@metamask-previews/profile-sync-controller 29.0.0-preview-b13d916 → 29.0.0-preview-4f4c98e

package/dist/controllers/authentication/AuthenticationController.cjs

@@ -1,489 +0,0 @@
-"use strict";
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getHdKeyringEntropySourceIds, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_getHdKeyringSeed, _AuthenticationController_getPublicKey, _AuthenticationController__signMessageCache, _AuthenticationController_scopedCacheKey, _AuthenticationController_signMessage;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthenticationController = exports.defaultState = void 0;
-const base_controller_1 = require("@metamask/base-controller");
-const index_js_1 = require("../../sdk/index.cjs");
-const entropy_source_js_1 = require("../../shared/utils/entropy-source.cjs");
-const hd_keyring_seed_js_1 = require("../../shared/utils/hd-keyring-seed.cjs");
-const message_signing_js_1 = require("../../shared/utils/message-signing.cjs");
-const controllerName = 'AuthenticationController';
-exports.defaultState = {
-    isSignedIn: false,
-    needsProfilePairing: true,
-};
-const metadata = {
-    isSignedIn: {
-        includeInStateLogs: true,
-        persist: true,
-        includeInDebugSnapshot: true,
-        usedInUi: true,
-    },
-    needsProfilePairing: {
-        includeInStateLogs: true,
-        persist: true,
-        includeInDebugSnapshot: true,
-        usedInUi: true,
-    },
-    srpSessionData: {
-        // Remove access token from state logs
-        includeInStateLogs: (srpSessionData) => {
-            // Unreachable branch, included just to fix a type error for the case where this property is
-            // unset. The type gets collapsed to include `| undefined` even though `undefined` is never
-            // set here, because we don't yet use `exactOptionalPropertyTypes`.
-            // TODO: Remove branch after enabling `exactOptionalPropertyTypes`
-            // ref: https://github.com/MetaMask/core/issues/6565
-            if (srpSessionData === null || srpSessionData === undefined) {
-                return null;
-            }
-            return Object.entries(srpSessionData).reduce((sanitizedSrpSessionData, [key, value]) => {
-                const { accessToken: _unused, ...tokenWithoutAccessToken } = value.token;
-                sanitizedSrpSessionData[key] = {
-                    ...value,
-                    token: tokenWithoutAccessToken,
-                };
-                return sanitizedSrpSessionData;
-            }, {});
-        },
-        persist: true,
-        includeInDebugSnapshot: false,
-        usedInUi: true,
-    },
-};
-const MESSENGER_EXPOSED_METHODS = [
-    'performSignIn',
-    'performSignOut',
-    'getBearerToken',
-    'getSessionProfile',
-    'refreshCanonicalProfileId',
-    'getUserProfileLineage',
-    'getCustomerServiceToken',
-    'isSignedIn',
-    'requestProfilePairing',
-];
-/**
- * Controller that enables authentication for restricted endpoints.
- * Used for Backup & Sync, Notifications, and other services.
- */
-class AuthenticationController extends base_controller_1.BaseController {
-    constructor({ messenger, state, config, metametrics, }) {
-        super({
-            messenger,
-            metadata,
-            name: controllerName,
-            state: { ...exports.defaultState, ...state },
-        });
-        _AuthenticationController_instances.add(this);
-        _AuthenticationController_metametrics.set(this, void 0);
-        _AuthenticationController_auth.set(this, void 0);
-        _AuthenticationController_config.set(this, {
-            env: index_js_1.Env.PRD,
-        });
-        _AuthenticationController_isUnlocked.set(this, false);
-        // Bumped by `requestProfilePairing`. `performSignIn` snapshots this
-        // before its first await; if it changes mid-flight we must NOT clear
-        // `needsProfilePairing` (the rearm signal wins).
-        _AuthenticationController_profilePairingRequestEpoch.set(this, 0);
-        _AuthenticationController_keyringController.set(this, {
-            setupLockedStateSubscriptions: () => {
-                const { isUnlocked } = this.messenger.call('KeyringController:getState');
-                __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, isUnlocked, "f");
-                this.messenger.subscribe('KeyringController:unlock', () => {
-                    __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, true, "f");
-                });
-                this.messenger.subscribe('KeyringController:lock', () => {
-                    __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, false, "f");
-                });
-            },
-        });
-        _AuthenticationController__signMessageCache.set(this, {});
-        if (!metametrics) {
-            throw new Error('`metametrics` field is required');
-        }
-        __classPrivateFieldSet(this, _AuthenticationController_config, {
-            ...__classPrivateFieldGet(this, _AuthenticationController_config, "f"),
-            ...config,
-        }, "f");
-        __classPrivateFieldSet(this, _AuthenticationController_metametrics, metametrics, "f");
-        __classPrivateFieldSet(this, _AuthenticationController_auth, new index_js_1.JwtBearerAuth({
-            env: __classPrivateFieldGet(this, _AuthenticationController_config, "f").env,
-            platform: metametrics.agent,
-            type: index_js_1.AuthType.SRP,
-        }, {
-            storage: {
-                getLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginResponseFromState).bind(this),
-                setLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_setLoginResponseToState).bind(this),
-            },
-            signing: {
-                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPublicKey).bind(this),
-                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_signMessage).bind(this),
-            },
-            getLoginTag: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginTag).bind(this),
-            getLoginIdentifierType: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginIdentifierType).bind(this),
-            metametrics: __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f"),
-        }), "f");
-        __classPrivateFieldGet(this, _AuthenticationController_keyringController, "f").setupLockedStateSubscriptions();
-        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
-    }
-    async performSignIn() {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'performSignIn');
-        const epochAtStart = __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f");
-        const entropySourceIds = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringEntropySourceIds).call(this);
-        const accessTokens = [];
-        // We iterate sequentially in order to be sure that the first entry
-        // is the primary SRP LoginResponse.
-        for (const entropySourceId of entropySourceIds) {
-            const accessToken = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(entropySourceId);
-            accessTokens.push(accessToken);
-        }
-        if (entropySourceIds.length < 2) {
-            // Single-SRP wallet: nothing to pair.
-            __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
-        }
-        else {
-            // Pair failures must not break sign-in; the gate stays `true` for retry.
-            try {
-                await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_doPair).call(this, accessTokens, epochAtStart);
-            }
-            catch {
-                // noop
-            }
-        }
-        return accessTokens;
-    }
-    /**
-     * Marks profile pairing as needed. Clients call this when the SRP set
-     * changes (e.g. a new keyring was added) so the next auto-sign-in cycle
-     * re-runs `performSignIn` and re-pairs.
