@metamask-previews/profile-sync-controller 32.1.1-preview-c6cdff1dd → 32.1.1-preview-9d2a9bdf5

package/dist/sdk/authentication-jwt-bearer/flow-srp.js

@@ -1,8 +1,7 @@
-import { MfaError, ValidationError, RateLimitedError } from '../errors.js';
+import { ValidationError, RateLimitedError } from '../errors.js';
 import { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider.js';
 import { MESSAGE_SIGNING_SNAP, assertMessageStartsWithMetamask, connectSnap, isSnapConnected, } from '../utils/messaging-signing-snap-requests.js';
 import { validateLoginResponse } from '../utils/validate-login-response.js';
-import { getMfaCredentials, mfaEnroll, mfaEnrollComplete, mfaVerify, mfaVerifyComplete, } from './mfa/services.js';
 import { authenticate, authorizeOIDC, getCustomerServiceToken, getNonce, getPartnerIdentityToken, getUserProfileLineage, pairProfiles, pairSocialIdentifier, } from './services.js';
 import { computeIdentifierId } from './utils/identifier.js';
 import * as timeUtils from './utils/time.js';
@@ -96,123 +95,6 @@ export class SRPJwtBearerAuth {
         const accessToken = await this.getAccessToken(entropySourceId);
         return await getPartnerIdentityToken(this.#config.env, accessToken, claims, audience);
     }
-    /**
-     * Begins enrollment of an MFA credential for the primary profile.
-     *
-     * @param type - Credential type to enroll.
-     * @param options - Enrollment options.
-     * @param options.email - Email address, required for email OTP.
-     * @param options.entropySourceId - Entropy source whose profile owns the
-     * credential.
-     * @returns Enrollment challenge for the client ceremony.
-     */
-    async beginMfaEnrollment(type, options) {
-        const { email, entropySourceId } = options ?? {};
-        const accessToken = await this.getAccessToken(entropySourceId);
-        const result = await mfaEnroll(this.#config.env, accessToken, {
-            credential_type: type,
-            ...(email ? { identifier: email } : {}),
-        });
-        if (type === 'passkey') {
-            if (!result.publicKey) {
-                throw new MfaError('invalid_response', 'Passkey enrollment response is missing creation data');
-            }
-            return {
-                type,
-                flowId: result.flowId,
-                expiresAt: result.expiresAt,
-                publicKey: result.publicKey,
-            };
-        }
-        return {
-            type,
-            flowId: result.flowId,
-            expiresAt: result.expiresAt,
-        };
-    }
-    /**
-     * Completes enrollment of an MFA credential.
-     *
-     * @param flowId - Identifier returned by the begin call.
-     * @param proof - Platform attestation or email code.
-     * @param entropySourceId - Entropy source whose profile owns the credential.
-     */
-    async completeMfaEnrollment(flowId, proof, entropySourceId) {
-        const accessToken = await this.getAccessToken(entropySourceId);
-        await mfaEnrollComplete(this.#config.env, accessToken, {
-            credential_type: proof.type,
-            flow_id: flowId,
-            ...(proof.type === 'passkey'
-                ? { passkey_attestation: proof.attestation }
-                : { otp_code: proof.code }),
-        });
-    }
-    /**
-     * Begins step-up verification with an enrolled credential.
-     *
-     * @param type - Credential type to verify.
-     * @param entropySourceId - Entropy source whose profile owns the credential.
-     * @returns Verification challenge for the client ceremony.
-     */
-    async beginMfaVerification(type, entropySourceId) {
-        const accessToken = await this.getAccessToken(entropySourceId);
-        const result = await mfaVerify(this.#config.env, accessToken, {
-            credential_type: type,
-        });
-        if (type === 'passkey') {
-            if (!result.publicKey) {
-                throw new MfaError('invalid_response', 'Passkey verification response is missing request data');
-            }
-            return {
-                type,
-                flowId: result.flowId,
-                expiresAt: result.expiresAt,
-                publicKey: result.publicKey,
-            };
-        }
-        return {
-            type,
-            flowId: result.flowId,
-            expiresAt: result.expiresAt,
-        };
-    }
-    /**
-     * Completes step-up verification with an enrolled credential.
-     *
-     * @param flowId - Identifier returned by the begin call.
-     * @param proof - Platform assertion or email code.
-     * @param entropySourceId - Entropy source whose profile owns the credential.
-     * @returns AAL2 assertion issued after verification.
-     */
-    async completeMfaVerification(flowId, proof, entropySourceId) {
-        const accessToken = await this.getAccessToken(entropySourceId);
-        return await mfaVerifyComplete(this.#config.env, accessToken, {
-            credential_type: proof.type,
-            flow_id: flowId,
-            ...(proof.type === 'passkey'
-                ? { passkey_assertion: proof.assertion }
-                : { otp_code: proof.code }),
-        });
-    }
-    /**
-     * Gets credentials enrolled on the primary profile.
-     *
-     * @param entropySourceId - Entropy source whose profile owns the credentials.
-     * @returns Supported enrolled credentials.
-     */
-    async getMfaCredentials(entropySourceId) {
-        const accessToken = await this.getAccessToken(entropySourceId);
-        return await getMfaCredentials(this.#config.env, accessToken);
-    }
-    /**
-     * Exchanges an MFA assertion for an elevated access token.
-     *
-     * @param assertionJwt - AAL2 authentication assertion.
-     * @returns Elevated access token.
-     */
-    async exchangeMfaAssertion(assertionJwt) {
-        return await authorizeOIDC(assertionJwt, this.#config.env, this.#config.platform);
-    }
     async pairSocialIdentifier(params, authAccessToken) {
         await pairSocialIdentifier(params, authAccessToken, this.#config.env);
     }

