@metamask-previews/profile-sync-controller 32.1.1-preview-2731bd7 → 32.1.1-preview-f67925e6c

package/CHANGELOG.md

@@ -9,7 +9,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Add validated MFA domain types and structured `MfaError` classes with a serialization-safe `mfaCode` ([#10264](https://github.com/MetaMask/core/pull/10264))
 - Add `rampsOrders` to `USER_STORAGE_FEATURE_NAMES` ([#10227](https://github.com/MetaMask/core/pull/10227))
 
 ## [32.1.1]

package/dist/sdk/constants.d.ts

@@ -1,8 +1,6 @@
 export declare const HTTP_STATUS_CODES: {
-    UNAUTHORIZED: number;
     CONFLICT: number;
     UNPROCESSABLE_ENTITY: number;
     TOO_MANY_REQUESTS: number;
-    BAD_GATEWAY: number;
 };
 //# sourceMappingURL=constants.d.ts.map

package/dist/sdk/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;IAC5B,YAAY;IACZ,QAAQ;IACR,oBAAoB;IACpB,iBAAiB;IACjB,WAAW;CACZ,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;IAC5B,QAAQ;IACR,oBAAoB;IACpB,iBAAiB;CAClB,CAAC"}

package/dist/sdk/constants.js

@@ -1,8 +1,6 @@
 export const HTTP_STATUS_CODES = {
-    UNAUTHORIZED: 401,
     CONFLICT: 409,
     UNPROCESSABLE_ENTITY: 422,
     TOO_MANY_REQUESTS: 429,
-    BAD_GATEWAY: 502,
 };
 //# sourceMappingURL=constants.js.map

package/dist/sdk/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY,EAAE,GAAG;IACjB,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,WAAW,EAAE,GAAG;CACjB,CAAC","sourcesContent":["export const HTTP_STATUS_CODES = {\n  UNAUTHORIZED: 401,\n  CONFLICT: 409,\n  UNPROCESSABLE_ENTITY: 422,\n  TOO_MANY_REQUESTS: 429,\n  BAD_GATEWAY: 502,\n};\n"]}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;CACvB,CAAC","sourcesContent":["export const HTTP_STATUS_CODES = {\n  CONFLICT: 409,\n  UNPROCESSABLE_ENTITY: 422,\n  TOO_MANY_REQUESTS: 429,\n};\n"]}

