@metamask-previews/profile-sync-controller 29.0.0-preview-5b293ee50 → 29.0.0-preview-3866c0ff1

package/CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **BREAKING:** Bump minimum Node.js version to 22 ([#9168](https://github.com/MetaMask/core/pull/9168))
 - **BREAKING:** Derive auth and user-storage message-signing keys natively via SIP-6 from HD keyring seeds instead of calling `@metamask/message-signing-snap` through `SnapController`. `AuthenticationController` and `UserStorageController` now require `KeyringController:withKeyringV2Unsafe` and no longer call `SnapController:handleRequest`. The message-signing snap remains for Portfolio / external origins ([#9824](https://github.com/MetaMask/core/pull/9824))
   - Derive native SIP-6 keys with `@noble/hashes` HMAC-SHA-512 instead of Web Crypto, so auth works on React Native, whose SubtleCrypto cannot HMAC.
 - Resolve HD entropy source IDs from `KeyringController` instead of the message-signing snap (`getBearerToken` primary ID, `performSignIn` SRP enumeration) ([#9794](https://github.com/MetaMask/core/pull/9794))

package/dist/controllers/authentication/{AuthenticationController-method-action-types.d.mts → AuthenticationController-method-action-types.d.ts}

@@ -2,7 +2,7 @@
  * This file is auto generated.
  * Do not edit manually.
  */
-import type { AuthenticationController } from "./AuthenticationController.mjs";
+import type { AuthenticationController } from './AuthenticationController.js';
 export type AuthenticationControllerPerformSignInAction = {
     type: `AuthenticationController:performSignIn`;
     handler: AuthenticationController['performSignIn'];
@@ -99,4 +99,4 @@ export type AuthenticationControllerIsSignedInAction = {
  * Union of all AuthenticationController action types.
  */
 export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerIsSignedInAction;
-//# sourceMappingURL=AuthenticationController-method-action-types.d.mts.map
+//# sourceMappingURL=AuthenticationController-method-action-types.d.ts.map

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,wCAAwC,CAAC"}

package/dist/controllers/authentication/{AuthenticationController-method-action-types.mjs → AuthenticationController-method-action-types.js}

@@ -3,4 +3,4 @@
  * Do not edit manually.
  */
 export {};
-//# sourceMappingURL=AuthenticationController-method-action-types.mjs.map
+//# sourceMappingURL=AuthenticationController-method-action-types.js.map

package/dist/controllers/authentication/AuthenticationController-method-action-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}

package/dist/controllers/authentication/{AuthenticationController.d.mts → AuthenticationController.d.ts}

@@ -1,12 +1,12 @@
-import { BaseController } from "@metamask/base-controller";
-import type { ControllerGetStateAction, ControllerStateChangeEvent } from "@metamask/base-controller";
-import type { KeyringControllerGetStateAction, KeyringControllerLockEvent, KeyringControllerUnlockEvent, KeyringControllerWithKeyringV2UnsafeAction } from "@metamask/keyring-controller";
-import type { Messenger } from "@metamask/messenger";
-import type { SeedlessOnboardingControllerGetStateAction } from "@metamask/seedless-onboarding-controller";
-import type { LoginResponse, ProfileAlias, UserProfile, UserProfileLineage } from "../../sdk/index.mjs";
-import { Env } from "../../sdk/index.mjs";
-import type { MetaMetricsAuth } from "../../shared/types/services.mjs";
-import { AuthenticationControllerMethodActions } from "./AuthenticationController-method-action-types.mjs";
+import { BaseController } from '@metamask/base-controller';
+import type { ControllerGetStateAction, ControllerStateChangeEvent } from '@metamask/base-controller';
+import type { KeyringControllerGetStateAction, KeyringControllerLockEvent, KeyringControllerUnlockEvent, KeyringControllerWithKeyringV2UnsafeAction } from '@metamask/keyring-controller';
+import type { Messenger } from '@metamask/messenger';
+import type { SeedlessOnboardingControllerGetStateAction } from '@metamask/seedless-onboarding-controller';
+import type { LoginResponse, ProfileAlias, UserProfile, UserProfileLineage } from '../../sdk/index.js';
+import { Env } from '../../sdk/index.js';
+import type { MetaMetricsAuth } from '../../shared/types/services.js';
+import { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types.js';
 declare const controllerName = "AuthenticationController";
 export type AuthenticationControllerState = {
     isSignedIn: boolean;
@@ -127,4 +127,4 @@ export declare class AuthenticationController extends BaseController<typeof cont
     isSignedIn(): boolean;
 }
 export {};
-//# sourceMappingURL=AuthenticationController.d.mts.map
+//# sourceMappingURL=AuthenticationController.d.ts.map