package/dist/sdk/authentication-jwt-bearer/flow-srp.js.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.js","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,WAAW,EACX,eAAe,GAChB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,iBAAiB,EACjB,SAAS,EACT,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EACL,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,QAAQ,EACR,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAkBvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAuB7C,0EAA0E;AAC1E,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAa;IAEpB,QAAQ,CAGf;IAEO,YAAY,CAAmB;IAExC,yDAAyD;IAChD,cAAc,GAAG,IAAI,GAAG,EAG9B,CAAC;IAEJ,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACxD,gBAAgB,GAAG,IAAI,GAAG,EAGhC,CAAC;IAEJ,sDAAsD;IAC7C,kBAAkB,CAAS;IAEpC,uDAAuD;IAC9C,gBAAgB,CAAS;IAEzB,YAAY,CAAsD;IAElE,uBAAuB,CAEE;IAElC,eAAe,CAAmB;IAElC,YACE,MAA2C,EAC3C,OAGC;QAED,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,IAAI,CAAC,eAAe,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QAExC,4CAA4C;QAC5C,IAAI,CAAC,kBAAkB;YACrB,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAuB,CAClC,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,WAAW,EACX,MAAM,EACN,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,kBAAkB,CACtB,IAAuB,EACvB,OAAsD;QAEtD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,sDAAsD,CACvD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAsB,EACtB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YACrD,eAAe,EAAE,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,MAAM;YACf,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,WAAW,EAAE;gBAC5C,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,IAAuB,EACvB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QAEH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,uBAAuB,CAC3B,MAAc,EACd,KAAkB,EAClB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,MAAM;YACf,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE;gBACxC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC7C,OAAO,MAAM,aAAa,CACxB,YAAY,EACZ,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,MAAM,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAC1B,YAAY,EACZ,eAAe,EACf,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;QACF,yEAAyE;QACzE,4CAA4C;QAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC7B,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,gBAAgB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,mEAAmE;YACnE,0CAA0C;YAC1C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC7B,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;aAC3C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,oCAAoC;YACpC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,eAAe,CACnB,eAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;QAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAwB;QACnC,gDAAgD;QAChD,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,QAAQ;QACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7D,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,cAAc,GAClB,CAAC,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAC/C,QAAQ,CAAC,KAAK,EACd,SAAS,EACT,GAAG,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAEtE,eAAe;QACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,YAAY,EACjB,cAAc,CACf,CAAC;QAEF,2CAA2C;QAC3C,oFAAoF;QACpF,8DAA8D;QAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;QAE5C,IAAI,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,kBAAkB,GAAG,mBAAmB,CAC5C,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;YAEF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAC/D,CAAC;YAEF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,WAAW,GACf,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;gBACjE,eAAe,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAEhD,YAAY;QACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;QAEF,OAAO;QACP,MAAM,MAAM,GAAkB;YAC5B,OAAO;YACP,KAAK,EAAE,aAAa;SACrB,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAEtE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,qEAAqE;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,6BAA6B;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAE3D,+BAA+B;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,iCAAiC;YACjC,OAAO,MAAM,YAAY,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,sDAAsD;YACtD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,eAAwB;QAC5C,uDAAuD;QACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,wCAAwC;gBACxC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACrC,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,2CAA2C;gBAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC;gBACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAE9B,0BAA0B;YAC5B,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,yBAAyB,CACvB,KAAa,EACb,SAAiB,EACjB,GAAiB;QAIjB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,YAAY,KAAK,IAAI,SAAS,IAAI,GAAG,EAAW,CAAC;QAC1D,CAAC;QACD,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;IACnD,CAAC;CACF","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { MetaMetricsAuth } from '../../shared/types/services.js';\nimport { MfaError, ValidationError, RateLimitedError } from '../errors.js';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider.js';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests.js';\nimport { validateLoginResponse } from '../utils/validate-login-response.js';\nimport {\n  getMfaCredentials,\n  mfaEnroll,\n  mfaEnrollComplete,\n  mfaVerify,\n  mfaVerifyComplete,\n} from './mfa/services.js';\nimport type { MfaStepUpAssertion } from './mfa/services.js';\nimport type {\n  EnrolledCredential,\n  EnrollmentChallenge,\n  EnrollmentProof,\n  MfaCredentialType,\n  StepUpChallenge,\n  StepUpProof,\n} from './mfa/types.js';\nimport {\n  authenticate,\n  authorizeOIDC,\n  getCustomerServiceToken,\n  getNonce,\n  getPartnerIdentityToken,\n  getUserProfileLineage,\n  pairProfiles,\n  pairSocialIdentifier,\n} from './services.js';\nimport type { PairProfilesResponse } from './services.js';\nimport type {\n  AuthConfig,\n  AccessToken,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginIdentifierType,\n  LoginResponse,\n  OidcTokenAudience,\n  OidcTokenClaims,\n  PairSocialIdentifierParams,\n  SrpLoginTag,\n  UserProfile,\n  UserProfileLineage,\n} from './types.js';\nimport { computeIdentifierId } from './utils/identifier.js';\nimport * as timeUtils from './utils/time.js';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  /**\n   * Resolves the login tag for a given entropy source.\n   * When omitted, `raw_message` stays untagged (`metamask:<nonce>:<pubkey>`).\n   */\n  getLoginTag?: (entropySourceId?: string) => Promise<SrpLoginTag>;\n  /**\n   * Resolves the metametrics `identifier_type` for a given entropy source.\n   * Defaults to `'SRP'` when omitted.\n   */\n  getLoginIdentifierType?: (\n    entropySourceId?: string,\n  ) => Promise<LoginIdentifierType>;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\n// How long a successful pairing result stays cached so identical payloads\n// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.\nexport const PAIR_DEDUPE_TTL_MS = 30_000;\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<\n    string | undefined,\n    Promise<LoginResponse>\n  >();\n\n  // Map to dedupe pairing calls by an order-insensitive token-set key.\n  // Holds the in-flight promise (coalescing concurrent callers) and keeps it\n  // for a short TTL after success (collapsing sequential retries).\n  readonly #ongoingPairings = new Map<\n    string,\n    { promise: Promise<PairProfilesResponse>; expiresAt: number }\n  >();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  readonly #getLoginTag?: (entropySourceId?: string) => Promise<SrpLoginTag>;\n\n  readonly #getLoginIdentifierType?: (\n    entropySourceId?: string,\n  ) => Promise<LoginIdentifierType>;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#getLoginTag = options.getLoginTag;\n    this.#getLoginIdentifierType = options.getLoginIdentifierType;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getCustomerServiceToken(this.#config.env, accessToken);\n  }\n\n  async getPartnerIdentityToken(\n    claims: OidcTokenClaims,\n    audience: OidcTokenAudience,\n    entropySourceId?: string,\n  ): Promise<string> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getPartnerIdentityToken(\n      this.#config.env,\n      accessToken,\n      claims,\n      audience,\n    );\n  }\n\n  /**\n   * Begins enrollment of an MFA credential for the primary profile.\n   *\n   * @param type - Credential type to enroll.\n   * @param options - Enrollment options.\n   * @param options.email - Email address, required for email OTP.\n   * @param options.entropySourceId - Entropy source whose profile owns the\n   * credential.\n   * @returns Enrollment challenge for the client ceremony.\n   */\n  async beginMfaEnrollment(\n    type: MfaCredentialType,\n    options?: { email?: string; entropySourceId?: string },\n  ): Promise<EnrollmentChallenge> {\n    const { email, entropySourceId } = options ?? {};\n    const accessToken = await this.getAccessToken(entropySourceId);\n    const result = await mfaEnroll(this.#config.env, accessToken, {\n      credential_type: type,\n      ...