package/dist/sdk/errors.d.ts

@@ -1,93 +1,3 @@
-import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';
-type ExtensibleMfaErrorCode = MfaErrorCode | (string & {});
-/**
- * Base error for MFA operations.
- *
- * The machine-readable code is an enumerable own property so it survives
- * JSON-RPC error serialization.
- */
-export declare class MfaError extends Error {
-    readonly mfaCode: ExtensibleMfaErrorCode;
-    readonly status?: number;
-    readonly retryAfterMs?: number;
-    constructor(mfaCode: ExtensibleMfaErrorCode, message: string, options?: {
-        status?: number;
-        retryAfterMs?: number;
-    });
-}
-export declare class CredentialAlreadyEnrolledError extends MfaError {
-    constructor(code: 'credential_already_enrolled' | 'email_already_enrolled', message: string, status?: number);
-}
-export declare class CredentialNotEnrolledError extends MfaError {
-    constructor(message: string, status?: number);
-}
-/**
- * The begin/complete flow is stale or unknown; the client must restart it.
- */
-export declare class MfaFlowExpiredError extends MfaError {
-    constructor(code: 'flow_expired' | 'invalid_flow', message: string, status?: number);
-}
-/**
- * The profile has no identity-provider record yet. Not a stale flow: the
- * user must enroll a first credential before verifying.
- */
-export declare class MfaIdentityMissingError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class MfaVerificationFailedError extends MfaError {
-    constructor(code: 'invalid_code' | 'invalid_attestation' | 'invalid_assertion', message: string, status?: number);
-}
-export declare class TooManyAttemptsError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class MaxPasskeysReachedError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class MaxIdentifiersReachedError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class OtpResendCooldownError extends MfaError {
-    constructor(message: string, retryAfterMs?: number, status?: number);
-}
-/**
- * A 429 without an MFA-specific code: generic throttling, not an OTP resend
- * cooldown.
- */
-export declare class MfaRateLimitedError extends MfaError {
-    constructor(message: string, retryAfterMs?: number, status?: number);
-}
-/**
- * The identity provider or the network is unreachable. Safe to retry.
- * `status` is only set when the service answered.
- */
-export declare class MfaUnavailableError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class ElevatedTokenInvalidError extends MfaError {
-    constructor(message: string);
-}
-/**
- * Gets an MFA code from direct, serialized, or message-only errors.
- *
- * @param error - Value to inspect.
- * @returns The stable code, if present.
- */
-export declare function getMfaErrorCode(error: unknown): ExtensibleMfaErrorCode | undefined;
-/**
- * Checks whether a value carries an MFA error code.
- *
- * @param error - Value to inspect.
- * @param codes - Optional codes to match.
- * @returns Whether the value is an MFA error with a requested code.
- */
-export declare function isMfaError(error: unknown, ...codes: ExtensibleMfaErrorCode[]): boolean;
-/**
- * Gets a retry delay from direct or serialized MFA errors.
- *
- * @param error - Value to inspect.
- * @returns Retry delay in milliseconds, if present.
- */
-export declare function getMfaRetryAfterMs(error: unknown): number | undefined;
 export declare class NonceRetrievalError extends Error {
     constructor(message: string);
 }
@@ -139,5 +49,4 @@ export declare class RateLimitedError extends Error {
      */
     static isRateLimitError(e: unknown): e is RateLimitedError;
 }
-export {};
 //# sourceMappingURL=errors.d.ts.map

package/dist/sdk/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAG7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAU3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,EAAE,6BAA6B,GAAG,wBAAwB,EAC9D,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAEA,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}