package/dist/controllers/authentication/AuthenticationController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,0CAA0C,CAAC;AAG3G,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAGZ,WAAW,EACX,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAEJ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAUtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAG1B,CAAC;AA4CF,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAcF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,0CAA0C,GAC1C,0CAA0C,CAAC;AAE/C,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;IA+BC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;KAC9B,EA8CA;IAmJY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CA2B9C;IAED;;;;OAIG;IACI,qBAAqB,IAAI,IAAI,CAOnC;IAuGM,cAAc,IAAI,IAAI,CAK5B;IAED;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE;IAED;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAItB;IAED;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBxD;IAcY,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAI7B;IAED;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAEM,UAAU,IAAI,OAAO,CAE3B;CA8EF"}

package/dist/controllers/authentication/AuthenticationController.js

@@ -0,0 +1,536 @@
+import { BaseController } from '@metamask/base-controller';
+import { assertMessageStartsWithMetamask, AuthType, Env, JwtBearerAuth, } from '../../sdk/index.js';
+import { getHdKeyringEntropySourceIds, getPrimaryHdKeyringEntropySourceId, } from '../../shared/utils/entropy-source.js';
+import { getHdKeyringSeed } from '../../shared/utils/hd-keyring-seed.js';
+import { getMessageSigningPublicKey, signMessageWithMessageSigningKey, } from '../../shared/utils/message-signing.js';
+const controllerName = 'AuthenticationController';
+export const defaultState = {
+    isSignedIn: false,
+    needsProfilePairing: true,
+};
+const metadata = {
+    isSignedIn: {
+        includeInStateLogs: true,
+        persist: true,
+        includeInDebugSnapshot: true,
+        usedInUi: true,
+    },
+    needsProfilePairing: {
+        includeInStateLogs: true,
+        persist: true,
+        includeInDebugSnapshot: true,
+        usedInUi: true,
+    },
+    srpSessionData: {
+        // Remove access token from state logs
+        includeInStateLogs: (srpSessionData) => {
+            // Unreachable branch, included just to fix a type error for the case where this property is
+            // unset. The type gets collapsed to include `| undefined` even though `undefined` is never
+            // set here, because we don't yet use `exactOptionalPropertyTypes`.
+            // TODO: Remove branch after enabling `exactOptionalPropertyTypes`
+            // ref: https://github.com/MetaMask/core/issues/6565
+            if (srpSessionData === null || srpSessionData === undefined) {
+                return null;
+            }
+            return Object.entries(srpSessionData).reduce((sanitizedSrpSessionData, [key, value]) => {
+                const { accessToken: _unused, ...tokenWithoutAccessToken } = value.token;
+                sanitizedSrpSessionData[key] = {
+                    ...value,
+                    token: tokenWithoutAccessToken,
+                };
+                return sanitizedSrpSessionData;
+            }, {});
+        },
+        persist: true,
+        includeInDebugSnapshot: false,
+        usedInUi: true,
+    },
+};
+const MESSENGER_EXPOSED_METHODS = [
+    'performSignIn',
+    'performSignOut',
+    'getBearerToken',
+    'getSessionProfile',
+    'refreshCanonicalProfileId',
+    'getUserProfileLineage',
+    'getCustomerServiceToken',
+    'isSignedIn',
+    'requestProfilePairing',
+];
+/**
+ * Controller that enables authentication for restricted endpoints.
+ * Used for Backup & Sync, Notifications, and other services.
+ */
+export class AuthenticationController extends BaseController {
+    #metametrics;
+    #auth;
+    #config = {
+        env: Env.PRD,
+    };
+    #isUnlocked = false;
+    // Bumped by `requestProfilePairing`. `performSignIn` snapshots this
+    // before its first await; if it changes mid-flight we must NOT clear
+    // `needsProfilePairing` (the rearm signal wins).
+    #profilePairingRequestEpoch = 0;
+    #keyringController = {
+        setupLockedStateSubscriptions: () => {
+            const { isUnlocked } = this.messenger.call('KeyringController:getState');
+            this.#isUnlocked = isUnlocked;
+            this.messenger.subscribe('KeyringController:unlock', () => {
+                this.#isUnlocked = true;
+            });
+            this.messenger.subscribe('KeyringController:lock', () => {
+                this.#isUnlocked = false;
+            });
+        },
+    };
+    constructor({ messenger, state, config, metametrics, }) {
