@metamask-previews/profile-sync-controller 32.1.1-preview-c6cdff1dd → 32.1.1-preview-9d2a9bdf5

package/dist/sdk/authentication-jwt-bearer/mfa/services.js

@@ -1,363 +0,0 @@
-import log from 'loglevel';
-import { getEnvUrls } from '../../../shared/env.js';
-import { HTTP_STATUS_CODES } from '../../constants.js';
-import { CredentialAlreadyEnrolledError, CredentialNotEnrolledError, MaxIdentifiersReachedError, MaxPasskeysReachedError, MfaError, MfaFlowExpiredError, MfaIdentityMissingError, MfaRateLimitedError, MfaUnavailableError, MfaVerificationFailedError, OtpResendCooldownError, TooManyAttemptsError, } from '../../errors.js';
-import { asRecord } from '../../utils/as-record.js';
-import { toErrorMessage } from '../../utils/to-error-message.js';
-import { AuthenticationResponseJSONStruct, MfaCredentialsResponseStruct, MfaEnrollCompleteResponseStruct, MfaEnrollResponseStruct, MfaErrorResponseStruct, MfaVerifyCompleteResponseStruct, MfaVerifyResponseStruct, PasskeyCreateDataStruct, PasskeyRequestDataStruct, RegistrationResponseJSONStruct, assertValidMfaRequest, assertValidMfaResponse, } from './schemas.js';
-export const MFA_ENROLL_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll`;
-export const MFA_ENROLL_COMPLETE_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll/complete`;
-export const MFA_VERIFY_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify`;
-export const MFA_VERIFY_COMPLETE_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;
-export const MFA_CREDENTIALS_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;
-/**
- * Reads a credential's enrollment date. Unlike flow deadlines, this is display
- * metadata, so an unparsable value is dropped instead of rejecting the whole
- * credential list.
- *
- * @param value - The raw `enrolled_at` value, if the server sent one.
- * @returns The epoch milliseconds, or undefined when absent or unparsable.
- */
-function parseEnrolledAt(value) {
-    if (!value) {
-        return undefined;
-    }
-    const enrolledAt = Date.parse(value);
-    if (Number.isNaN(enrolledAt)) {
-        log.warn(`Ignoring unparsable MFA credential enrolled_at: ${value}`);
-        return undefined;
-    }
-    return enrolledAt;
-}
-function parseExpiresAt(value) {
-    const expiresAt = Date.parse(value);
-    if (Number.isNaN(expiresAt)) {
-        throw new MfaError('invalid_response', `Invalid expires_at: ${value}`);
-    }
-    return expiresAt;
-}
-/**
- * Parses passkey creation data embedded in an enrollment response.
- *
- * @param value - JSON-encoded creation options.
- * @returns Validated public-key creation options.
- */
-export function parsePasskeyCreateData(value) {
-    try {
-        const parsed = JSON.parse(value);
-        assertValidMfaResponse(parsed, PasskeyCreateDataStruct);
-        return parsed.publicKey;
-    }
-    catch (error) {
-        if (error instanceof MfaError) {
-            throw error;
-        }
-        const message = toErrorMessage(error);
-        throw new MfaError('invalid_response', message);
-    }
-}
-/**
- * Parses passkey request data embedded in a verification response.
- *
- * @param value - JSON-encoded request options.
- * @returns Validated public-key request options.
- */
-export function parsePasskeyRequestData(value) {
-    try {
-        const parsed = JSON.parse(value);
-        assertValidMfaResponse(parsed, PasskeyRequestDataStruct);
-        return parsed.publicKey;
-    }
-    catch (error) {
-        if (error instanceof MfaError) {
-            throw error;
-        }
-        const message = toErrorMessage(error);
-        throw new MfaError('invalid_response', message);
-    }
-}
-/**
- * Reads a `Retry-After` header as a delay. The human-readable error message is
- * deliberately not parsed: the API documents it as unstable.
- *
- * @param response - The throttled response.