package/dist/sdk/errors.js

@@ -1,169 +1,4 @@
 import { HTTP_STATUS_CODES } from './constants.js';
-function asRecord(value) {
-    return typeof value === 'object' && value !== null
-        ? value
-        : undefined;
-}
-/**
- * Base error for MFA operations.
- *
- * The machine-readable code is an enumerable own property so it survives
- * JSON-RPC error serialization.
- */
-export class MfaError extends Error {
-    mfaCode;
-    status;
-    retryAfterMs;
-    constructor(mfaCode, message, options) {
-        super(`MFA[${mfaCode}]: ${message}`);
-        this.name = 'MfaError';
-        this.mfaCode = mfaCode;
-        this.status = options?.status;
-        this.retryAfterMs = options?.retryAfterMs;
-    }
-}
-export class CredentialAlreadyEnrolledError extends MfaError {
-    constructor(code, message, status = HTTP_STATUS_CODES.CONFLICT) {
-        super(code, message, { status });
-        this.name = 'CredentialAlreadyEnrolledError';
-    }
-}
-export class CredentialNotEnrolledError extends MfaError {
-    constructor(message, status = HTTP_STATUS_CODES.CONFLICT) {
-        super('credential_not_enrolled', message, { status });
-        this.name = 'CredentialNotEnrolledError';
-    }
-}
-/**
- * The begin/complete flow is stale or unknown; the client must restart it.
- */
-export class MfaFlowExpiredError extends MfaError {
-    constructor(code, message, status) {
-        super(code, message, { status });
-        this.name = 'MfaFlowExpiredError';
-    }
-}
-/**
- * The profile has no identity-provider record yet. Not a stale flow: the
- * user must enroll a first credential before verifying.
- */
-export class MfaIdentityMissingError extends MfaError {
-    constructor(message, status = HTTP_STATUS_CODES.CONFLICT) {
-        super('mfa_identity_missing', message, { status });
-        this.name = 'MfaIdentityMissingError';
-    }
-}
-export class MfaVerificationFailedError extends MfaError {
-    constructor(code, message, status) {
-        super(code, message, { status });
-        this.name = 'MfaVerificationFailedError';
-    }
-}
-export class TooManyAttemptsError extends MfaError {
-    constructor(message, status) {
-        super('too_many_attempts', message, { status });
-        this.name = 'TooManyAttemptsError';
-    }
-}
-export class MaxPasskeysReachedError extends MfaError {
-    constructor(message, status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY) {
-        super('max_passkeys_reached', message, { status });
-        this.name = 'MaxPasskeysReachedError';
-    }
-}
-export class MaxIdentifiersReachedError extends MfaError {
-    constructor(message, status = HTTP_STATUS_CODES.CONFLICT) {
-        super('max_identifiers_reached', message, { status });
-        this.name = 'MaxIdentifiersReachedError';
-    }
-}
-export class OtpResendCooldownError extends MfaError {
-    constructor(message, retryAfterMs, status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
-        super('otp_resend_cooldown', message, { status, retryAfterMs });
-        this.name = 'OtpResendCooldownError';
-    }
-}
-/**
- * A 429 without an MFA-specific code: generic throttling, not an OTP resend
- * cooldown.
- */
-export class MfaRateLimitedError extends MfaError {
-    constructor(message, retryAfterMs, status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
-        super('rate_limited', message, { status, retryAfterMs });
-        this.name = 'MfaRateLimitedError';
-    }
-}
-/**
- * The identity provider or the network is unreachable. Safe to retry.
- * `status` is only set when the service answered.
- */
-export class MfaUnavailableError extends MfaError {
-    constructor(message, status) {
-        super('kratos_unavailable', message, { status });
-        this.name = 'MfaUnavailableError';
-    }
-}
-export class ElevatedTokenInvalidError extends MfaError {
-    constructor(message) {
-        super('elevated_token_invalid', message);
-        this.name = 'ElevatedTokenInvalidError';
-    }
-}
-/**
- * Gets an MFA code from direct, serialized, or message-only errors.
- *
- * @param error - Value to inspect.
- * @returns The stable code, if present.
- */
-export function getMfaErrorCode(error) {
-    const direct = asRecord(error);
-    if (typeof direct?.mfaCode === 'string') {
-        return direct.mfaCode;
-    }
-    const data = asRecord(direct?.data);
-    const cause = asRecord(data?.cause);
-    if (typeof cause?.mfaCode === 'string') {
-        return cause.mfaCode;
-    }
-    const messages = [direct?.message, cause?.message];
-    for (const message of messages) {
-        if (typeof message === 'string') {
-            const match = /^MFA\[([^\]]+)\]:/u.exec(message);
-            if (match?.[1]) {
-                return match[1];
-            }
-        }
-    }
-    return undefined;
-}
-/**
- * Checks whether a value carries an MFA error code.
- *
- * @param error - Value to inspect.
- * @param codes - Optional codes to match.
- * @returns Whether the value is an MFA error with a requested code.
- */
-export function isMfaError(error, ...codes) {
-    const code = getMfaErrorCode(error);
-    return code !== undefined && (codes.length === 0 || codes.includes(code));
-}
-/**
- * Gets a retry delay from direct or serialized MFA errors.
- *
- * @param error - Value to inspect.
- * @returns Retry delay in milliseconds, if present.
- */
-export function getMfaRetryAfterMs(error) {
-    const direct = asRecord(error);
-    if (typeof direct?.retryAfterMs === 'number') {
-        return direct.retryAfterMs;
-    }
-    const data = asRecord(direct?.data);
-    const cause = asRecord(data?.cause);
-    return typeof cause?.retryAfterMs === 'number'
-        ? cause.retryAfterMs
-        : undefined;
-}
 export class NonceRetrievalError extends Error {
     constructor(message) {
         super(message);