(email ? { identifier: email } : {}),\n    });\n\n    if (type === 'passkey') {\n      if (!result.publicKey) {\n        throw new MfaError(\n          'invalid_response',\n          'Passkey enrollment response is missing creation data',\n        );\n      }\n      return {\n        type,\n        flowId: result.flowId,\n        expiresAt: result.expiresAt,\n        publicKey: result.publicKey,\n      };\n    }\n    return {\n      type,\n      flowId: result.flowId,\n      expiresAt: result.expiresAt,\n    };\n  }\n\n  /**\n   * Completes enrollment of an MFA credential.\n   *\n   * @param flowId - Identifier returned by the begin call.\n   * @param proof - Platform attestation or email code.\n   * @param entropySourceId - Entropy source whose profile owns the credential.\n   */\n  async completeMfaEnrollment(\n    flowId: string,\n    proof: EnrollmentProof,\n    entropySourceId?: string,\n  ): Promise<void> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    await mfaEnrollComplete(this.#config.env, accessToken, {\n      credential_type: proof.type,\n      flow_id: flowId,\n      ...(proof.type === 'passkey'\n        ? { passkey_attestation: proof.attestation }\n        : { otp_code: proof.code }),\n    });\n  }\n\n  /**\n   * Begins step-up verification with an enrolled credential.\n   *\n   * @param type - Credential type to verify.\n   * @param entropySourceId - Entropy source whose profile owns the credential.\n   * @returns Verification challenge for the client ceremony.\n   */\n  async beginMfaVerification(\n    type: MfaCredentialType,\n    entropySourceId?: string,\n  ): Promise<StepUpChallenge> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    const result = await mfaVerify(this.#config.env, accessToken, {\n      credential_type: type,\n    });\n\n    if (type === 'passkey') {\n      if (!result.publicKey) {\n        throw new MfaError(\n          'invalid_response',\n          'Passkey verification response is missing request data',\n        );\n      }\n      return {\n        type,\n        flowId: result.flowId,\n        expiresAt: result.expiresAt,\n        publicKey: result.publicKey,\n      };\n    }\n    return {\n      type,\n      flowId: result.flowId,\n      expiresAt: result.expiresAt,\n    };\n  }\n\n  /**\n   * Completes step-up verification with an enrolled credential.\n   *\n   * @param flowId - Identifier returned by the begin call.\n   * @param proof - Platform assertion or email code.\n   * @param entropySourceId - Entropy source whose profile owns the credential.\n   * @returns AAL2 assertion issued after verification.\n   */\n  async completeMfaVerification(\n    flowId: string,\n    proof: StepUpProof,\n    entropySourceId?: string,\n  ): Promise<MfaStepUpAssertion> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await mfaVerifyComplete(this.#config.env, accessToken, {\n      credential_type: proof.type,\n      flow_id: flowId,\n      ...(proof.type === 'passkey'\n        ? { passkey_assertion: proof.assertion }\n        : { otp_code: proof.code }),\n    });\n  }\n\n  /**\n   * Gets credentials enrolled on the primary profile.\n   *\n   * @param entropySourceId - Entropy source whose profile owns the credentials.\n   * @returns Supported enrolled credentials.\n   */\n  async getMfaCredentials(\n    entropySourceId?: string,\n  ): Promise<EnrolledCredential[]> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getMfaCredentials(this.#config.env, accessToken);\n  }\n\n  /**\n   * Exchanges an MFA assertion for an elevated access token.\n   *\n   * @param assertionJwt - AAL2 authentication assertion.\n   * @returns Elevated access token.\n   */\n  async exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken> {\n    return await authorizeOIDC(\n      assertionJwt,\n      this.#config.env,\n      this.#config.platform,\n    );\n  }\n\n  async pairSocialIdentifier(\n    params: PairSocialIdentifierParams,\n    authAccessToken: string,\n  ): Promise<void> {\n    await pairSocialIdentifier(params, authAccessToken, this.#config.env);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    // Order-insensitive key: the same token set in any order maps to the same\n    // entry. Sort a copy so the request payload itself stays primary-first.\n    const key = JSON.stringify([...accessTokens].sort());\n\n    const cached = this.#ongoingPairings.get(key);\n    if (cached && cached.expiresAt > Date.now()) {\n      return await cached.promise;\n    }\n\n    const promise = pairProfiles(\n      accessTokens,\n      authAccessToken,\n      this.#config.env,\n    );\n    // Store the in-flight promise immediately so concurrent callers coalesce\n    // regardless of how long the request takes.\n    this.#ongoingPairings.set(key, {\n      promise,\n      expiresAt: Number.MAX_SAFE_INTEGER,\n    });\n\n    try {\n      const result = await promise;\n      // Keep the resolved result cached for a short window so sequential\n      // retries with the same payload reuse it.\n      this.#ongoingPairings.set(key, {\n        promise,\n        expiresAt: Date.now() + PAIR_DEDUPE_TTL_MS,\n      });\n      return result;\n    } catch (error) {\n      // Never cache failures: the pairing retry loop must be able to re-hit\n      // the endpoint on the next attempt.\n      this.#ongoingPairings.delete(key);\n      throw error;\n    }\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    // get canonical profile id from server if not present in the cached session\n    if (!auth.profile.canonicalProfileId) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    // Tag only when the wallet supplies getLoginTag. SDK callers keep the\n    // legacy 3-part message rather than guessing `primary`.\n    const tag = await this.#getLoginTag?.(entropySourceId);\n    const identifierType =\n      (await this.#getLoginIdentifierType?.(entropySourceId)) ?? 'SRP';\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n      tag,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n      identifierType,\n    );\n\n    // Resolve original profileId from aliases.\n    // This is done mainly to preserve the original profileId for storage key derivation\n    // until we migrate to the canonical profileId storage system.\n    const canonicalProfileId = authResponse.profile.profileId;\n    const profile = { ...authResponse.profile };\n\n    if (authResponse.profileAliases?.length > 0) {\n      const targetIdentifierId = computeIdentifierId(\n        publicKey,\n        this.#config.env,\n      );\n\n      const matchingAliases = authResponse.profileAliases.filter((alias) =>\n        alias.identifierIds.some((id) => id.id === targetIdentifierId),\n      );\n\n      // Prefer the leaf alias (single identifier) — it's the original profile\n      // created for this SRP. Multi-identifier aliases are former canonicals\n      // that absorbed other profiles; they are correct only when this SRP's\n      // original profile was itself a canonical before being absorbed.\n      const targetAlias =\n        matchingAliases.find((alias) => alias.identifierIds.length === 1) ??\n        matchingAliases[0];\n\n      if (targetAlias) {\n        profile.profileId = targetAlias.aliasProfileId;\n      }\n    }\n\n    profile.canonicalProfileId = canonicalProfileId;\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(entropySourceId);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      return await loginPromise;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(entropySourceId);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n    tag?: SrpLoginTag,\n  ):\n    | `metamask:${string}:${string}`\n    | `metamask:${string}:${string}:${SrpLoginTag}` {\n    if (tag) {\n      return `metamask:${nonce}:${publicKey}:${tag}` as const;\n    }\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}
+{"version":3,"file":"flow-srp.js","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,WAAW,EACX,eAAe,GAChB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EACL,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,QAAQ,EACR,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAiBvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAuB7C,0EAA0E;AAC1E,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAa;IAEpB,QAAQ,CAGf;IAEO,YAAY,CAAmB;IAExC,yDAAyD;IAChD,cAAc,GAAG,IAAI,GAAG,EAG9B,CAAC;IAEJ,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACxD,gBAAgB,GAAG,IAAI,GAAG,EAGhC,CAAC;IAEJ,sDAAsD;IAC7C,kBAAkB,CAAS;IAEpC,uDAAuD;IAC9C,gBAAgB,CAAS;IAEzB,YAAY,CAAsD;IAElE,uBAAuB,CAEE;IAElC,eAAe,CAAmB;IAElC,YACE,MAA2C,EAC3C,OAGC;QAED,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,IAAI,CAAC,eAAe,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QAExC,4CAA4C;QAC5C,IAAI,CAAC,kBAAkB;YACrB,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAuB,CAClC,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,WAAW,EACX,MAAM,EACN,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,MAAM,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAC1B,YAAY,EACZ,eAAe,EACf,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;QACF,yEAAyE;QACzE,4CAA4C;QAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC7B,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,gBAAgB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,mEAAmE;YACnE,0CAA0C;YAC1C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC7B,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;aAC3C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,oCAAoC;