- * @returns The delay in milliseconds, or undefined without a usable header.
- */
-function parseRetryAfter(response) {
-    const header = response.headers.get('Retry-After');
-    if (!header) {
-        return undefined;
-    }
-    const seconds = Number(header);
-    if (Number.isInteger(seconds)) {
-        return Math.max(0, seconds * 1000);
-    }
-    const date = Date.parse(header);
-    return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());
-}
-/**
- * Reads and validates the JSON error body of a failed MFA request.
- *
- * When the body parses as JSON but does not match the documented error
- * shape, a `message` field is salvaged if present so callers still get a
- * useful diagnostic instead of a content-free fallback.
- *
- * @param response - The failed response.
- * @returns The validated error body, a best-effort salvage of it, or
- * undefined when the body could not be parsed as JSON at all.
- */
-async function readErrorBody(response) {
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        return undefined;
-    }
-    try {
-        assertValidMfaResponse(body, MfaErrorResponseStruct);
-        return body;
-    }
-    catch {
-        const message = asRecord(body)?.message;
-        return typeof message === 'string' ? { message } : undefined;
-    }
-}
-async function throwMfaError(response, errorPrefix) {
-    const { status } = response;
-    const body = await readErrorBody(response);
-    const message = `${errorPrefix}: ${body?.message ?? `HTTP ${status}`}`;
-    // Status-only classification first: gateways and load balancers answer
-    // 401/429/502 without the service's JSON body, and the caller still needs
-    // to invalidate its session, honour Retry-After, or back off.
-    if (status === HTTP_STATUS_CODES.UNAUTHORIZED) {
-        throw new MfaError('authentication_required', message, { status });
-    }
-    const code = body?.code;
-    switch (code) {
-        case 'credential_already_enrolled':
-        case 'email_already_enrolled':
-            throw new CredentialAlreadyEnrolledError(code, message, status);
-        case 'credential_not_enrolled':
-            throw new CredentialNotEnrolledError(message, status);
-        case 'flow_expired':
-        case 'invalid_flow':
-            throw new MfaFlowExpiredError(code, message, status);
-        case 'mfa_identity_missing':
-            throw new MfaIdentityMissingError(message, status);
-        case 'invalid_code':
-        case 'invalid_attestation':
-        case 'invalid_assertion':
-            throw new MfaVerificationFailedError(code, message, status);
-        case 'too_many_attempts':
-            throw new TooManyAttemptsError(message, status);
-        case 'max_passkeys_reached':
-            throw new MaxPasskeysReachedError(message, status);
-        case 'max_identifiers_reached':
-            throw new MaxIdentifiersReachedError(message, status);
-        case 'otp_resend_cooldown':
-            throw new OtpResendCooldownError(message, parseRetryAfter(response), status);
-        case 'kratos_unavailable':
-            throw new MfaUnavailableError(message, status);
-        default:
-            break;
-    }
-    if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
-        throw new MfaRateLimitedError(message, parseRetryAfter(response), status);
-    }
-    if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {
-        throw new MfaUnavailableError(message, status);
-    }
-    if (!body) {
-        throw new MfaError('invalid_response', `${errorPrefix}: Unexpected error response (HTTP ${status})`, { status });
-    }
-    throw new MfaError(code ?? 'server_error', message, { status });
-}
-async function requestJson(url, accessToken, init) {
-    let response;
-    try {
-        response = await fetch(url, {
-            method: init?.method ?? 'GET',
-            headers: {
-                Authorization: `Bearer ${accessToken}`,
-                ...(init?.body === undefined
-                    ? {}
-                    : { 'Content-Type': 'application/json' }),
-            },
-            ...(init?.body === undefined ? {} : { body: JSON.stringify(init.body) }),
-        });
-    }
-    catch (error) {
-        const message = toErrorMessage(error);
-        throw new MfaUnavailableError(`MFA request failed: ${message}`);
-    }
-    if (!response.ok) {
-        return await throwMfaError(response, 'MFA request failed');
-    }
-    try {
-        return await response.json();
-    }
-    catch (error) {
-        const message = toErrorMessage(error);
-        throw new MfaError('invalid_response', message, {
-            status: response.status,
-        });
-    }
-}
-/**
- * Begins enrollment of an MFA credential.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @param body - Enrollment request.