-     */
-    requestProfilePairing() {
-        __classPrivateFieldSet(this, _AuthenticationController_profilePairingRequestEpoch, __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") + 1, "f");
-        if (!this.state.needsProfilePairing) {
-            this.update((state) => {
-                state.needsProfilePairing = true;
-            });
-        }
-    }
-    performSignOut() {
-        this.update((state) => {
-            state.isSignedIn = false;
-            state.srpSessionData = undefined;
-        });
-    }
-    /**
-     * Returns a bearer token for the specified SRP, logging in if needed.
-     *
-     * When called without `entropySourceId`, returns the primary (first) SRP's
-     * access token, which is effectively the canonical
-     * profile's token that can be used by alias-aware consumers for cross-SRP
-     * operations.
-     *
-     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
-     * @returns The OIDC access token.
-     */
-    async getBearerToken(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getBearerToken');
-        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(resolvedId);
-    }
-    /**
-     * Returns the cached session profile, logging in if no session exists.
-     *
-     * The returned `canonicalProfileId` reflects the value from the most recent
-     * login or pairing. In the rare event where a canonical changed because of
-     * a pairing that happened on another device, the cached value may be stale
-     * until the next login. For guaranteed freshness, call
-     * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.
-     *
-     * @param entropySourceId - The entropy source ID used to derive the key,
-     * when multiple sources are available (Multi-SRP).
-     * @returns profile for the session.
-     */
-    async getSessionProfile(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getSessionProfile');
-        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfile(resolvedId);
-    }
-    /**
-     * Forces a fresh retrieval of the canonical profile ID from the server
-     * and propagates it to all cached SRP sessions.
-     *
-     * This method invalidates the primary SRP's cached session and forces a
-     * re-login. Use it before operations that require a guaranteed-fresh
-     * canonical (e.g. storage key derivation for Accounts ADR 0005). For
-     * best-effort reads, use
-     * `getSessionProfile().canonicalProfileId` instead.
-     *
-     * Only the primary SRP is re-logged-in regardless of how many SRPs exist —
-     * the server returns the current canonical for the entire pairing group
-     * from any single SRP login.
-     *
-     * @returns The refreshed canonical profile ID.
-     */
-    async refreshCanonicalProfileId() {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'refreshCanonicalProfileId');
-        const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_invalidateSrpSession).call(this, primaryEntropySourceId);
-        await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(primaryEntropySourceId);
-        const canonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-        if (!canonical) {
-            throw new Error('refreshCanonicalProfileId - Unable to resolve canonical profile ID');
-        }
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_propagateCanonical).call(this, canonical);
-        return canonical;
-    }
-    async getUserProfileLineage(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getUserProfileLineage');
-        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
-    }
-    /**
-     * Returns a Customer Service specific access token for the specified SRP,
-     * logging in if needed.
-     *
-     * Exchanges the OIDC access token for a short-lived token scoped to the
-     * customer-service audience. Customer Service tooling consumes this token to
-     * identify and authenticate the user.
-     *
-     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
-     * @returns The customer-service access token.
-     */
-    async getCustomerServiceToken(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
-        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
-    }
-    isSignedIn() {
-        return this.state.isSignedIn;
-    }
-}
-exports.AuthenticationController = AuthenticationController;
-_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__signMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
-    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    if (!this.state.srpSessionData?.[resolvedId]) {
-        return null;
-    }
-    return this.state.srpSessionData[resolvedId];
-}, _AuthenticationController_setLoginResponseToState = async function _AuthenticationController_setLoginResponseToState(loginResponse, entropySourceId) {
-    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    const metaMetricsId = await __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f").getMetaMetricsId();
-    this.update((state) => {
-        state.isSignedIn = true;
-        if (!state.srpSessionData) {
-            state.srpSessionData = {};
-        }
-        state.srpSessionData[resolvedId] = {
-            ...loginResponse,
-            profile: {
-                ...loginResponse.profile,
-                metaMetricsId,
-            },
-        };
-    });
-}, _AuthenticationController_assertIsUnlocked = function _AuthenticationController_assertIsUnlocked(methodName) {
-    if (!__classPrivateFieldGet(this, _AuthenticationController_isUnlocked, "f")) {
-        throw new Error(`${methodName} - unable to proceed, wallet is locked`);
-    }
-}, _AuthenticationController_getHdKeyringEntropySourceIds = function _AuthenticationController_getHdKeyringEntropySourceIds() {
-    const { keyrings } = this.messenger.call('KeyringController:getState');
-    return (0, entropy_source_js_1.getHdKeyringEntropySourceIds)(keyrings);
-}, _AuthenticationController_getPrimaryEntropySourceId = function _AuthenticationController_getPrimaryEntropySourceId() {
-    const { keyrings } = this.messenger.call('KeyringController:getState');
-    return (0, entropy_source_js_1.getPrimaryHdKeyringEntropySourceId)(keyrings);
-}, _AuthenticationController_getLoginTag = 
-/**
- * Resolves the SRP login tag for `raw_message`.
- *
- * - `primary` for the first HD entropy source
- * - `secondary` for any other entropy source
- *
- * @param entropySourceId - Entropy source for this login attempt.
- * @returns The login tag to append to the signed message.
- */
-async function _AuthenticationController_getLoginTag(entropySourceId) {
-    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    const resolvedId = entropySourceId ?? primaryEntropySourceId;
-    return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';
-}, _AuthenticationController_getLoginIdentifierType = 
-/**
- * Resolves metametrics `identifier_type` for `/srp/login`
- * (`SRP` | `GOOGLE` | `APPLE` | `TELEGRAM`).
- *
- * This is the auth method for the entropy source, independent of
- * {@link SrpLoginTag} (`primary` / `secondary`).
- *
- * SeedlessOnboarding currently exposes a single vault-level
- * `authConnection`, which always backs the primary entropy source. Non-
- * primary sources therefore return `SRP`. If social identities become
- * per-entropy later, resolve from that metadata instead of assuming
- * primary === social.
- *
- * Soft-fails to `SRP` when SeedlessOnboarding is not registered.
- *
- * @param entropySourceId - Entropy source for this login attempt.
- * @returns The login identifier type.