+        super({
+            messenger,
+            metadata,
+            name: controllerName,
+            state: { ...defaultState, ...state },
+        });
+        if (!metametrics) {
+            throw new Error('`metametrics` field is required');
+        }
+        this.#config = {
+            ...this.#config,
+            ...config,
+        };
+        this.#metametrics = metametrics;
+        this.#auth = new JwtBearerAuth({
+            env: this.#config.env,
+            platform: metametrics.agent,
+            type: AuthType.SRP,
+        }, {
+            storage: {
+                getLoginResponse: this.#getLoginResponseFromState.bind(this),
+                setLoginResponse: this.#setLoginResponseToState.bind(this),
+            },
+            signing: {
+                getIdentifier: this.#getPublicKey.bind(this),
+                signMessage: this.#signMessage.bind(this),
+            },
+            getLoginTag: this.#getLoginTag.bind(this),
+            getLoginIdentifierType: this.#getLoginIdentifierType.bind(this),
+            metametrics: this.#metametrics,
+        });
+        this.#keyringController.setupLockedStateSubscriptions();
+        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
+    }
+    async #getLoginResponseFromState(entropySourceId) {
+        const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();
+        if (!this.state.srpSessionData?.[resolvedId]) {
+            return null;
+        }
+        return this.state.srpSessionData[resolvedId];
+    }
+    async #setLoginResponseToState(loginResponse, entropySourceId) {
+        const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();
+        const metaMetricsId = await this.#metametrics.getMetaMetricsId();
+        this.update((state) => {
+            state.isSignedIn = true;
+            if (!state.srpSessionData) {
+                state.srpSessionData = {};
+            }
+            state.srpSessionData[resolvedId] = {
+                ...loginResponse,
+                profile: {
+                    ...loginResponse.profile,
+                    metaMetricsId,
+                },
+            };
+        });
+    }
+    #assertIsUnlocked(methodName) {
+        if (!this.#isUnlocked) {
+            throw new Error(`${methodName} - unable to proceed, wallet is locked`);
+        }
+    }
+    /**
+     * Reads the HD keyring entropy source IDs from KeyringController.
+     *
+     * @returns The HD keyring metadata IDs, primary first.
+     */
+    #getHdKeyringEntropySourceIds() {
+        const { keyrings } = this.messenger.call('KeyringController:getState');
+        return getHdKeyringEntropySourceIds(keyrings);
+    }
+    /**
+     * Resolves the primary SRP's entropy source ID from KeyringController rather
+     * than the message-signing snap, so callers like `getBearerToken()` are not
+     * blocked on snap boot.
+     *
+     * @returns The primary HD keyring metadata ID.
+     * @throws If no HD keyring is available; callers must only resolve while
+     * the wallet is unlocked.
+     */
+    #getPrimaryEntropySourceId() {
+        const { keyrings } = this.messenger.call('KeyringController:getState');
+        return getPrimaryHdKeyringEntropySourceId(keyrings);
+    }
+    /**
+     * Resolves the SRP login tag for `raw_message`.
+     *
+     * - `primary` for the first HD entropy source
+     * - `secondary` for any other entropy source
+     *
+     * @param entropySourceId - Entropy source for this login attempt.
+     * @returns The login tag to append to the signed message.
+     */
+    async #getLoginTag(entropySourceId) {
+        const primaryEntropySourceId = this.#getPrimaryEntropySourceId();
+        const resolvedId = entropySourceId ?? primaryEntropySourceId;
+        return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';
+    }
+    /**
+     * Resolves metametrics `identifier_type` for `/srp/login`
+     * (`SRP` | `GOOGLE` | `APPLE` | `TELEGRAM`).
+     *
+     * This is the auth method for the entropy source, independent of
+     * {@link SrpLoginTag} (`primary` / `secondary`).
+     *
+     * SeedlessOnboarding currently exposes a single vault-level
+     * `authConnection`, which always backs the primary entropy source. Non-
+     * primary sources therefore return `SRP`. If social identities become
+     * per-entropy later, resolve from that metadata instead of assuming
+     * primary === social.
+     *
+     * Soft-fails to `SRP` when SeedlessOnboarding is not registered.
+     *
+     * @param entropySourceId - Entropy source for this login attempt.
+     * @returns The login identifier type.
+     */
+    async #getLoginIdentifierType(entropySourceId) {