- * @returns Validated enrollment flow data.
- */
-export async function mfaEnroll(env, accessToken, body) {
-    const json = await requestJson(MFA_ENROLL_URL(env), accessToken, {
-        method: 'POST',
-        body,
-    });
-    assertValidMfaResponse(json, MfaEnrollResponseStruct);
-    return {
-        flowId: json.flow_id,
-        expiresAt: parseExpiresAt(json.expires_at),
-        ...(json.passkey_create_data
-            ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }
-            : {}),
-    };
-}
-/**
- * Completes enrollment of an MFA credential.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @param params - Flow identifier and enrollment proof.
- */
-export async function mfaEnrollComplete(env, accessToken, params) {
-    let body = {
-        credential_type: params.credential_type,
-        flow_id: params.flow_id,
-        ...(params.otp_code ? { otp_code: params.otp_code } : {}),
-    };
-    if (params.passkey_attestation) {
-        assertValidMfaRequest(params.passkey_attestation, RegistrationResponseJSONStruct);
-        body = {
-            ...body,
-            passkey_attestation: JSON.stringify(params.passkey_attestation),
-        };
-    }
-    const json = await requestJson(MFA_ENROLL_COMPLETE_URL(env), accessToken, {
-        method: 'POST',
-        body,
-    });
-    assertValidMfaResponse(json, MfaEnrollCompleteResponseStruct);
-}
-/**
- * Begins step-up verification with an enrolled credential.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @param body - Verification request.
- * @returns Validated verification flow data.
- */
-export async function mfaVerify(env, accessToken, body) {
-    const json = await requestJson(MFA_VERIFY_URL(env), accessToken, {
-        method: 'POST',
-        body,
-    });
-    assertValidMfaResponse(json, MfaVerifyResponseStruct);
-    return {
-        flowId: json.flow_id,
-        expiresAt: parseExpiresAt(json.expires_at),
-        ...(json.passkey_request_data
-            ? { publicKey: parsePasskeyRequestData(json.passkey_request_data) }
-            : {}),
-    };
-}
-/**
- * Completes step-up verification with an enrolled credential.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @param params - Flow identifier and verification proof.
- * @returns The AAL2 assertion JWT and its lifetime in seconds.
- */
-export async function mfaVerifyComplete(env, accessToken, params) {
-    let body = {
-        credential_type: params.credential_type,
-        flow_id: params.flow_id,
-        ...(params.otp_code ? { otp_code: params.otp_code } : {}),
-    };
-    if (params.passkey_assertion) {
-        assertValidMfaRequest(params.passkey_assertion, AuthenticationResponseJSONStruct);
-        body = {
-            ...body,
-            passkey_assertion: JSON.stringify(params.passkey_assertion),
-        };
-    }
-    const json = await requestJson(MFA_VERIFY_COMPLETE_URL(env), accessToken, {
-        method: 'POST',
-        body,
-    });
-    assertValidMfaResponse(json, MfaVerifyCompleteResponseStruct);
-    return { token: json.token, expiresIn: json.expires_in };
-}
-function isSupportedStatus(status) {
-    return status === 'active' || status === 'pending';
-}
-/**
- * Maps a server credential to its public controller representation.
- *
- * Unknown credential types or statuses are dropped so the server can extend
- * either without invalidating the whole list.
- *
- * @param credential - Validated server credential.
- * @returns A supported credential, or null when it cannot be represented.
