropySourceId(keyrings);
+}, _AuthenticationController_getLoginTag = 
+/**
+ * Resolves the SRP login tag for `raw_message`.
+ *
+ * - `primary` for the first HD entropy source
+ * - `secondary` for any other entropy source
+ *
+ * @param entropySourceId - Entropy source for this login attempt.
+ * @returns The login tag to append to the signed message.
+ */
+async function _AuthenticationController_getLoginTag(entropySourceId) {
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const resolvedId = entropySourceId ?? primaryEntropySourceId;
+    return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';
+}, _AuthenticationController_getLoginIdentifierType = 
+/**
+ * Resolves metametrics `identifier_type` for `/srp/login`
+ * (`SRP` | `GOOGLE` | `APPLE` | `TELEGRAM`).
+ *
+ * This is the auth method for the entropy source, independent of
+ * {@link SrpLoginTag} (`primary` / `secondary`).
+ *
+ * SeedlessOnboarding currently exposes a single vault-level
+ * `authConnection`, which always backs the primary entropy source. Non-
+ * primary sources therefore return `SRP`. If social identities become
+ * per-entropy later, resolve from that metadata instead of assuming
+ * primary === social.
+ *
+ * Soft-fails to `SRP` when SeedlessOnboarding is not registered.
+ *
+ * @param entropySourceId - Entropy source for this login attempt.
+ * @returns The login identifier type.
+ */
+async function _AuthenticationController_getLoginIdentifierType(entropySourceId) {
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const resolvedId = entropySourceId ?? primaryEntropySourceId;
+    // Social vault authConnection is only associated with the primary source.
+    if (resolvedId !== primaryEntropySourceId) {
+        return 'SRP';
+    }
+    return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_resolveSocialIdentifierType).call(this);
+}, _AuthenticationController_resolveSocialIdentifierType = function _AuthenticationController_resolveSocialIdentifierType() {
+    try {
+        const { vault, authConnection } = this.messenger.call('SeedlessOnboardingController:getState');
+        if (vault === null || vault === undefined) {
+            return 'SRP';
+        }
+        // Match provider strings from SeedlessOnboarding state rather than
+        // importing AuthConnection — a value import would load that package
+        // (and its heavy deps) whenever this controller is imported.
+        switch (authConnection) {
+            case 'google':
+                return 'GOOGLE';
+            case 'apple':
+                return 'APPLE';
+            case 'telegram':
+                return 'TELEGRAM';
+            default:
+                return 'SRP';
+        }
+    }
+    catch {
+        return 'SRP';
+    }
+}, _AuthenticationController_tryClearNeedsProfilePairing = function _AuthenticationController_tryClearNeedsProfilePairing(epochAtStart) {
+    if (__classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") !== epochAtStart) {
+        return;
+    }
+    if (this.state.needsProfilePairing) {
+        this.update((state) => {
+            state.needsProfilePairing = false;
+        });
+    }
+}, _AuthenticationController_doPair = 
+/**
+ * Pairs all SRPs via `POST /profile/pair`, propagates the canonical
+ * profile ID, clears `needsProfilePairing`, and emits
+ * `AuthenticationController:profileSignIn` when the canonical changes or
+ * new aliases are returned. Throws on failure.
+ *
+ * @param accessTokens - Per-SRP access tokens, primary first.
+ * @param epochAtStart - Pairing-request epoch captured by the caller.
+ * Used to skip the gate clear if `requestProfilePairing` ran while the
+ * pair API call was in-flight.
+ */
+async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
+    const previousCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+    const profileAliases = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_pairSrpProfiles).call(this, accessTokens);
+    const newCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+    // If somehow we cannot compute the new canonical profile ID after pairing,
+    // we just return now and do not update the `needsProfilePairing` flag.