+        const primaryEntropySourceId = this.#getPrimaryEntropySourceId();
+        const resolvedId = entropySourceId ?? primaryEntropySourceId;
+        // Social vault authConnection is only associated with the primary source.
+        if (resolvedId !== primaryEntropySourceId) {
+            return 'SRP';
+        }
+        return this.#resolveSocialIdentifierType();
+    }
+    /**
+     * Maps `SeedlessOnboardingController.state.authConnection` to a login
+     * identifier type when a social vault is present.
+     *
+     * Returns `SRP` if there is no vault, the provider is unrecognized, or
+     * SeedlessOnboardingController is unavailable on the messenger.
+     *
+     * @returns The social provider identifier type, or `SRP`.
+     */
+    #resolveSocialIdentifierType() {
+        try {
+            const { vault, authConnection } = this.messenger.call('SeedlessOnboardingController:getState');
+            if (vault === null || vault === undefined) {
+                return 'SRP';
+            }
+            // Match provider strings from SeedlessOnboarding state rather than
+            // importing AuthConnection — a value import would load that package
+            // (and its heavy deps) whenever this controller is imported.
+            switch (authConnection) {
+                case 'google':
+                    return 'GOOGLE';
+                case 'apple':
+                    return 'APPLE';
+                case 'telegram':
+                    return 'TELEGRAM';
+                default:
+                    return 'SRP';
+            }
+        }
+        catch {
+            return 'SRP';
+        }
+    }
+    async performSignIn() {
+        this.#assertIsUnlocked('performSignIn');
+        const epochAtStart = this.#profilePairingRequestEpoch;
+        const entropySourceIds = this.#getHdKeyringEntropySourceIds();
+        const accessTokens = [];
+        // We iterate sequentially in order to be sure that the first entry
+        // is the primary SRP LoginResponse.
+        for (const entropySourceId of entropySourceIds) {
+            const accessToken = await this.#auth.getAccessToken(entropySourceId);
+            accessTokens.push(accessToken);
+        }
+        if (entropySourceIds.length < 2) {
+            // Single-SRP wallet: nothing to pair.
+            this.#tryClearNeedsProfilePairing(epochAtStart);
+        }
+        else {
+            // Pair failures must not break sign-in; the gate stays `true` for retry.
+            try {
+                await this.#doPair(accessTokens, epochAtStart);
+            }
+            catch {
+                // noop
+            }
+        }
+        return accessTokens;
+    }
+    /**
+     * Marks profile pairing as needed. Clients call this when the SRP set
+     * changes (e.g. a new keyring was added) so the next auto-sign-in cycle
+     * re-runs `performSignIn` and re-pairs.
+     */
+    requestProfilePairing() {
+        this.#profilePairingRequestEpoch += 1;
+        if (!this.state.needsProfilePairing) {
+            this.update((state) => {
+                state.needsProfilePairing = true;
+            });
+        }
+    }
+    /**
+     * Clears `needsProfilePairing` only if no `requestProfilePairing` call
+     * landed since `epochAtStart` was captured. Prevents `performSignIn`
+     * from silently overwriting a concurrent rearm.
+     *
+     * @param epochAtStart - Epoch value captured at the start of `performSignIn`.
+     */
+    #tryClearNeedsProfilePairing(epochAtStart) {
+        if (this.#profilePairingRequestEpoch !== epochAtStart) {
+            return;
+        }
+        if (this.state.needsProfilePairing) {
+            this.update((state) => {
+                state.needsProfilePairing = false;
+            });
+        }
+    }
+    /**
+     * Pairs all SRPs via `POST /profile/pair`, propagates the canonical
+     * profile ID, clears `needsProfilePairing`, and emits
+     * `AuthenticationController:profileSignIn` when the canonical changes or
+     * new aliases are returned. Throws on failure.
+     *
+     * @param accessTokens - Per-SRP access tokens, primary first.
+     * @param epochAtStart - Pairing-request epoch captured by the caller.
+     * Used to skip the gate clear if `requestProfilePairing` ran while the
+     * pair API call was in-flight.
+     */
+    async #doPair(accessTokens, epochAtStart) {
+        const previousCanonical = this.#getCanonicalProfileId();
+        const profileAliases = await this.#pairSrpProfiles(accessTokens);
+        const newCanonical = this.#getCanonicalProfileId();
+        // If somehow we cannot compute the new canonical profile ID after pairing,
+        // we just return now and do not update the `needsProfilePairing` flag.