package/dist/sdk/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAMnD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAE,KAAqB;QACxB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,OAAO,CAAyB;IAEhC,MAAM,CAAU;IAEhB,YAAY,CAAU;IAE/B,YACE,OAA+B,EAC/B,OAAe,EACf,OAAoD;QAEpD,KAAK,CAAC,OAAO,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAA8D,EAC9D,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAEnC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAqC,EACrC,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAkE,EAClE,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,oBAAoB;QAE/C,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc;IAEd,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,KAAc,EACd,GAAG,KAA+B;IAElC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ;QAC5C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IACrC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;IAE7C,YAAY,CAAU;IAE/B,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAU;QAChC,OAAO,CACL,CAAC,YAAY,gBAAgB;YAC7B,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpB,CAAC,KAAK,IAAI;gBACV,QAAQ,IAAI,CAAC;gBACb,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,CAAC,CACpD,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';\nimport { HTTP_STATUS_CODES } from './constants.js';\n\ntype ExtensibleMfaErrorCode = MfaErrorCode | (string & {});\n\ntype ErrorRecord = Record<string, unknown>;\n\nfunction asRecord(value: unknown): ErrorRecord | undefined {\n  return typeof value === 'object' && value !== null\n    ? (value as ErrorRecord)\n    : undefined;\n}\n\n/**\n * Base error for MFA operations.\n *\n * The machine-readable code is an enumerable own property so it survives\n * JSON-RPC error serialization.\n */\nexport class MfaError extends Error {\n  readonly mfaCode: ExtensibleMfaErrorCode;\n\n  readonly status?: number;\n\n  readonly retryAfterMs?: number;\n\n  constructor(\n    mfaCode: ExtensibleMfaErrorCode,\n    message: string,\n    options?: { status?: number; retryAfterMs?: number },\n  ) {\n    super(`MFA[${mfaCode}]: ${message}`);\n    this.name = 'MfaError';\n    this.mfaCode = mfaCode;\n    this.status = options?.status;\n    this.retryAfterMs = options?.retryAfterMs;\n  }\n}\n\nexport class CredentialAlreadyEnrolledError extends MfaError {\n  constructor(\n    code: 'credential_already_enrolled' | 'email_already_enrolled',\n    message: string,\n    status = HTTP_STATUS_CODES.CONFLICT,\n  ) {\n    super(code, message, { status });\n    this.name = 'CredentialAlreadyEnrolledError';\n  }\n}\n\nexport class CredentialNotEnrolledError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('credential_not_enrolled', message, { status });\n    this.name = 'CredentialNotEnrolledError';\n  }\n}\n\n/**\n * The begin/complete flow is stale or unknown; the client must restart it.\n */\nexport class MfaFlowExpiredError extends MfaError {\n  constructor(\n    code: 'flow_expired' | 'invalid_flow',\n    message: string,\n    status?: number,\n  ) {\n    super(code, message, { status });\n    this.name = 'MfaFlowExpiredError';\n  }\n}\n\n/**\n * The profile has no identity-provider record yet. Not a stale flow: the\n * user must enroll a first credential before verifying.\n */\nexport class MfaIdentityMissingError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('mfa_identity_missing', message, { status });\n    this.name = 'MfaIdentityMissingError';\n  }\n}\n\nexport class MfaVerificationFailedError extends MfaError {\n  constructor(\n    code: 'invalid_code' | 'invalid_attestation' | 'invalid_assertion',\n    message: string,\n    status?: number,\n  ) {\n    super(code, message, { status });\n    this.name = 'MfaVerificationFailedError';\n  }\n}\n\nexport class TooManyAttemptsError extends MfaError {\n  constructor(message: string, status?: number) {\n    super('too_many_attempts', message, { status });\n    this.name = 'TooManyAttemptsError';\n  }\n}\n\nexport class MaxPasskeysReachedError extends MfaError {\n  constructor(\n    message: string,\n    