- */
-async function _AuthenticationController_getLoginIdentifierType(entropySourceId) {
-    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    const resolvedId = entropySourceId ?? primaryEntropySourceId;
-    // Social vault authConnection is only associated with the primary source.
-    if (resolvedId !== primaryEntropySourceId) {
-        return 'SRP';
-    }
-    return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_resolveSocialIdentifierType).call(this);
-}, _AuthenticationController_resolveSocialIdentifierType = function _AuthenticationController_resolveSocialIdentifierType() {
-    try {
-        const { vault, authConnection } = this.messenger.call('SeedlessOnboardingController:getState');
-        if (vault === null || vault === undefined) {
-            return 'SRP';
-        }
-        // Match provider strings from SeedlessOnboarding state rather than
-        // importing AuthConnection — a value import would load that package
-        // (and its heavy deps) whenever this controller is imported.
-        switch (authConnection) {
-            case 'google':
-                return 'GOOGLE';
-            case 'apple':
-                return 'APPLE';
-            case 'telegram':
-                return 'TELEGRAM';
-            default:
-                return 'SRP';
-        }
-    }
-    catch {
-        return 'SRP';
-    }
-}, _AuthenticationController_tryClearNeedsProfilePairing = function _AuthenticationController_tryClearNeedsProfilePairing(epochAtStart) {
-    if (__classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") !== epochAtStart) {
-        return;
-    }
-    if (this.state.needsProfilePairing) {
-        this.update((state) => {
-            state.needsProfilePairing = false;
-        });
-    }
-}, _AuthenticationController_doPair = 
-/**
- * Pairs all SRPs via `POST /profile/pair`, propagates the canonical
- * profile ID, clears `needsProfilePairing`, and emits
- * `AuthenticationController:profileSignIn` when the canonical changes or
- * new aliases are returned. Throws on failure.
- *
- * @param accessTokens - Per-SRP access tokens, primary first.
- * @param epochAtStart - Pairing-request epoch captured by the caller.
- * Used to skip the gate clear if `requestProfilePairing` ran while the
- * pair API call was in-flight.
- */
-async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
-    const previousCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-    const profileAliases = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_pairSrpProfiles).call(this, accessTokens);
-    const newCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-    // If somehow we cannot compute the new canonical profile ID after pairing,
-    // we just return now and do not update the `needsProfilePairing` flag.
-    if (!newCanonical) {
-        return;
-    }
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
-    const profileIdChanged = previousCanonical !== newCanonical;
-    const shouldEmitProfileSignInEvent = profileIdChanged || profileAliases.length > 0;
-    if (shouldEmitProfileSignInEvent) {
-        this.messenger.publish('AuthenticationController:profileSignIn', {
-            profileId: newCanonical,
-            profileAliases,
-            profileIdChanged,
-        });
-    }
-}, _AuthenticationController_pairSrpProfiles = async function _AuthenticationController_pairSrpProfiles(accessTokens) {
-    if (accessTokens.length < 2) {
-        return [];
-    }
-    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.
-    const { profileAliases, profile: { canonicalProfileId }, } = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").pairSrpProfiles(accessTokens, primaryAccessToken);
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_propagateCanonical).call(this, canonicalProfileId);
-    return profileAliases;
-}, _AuthenticationController_propagateCanonical = function _AuthenticationController_propagateCanonical(canonicalProfileId) {
-    const { srpSessionData } = this.state;
-    if (!srpSessionData) {
-        return;
-    }
-    this.update((state) => {
-        for (const entry of Object.values(state.srpSessionData ?? {})) {
-            if (entry?.profile) {
-                entry.profile.canonicalProfileId = canonicalProfileId;
-            }
-        }
-    });
-}, _AuthenticationController_getCanonicalProfileId = function _AuthenticationController_getCanonicalProfileId() {
-    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    return (this.state.srpSessionData?.[primaryEntropySourceId]?.profile
-        ?.canonicalProfileId ?? null);
-}, _AuthenticationController_invalidateSrpSession = function _AuthenticationController_invalidateSrpSession(entropySourceId) {
-    this.update((state) => {
-        const entry = state.srpSessionData?.[entropySourceId];
-        if (entry?.profile) {
-            // Setting canonicalProfileId to '' forces a re-fetch on the next
-            // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)
-            // treats '' the same as undefined/null — all signal an invalid session.
-            entry.profile.canonicalProfileId = '';
-        }
-    });
-}, _AuthenticationController_getHdKeyringSeed = 
-/**
- * Reads the BIP-39 seed for an HD entropy source from KeyringController.
- *
- * @param entropySourceId - Entropy source ID. Defaults to the primary HD
- * keyring.
- * @returns The HD keyring seed.
- */
-async function _AuthenticationController_getHdKeyringSeed(entropySourceId) {
-    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    return (0, hd_keyring_seed_js_1.getHdKeyringSeed)(this.messenger, resolvedId);
-}, _AuthenticationController_getPublicKey = 
-/**
- * Returns the message-signing public key via native SIP-6 derivation
- * (same key as `@metamask/message-signing-snap` with empty salt).
- *
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns The public key hex.
- */
-async function _AuthenticationController_getPublicKey(entropySourceId) {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#getPublicKey');
-    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
-    return (0, message_signing_js_1.getMessageSigningPublicKey)(seed);
-}, _AuthenticationController_scopedCacheKey = function _AuthenticationController_scopedCacheKey(message, entropySourceId) {
-    return `${entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this)}:${message}`;
-}, _AuthenticationController_signMessage = 
-/**
- * Signs a `metamask:…` message with the native SIP-6 message-signing key.
- *
- * @param message - A specific tagged message to sign.
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns Compact secp256k1 signature hex.