+        if (!newCanonical) {
+            return;
+        }
+        this.#tryClearNeedsProfilePairing(epochAtStart);
+        const profileIdChanged = previousCanonical !== newCanonical;
+        const shouldEmitProfileSignInEvent = profileIdChanged || profileAliases.length > 0;
+        if (shouldEmitProfileSignInEvent) {
+            this.messenger.publish('AuthenticationController:profileSignIn', {
+                profileId: newCanonical,
+                profileAliases,
+                profileIdChanged,
+            });
+        }
+    }
+    async #pairSrpProfiles(accessTokens) {
+        if (accessTokens.length < 2) {
+            return [];
+        }
+        const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.
+        const { profileAliases, profile: { canonicalProfileId }, } = await this.#auth.pairSrpProfiles(accessTokens, primaryAccessToken);
+        this.#propagateCanonical(canonicalProfileId);
+        return profileAliases;
+    }
+    #propagateCanonical(canonicalProfileId) {
+        const { srpSessionData } = this.state;
+        if (!srpSessionData) {
+            return;
+        }
+        this.update((state) => {
+            for (const entry of Object.values(state.srpSessionData ?? {})) {
+                if (entry?.profile) {
+                    entry.profile.canonicalProfileId = canonicalProfileId;
+                }
+            }
+        });
+    }
+    /**
+     * Returns the canonical profile id from the primary SRP's cached session.
+     * Returns `null` when no session exists yet for the primary SRP.
+     *
+     * Always reads from the primary SRP because the canonical is shared across
+     * all paired SRPs after `#propagateCanonical`.
+     *
+     * @returns The canonical profile id, or `null` if unavailable.
+     */
+    #getCanonicalProfileId() {
+        const primaryEntropySourceId = this.#getPrimaryEntropySourceId();
+        return (this.state.srpSessionData?.[primaryEntropySourceId]?.profile
+            ?.canonicalProfileId ?? null);
+    }
+    performSignOut() {
+        this.update((state) => {
+            state.isSignedIn = false;
+            state.srpSessionData = undefined;
+        });
+    }
+    /**
+     * Returns a bearer token for the specified SRP, logging in if needed.
+     *
+     * When called without `entropySourceId`, returns the primary (first) SRP's
+     * access token, which is effectively the canonical
+     * profile's token that can be used by alias-aware consumers for cross-SRP
+     * operations.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The OIDC access token.
+     */
+    async getBearerToken(entropySourceId) {
+        this.#assertIsUnlocked('getBearerToken');
+        const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();
+        return await this.#auth.getAccessToken(resolvedId);
+    }
+    /**
+     * Returns the cached session profile, logging in if no session exists.
+     *
+     * The returned `canonicalProfileId` reflects the value from the most recent
+     * login or pairing. In the rare event where a canonical changed because of
+     * a pairing that happened on another device, the cached value may be stale
+     * until the next login. For guaranteed freshness, call
+     * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.
+     *
+     * @param entropySourceId - The entropy source ID used to derive the key,
+     * when multiple sources are available (Multi-SRP).
+     * @returns profile for the session.
+     */
+    async getSessionProfile(entropySourceId) {
+        this.#assertIsUnlocked('getSessionProfile');
+        const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();
+        return await this.#auth.getUserProfile(resolvedId);
+    }
+    /**
+     * Forces a fresh retrieval of the canonical profile ID from the server
+     * and propagates it to all cached SRP sessions.
+     *
+     * This method invalidates the primary SRP's cached session and forces a
+     * re-login. Use it before operations that require a guaranteed-fresh
+     * canonical (e.g. storage key derivation for Accounts ADR 0005). For
+     * best-effort reads, use
+     * `getSessionProfile().canonicalProfileId` instead.
+     *
+     * Only the primary SRP is re-logged-in regardless of how many SRPs exist —
+     * the server returns the current canonical for the entire pairing group
+     * from any single SRP login.
+     *
+     * @returns The refreshed canonical profile ID.
+     */
+    async refreshCanonicalProfileId() {
+        this.#assertIsUnlocked('refreshCanonicalProfileId');
+        const primaryEntropySourceId = this.#getPrimaryEntropySourceId();
+        this.#invalidateSrpSession(primaryEntropySourceId);