+    if (!newCanonical) {
+        return;
+    }
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
+    const profileIdChanged = previousCanonical !== newCanonical;
+    const shouldEmitProfileSignInEvent = profileIdChanged || profileAliases.length > 0;
+    if (shouldEmitProfileSignInEvent) {
+        this.messenger.publish('AuthenticationController:profileSignIn', {
+            profileId: newCanonical,
+            profileAliases,
+            profileIdChanged,
+        });
+    }
+}, _AuthenticationController_pairSrpProfiles = async function _AuthenticationController_pairSrpProfiles(accessTokens) {
+    if (accessTokens.length < 2) {
+        return [];
+    }
+    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.
+    const { profileAliases, profile: { canonicalProfileId }, } = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").pairSrpProfiles(accessTokens, primaryAccessToken);
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_propagateCanonical).call(this, canonicalProfileId);
+    return profileAliases;
+}, _AuthenticationController_propagateCanonical = function _AuthenticationController_propagateCanonical(canonicalProfileId) {
+    const { srpSessionData } = this.state;
+    if (!srpSessionData) {
+        return;
+    }
+    this.update((state) => {
+        for (const entry of Object.values(state.srpSessionData ?? {})) {
+            if (entry?.profile) {
+                entry.profile.canonicalProfileId = canonicalProfileId;
+            }
+        }
+    });
+}, _AuthenticationController_getCanonicalProfileId = function _AuthenticationController_getCanonicalProfileId() {
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    return (this.state.srpSessionData?.[primaryEntropySourceId]?.profile
+        ?.canonicalProfileId ?? null);
+}, _AuthenticationController_invalidateSrpSession = function _AuthenticationController_invalidateSrpSession(entropySourceId) {
+    this.update((state) => {
+        const entry = state.srpSessionData?.[entropySourceId];
+        if (entry?.profile) {
+            // Setting canonicalProfileId to '' forces a re-fetch on the next
+            // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)
+            // treats '' the same as undefined/null — all signal an invalid session.
+            entry.profile.canonicalProfileId = '';
+        }
+    });
+}, _AuthenticationController_getHdKeyringSeed = 
+/**
+ * Reads the BIP-39 seed for an HD entropy source from KeyringController.
+ *
+ * @param entropySourceId - Entropy source ID. Defaults to the primary HD
+ * keyring.
+ * @returns The HD keyring seed.
+ */
+async function _AuthenticationController_getHdKeyringSeed(entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    return getHdKeyringSeed(this.messenger, resolvedId);
+}, _AuthenticationController_getPublicKey = 
+/**
+ * Returns the message-signing public key via native SIP-6 derivation
+ * (same key as `@metamask/message-signing-snap` with empty salt).
+ *
+ * @param entropySourceId - The entropy source ID used to derive the key,
+ * when multiple sources are available (Multi-SRP).
+ * @returns The public key hex.
+ */
+async function _AuthenticationController_getPublicKey(entropySourceId) {
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#getPublicKey');
+    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
+    return getMessageSigningPublicKey(seed);
+}, _AuthenticationController_scopedCacheKey = function _AuthenticationController_scopedCacheKey(message, entropySourceId) {
+    return `${entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this)}:${message}`;
+}, _AuthenticationController_signMessage = 
+/**
+ * Signs a `metamask:…` message with the native SIP-6 message-signing key.
+ *
+ * @param message - A specific tagged message to sign.
+ * @param entropySourceId - The entropy source ID used to derive the key,
+ * when multiple sources are available (Multi-SRP).
+ * @returns Compact secp256k1 signature hex.
+ */
+async function _AuthenticationController_signMessage(message, entropySourceId) {
+    assertMessageStartsWithMetamask(message);
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#signMessage');
+    const cacheKey = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_scopedCacheKey).call(this, message, entropySourceId);
+    if (__classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey]) {
+        return __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey];
+    }
+    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
+    const result = await signMessageWithMessageSigningKey(message, seed);
+    __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey] = result;
+    return result;
+};
+//# sourceMappingURL=AuthenticationController.mjs.map