YACpC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,eAAe,CACnB,eAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;QAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAwB;QACnC,gDAAgD;QAChD,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,QAAQ;QACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7D,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,cAAc,GAClB,CAAC,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAC/C,QAAQ,CAAC,KAAK,EACd,SAAS,EACT,GAAG,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAEtE,eAAe;QACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,YAAY,EACjB,cAAc,CACf,CAAC;QAEF,2CAA2C;QAC3C,oFAAoF;QACpF,8DAA8D;QAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;QAE5C,IAAI,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,kBAAkB,GAAG,mBAAmB,CAC5C,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;YAEF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAC/D,CAAC;YAEF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,WAAW,GACf,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;gBACjE,eAAe,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAEhD,YAAY;QACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;QAEF,OAAO;QACP,MAAM,MAAM,GAAkB;YAC5B,OAAO;YACP,KAAK,EAAE,aAAa;SACrB,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAEtE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,qEAAqE;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,6BAA6B;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAE3D,+BAA+B;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,iCAAiC;YACjC,OAAO,MAAM,YAAY,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,sDAAsD;YACtD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,eAAwB;QAC5C,uDAAuD;QACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,wCAAwC;gBACxC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACrC,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,2CAA2C;gBAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC;gBACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAE9B,0BAA0B;YAC5B,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,yBAAyB,CACvB,KAAa,EACb,SAAiB,EACjB,GAAiB;QAIjB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,YAAY,KAAK,IAAI,SAAS,IAAI,GAAG,EAAW,CAAC;QAC1D,CAAC;QACD,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;IACnD,CAAC;CACF","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { MetaMetricsAuth } from '../../shared/types/services.js';\nimport { ValidationError, RateLimitedError } from '../errors.js';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider.js';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests.js';\nimport { validateLoginResponse } from '../utils/validate-login-response.js';\nimport {\n  authenticate,\n  authorizeOIDC,\n  getCustomerServiceToken,\n  getNonce,\n  getPartnerIdentityToken,\n  getUserProfileLineage,\n  pairProfiles,\n  pairSocialIdentifier,\n} from './services.js';\nimport type { PairProfilesResponse } from './services.js';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginIdentifierType,\n  LoginResponse,\n  OidcTokenAudience,\n  OidcTokenClaims,\n  PairSocialIdentifierParams,\n  SrpLoginTag,\n  UserProfile,\n  UserProfileLineage,\n} from './types.js';\nimport { computeIdentifierId } from './utils/identifier.js';\nimport * as timeUtils from './utils/time.js';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  /**\n   * Resolves the login tag for a given entropy source.\n   * When omitted, `raw_message` stays untagged (`metamask:<nonce>:<pubkey>`).\n   */\n  getLoginTag?: (entropySourceId?: string) => Promise<SrpLoginTag>;\n  /**\n   * Resolves the metametrics `identifier_type` for a given entropy source.\n   * Defaults to `'SRP'` when omitted.\n   */\n  getLoginIdentifierType?: (\n    entropySourceId?: string,\n  ) => Promise<LoginIdentifierType>;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\n// How long a successful pairing result stays cached so identical payloads\n// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.\nexport const PAIR_DEDUPE_TTL_MS = 30_000;\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<\n    string | undefined,\n    Promise<LoginResponse>\n  >();\n\n  // Map to dedupe pairing calls by an order-insensitive token-set key.\n  // Holds the in-flight promise (coalescing concurrent callers) and keeps it\n  // for a short TTL after success (collapsing sequential retries).\n  readonly #ongoingPairings = new Map<\n    string,\n    { promise: Promise<PairProfilesResponse>; expiresAt: number }\n  >();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  readonly #getLoginTag?: (entropySourceId?: string) => Promise<SrpLoginTag>;\n\n  readonly #getLoginIdentifierType?: (\n    entropySourceId?: string,\n  ) => Promise<LoginIdentifierType>;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#getLoginTag = options.getLoginTag;\n    this.#getLoginIdentifierType = options.getLoginIdentifierType;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getCustomerServiceToken(this.#config.env, accessToken);\n  }\n\n  async getPartnerIdentityToken(\n    claims: OidcTokenClaims,\n    audience: OidcTokenAudience,\n    entropySourceId?: string,\n  ): Promise<string> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getPartnerIdentityToken(\n      this.#config.env,\n      accessToken,\n      claims,\n      audience,\n    );\n  }\n\n  async pairSocialIdentifier(\n    params: PairSocialIdentifierParams,\n    authAccessToken: string,\n  ): Promise<void> {\n    await pairSocialIdentifier(params, authAccessToken, this.#config.env);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    // Order-insensitive key: the same token set in any order maps to the same\n    // entry. Sort a copy so the request payload itself stays primary-first.\n    const key = JSON.stringify([...accessTokens].sort());\n\n    const cached = this.#ongoingPairings.get(key);\n    if (cached && cached.expiresAt > Date.now()) {\n      return await cached.promise;\n    }\n\n    const promise = pairProfiles(\n      accessTokens,\n      authAccessToken,\n      this.#config.env,\n    );\n    // Store the in-flight promise immediately so concurrent callers coalesce\n    // regardless of how long the request takes.\n    this.#ongoingPairings.set(key, {\n      promise,\n      expiresAt: Number.MAX_SAFE_INTEGER,\n    });\n\n    try {\n      const result = await promise;\n      // Keep the resolved result cached for a short window so sequential\n      // retries with the same payload reuse it.\n      this.#ongoingPairings.set(key, {\n        promise,\n        expiresAt: Date.now() + PAIR_DEDUPE_TTL_MS,\n      });\n      return result;\n    } catch (error) {\n      // Never cache failures: the pairing retry loop must be able to re-hit\n      // the endpoint on the next attempt.\n      this.#ongoingPairings.delete(key);\n      throw error;\n    }\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    // get canonical profile id from server if not present in the cached session\n    if (!auth.profile.canonicalProfileId) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    // Tag only when the wallet supplies getLoginTag. SDK callers keep the\n    // legacy 3-part message rather than guessing `primary`.\n    const tag = await this.#getLoginTag?.(entropySourceId);\n    const identifierType =\n      (await this.#getLoginIdentifierType?.(entropySourceId)) ?? 'SRP';\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n      tag,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n      identifierType,\n    );\n\n    // Resolve original profileId from aliases.\n    // This is done mainly to preserve the original profileId for storage key derivation\n    // until we migrate to the canonical profileId storage system.\n    const canonicalProfileId = authResponse.profile.profileId;\n    const profile = { ...authResponse.profile };\n\n    if (authResponse.profileAliases?.length > 0) {\n      const targetIdentifierId = computeIdentifierId(\n        publicKey,\n        this.#config.env,\n      );\n\n      const matchingAliases = authResponse.profileAliases.filter((alias) =>\n        alias.identifierIds.some((id) => id.id === targetIdentifierId),\n      );\n\n      // Prefer the leaf alias (single identifier) — it's the original profile\n      // created for this SRP. Multi-identifier aliases are former canonicals\n      // that absorbed other profiles; they are correct only when this SRP's\n      // original profile was itself a canonical before being absorbed.\n      const targetAlias =\n        matchingAliases.find((alias) => alias.identifierIds.length === 1) ??\n        matchingAliases[0];\n\n      if (targetAlias) {\n        profile.profileId = targetAlias.aliasProfileId;\n      }\n    }\n\n    profile.canonicalProfileId = canonicalProfileId;\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(entropySourceId);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      return await loginPromise;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(entropySourceId);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n    tag?: SrpLoginTag,\n  ):\n    | `metamask:${string}:${string}`\n    | `metamask:${string}:${string}:${SrpLoginTag}` {\n    if (tag) {\n      return `metamask:${nonce}:${publicKey}:${tag}` as const;\n    }\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}