- */
-async function _AuthenticationController_signMessage(message, entropySourceId) {
-    (0, index_js_1.assertMessageStartsWithMetamask)(message);
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#signMessage');
-    const cacheKey = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_scopedCacheKey).call(this, message, entropySourceId);
-    if (__classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey]) {
-        return __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey];
-    }
-    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
-    const result = await (0, message_signing_js_1.signMessageWithMessageSigningKey)(message, seed);
-    __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey] = result;
-    return result;
-};
-//# sourceMappingURL=AuthenticationController.cjs.map

package/dist/controllers/authentication/AuthenticationController.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthenticationController.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,+DAA2D;AAyB3D,kDAK4B;AAE5B,6EAG8C;AAC9C,+EAAyE;AACzE,+EAG+C;AAG/C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAmBrC,QAAA,YAAY,GAAkC;IACzD,UAAU,EAAE,KAAK;IACjB,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AACF,MAAM,QAAQ,GAAiD;IAC7D,UAAU,EAAE;QACV,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,mBAAmB,EAAE;QACnB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,cAAc,EAAE;QACd,sCAAsC;QACtC,kBAAkB,EAAE,CAAC,cAAc,EAAE,EAAE;YACrC,4FAA4F;YAC5F,2FAA2F;YAC3F,mEAAmE;YACnE,kEAAkE;YAClE,oDAAoD;YACpD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,MAAM,CAC1C,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACxC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,uBAAuB,EAAE,GACxD,KAAK,CAAC,KAAK,CAAC;gBACd,uBAAuB,CAAC,GAAG,CAAC,GAAG;oBAC7B,GAAG,KAAK;oBACR,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC,EACD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAMF,MAAM,yBAAyB,GAAG;IAChC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,YAAY;IACZ,uBAAuB;CACf,CAAC;AA+CX;;;GAGG;AACH,MAAa,wBAAyB,SAAQ,gCAI7C;IA+BC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GAUZ;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,oBAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QAlDI,wDAA8B;QAE9B,iDAAoB;QAEpB,2CAA4B;YACnC,GAAG,EAAE,cAAG,CAAC,GAAG;SACb,EAAC;QAEF,+CAAc,KAAK,EAAC;QAEpB,oEAAoE;QACpE,qEAAqE;QACrE,iDAAiD;QACjD,+DAA8B,CAAC,EAAC;QAEvB,sDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,wCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,wCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,wCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QAqfF,sDAA6C,EAAE,EAAC;QA7d9C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,uBAAA,IAAI,oCAAW;YACb,GAAG,uBAAA,IAAI,wCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QAEF,uBAAA,IAAI,yCAAgB,WAAW,MAAA,CAAC;QAEhC,uBAAA,IAAI,kCAAS,IAAI,wBAAa,CAC5B;YACE,GAAG,EAAE,uBAAA,IAAI,wCAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,WAAW,CAAC,KAAK;YAC3B,IAAI,EAAE,mBAAQ,CAAC,GAAG;SACnB,EACD;YACE,OAAO,EAAE;gBACP,gBAAgB,EAAE,uBAAA,IAAI,gGAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,gBAAgB,EAAE,uBAAA,IAAI,8FAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;aAC3D;YACD,OAAO,EAAE;gBACP,aAAa,EAAE,uBAAA,IAAI,mFAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5C,WAAW,EAAE,uBAAA,IAAI,kFAAa,CAAC,IAAI,CAAC,IAAI,CAAC;aAC1C;YACD,WAAW,EAAE,uBAAA,IAAI,kFAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,sBAAsB,EAAE,uBAAA,IAAI,6FAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/D,WAAW,EAAE,uBAAA,IAAI,6CAAa;SAC/B,CACF,MAAA,CAAC;QAEF,uBAAA,IAAI,mDAAmB,CAAC,6BAA6B,EAAE,CAAC;QAExD,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAmJM,KAAK,CAAC,aAAa;QACxB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,uBAAA,IAAI,4DAA4B,CAAC;QACtD,MAAM,gBAAgB,GAAG,uBAAA,IAAI,mGAA8B,MAAlC,IAAI,CAAgC,CAAC;QAC9D,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,mEAAmE;QACnE,oCAAoC;QACpC,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YACrE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,sCAAsC;YACtC,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC;gBACH,MAAM,uBAAA,IAAI,6EAAQ,MAAZ,IAAI,EAAS,YAAY,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACI,qBAAqB;QAC1B,6KAAoC,CAAC,MAAA,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAuGM,cAAc;QACnB,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;YACzB,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,eAAwB;QAClD,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,gBAAgB,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,eAAe,IAAI,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACxE,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,iBAAiB,CAC5B,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,mBAAmB,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,eAAe,IAAI,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACxE,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,KAAK,CAAC,yBAAyB;QACpC,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,2BAA2B,CAAC,CAAC;QAEpD,MAAM,sBAAsB,GAAG,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACjE,uBAAA,IAAI,2FAAsB,MAA1B,IAAI,EAAuB,sBAAsB,CAAC,CAAC;QACnD,MAAM,uBAAA,IAAI,sCAAM,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAExD,MAAM,SAAS,GAAG,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,SAAS,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAcM,KAAK,CAAC,qBAAqB,CAChC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,uBAAuB,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,eAAe,IAAI,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACxE,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,uBAAuB,CAClC,eAAwB;QAExB,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,yBAAyB,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,eAAe,IAAI,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;QACxE,OAAO,MAAM,uBAAA,IAAI,sCAAM,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAEM,UAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;CA8EF;AAxkBD,4DAwkBC;0fAveC,KAAK,8DACH,eAAwB;IAExB,MAAM,UAAU,GAAG,eAAe,IAAI,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC,sDAED,KAAK,4DACH,aAA4B,EAC5B,eAAwB;IAExB,MAAM,UAAU,GAAG,eAAe,IAAI,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACxE,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,6CAAa,CAAC,gBAAgB,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;YACjC,GAAG,aAAa;YAChB,OAAO,EAAE;gBACP,GAAG,aAAa,CAAC,OAAO;gBACxB,aAAa;aACd;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,mGAEiB,UAAkB;IAClC,IAAI,CAAC,uBAAA,IAAI,4CAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,wCAAwC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;IAQC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACvE,OAAO,IAAA,gDAA4B,EAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;IAYC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACvE,OAAO,IAAA,sDAAkC,EAAC,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,gDAAc,eAAwB;IACzC,MAAM,sBAAsB,GAAG,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACjE,MAAM,UAAU,GAAG,eAAe,IAAI,sBAAsB,CAAC;IAE7D,OAAO,UAAU,KAAK,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,2DACH,eAAwB;IAExB,MAAM,sBAAsB,GAAG,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACjE,MAAM,UAAU,GAAG,eAAe,IAAI,sBAAsB,CAAC;IAE7D,0EAA0E;IAC1E,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,CAA+B,CAAC;AAC7C,CAAC;IAYC,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CACnD,uCAAuC,CACxC,CAAC;QACF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,QAAQ,cAAc,EAAE,CAAC;YACvB,KAAK,QAAQ;gBACX,OAAO,QAAQ,CAAC;YAClB,KAAK,OAAO;gBACV,OAAO,OAAO,CAAC;YACjB,KAAK,UAAU;gBACb,OAAO,UAAU,CAAC;YACpB;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,yHAoD4B,YAAoB;IAC/C,IAAI,uBAAA,IAAI,4DAA4B,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,2CAAS,YAAsB,EAAE,YAAoB;IACxD,MAAM,iBAAiB,GAAG,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAExD,MAAM,cAAc,GAAG,MAAM,uBAAA,IAAI,sFAAiB,MAArB,IAAI,EAAkB,YAAY,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,uBAAA,IAAI,4FAAuB,MAA3B,IAAI,CAAyB,CAAC;IAEnD,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,uBAAA,IAAI,kGAA6B,MAAjC,IAAI,EAA8B,YAAY,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,YAAY,CAAC;IAC5D,MAAM,4BAA4B,GAChC,gBAAgB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,IAAI,4BAA4B,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wCAAwC,EAAE;YAC/D,SAAS,EAAE,YAAY;YACvB,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,8CAED,KAAK,oDAAkB,YAAsB;IAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IAC3E,MAAM,EACJ,cAAc,EACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,GAChC,GAAG,MAAM,uBAAA,IAAI,sCAAM,CAAC,eAAe,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACvE,uBAAA,IAAI,yFAAoB,MAAxB,IAAI,EAAqB,kBAAkB,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC,uGAEmB,kBAA0B;IAC5C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;gBACnB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;IAYC,MAAM,sBAAsB,GAAG,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACjE,OAAO,CACL,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO;QAC1D,EAAE,kBAAkB,IAAI,IAAI,CAC/B,CAAC;AACJ,CAAC,2GAiFqB,eAAuB;IAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;YACnB,iEAAiE;YACjE,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,EAAE,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAiCD;;;;;;GAMG;AACH,KAAK,qDAAmB,eAAwB;IAC9C,MAAM,UAAU,GAAG,eAAe,IAAI,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,CAAC;IACxE,OAAO,IAAA,qCAAgB,EAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,iDAAe,eAAwB;IAC1C,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;IAC3D,OAAO,IAAA,+CAA0B,EAAC,IAAI,CAAC,CAAC;AAC1C,CAAC,+FAmBC,OAA6B,EAC7B,eAAwB;IAExB,OAAO,GAAG,eAAe,IAAI,uBAAA,IAAI,gGAA2B,MAA/B,IAAI,CAA6B,IAAI,OAAO,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,gDACH,OAAe,EACf,eAAwB;IAExB,IAAA,0CAA+B,EAAC,OAAO,CAAC,CAAC;IACzC,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,cAAc,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,uBAAA,IAAI,qFAAgB,MAApB,IAAI,EAAiB,OAAO,EAAE,eAAe,CAAC,CAAC;IAChE,IAAI,uBAAA,IAAI,mDAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,uBAAA,IAAI,mDAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,uFAAkB,MAAtB,IAAI,EAAmB,eAAe,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,qDAAgC,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAErE,uBAAA,IAAI,mDAAmB,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IAE3C,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n  KeyringControllerWithKeyringV2UnsafeAction,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SeedlessOnboardingControllerGetStateAction } from '@metamask/seedless-onboarding-controller';\nimport type { Json } from '@metamask/utils';\n\nimport type {\n  LoginIdentifierType,\n  LoginResponse,\n  ProfileAlias,\n  SRPInterface,\n  SrpLoginTag,\n  UserProfile,\n  UserProfileLineage,\n} from '../../sdk/index.js';\nimport {\n  assertMessageStartsWithMetamask,\n  AuthType,\n  Env,\n  JwtBearerAuth,\n} from '../../sdk/index.js';\nimport type { MetaMetricsAuth } from '../../shared/types/services.js';\nimport {\n  getHdKeyringEntropySourceIds,\n  getPrimaryHdKeyringEntropySourceId,\n} from '../../shared/utils/entropy-source.js';\nimport { getHdKeyringSeed } from '../../shared/utils/hd-keyring-seed.js';\nimport {\n  getMessageSigningPublicKey,\n  signMessageWithMessageSigningKey,\n} from '../../shared/utils/message-signing.js';\nimport { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types.js';\n\nconst controllerName = 'AuthenticationController';\n\n// State\nexport type AuthenticationControllerState = {\n  isSignedIn: boolean;\n  srpSessionData?: Record<string, LoginResponse>;\n  /**\n   * Client gate for profile pairing. Defaults to `true` (fresh install /\n   * upgrade), set to `false` after a successful `performSignIn` pair, set\n   * back to `true` via `requestProfilePairing()` when the SRP set changes,\n   * and left `true` on pair failure so the next state shift retries.\n   *\n   * Optional in the type so partial-state selectors stay assignable to\n   * `AuthenticationControllerState`. The controller seeds it via\n   * `defaultState` at construction; consumers should read `undefined` as\n   * `true` to mirror that runtime default.\n   */\n  needsProfilePairing?: boolean;\n};\nexport const defaultState: AuthenticationControllerState = {\n  isSignedIn: false,\n  needsProfilePairing: true,\n};\nconst metadata: StateMetadata<AuthenticationControllerState> = {\n  isSignedIn: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  needsProfilePairing: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  srpSessionData: {\n    // Remove access token from state logs\n    includeInStateLogs: (srpSessionData) => {\n      // Unreachable branch, included just to fix a type error for the case where this property is\n      // unset. The type gets collapsed to include `| undefined` even though `undefined` is never\n      // set here, because we don't yet use `exactOptionalPropertyTypes`.