status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY,\n  ) {\n    super('max_passkeys_reached', message, { status });\n    this.name = 'MaxPasskeysReachedError';\n  }\n}\n\nexport class MaxIdentifiersReachedError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('max_identifiers_reached', message, { status });\n    this.name = 'MaxIdentifiersReachedError';\n  }\n}\n\nexport class OtpResendCooldownError extends MfaError {\n  constructor(\n    message: string,\n    retryAfterMs?: number,\n    status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n  ) {\n    super('otp_resend_cooldown', message, { status, retryAfterMs });\n    this.name = 'OtpResendCooldownError';\n  }\n}\n\n/**\n * A 429 without an MFA-specific code: generic throttling, not an OTP resend\n * cooldown.\n */\nexport class MfaRateLimitedError extends MfaError {\n  constructor(\n    message: string,\n    retryAfterMs?: number,\n    status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n  ) {\n    super('rate_limited', message, { status, retryAfterMs });\n    this.name = 'MfaRateLimitedError';\n  }\n}\n\n/**\n * The identity provider or the network is unreachable. Safe to retry.\n * `status` is only set when the service answered.\n */\nexport class MfaUnavailableError extends MfaError {\n  constructor(message: string, status?: number) {\n    super('kratos_unavailable', message, { status });\n    this.name = 'MfaUnavailableError';\n  }\n}\n\nexport class ElevatedTokenInvalidError extends MfaError {\n  constructor(message: string) {\n    super('elevated_token_invalid', message);\n    this.name = 'ElevatedTokenInvalidError';\n  }\n}\n\n/**\n * Gets an MFA code from direct, serialized, or message-only errors.\n *\n * @param error - Value to inspect.\n * @returns The stable code, if present.\n */\nexport function getMfaErrorCode(\n  error: unknown,\n): ExtensibleMfaErrorCode | undefined {\n  const direct = asRecord(error);\n  if (typeof direct?.mfaCode === 'string') {\n    return direct.mfaCode;\n  }\n\n  const data = asRecord(direct?.data);\n  const cause = asRecord(data?.cause);\n  if (typeof cause?.mfaCode === 'string') {\n    return cause.mfaCode;\n  }\n\n  const messages = [direct?.message, cause?.message];\n  for (const message of messages) {\n    if (typeof message === 'string') {\n      const match = /^MFA\\[([^\\]]+)\\]:/u.exec(message);\n      if (match?.[1]) {\n        return match[1];\n      }\n    }\n  }\n  return undefined;\n}\n\n/**\n * Checks whether a value carries an MFA error code.\n *\n * @param error - Value to inspect.\n * @param codes - Optional codes to match.\n * @returns Whether the value is an MFA error with a requested code.\n */\nexport function isMfaError(\n  error: unknown,\n  ...codes: ExtensibleMfaErrorCode[]\n): boolean {\n  const code = getMfaErrorCode(error);\n  return code !== undefined && (codes.length === 0 || codes.includes(code));\n}\n\n/**\n * Gets a retry delay from direct or serialized MFA errors.\n *\n * @param error - Value to inspect.\n * @returns Retry delay in milliseconds, if present.\n */\nexport function getMfaRetryAfterMs(error: unknown): number | undefined {\n  const direct = asRecord(error);\n  if (typeof direct?.retryAfterMs === 'number') {\n    return direct.retryAfterMs;\n  }\n  const data = asRecord(direct?.data);\n  const cause = asRecord(data?.cause);\n  return typeof cause?.retryAfterMs === 'number'\n    ? cause.retryAfterMs\n    : undefined;\n}\n\nexport class NonceRetrievalError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NonceRetrievalError';\n  }\n}\n\nexport class SignInError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignInError';\n  }\n}\n\nexport class PairError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/profile/pair/identifier` returns 409 Conflict:\n * the social identifier already belongs to another canonical profile.\n * Retrying the same request cannot succeed.