package/dist/sdk/authentication.d.ts

@@ -1,13 +1,13 @@
-import type { PublicInterface } from '@metamask/utils';
 import type { Eip1193Provider } from 'ethers';
 import { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';
 import { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';
-import type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';
-import type { EnrolledCredential, EnrollmentChallenge, EnrollmentProof, MfaCredentialType, StepUpChallenge, StepUpProof } from './authentication-jwt-bearer/mfa/types.js';
 import type { PairProfilesResponse } from './authentication-jwt-bearer/services.js';
-import type { AccessToken, UserProfile, Pair, PairSocialIdentifierParams, OidcTokenAudience, OidcTokenClaims, UserProfileLineage } from './authentication-jwt-bearer/types.js';
-type SIWEInterface = PublicInterface<SIWEJwtBearerAuth>;
-export type SRPInterface = PublicInterface<SRPJwtBearerAuth>;
+import type { UserProfile, Pair, PairSocialIdentifierParams, OidcTokenAudience, OidcTokenClaims, UserProfileLineage } from './authentication-jwt-bearer/types.js';
+type Compute<T> = T extends infer U ? {
+    [K in keyof U]: U[K];
+} : never;
+type SIWEInterface = Compute<SIWEJwtBearerAuth>;
+export type SRPInterface = Compute<SRPJwtBearerAuth>;
 type SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;
 type SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;
 type JwtBearerAuthParams = SiweParams | SRPParams;
@@ -23,15 +23,6 @@ export declare class JwtBearerAuth implements SIWEInterface, SRPInterface {
     getUserProfileLineage(entropySourceId?: string): Promise<UserProfileLineage>;
     getCustomerServiceToken(entropySourceId?: string): Promise<string>;
     getPartnerIdentityToken(claims: OidcTokenClaims, audience: OidcTokenAudience, entropySourceId?: string): Promise<string>;
-    beginMfaEnrollment(type: MfaCredentialType, options?: {
-        email?: string;
-        entropySourceId?: string;
-    }): Promise<EnrollmentChallenge>;
-    completeMfaEnrollment(flowId: string, proof: EnrollmentProof, entropySourceId?: string): Promise<void>;
-    beginMfaVerification(type: MfaCredentialType, entropySourceId?: string): Promise<StepUpChallenge>;
-    completeMfaVerification(flowId: string, proof: StepUpProof, entropySourceId?: string): Promise<MfaStepUpAssertion>;
-    getMfaCredentials(entropySourceId?: string): Promise<EnrolledCredential[]>;
-    exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken>;
     pairSrpProfiles(accessTokens: string[], authAccessToken: string): Promise<PairProfilesResponse>;
     pairSocialIdentifier(params: PairSocialIdentifierParams, authAccessToken: string): Promise<void>;
     signMessage(message: string, entropySourceId?: string): Promise<string>;

package/dist/sdk/authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAKlD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,IAAI,EACJ,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,sCAAsC,CAAC;AAM9C,KAAK,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAE7D,KAAK,UAAU,GAAG,qBAAqB,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,KAAK,SAAS,GAAG,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,KAAK,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAAC;AAElD,qBAAa,aAAc,YAAW,aAAa,EAAE,YAAY;;IAO/D,YAAY,GAAG,IAAI,EAAE,mBAAmB,EAevC;IAED,iBAAiB,CAAC,QAAQ,EAAE,eAAe,QAG1C;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;IAEK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAGnC;IAEK,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxC;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnE;IAEK,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAEK,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;IAEK,uBAAuB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;IAEK,uBAAuB,CAC3B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAMjB;IAEK,kBAAkB,CACtB,IAAI,EAAE,iBAAiB,EACvB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,mBAAmB,CAAC,CAG9B;IAEK,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,oBAAoB,CACxB,IAAI,EAAE,iBAAiB,EACvB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,eAAe,CAAC,CAG1B;IAEK,uBAAuB,CAC3B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;IAEK,iBAAiB,CACrB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAG/B;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAGrE;IAEK,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAG/B;IAEK,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAEjB;IAEK,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAGP;CA2BF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC"}
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAK3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EACV,WAAW,EACX,IAAI,EACJ,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,sCAAsC,CAAC;AAM9C,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,KAAK,CAAC;AACvE,KAAK,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAChD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAErD,KAAK,UAAU,GAAG,qBAAqB,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,KAAK,SAAS,GAAG,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,KAAK,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAAC;AAElD,qBAAa,aAAc,YAAW,aAAa,EAAE,YAAY;;IAO/D,YAAY,GAAG,IAAI,EAAE,mBAAmB,EAevC;IAED,iBAAiB,CAAC,QAAQ,EAAE,eAAe,QAG1C;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;IAEK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAGnC;IAEK,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxC;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnE;IAEK,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAEK,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;IAEK,uBAAuB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;IAEK,uBAAuB,CAC3B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAMjB;IAEK,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAG/B;IAEK,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAEjB;IAEK,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAGP;CA2BF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC"}