\n      // TODO: Remove branch after enabling `exactOptionalPropertyTypes`\n      // ref: https://github.com/MetaMask/core/issues/6565\n      if (srpSessionData === null || srpSessionData === undefined) {\n        return null;\n      }\n      return Object.entries(srpSessionData).reduce<Record<string, Json>>(\n        (sanitizedSrpSessionData, [key, value]) => {\n          const { accessToken: _unused, ...tokenWithoutAccessToken } =\n            value.token;\n          sanitizedSrpSessionData[key] = {\n            ...value,\n            token: tokenWithoutAccessToken,\n          };\n          return sanitizedSrpSessionData;\n        },\n        {},\n      );\n    },\n    persist: true,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performSignIn',\n  'performSignOut',\n  'getBearerToken',\n  'getSessionProfile',\n  'refreshCanonicalProfileId',\n  'getUserProfileLineage',\n  'getCustomerServiceToken',\n  'isSignedIn',\n  'requestProfilePairing',\n] as const;\n\nexport type Actions =\n  | AuthenticationControllerGetStateAction\n  | AuthenticationControllerMethodActions;\n\nexport type AuthenticationControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  AuthenticationControllerState\n>;\n\nexport type AuthenticationControllerStateChangeEvent =\n  ControllerStateChangeEvent<\n    typeof controllerName,\n    AuthenticationControllerState\n  >;\n\nexport type ProfileSignInInfo = {\n  profileId: string;\n  profileAliases: ProfileAlias[];\n  profileIdChanged: boolean;\n};\n\nexport type AuthenticationControllerProfileSignInEvent = {\n  type: `${typeof controllerName}:profileSignIn`;\n  payload: [ProfileSignInInfo];\n};\n\nexport type Events =\n  | AuthenticationControllerStateChangeEvent\n  | AuthenticationControllerProfileSignInEvent;\n\n// Allowed Actions\ntype AllowedActions =\n  | KeyringControllerGetStateAction\n  | KeyringControllerWithKeyringV2UnsafeAction\n  | SeedlessOnboardingControllerGetStateAction;\n\ntype AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;\n\n// Messenger\nexport type AuthenticationControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Controller that enables authentication for restricted endpoints.\n * Used for Backup & Sync, Notifications, and other services.\n */\nexport class AuthenticationController extends BaseController<\n  typeof controllerName,\n  AuthenticationControllerState,\n  AuthenticationControllerMessenger\n> {\n  readonly #metametrics: MetaMetricsAuth;\n\n  readonly #auth: SRPInterface;\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  #isUnlocked = false;\n\n  // Bumped by `requestProfilePairing`. `performSignIn` snapshots this\n  // before its first await; if it changes mid-flight we must NOT clear\n  // `needsProfilePairing` (the rearm signal wins).\n  #profilePairingRequestEpoch = 0;\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  constructor({\n    messenger,\n    state,\n    config,\n    metametrics,\n  }: {\n    messenger: AuthenticationControllerMessenger;\n    state?: AuthenticationControllerState;\n    config?: Partial<ControllerConfig>;\n    /**\n     * Not using the Messaging System as we\n     * do not want to tie this strictly to extension\n     */\n    metametrics: MetaMetricsAuth;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    if (!metametrics) {\n      throw new Error('`metametrics` field is required');\n    }\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n\n    this.#metametrics = metametrics;\n\n    this.#auth = new JwtBearerAuth(\n      {\n        env: this.#config.env,\n        platform: metametrics.agent,\n        type: AuthType.SRP,\n      },\n      {\n        storage: {\n          getLoginResponse: this.#getLoginResponseFromState.bind(this),\n          setLoginResponse: this.#setLoginResponseToState.bind(this),\n        },\n        signing: {\n          getIdentifier: this.#getPublicKey.bind(this),\n          signMessage: this.#signMessage.bind(this),\n        },\n        getLoginTag: this.#getLoginTag.bind(this),\n        getLoginIdentifierType: this.#getLoginIdentifierType.bind(this),\n        metametrics: this.#metametrics,\n      },\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  async #getLoginResponseFromState(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();\n    if (!this.state.srpSessionData?.[resolvedId]) {\n      return null;\n    }\n    return this.state.srpSessionData[resolvedId];\n  }\n\n  async #setLoginResponseToState(\n    loginResponse: LoginResponse,\n    entropySourceId?: string,\n  ) {\n    const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();\n    const metaMetricsId = await this.#metametrics.getMetaMetricsId();\n    this.update((state) => {\n      state.isSignedIn = true;\n      if (!state.srpSessionData) {\n        state.srpSessionData = {};\n      }\n      state.srpSessionData[resolvedId] = {\n        ...loginResponse,\n        profile: {\n          ...loginResponse.profile,\n          metaMetricsId,\n        },\n      };\n    });\n  }\n\n  #assertIsUnlocked(methodName: string): void {\n    if (!this.#isUnlocked) {\n      throw new Error(`${methodName} - unable to proceed, wallet is locked`);\n    }\n  }\n\n  /**\n   * Reads the HD keyring entropy source IDs from KeyringController.\n   *\n   * @returns The HD keyring metadata IDs, primary first.\n   */\n  #getHdKeyringEntropySourceIds(): string[] {\n    const { keyrings } = this.messenger.call('KeyringController:getState');\n    return getHdKeyringEntropySourceIds(keyrings);\n  }\n\n  /**\n   * Resolves the primary SRP's entropy source ID from KeyringController rather\n   * than the message-signing snap, so callers like `getBearerToken()` are not\n   * blocked on snap boot.\n   *\n   * @returns The primary HD keyring metadata ID.\n   * @throws If no HD keyring is available; callers must only resolve while\n   * the wallet is unlocked.\n   */\n  #getPrimaryEntropySourceId(): string {\n    const { keyrings } = this.messenger.call('KeyringController:getState');\n    return getPrimaryHdKeyringEntropySourceId(keyrings);\n  }\n\n  /**\n   * Resolves the SRP login tag for `raw_message`.\n   *\n   * - `primary` for the first HD entropy source\n   * - `secondary` for any other entropy source\n   *\n   * @param entropySourceId - Entropy source for this login attempt.\n   * @returns The login tag to append to the signed message.\n   */\n  async #getLoginTag(entropySourceId?: string): Promise<SrpLoginTag> {\n    const primaryEntropySourceId = this.#getPrimaryEntropySourceId();\n    const resolvedId = entropySourceId ?? primaryEntropySourceId;\n\n    return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';\n  }\n\n  /**\n   * Resolves metametrics `identifier_type` for `/srp/login`\n   * (`SRP` | `GOOGLE` | `APPLE` | `TELEGRAM`).\n   *\n   * This is the auth method for the entropy source, independent of\n   * {@link SrpLoginTag} (`primary` / `secondary`).\n   *\n   * SeedlessOnboarding currently exposes a single vault-level\n   * `authConnection`, which always backs the primary entropy source. Non-\n   * primary sources therefore return `SRP`. If social identities become\n   * per-entropy later, resolve from that metadata instead of assuming\n   * primary === social.\n   *\n   * Soft-fails to `SRP` when SeedlessOnboarding is not registered.