\n */\nexport class PairConflictError extends PairError {\n  readonly status = HTTP_STATUS_CODES.CONFLICT;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairConflictError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/oidc/token` returns 422: this profile has no\n * verified email on record. Consumers should send the user through email\n * OTP (or Google pair) and retry.\n */\nexport class EmailRequiredError extends Error {\n  readonly status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'EmailRequiredError';\n  }\n}\n\nexport class UserStorageError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UserStorageError';\n  }\n}\n\nexport class ValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UnsupportedAuthTypeError';\n  }\n}\n\nexport class NotFoundError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class RateLimitedError extends Error {\n  readonly status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS;\n\n  readonly retryAfterMs?: number;\n\n  constructor(message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = 'RateLimitedError';\n    this.retryAfterMs = retryAfterMs;\n  }\n\n  /**\n   * Check if an unknown error is a rate limit error (429 status).\n   *\n   * @param e - The error to check\n   * @returns True if the error is a rate limit error\n   */\n  static isRateLimitError(e: unknown): e is RateLimitedError {\n    return (\n      e instanceof RateLimitedError ||\n      (typeof e === 'object' &&\n        e !== null &&\n        'status' in e &&\n        e.status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS)\n    );\n  }\n}\n"]}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IACrC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;IAE7C,YAAY,CAAU;IAE/B,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAU;QAChC,OAAO,CACL,CAAC,YAAY,gBAAgB;YAC7B,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpB,CAAC,KAAK,IAAI;gBACV,QAAQ,IAAI,CAAC;gBACb,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,CAAC,CACpD,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { HTTP_STATUS_CODES } from './constants.js';\n\nexport class NonceRetrievalError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NonceRetrievalError';\n  }\n}\n\nexport class SignInError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignInError';\n  }\n}\n\nexport class PairError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/profile/pair/identifier` returns 409 Conflict:\n * the social identifier already belongs to another canonical profile.\n * Retrying the same request cannot succeed.\n */\nexport class PairConflictError extends PairError {\n  readonly status = HTTP_STATUS_CODES.CONFLICT;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairConflictError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/oidc/token` returns 422: this profile has no\n * verified email on record. Consumers should send the user through email\n * OTP (or Google pair) and retry.\n */\nexport class EmailRequiredError extends Error {\n  readonly status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'EmailRequiredError';\n  }\n}\n\nexport class UserStorageError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UserStorageError';\n  }\n}\n\nexport class ValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UnsupportedAuthTypeError';\n  }\n}\n\nexport class NotFoundError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class RateLimitedError extends Error {\n  readonly status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS;\n\n  readonly retryAfterMs?: number;\n\n  constructor(message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = 'RateLimitedError';\n    this.retryAfterMs = retryAfterMs;\n  }\n\n  /**\n   * Check if an unknown error is a rate limit error (429 status).\n   *\n   * @param e - The error to check\n   * @returns True if the error is a rate limit error\n   */\n  static isRateLimitError(e: unknown): e is RateLimitedError {\n    return (\n      e instanceof RateLimitedError ||\n      (typeof e === 'object' &&\n        e !== null &&\n        'status' in e &&\n        e.status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS)\n    );\n  }\n}\n"]}