package/dist/sdk/authentication.js

@@ -50,30 +50,6 @@ export class JwtBearerAuth {
     async getPartnerIdentityToken(claims, audience, entropySourceId) {
         return await this.#sdk.getPartnerIdentityToken(claims, audience, entropySourceId);
     }
-    async beginMfaEnrollment(type, options) {
-        this.#assertSRP(this.#type, this.#sdk);
-        return await this.#sdk.beginMfaEnrollment(type, options);
-    }
-    async completeMfaEnrollment(flowId, proof, entropySourceId) {
-        this.#assertSRP(this.#type, this.#sdk);
-        await this.#sdk.completeMfaEnrollment(flowId, proof, entropySourceId);
-    }
-    async beginMfaVerification(type, entropySourceId) {
-        this.#assertSRP(this.#type, this.#sdk);
-        return await this.#sdk.beginMfaVerification(type, entropySourceId);
-    }
-    async completeMfaVerification(flowId, proof, entropySourceId) {
-        this.#assertSRP(this.#type, this.#sdk);
-        return await this.#sdk.completeMfaVerification(flowId, proof, entropySourceId);
-    }
-    async getMfaCredentials(entropySourceId) {
-        this.#assertSRP(this.#type, this.#sdk);
-        return await this.#sdk.getMfaCredentials(entropySourceId);
-    }
-    async exchangeMfaAssertion(assertionJwt) {
-        this.#assertSRP(this.#type, this.#sdk);
-        return await this.#sdk.exchangeMfaAssertion(assertionJwt);
-    }
     async pairSrpProfiles(accessTokens, authAccessToken) {
         this.#assertSRP(this.#type, this.#sdk);
         return await this.#sdk.pairSrpProfiles(accessTokens, authAccessToken);