\n   *\n   * @param entropySourceId - Entropy source for this login attempt.\n   * @returns The login identifier type.\n   */\n  async #getLoginIdentifierType(\n    entropySourceId?: string,\n  ): Promise<LoginIdentifierType> {\n    const primaryEntropySourceId = this.#getPrimaryEntropySourceId();\n    const resolvedId = entropySourceId ?? primaryEntropySourceId;\n\n    // Social vault authConnection is only associated with the primary source.\n    if (resolvedId !== primaryEntropySourceId) {\n      return 'SRP';\n    }\n\n    return this.#resolveSocialIdentifierType();\n  }\n\n  /**\n   * Maps `SeedlessOnboardingController.state.authConnection` to a login\n   * identifier type when a social vault is present.\n   *\n   * Returns `SRP` if there is no vault, the provider is unrecognized, or\n   * SeedlessOnboardingController is unavailable on the messenger.\n   *\n   * @returns The social provider identifier type, or `SRP`.\n   */\n  #resolveSocialIdentifierType(): LoginIdentifierType {\n    try {\n      const { vault, authConnection } = this.messenger.call(\n        'SeedlessOnboardingController:getState',\n      );\n      if (vault === null || vault === undefined) {\n        return 'SRP';\n      }\n\n      // Match provider strings from SeedlessOnboarding state rather than\n      // importing AuthConnection — a value import would load that package\n      // (and its heavy deps) whenever this controller is imported.\n      switch (authConnection) {\n        case 'google':\n          return 'GOOGLE';\n        case 'apple':\n          return 'APPLE';\n        case 'telegram':\n          return 'TELEGRAM';\n        default:\n          return 'SRP';\n      }\n    } catch {\n      return 'SRP';\n    }\n  }\n\n  public async performSignIn(): Promise<string[]> {\n    this.#assertIsUnlocked('performSignIn');\n\n    const epochAtStart = this.#profilePairingRequestEpoch;\n    const entropySourceIds = this.#getHdKeyringEntropySourceIds();\n    const accessTokens: string[] = [];\n\n    // We iterate sequentially in order to be sure that the first entry\n    // is the primary SRP LoginResponse.\n    for (const entropySourceId of entropySourceIds) {\n      const accessToken = await this.#auth.getAccessToken(entropySourceId);\n      accessTokens.push(accessToken);\n    }\n\n    if (entropySourceIds.length < 2) {\n      // Single-SRP wallet: nothing to pair.\n      this.#tryClearNeedsProfilePairing(epochAtStart);\n    } else {\n      // Pair failures must not break sign-in; the gate stays `true` for retry.\n      try {\n        await this.#doPair(accessTokens, epochAtStart);\n      } catch {\n        // noop\n      }\n    }\n\n    return accessTokens;\n  }\n\n  /**\n   * Marks profile pairing as needed. Clients call this when the SRP set\n   * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n   * re-runs `performSignIn` and re-pairs.\n   */\n  public requestProfilePairing(): void {\n    this.#profilePairingRequestEpoch += 1;\n    if (!this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = true;\n      });\n    }\n  }\n\n  /**\n   * Clears `needsProfilePairing` only if no `requestProfilePairing` call\n   * landed since `epochAtStart` was captured. Prevents `performSignIn`\n   * from silently overwriting a concurrent rearm.\n   *\n   * @param epochAtStart - Epoch value captured at the start of `performSignIn`.\n   */\n  #tryClearNeedsProfilePairing(epochAtStart: number): void {\n    if (this.#profilePairingRequestEpoch !== epochAtStart) {\n      return;\n    }\n    if (this.state.needsProfilePairing) {\n      this.update((state) => {\n        state.needsProfilePairing = false;\n      });\n    }\n  }\n\n  /**\n   * Pairs all SRPs via `POST /profile/pair`, propagates the canonical\n   * profile ID, clears `needsProfilePairing`, and emits\n   * `AuthenticationController:profileSignIn` when the canonical changes or\n   * new aliases are returned. Throws on failure.\n   *\n   * @param accessTokens - Per-SRP access tokens, primary first.\n   * @param epochAtStart - Pairing-request epoch captured by the caller.\n   * Used to skip the gate clear if `requestProfilePairing` ran while the\n   * pair API call was in-flight.\n   */\n  async #doPair(accessTokens: string[], epochAtStart: number): Promise<void> {\n    const previousCanonical = this.#getCanonicalProfileId();\n\n    const profileAliases = await this.#pairSrpProfiles(accessTokens);\n    const newCanonical = this.#getCanonicalProfileId();\n\n    // If somehow we cannot compute the new canonical profile ID after pairing,\n    // we just return now and do not update the `needsProfilePairing` flag.\n    if (!newCanonical) {\n      return;\n    }\n\n    this.#tryClearNeedsProfilePairing(epochAtStart);\n\n    const profileIdChanged = previousCanonical !== newCanonical;\n    const shouldEmitProfileSignInEvent =\n      profileIdChanged || profileAliases.length > 0;\n\n    if (shouldEmitProfileSignInEvent) {\n      this.messenger.publish('AuthenticationController:profileSignIn', {\n        profileId: newCanonical,\n        profileAliases,\n        profileIdChanged,\n      });\n    }\n  }\n\n  async #pairSrpProfiles(accessTokens: string[]): Promise<ProfileAlias[]> {\n    if (accessTokens.length < 2) {\n      return [];\n    }\n    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.\n    const {\n      profileAliases,\n      profile: { canonicalProfileId },\n    } = await this.#auth.pairSrpProfiles(accessTokens, primaryAccessToken);\n    this.#propagateCanonical(canonicalProfileId);\n    return profileAliases;\n  }\n\n  #propagateCanonical(canonicalProfileId: string): void {\n    const { srpSessionData } = this.state;\n    if (!srpSessionData) {\n      return;\n    }\n\n    this.update((state) => {\n      for (const entry of Object.values(state.srpSessionData ?? {})) {\n        if (entry?.profile) {\n          entry.profile.canonicalProfileId = canonicalProfileId;\n        }\n      }\n    });\n  }\n\n  /**\n   * Returns the canonical profile id from the primary SRP's cached session.\n   * Returns `null` when no session exists yet for the primary SRP.\n   *\n   * Always reads from the primary SRP because the canonical is shared across\n   * all paired SRPs after `#propagateCanonical`.\n   *\n   * @returns The canonical profile id, or `null` if unavailable.\n   */\n  #getCanonicalProfileId(): string | null {\n    const primaryEntropySourceId = this.#getPrimaryEntropySourceId();\n    return (\n      this.state.srpSessionData?.[primaryEntropySourceId]?.profile\n        ?.canonicalProfileId ?? null\n    );\n  }\n\n  public performSignOut(): void {\n    this.update((state) => {\n      state.isSignedIn = false;\n      state.srpSessionData = undefined;\n    });\n  }\n\n  /**\n   * Returns a bearer token for the specified SRP, logging in if needed.