- */
-export function toEnrolledCredential(credential) {
-    const { credential_type: type, status } = credential;
-    if (!isSupportedStatus(status)) {
-        log.warn(`Ignoring MFA credential with unsupported status: ${status}`);
-        return null;
-    }
-    const enrolledAt = parseEnrolledAt(credential.enrolled_at);
-    const base = {
-        status,
-        ...(enrolledAt === undefined ? {} : { enrolledAt }),
-    };
-    if (type === 'passkey') {
-        return {
-            type,
-            ...base,
-            ...(credential.passkey?.display_name
-                ? { displayName: credential.passkey.display_name }
-                : {}),
-        };
-    }
-    if (type === 'email_otp' && credential.email?.address !== undefined) {
-        return {
-            type,
-            ...base,
-            email: credential.email.address,
-            // The spec marks `verified` optional; an active row is verified.
-            verified: credential.email.verified ?? status === 'active',
-        };
-    }
-    log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);
-    return null;
-}
-/**
- * Gets the credentials enrolled on the canonical profile.
- *
- * @param env - Authentication environment.
- * @param accessToken - Primary profile access token.
- * @returns Supported enrolled credentials.
- */
-export async function getMfaCredentials(env, accessToken) {
-    const json = await requestJson(MFA_CREDENTIALS_URL(env), accessToken);
-    assertValidMfaResponse(json, MfaCredentialsResponseStruct);
-    return json.credentials
-        .map(toEnrolledCredential)
-        .filter((credential) => Boolean(credential));
-}
-//# sourceMappingURL=services.js.map

package/dist/sdk/authentication-jwt-bearer/mfa/services.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAgBtB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AA2CzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,aAAa,CAC1B,QAAkB;IAElB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,OAAO,IAAI,QAAQ,MAAM,EAAE,EAAE,CAAC;IAEvE,uEAAuE;IACvE,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,KAAK,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,6BAA6B,CAAC;QACnC,KAAK,wBAAwB;YAC3B,MAAM,IAAI,8BAA8B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,cAAc,CAAC;QACpB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB;YACtB,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,mBAAmB;YACtB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,qBAAqB;YACxB,MAAM,IAAI,sBAAsB,CAC9B,OAAO,EACP,eAAe,CAAC,QAAQ,CAAC,EACzB,MAAM,CACP,CAAC;QACJ,KAAK,oBAAoB;YACvB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD;YACE,MAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,GAAG,WAAW,qCAAqC,MAAM,GAAG,EAC5D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,IAA+C;IAE/C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC5C;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,mBAAmB;YAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAkC;IAElC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,qBAAqB,CACnB,MAAM,CAAC,mBAAmB,EAC1B,8BAA8B,CAC/B,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oBAAoB;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAoC;IAEpC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,qBAAqB,CACnB,MAAM,CAAC,iBAAiB,EACxB,gCAAgC,CACjC,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAyB;IAEzB,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oDAAoD,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,MAAM;QACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;IAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY;gBAClC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;YAC/B,iEAAiE;YACjE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,KAAK,QAAQ;SAC3D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW;SACpB,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,CAAC,UAAU,EAAoC,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;AACN,CAAC","sourcesContent":["import type { Json } from '@metamask/utils';\nimport log from 'loglevel';\n\nimport type { Env } from '../../../shared/env.js';\nimport { getEnvUrls } from '../../../shared/env.js';\nimport { HTTP_STATUS_CODES } from '../../constants.js';\nimport {\n  CredentialAlreadyEnrolledError,\n  CredentialNotEnrolledError,\n  MaxIdentifiersReachedError,\n  