package/dist/sdk/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAU3E,OAAO,EACL,QAAQ,EACR,eAAe,GAChB,MAAM,yCAAyC,CAAC;AAWjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAWlE,MAAM,OAAO,aAAa;IACf,KAAK,CAAW;IAEhB,IAAI,CAAM;IAEV,IAAI,CAAuC;IAEpD,YAAY,GAAG,IAAyB;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAExB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAuB,EACvB,OAAsD;QAEtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAsB,EACtB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,IAAuB,EACvB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAc,EACd,KAAkB,EAClB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,KAAK,EACL,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO;oBACL,SAAS,EAAE,GAAG;oBACd,WAAW,EAAE,GAAG;oBAChB,qBAAqB,EAAE,CAAC,CAAC,mBAAmB;oBAC5C,eAAe,EAAE,CAAC,CAAC,cAAc;iBAClC,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,0BAA0B;gBAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,IAAI,SAAS,CACjB,mCAAmC,YAAY,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,MAKP;QACC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,WAAW,CACT,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,UAAU,CACR,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,iDAAiD,CAClD,CAAC;IACJ,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC","sourcesContent":["import type { PublicInterface } from '@metamask/utils';\nimport type { Eip1193Provider } from 'ethers';\n\nimport type { Env } from '../shared/env.js';\nimport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nimport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nimport type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';\nimport type {\n  EnrolledCredential,\n  EnrollmentChallenge,\n  EnrollmentProof,\n  MfaCredentialType,\n  StepUpChallenge,\n  StepUpProof,\n} from './authentication-jwt-bearer/mfa/types.js';\nimport {\n  getNonce,\n  pairIdentifiers,\n} from './authentication-jwt-bearer/services.js';\nimport type { PairProfilesResponse } from './authentication-jwt-bearer/services.js';\nimport type {\n  AccessToken,\n  UserProfile,\n  Pair,\n  PairSocialIdentifierParams,\n  OidcTokenAudience,\n  OidcTokenClaims,\n  UserProfileLineage,\n} from './authentication-jwt-bearer/types.js';\nimport { AuthType } from './authentication-jwt-bearer/types.js';\nimport { PairError, UnsupportedAuthTypeError } from './errors.js';\n\n// Computing the Classes, so we only get back the public methods for the interface.\n\ntype SIWEInterface = PublicInterface<SIWEJwtBearerAuth>;\nexport type SRPInterface = PublicInterface<SRPJwtBearerAuth>;\n\ntype SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;\ntype SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;\ntype JwtBearerAuthParams = SiweParams | SRPParams;\n\nexport class JwtBearerAuth implements SIWEInterface, SRPInterface {\n  readonly #type: AuthType;\n\n  readonly #env: Env;\n\n  readonly #sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth;\n\n  constructor(...args: JwtBearerAuthParams) {\n    this.#type = args[0].type;\n    this.#env = args[0].env;\n\n    if (args[0].type === AuthType.SRP) {\n      this.#sdk = new SRPJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    if (args[0].type === AuthType.SiWE) {\n      this.#sdk = new SIWEJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError('unsupported auth type');\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#assertSRP(this.#type, this.#sdk);\n    this.#sdk.setCustomProvider(provider);\n  }\n\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getAccessToken(entropySourceId);\n  }\n\n  async connectSnap(): Promise<string> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return this.#sdk.connectSnap();\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return this.#sdk.isSnapConnected();\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    return await this.#sdk.getUserProfile(entropySourceId);\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    return await this.#sdk.getUserProfileLineage(entropySourceId);\n  }\n\n  async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getCustomerServiceToken(entropySourceId);\n  }\n\n  async getPartnerIdentityToken(\n    claims: OidcTokenClaims,\n    audience: OidcTokenAudience,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#sdk.getPartnerIdentityToken(\n      claims,\n      audience,\n      entropySourceId,\n    );\n  }\n\n  async beginMfaEnrollment(\n    type: MfaCredentialType,\n    options?: { email?: string; entropySourceId?: string },\n  ): Promise<EnrollmentChallenge> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.beginMfaEnrollment(type, options);\n  }\n\n  async completeMfaEnrollment(\n    flowId: string,\n    proof: EnrollmentProof,\n    entropySourceId?: string,\n  ): Promise<void> {\n    this.#assertSRP(this.#type, this.#sdk);\n    await this.#sdk.completeMfaEnrollment(flowId, proof, entropySourceId);\n  }\n\n  async beginMfaVerification(\n    type: MfaCredentialType,\n    entropySourceId?: string,\n  ): Promise<StepUpChallenge> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.beginMfaVerification(type, entropySourceId);\n  }\n\n  async completeMfaVerification(\n    flowId: string,\n    proof: StepUpProof,\n    entropySourceId?: string,\n  ): Promise<MfaStepUpAssertion> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.completeMfaVerification(\n      flowId,\n      proof,\n      entropySourceId,\n    );\n  }\n\n  async getMfaCredentials(\n    entropySourceId?: string,\n  ): Promise<EnrolledCredential[]> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.getMfaCredentials(entropySourceId);\n  }\n\n  async exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.exchangeMfaAssertion(assertionJwt);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.pairSrpProfiles(accessTokens, authAccessToken);\n  }\n\n  async pairSocialIdentifier(\n    params: PairSocialIdentifierParams,\n    authAccessToken: string,\n  ): Promise<void> {\n    this.#assertSRP(this.#type, this.#sdk);\n    await this.#sdk.pairSocialIdentifier(params, authAccessToken);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#sdk.signMessage(message, entropySourceId);\n  }\n\n  async pairIdentifiers(pairing: Pair[]): Promise<void> {\n    const profile = await this.getUserProfile();\n    const n = await getNonce(profile.profileId, this.#env);\n\n    const logins = await Promise.all(\n      pairing.map(async (p) => {\n        try {\n          const raw = `metamask:${n.nonce}:${p.identifier}`;\n          const sig = await p.signMessage(raw);\n          return {\n            signature: sig,\n            raw_message: raw,\n            encrypted_storage_key: p.encryptedStorageKey,\n            identifier_type: p.identifierType,\n          };\n        } catch (e) {\n          /* istanbul ignore next */\n          const errorMessage =\n            e instanceof Error ? e.message : JSON.stringify(e ?? '');\n          throw new PairError(\n            `failed to sign pairing message: ${errorMessage}`,\n          );\n        }\n      }),\n    );\n\n    const accessToken = await this.getAccessToken();\n    await pairIdentifiers(n.nonce, logins, accessToken, this.#env);\n  }\n\n  prepare(signer: {\n    address: string;\n    chainId: number;\n    signMessage: (message: string) => Promise<string>;\n    domain: string;\n  }): void {\n    this.#assertSIWE(this.#type, this.#sdk);\n    this.#sdk.prepare(signer);\n  }\n\n  #assertSIWE(\n    type: AuthType,\n    _sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts _sdk is SIWEJwtBearerAuth {\n    if (type === AuthType.SiWE) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SIWE auth type',\n    );\n  }\n\n  #assertSRP(\n    type: AuthType,\n    _sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts _sdk is SRPJwtBearerAuth {\n    if (type === AuthType.SRP) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SRP auth type',\n    );\n  }\n}\n\nexport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nexport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nexport * from './authentication-jwt-bearer/types.js';\n"]}
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EACL,QAAQ,EACR,eAAe,GAChB,MAAM,yCAAyC,CAAC;AAUjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAYlE,MAAM,OAAO,aAAa;IACf,KAAK,CAAW;IAEhB,IAAI,CAAM;IAEV,IAAI,CAAuC;IAEpD,YAAY,GAAG,IAAyB;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAExB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO;oBACL,SAAS,EAAE,GAAG;oBACd,WAAW,EAAE,GAAG;oBAChB,qBAAqB,EAAE,CAAC,CAAC,mBAAmB;oBAC5C,eAAe,EAAE,CAAC,CAAC,cAAc;iBAClC,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,0BAA0B;gBAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,IAAI,SAAS,CACjB,mCAAmC,YAAY,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,MAKP;QACC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,WAAW,CACT,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,UAAU,CACR,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,iDAAiD,CAClD,CAAC;IACJ,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { Env } from '../shared/env.js';\nimport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nimport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nimport {\n  getNonce,\n  pairIdentifiers,\n} from './authentication-jwt-bearer/services.js';\nimport type { PairProfilesResponse } from './authentication-jwt-bearer/services.js';\nimport type {\n  UserProfile,\n  Pair,\n  PairSocialIdentifierParams,\n  OidcTokenAudience,\n  OidcTokenClaims,\n  UserProfileLineage,\n} from './authentication-jwt-bearer/types.js';\nimport { AuthType } from './authentication-jwt-bearer/types.js';\nimport { PairError, UnsupportedAuthTypeError } from './errors.js';\n\n// Computing the Classes, so we only get back the public methods for the interface.\n\ntype Compute<T> = T extends infer U ? { [K in keyof U]: U[K] } : never;\ntype SIWEInterface = Compute<SIWEJwtBearerAuth>;\nexport type SRPInterface = Compute<SRPJwtBearerAuth>;\n\ntype SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;\ntype SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;\ntype JwtBearerAuthParams = SiweParams | SRPParams;\n\nexport class JwtBearerAuth implements SIWEInterface, SRPInterface {\n  readonly #type: AuthType;\n\n  readonly #env: Env;\n\n  readonly #sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth;\n\n  constructor(...args: JwtBearerAuthParams) {\n    this.#type = args[0].type;\n    this.#env = args[0].env;\n\n    if (args[0].type === AuthType.SRP) {\n      this.#sdk = new SRPJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    if (args[0].type === AuthType.SiWE) {\n      this.#sdk = new SIWEJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError('unsupported auth type');\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#assertSRP(this.#type, this.#sdk);\n    this.#sdk.setCustomProvider(provider);\n  }\n\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getAccessToken(entropySourceId);\n  }\n\n  async connectSnap(): Promise<string> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return this.#sdk.connectSnap();\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return this.#sdk.isSnapConnected();\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    return await this.#sdk.getUserProfile(entropySourceId);\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    return await this.#sdk.getUserProfileLineage(entropySourceId);\n  }\n\n  async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getCustomerServiceToken(entropySourceId);\n  }\n\n  async getPartnerIdentityToken(\n    claims: OidcTokenClaims,\n    audience: OidcTokenAudience,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#sdk.getPartnerIdentityToken(\n      claims,\n      audience,\n      entropySourceId,\n    );\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.pairSrpProfiles(accessTokens, authAccessToken);\n  }\n\n  async pairSocialIdentifier(\n    params: PairSocialIdentifierParams,\n    authAccessToken: string,\n  ): Promise<void> {\n    this.#assertSRP(this.#type, this.#sdk);\n    await this.#sdk.pairSocialIdentifier(params, authAccessToken);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#sdk.signMessage(message, entropySourceId);\n  }\n\n  async pairIdentifiers(pairing: Pair[]): Promise<void> {\n    const profile = await this.getUserProfile();\n    const n = await getNonce(profile.profileId, this.#env);\n\n    const logins = await Promise.all(\n      pairing.map(async (p) => {\n        try {\n          const raw = `metamask:${n.nonce}:${p.identifier}`;\n          const sig = await p.signMessage(raw);\n          return {\n            signature: sig,\n            raw_message: raw,\n            encrypted_storage_key: p.encryptedStorageKey,\n            identifier_type: p.identifierType,\n          };\n        } catch (e) {\n          /* istanbul ignore next */\n          const errorMessage =\n            e instanceof Error ? e.message : JSON.stringify(e ?? '');\n          throw new PairError(\n            `failed to sign pairing message: ${errorMessage}`,\n          );\n        }\n      }),\n    );\n\n    const accessToken = await this.getAccessToken();\n    await pairIdentifiers(n.nonce, logins, accessToken, this.#env);\n  }\n\n  prepare(signer: {\n    address: string;\n    chainId: number;\n    signMessage: (message: string) => Promise<string>;\n    domain: string;\n  }): void {\n    this.#assertSIWE(this.#type, this.#sdk);\n    this.#sdk.prepare(signer);\n  }\n\n  #assertSIWE(\n    type: AuthType,\n    _sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts _sdk is SIWEJwtBearerAuth {\n    if (type === AuthType.SiWE) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SIWE auth type',\n    );\n  }\n\n  #assertSRP(\n    type: AuthType,\n    _sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts _sdk is SRPJwtBearerAuth {\n    if (type === AuthType.SRP) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SRP auth type',\n    );\n  }\n}\n\nexport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nexport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nexport * from './authentication-jwt-bearer/types.js';\n"]}