package/dist/sdk/utils/validate-login-response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-login-response.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG1D;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAgB5E"}
+{"version":3,"file":"validate-login-response.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAgB5E"}

package/dist/sdk/utils/validate-login-response.js

@@ -1,4 +1,3 @@
-import { decodeJwtPayload } from './jwt.js';
 /**
  * Validates that the input is a well-formed, non-expired LoginResponse.
  *
@@ -31,10 +30,13 @@ export function validateLoginResponse(input) {
  */
 function isJwtExpired(token) {
     try {
-        const { exp } = decodeJwtPayload(token);
-        return (typeof exp !== 'number' ||
-            !Number.isInteger(exp) ||
-            exp * 1000 <= Date.now());
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return true;
+        }
+        const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');
+        const { exp } = JSON.parse(atob(base64));
+        return !Number.isInteger(exp) || exp * 1000 <= Date.now();
     }
     catch {
         return true;

package/dist/sdk/utils/validate-login-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-login-response.js","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,YAAY,GAAG,KAAsB,CAAC;IAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAsB,CAAC;QAC7D,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;YACvB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;YACtB,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { LoginResponse } from '../authentication.js';\nimport { decodeJwtPayload } from './jwt.js';\n\n/**\n * Validates that the input is a well-formed, non-expired LoginResponse.\n *\n * Checks structural shape (token + profile objects exist) and verifies\n * the JWT access token's `exp` claim is still in the future. This acts\n * as a hard guard against stale cached tokens regardless of client-side\n * TTL tracking (obtainedAt / expiresIn), which can be corrupted.\n *\n * @param input - unknown/untyped input\n * @returns boolean if input is a valid, non-expired LoginResponse\n */\nexport function validateLoginResponse(input: unknown): input is LoginResponse {\n  const assumedInput = input as LoginResponse;\n\n  if (!assumedInput) {\n    return false;\n  }\n\n  if (!assumedInput?.token || !assumedInput?.profile) {\n    return false;\n  }\n\n  if (isJwtExpired(assumedInput.token.accessToken)) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Checks whether a JWT has expired by decoding its `exp` claim.\n *\n * @param token - A JWT string.\n * @returns true if the token is expired or cannot be decoded; false if still valid.\n */\nfunction isJwtExpired(token: string): boolean {\n  try {\n    const { exp } = decodeJwtPayload(token) as { exp?: unknown };\n    return (\n      typeof exp !== 'number' ||\n      !Number.isInteger(exp) ||\n      exp * 1000 <= Date.now()\n    );\n  } catch {\n    return true;\n  }\n}\n"]}
+{"version":3,"file":"validate-login-response.js","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,YAAY,GAAG,KAAsB,CAAC;IAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { LoginResponse } from '../authentication.js';\n\n/**\n * Validates that the input is a well-formed, non-expired LoginResponse.\n *\n * Checks structural shape (token + profile objects exist) and verifies\n * the JWT access token's `exp` claim is still in the future. This acts\n * as a hard guard against stale cached tokens regardless of client-side\n * TTL tracking (obtainedAt / expiresIn), which can be corrupted.\n *\n * @param input - unknown/untyped input\n * @returns boolean if input is a valid, non-expired LoginResponse\n */\nexport function validateLoginResponse(input: unknown): input is LoginResponse {\n  const assumedInput = input as LoginResponse;\n\n  if (!assumedInput) {\n    return false;\n  }\n\n  if (!assumedInput?.token || !assumedInput?.profile) {\n    return false;\n  }\n\n  if (isJwtExpired(assumedInput.token.accessToken)) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Checks whether a JWT has expired by decoding its `exp` claim.\n *\n * @param token - A JWT string.\n * @returns true if the token is expired or cannot be decoded; false if still valid.\n */\nfunction isJwtExpired(token: string): boolean {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      return true;\n    }\n    const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');\n    const { exp } = JSON.parse(atob(base64));\n    return !Number.isInteger(exp) || exp * 1000 <= Date.now();\n  } catch {\n    return true;\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask-previews/profile-sync-controller",
-  "version": "32.1.1-preview-2731bd7",
+  "version": "32.1.1-preview-f67925e6c",
   "description": "The profile sync helps developers synchronize data across multiple clients and devices in a privacy-preserving way. All data saved in the user storage database is encrypted client-side to preserve privacy. The user storage provides a modular design, giving developers the flexibility to construct and manage their storage spaces in a way that best suits their needs",
   "keywords": [
     "Ethereum",
@@ -79,7 +79,6 @@
     "@metamask/keyring-controller": "^28.0.0",
     "@metamask/messenger": "^3.0.0",
     "@metamask/seedless-onboarding-controller": "^11.0.0",
-    "@metamask/superstruct": "^3.4.1",
     "@metamask/utils": "^12.0.0",
     "@noble/ciphers": "^1.3.0",
     "@noble/curves": "^1.9.2",
@@ -96,7 +95,6 @@
     "@metamask/keyring-api": "^24.0.0",
     "@metamask/keyring-internal-api": "^12.0.0",
     "@metamask/providers": "^22.1.0",
-    "@metamask/rpc-errors": "^7.0.2",
     "@types/jest": "^30.0.0",
     "@typescript/native": "npm:typescript@^7.0.2",
     "deepmerge": "^4.2.2",