MaxPasskeysReachedError,\n  MfaError,\n  MfaFlowExpiredError,\n  MfaIdentityMissingError,\n  MfaRateLimitedError,\n  MfaUnavailableError,\n  MfaVerificationFailedError,\n  OtpResendCooldownError,\n  TooManyAttemptsError,\n} from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\nimport { toErrorMessage } from '../../utils/to-error-message.js';\nimport {\n  AuthenticationResponseJSONStruct,\n  MfaCredentialsResponseStruct,\n  MfaEnrollCompleteResponseStruct,\n  MfaEnrollResponseStruct,\n  MfaErrorResponseStruct,\n  MfaVerifyCompleteResponseStruct,\n  MfaVerifyResponseStruct,\n  PasskeyCreateDataStruct,\n  PasskeyRequestDataStruct,\n  RegistrationResponseJSONStruct,\n  assertValidMfaRequest,\n  assertValidMfaResponse,\n} from './schemas.js';\nimport type {\n  AuthenticationResponseJSON,\n  EnrolledCredential,\n  MfaCredential,\n  MfaCredentialStatus,\n  MfaCredentialType,\n  MfaEnrollCompleteRequest,\n  MfaEnrollRequest,\n  MfaVerifyCompleteRequest,\n  MfaVerifyRequest,\n  PublicKeyCredentialCreationOptionsJSON as PasskeyCreationOptions,\n  PublicKeyCredentialRequestOptionsJSON as PasskeyRequestOptions,\n  RegistrationResponseJSON,\n} from './types.js';\n\nexport const MFA_ENROLL_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll`;\n\nexport const MFA_ENROLL_COMPLETE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll/complete`;\n\nexport const MFA_VERIFY_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify`;\n\nexport const MFA_VERIFY_COMPLETE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;\n\nexport const MFA_CREDENTIALS_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;\n\ntype EnrollmentServiceResult = {\n  flowId: string;\n  expiresAt: number;\n  publicKey?: PasskeyCreationOptions;\n};\n\ntype VerificationServiceResult = {\n  flowId: string;\n  expiresAt: number;\n  publicKey?: PasskeyRequestOptions;\n};\n\nexport type MfaStepUpAssertion = {\n  /** AAL2 assertion JWT to exchange at Hydra for an elevated access token. */\n  token: string;\n  /** Assertion lifetime in seconds. */\n  expiresIn: number;\n};\n\ntype EnrollmentCompletionParams = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_attestation?: RegistrationResponseJSON;\n};\n\ntype VerificationCompletionParams = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_assertion?: AuthenticationResponseJSON;\n};\n\n/**\n * Reads a credential's enrollment date. Unlike flow deadlines, this is display\n * metadata, so an unparsable value is dropped instead of rejecting the whole\n * credential list.\n *\n * @param value - The raw `enrolled_at` value, if the server sent one.\n * @returns The epoch milliseconds, or undefined when absent or unparsable.\n */\nfunction parseEnrolledAt(value: string | undefined): number | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const enrolledAt = Date.parse(value);\n  if (Number.isNaN(enrolledAt)) {\n    log.warn(`Ignoring unparsable MFA credential enrolled_at: ${value}`);\n    return undefined;\n  }\n  return enrolledAt;\n}\n\nfunction parseExpiresAt(value: string): number {\n  const expiresAt = Date.parse(value);\n  if (Number.isNaN(expiresAt)) {\n    throw new MfaError('invalid_response', `Invalid expires_at: ${value}`);\n  }\n  return expiresAt;\n}\n\n/**\n * Parses passkey creation data embedded in an enrollment response.\n *\n * @param value - JSON-encoded creation options.\n * @returns Validated public-key creation options.\n */\nexport function parsePasskeyCreateData(value: string): PasskeyCreationOptions {\n  try {\n    const parsed: unknown = JSON.parse(value);\n    assertValidMfaResponse(parsed, PasskeyCreateDataStruct);\n    return parsed.publicKey;\n  } catch (error) {\n    if (error instanceof MfaError) {\n      throw error;\n    }\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message);\n  }\n}\n\n/**\n * Parses passkey request data embedded in a verification response.\n *\n * @param value - JSON-encoded request options.\n * @returns Validated public-key request options.\n */\nexport function parsePasskeyRequestData(value: string): PasskeyRequestOptions {\n  try {\n    const parsed: unknown = JSON.parse(value);\n    assertValidMfaResponse(parsed, PasskeyRequestDataStruct);\n    return parsed.publicKey;\n  } catch (error) {\n    if (error instanceof MfaError) {\n      throw error;\n    }\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message);\n  }\n}\n\n/**\n * Reads a `Retry-After` header as a delay. The human-readable error message is\n * deliberately not parsed: the API documents it as unstable.