package/dist/sdk/constants.d.ts

@@ -1,8 +1,6 @@
 export declare const HTTP_STATUS_CODES: {
-    UNAUTHORIZED: number;
     CONFLICT: number;
     UNPROCESSABLE_ENTITY: number;
     TOO_MANY_REQUESTS: number;
-    BAD_GATEWAY: number;
 };
 //# sourceMappingURL=constants.d.ts.map

package/dist/sdk/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;IAC5B,YAAY;IACZ,QAAQ;IACR,oBAAoB;IACpB,iBAAiB;IACjB,WAAW;CACZ,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;IAC5B,QAAQ;IACR,oBAAoB;IACpB,iBAAiB;CAClB,CAAC"}

package/dist/sdk/constants.js

@@ -1,8 +1,6 @@
 export const HTTP_STATUS_CODES = {
-    UNAUTHORIZED: 401,
     CONFLICT: 409,
     UNPROCESSABLE_ENTITY: 422,
     TOO_MANY_REQUESTS: 429,
-    BAD_GATEWAY: 502,
 };
 //# sourceMappingURL=constants.js.map

package/dist/sdk/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY,EAAE,GAAG;IACjB,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,WAAW,EAAE,GAAG;CACjB,CAAC","sourcesContent":["export const HTTP_STATUS_CODES = {\n  UNAUTHORIZED: 401,\n  CONFLICT: 409,\n  UNPROCESSABLE_ENTITY: 422,\n  TOO_MANY_REQUESTS: 429,\n  BAD_GATEWAY: 502,\n};\n"]}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;CACvB,CAAC","sourcesContent":["export const HTTP_STATUS_CODES = {\n  CONFLICT: 409,\n  UNPROCESSABLE_ENTITY: 422,\n  TOO_MANY_REQUESTS: 429,\n};\n"]}

package/dist/sdk/errors.d.ts

@@ -1,93 +1,3 @@
-import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';
-type ExtensibleMfaErrorCode = MfaErrorCode | (string & {});
-/**
- * Base error for MFA operations.
- *
- * The machine-readable code is an enumerable own property so it survives
- * JSON-RPC error serialization.
- */
-export declare class MfaError extends Error {
-    readonly mfaCode: ExtensibleMfaErrorCode;
-    readonly status?: number;
-    readonly retryAfterMs?: number;
-    constructor(mfaCode: ExtensibleMfaErrorCode, message: string, options?: {
-        status?: number;
-        retryAfterMs?: number;
-    });
-}
-export declare class CredentialAlreadyEnrolledError extends MfaError {
-    constructor(code: 'credential_already_enrolled' | 'email_already_enrolled', message: string, status?: number);
-}
-export declare class CredentialNotEnrolledError extends MfaError {
-    constructor(message: string, status?: number);
-}
-/**
- * The begin/complete flow is stale or unknown; the client must restart it.
- */
-export declare class MfaFlowExpiredError extends MfaError {
-    constructor(code: 'flow_expired' | 'invalid_flow', message: string, status?: number);
-}
-/**
- * The profile has no identity-provider record yet. Not a stale flow: the
- * user must enroll a first credential before verifying.
- */
-export declare class MfaIdentityMissingError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class MfaVerificationFailedError extends MfaError {
-    constructor(code: 'invalid_code' | 'invalid_attestation' | 'invalid_assertion', message: string, status?: number);
-}
-export declare class TooManyAttemptsError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class MaxPasskeysReachedError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class MaxIdentifiersReachedError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class OtpResendCooldownError extends MfaError {
-    constructor(message: string, retryAfterMs?: number, status?: number);
-}
-/**
- * A 429 without an MFA-specific code: generic throttling, not an OTP resend
- * cooldown.
- */
-export declare class MfaRateLimitedError extends MfaError {
-    constructor(message: string, retryAfterMs?: number, status?: number);
-}
-/**
- * The identity provider or the network is unreachable. Safe to retry.
- * `status` is only set when the service answered.
- */
-export declare class MfaUnavailableError extends MfaError {
-    constructor(message: string, status?: number);
-}
-export declare class ElevatedTokenInvalidError extends MfaError {
-    constructor(message: string);
-}
-/**
- * Gets an MFA code from direct, serialized, or message-only errors.
- *
- * @param error - Value to inspect.
- * @returns The stable code, if present.
- */
-export declare function getMfaErrorCode(error: unknown): ExtensibleMfaErrorCode | undefined;
-/**
- * Checks whether a value carries an MFA error code.
- *
- * @param error - Value to inspect.
- * @param codes - Optional codes to match.
- * @returns Whether the value is an MFA error with a requested code.
- */
-export declare function isMfaError(error: unknown, ...codes: ExtensibleMfaErrorCode[]): boolean;
-/**
- * Gets a retry delay from direct or serialized MFA errors.
- *
- * @param error - Value to inspect.
- * @returns Retry delay in milliseconds, if present.
- */
-export declare function getMfaRetryAfterMs(error: unknown): number | undefined;
 export declare class NonceRetrievalError extends Error {
     constructor(message: string);
 }
@@ -139,5 +49,4 @@ export declare class RateLimitedError extends Error {
      */
     static isRateLimitError(e: unknown): e is RateLimitedError;
 }
-export {};
 //# sourceMappingURL=errors.d.ts.map

package/dist/sdk/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,EAAE,6BAA6B,GAAG,wBAAwB,EAC9D,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAEA,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}