\n   *\n   * When called without `entropySourceId`, returns the primary (first) SRP's\n   * access token, which is effectively the canonical\n   * profile's token that can be used by alias-aware consumers for cross-SRP\n   * operations.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The OIDC access token.\n   */\n  public async getBearerToken(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('getBearerToken');\n    const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();\n    return await this.#auth.getAccessToken(resolvedId);\n  }\n\n  /**\n   * Returns the cached session profile, logging in if no session exists.\n   *\n   * The returned `canonicalProfileId` reflects the value from the most recent\n   * login or pairing. In the rare event where a canonical changed because of\n   * a pairing that happened on another device, the cached value may be stale\n   * until the next login. For guaranteed freshness, call\n   * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns profile for the session.\n   */\n  public async getSessionProfile(\n    entropySourceId?: string,\n  ): Promise<UserProfile> {\n    this.#assertIsUnlocked('getSessionProfile');\n    const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();\n    return await this.#auth.getUserProfile(resolvedId);\n  }\n\n  /**\n   * Forces a fresh retrieval of the canonical profile ID from the server\n   * and propagates it to all cached SRP sessions.\n   *\n   * This method invalidates the primary SRP's cached session and forces a\n   * re-login. Use it before operations that require a guaranteed-fresh\n   * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n   * best-effort reads, use\n   * `getSessionProfile().canonicalProfileId` instead.\n   *\n   * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n   * the server returns the current canonical for the entire pairing group\n   * from any single SRP login.\n   *\n   * @returns The refreshed canonical profile ID.\n   */\n  public async refreshCanonicalProfileId(): Promise<string> {\n    this.#assertIsUnlocked('refreshCanonicalProfileId');\n\n    const primaryEntropySourceId = this.#getPrimaryEntropySourceId();\n    this.#invalidateSrpSession(primaryEntropySourceId);\n    await this.#auth.getAccessToken(primaryEntropySourceId);\n\n    const canonical = this.#getCanonicalProfileId();\n    if (!canonical) {\n      throw new Error(\n        'refreshCanonicalProfileId - Unable to resolve canonical profile ID',\n      );\n    }\n\n    this.#propagateCanonical(canonical);\n    return canonical;\n  }\n\n  #invalidateSrpSession(entropySourceId: string): void {\n    this.update((state) => {\n      const entry = state.srpSessionData?.[entropySourceId];\n      if (entry?.profile) {\n        // Setting canonicalProfileId to '' forces a re-fetch on the next\n        // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)\n        // treats '' the same as undefined/null — all signal an invalid session.\n        entry.profile.canonicalProfileId = '';\n      }\n    });\n  }\n\n  public async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    this.#assertIsUnlocked('getUserProfileLineage');\n    const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();\n    return await this.#auth.getUserProfileLineage(resolvedId);\n  }\n\n  /**\n   * Returns a Customer Service specific access token for the specified SRP,\n   * logging in if needed.\n   *\n   * Exchanges the OIDC access token for a short-lived token scoped to the\n   * customer-service audience. Customer Service tooling consumes this token to\n   * identify and authenticate the user.\n   *\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The customer-service access token.\n   */\n  public async getCustomerServiceToken(\n    entropySourceId?: string,\n  ): Promise<string> {\n    this.#assertIsUnlocked('getCustomerServiceToken');\n    const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();\n    return await this.#auth.getCustomerServiceToken(resolvedId);\n  }\n\n  public isSignedIn(): boolean {\n    return this.state.isSignedIn;\n  }\n\n  /**\n   * Reads the BIP-39 seed for an HD entropy source from KeyringController.\n   *\n   * @param entropySourceId - Entropy source ID. Defaults to the primary HD\n   * keyring.\n   * @returns The HD keyring seed.\n   */\n  async #getHdKeyringSeed(entropySourceId?: string): Promise<Uint8Array> {\n    const resolvedId = entropySourceId ?? this.#getPrimaryEntropySourceId();\n    return getHdKeyringSeed(this.messenger, resolvedId);\n  }\n\n  /**\n   * Returns the message-signing public key via native SIP-6 derivation\n   * (same key as `@metamask/message-signing-snap` with empty salt).\n   *\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns The public key hex.\n   */\n  async #getPublicKey(entropySourceId?: string): Promise<string> {\n    this.#assertIsUnlocked('#getPublicKey');\n    const seed = await this.#getHdKeyringSeed(entropySourceId);\n    return getMessageSigningPublicKey(seed);\n  }\n\n  #_signMessageCache: Record<string, string> = {};\n\n  /**\n   * Builds a cache key scoped to a specific entropy source, so each SRP's\n   * signature stays isolated (same pattern as `UserStorageController`).\n   *\n   * When `entropySourceId` is omitted (primary SRP), it is resolved to the\n   * primary HD keyring's metadata ID rather than a stable literal. Because that\n   * ID is randomly regenerated whenever the vault is recreated (e.g. on\n   * restore), the cached entry is naturally invalidated across vaults — a\n   * different SRP can never inherit the previous primary's cached signature.\n   *\n   * @param message - The tagged message used for signing.\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The scoped cache key.\n   */\n  #scopedCacheKey(\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ): string {\n    return `${entropySourceId ?? this.#getPrimaryEntropySourceId()}:${message}`;\n  }\n\n  /**\n   * Signs a `metamask:…` message with the native SIP-6 message-signing key.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns Compact secp256k1 signature hex.\n   */\n  async #signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    assertMessageStartsWithMetamask(message);\n    this.#assertIsUnlocked('#signMessage');\n\n    const cacheKey = this.#scopedCacheKey(message, entropySourceId);\n    if (this.#_signMessageCache[cacheKey]) {\n      return this.#_signMessageCache[cacheKey];\n    }\n\n    const seed = await this.#getHdKeyringSeed(entropySourceId);\n    const result = await signMessageWithMessageSigningKey(message, seed);\n\n    this.#_signMessageCache[cacheKey] = result;\n\n    return result;\n  }\n}\n"]}