+        await this.#auth.getAccessToken(primaryEntropySourceId);
+        const canonical = this.#getCanonicalProfileId();
+        if (!canonical) {
+            throw new Error('refreshCanonicalProfileId - Unable to resolve canonical profile ID');
+        }
+        this.#propagateCanonical(canonical);
+        return canonical;
+    }
+    #invalidateSrpSession(entropySourceId) {
+        this.update((state) => {
+            const entry = state.srpSessionData?.[entropySourceId];
+            if (entry?.profile) {
+                // Setting canonicalProfileId to '' forces a re-fetch on the next
+                // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)
+                // treats '' the same as undefined/null — all signal an invalid session.
+                entry.profile.canonicalProfileId = '';
+            }
+        });
+    }
+    async getUserProfileLineage(entropySourceId) {
+        this.#assertIsUnlocked('getUserProfileLineage');
+        const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();
+        return await this.#auth.getUserProfileLineage(resolvedId);
+    }
+    /**
+     * Returns a Customer Service specific access token for the specified SRP,
+     * logging in if needed.
+     *
+     * Exchanges the OIDC access token for a short-lived token scoped to the
+     * customer-service audience. Customer Service tooling consumes this token to
+     * identify and authenticate the user.
+     *
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The customer-service access token.
+     */
+    async getCustomerServiceToken(entropySourceId) {
+        this.#assertIsUnlocked('getCustomerServiceToken');
+        const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();
+        return await this.#auth.getCustomerServiceToken(resolvedId);
+    }
+    isSignedIn() {
+        return this.state.isSignedIn;
+    }
+    /**
+     * Reads the BIP-39 seed for an HD entropy source from KeyringController.
+     *
+     * @param entropySourceId - Entropy source ID. Defaults to the primary HD
+     * keyring.
+     * @returns The HD keyring seed.
+     */
+    async #getHdKeyringSeed(entropySourceId) {
+        const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();
+        return getHdKeyringSeed(this.messenger, resolvedId);
+    }
+    /**
+     * Returns the message-signing public key via native SIP-6 derivation
+     * (same key as `@metamask/message-signing-snap` with empty salt).
+     *
+     * @param entropySourceId - The entropy source ID used to derive the key,
+     * when multiple sources are available (Multi-SRP).
+     * @returns The public key hex.
+     */
+    async #getPublicKey(entropySourceId) {
+        this.#assertIsUnlocked('#getPublicKey');
+        const seed = await this.#getHdKeyringSeed(entropySourceId);
+        return getMessageSigningPublicKey(seed);
+    }
+    #_signMessageCache = {};
+    /**
+     * Builds a cache key scoped to a specific entropy source, so each SRP's
+     * signature stays isolated (same pattern as `UserStorageController`).
+     *
+     * When `entropySourceId` is omitted (primary SRP), it is resolved to the
+     * primary HD keyring's metadata ID rather than a stable literal. Because that
+     * ID is randomly regenerated whenever the vault is recreated (e.g. on
+     * restore), the cached entry is naturally invalidated across vaults — a
+     * different SRP can never inherit the previous primary's cached signature.
+     *
+     * @param message - The tagged message used for signing.
+     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
+     * @returns The scoped cache key.
+     */
+    #scopedCacheKey(message, entropySourceId) {
+        return `${entropySourceId ?? this.#getPrimaryEntropySourceId()}:${message}`;
+    }
+    /**
+     * Signs a `metamask:…` message with the native SIP-6 message-signing key.
+     *
+     * @param message - A specific tagged message to sign.
+     * @param entropySourceId - The entropy source ID used to derive the key,
+     * when multiple sources are available (Multi-SRP).
+     * @returns Compact secp256k1 signature hex.
+     */
+    async #signMessage(message, entropySourceId) {
+        assertMessageStartsWithMetamask(message);
+        this.#assertIsUnlocked('#signMessage');
+        const cacheKey = this.#scopedCacheKey(message, entropySourceId);
+        if (this.#_signMessageCache[cacheKey]) {
+            return this.#_signMessageCache[cacheKey];
+        }
+        const seed = await this.#getHdKeyringSeed(entropySourceId);
+        const result = await signMessageWithMessageSigningKey(message, seed);
+        this.#_signMessageCache[cacheKey] = result;
+        return result;
+    }
+}
+//# sourceMappingURL=AuthenticationController.js.map