\n *\n * @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined without a usable header.\n */\nfunction parseRetryAfter(response: Response): number | undefined {\n  const header = response.headers.get('Retry-After');\n  if (!header) {\n    return undefined;\n  }\n  const seconds = Number(header);\n  if (Number.isInteger(seconds)) {\n    return Math.max(0, seconds * 1000);\n  }\n  const date = Date.parse(header);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\n/**\n * Reads and validates the JSON error body of a failed MFA request.\n *\n * When the body parses as JSON but does not match the documented error\n * shape, a `message` field is salvaged if present so callers still get a\n * useful diagnostic instead of a content-free fallback.\n *\n * @param response - The failed response.\n * @returns The validated error body, a best-effort salvage of it, or\n * undefined when the body could not be parsed as JSON at all.\n */\nasync function readErrorBody(\n  response: Response,\n): Promise<{ code?: string; message: string } | undefined> {\n  let body: unknown;\n  try {\n    body = await response.json();\n  } catch {\n    return undefined;\n  }\n\n  try {\n    assertValidMfaResponse(body, MfaErrorResponseStruct);\n    return body;\n  } catch {\n    const message = asRecord(body)?.message;\n    return typeof message === 'string' ? { message } : undefined;\n  }\n}\n\nasync function throwMfaError(\n  response: Response,\n  errorPrefix: string,\n): Promise<never> {\n  const { status } = response;\n  const body = await readErrorBody(response);\n  const message = `${errorPrefix}: ${body?.message ?? `HTTP ${status}`}`;\n\n  // Status-only classification first: gateways and load balancers answer\n  // 401/429/502 without the service's JSON body, and the caller still needs\n  // to invalidate its session, honour Retry-After, or back off.\n  if (status === HTTP_STATUS_CODES.UNAUTHORIZED) {\n    throw new MfaError('authentication_required', message, { status });\n  }\n\n  const code = body?.code;\n  switch (code) {\n    case 'credential_already_enrolled':\n    case 'email_already_enrolled':\n      throw new CredentialAlreadyEnrolledError(code, message, status);\n    case 'credential_not_enrolled':\n      throw new CredentialNotEnrolledError(message, status);\n    case 'flow_expired':\n    case 'invalid_flow':\n      throw new MfaFlowExpiredError(code, message, status);\n    case 'mfa_identity_missing':\n      throw new MfaIdentityMissingError(message, status);\n    case 'invalid_code':\n    case 'invalid_attestation':\n    case 'invalid_assertion':\n      throw new MfaVerificationFailedError(code, message, status);\n    case 'too_many_attempts':\n      throw new TooManyAttemptsError(message, status);\n    case 'max_passkeys_reached':\n      throw new MaxPasskeysReachedError(message, status);\n    case 'max_identifiers_reached':\n      throw new MaxIdentifiersReachedError(message, status);\n    case 'otp_resend_cooldown':\n      throw new OtpResendCooldownError(\n        message,\n        parseRetryAfter(response),\n        status,\n      );\n    case 'kratos_unavailable':\n      throw new MfaUnavailableError(message, status);\n    default:\n      break;\n  }\n\n  if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n    throw new MfaRateLimitedError(message, parseRetryAfter(response), status);\n  }\n  if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {\n    throw new MfaUnavailableError(message, status);\n  }\n  if (!body) {\n    throw new MfaError(\n      'invalid_response',\n      `${errorPrefix}: Unexpected error response (HTTP ${status})`,\n      { status },\n    );\n  }\n  throw new MfaError(code ?? 'server_error', message, { status });\n}\n\nasync function requestJson(\n  url: string,\n  accessToken: string,\n  init?: { method?: 'GET' | 'POST'; body?: Json },\n): Promise<Json> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      method: init?.method ?? 'GET',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        ...(init?.body === undefined\n          ? {}\n          : { 'Content-Type': 'application/json' }),\n      },\n      ...(init?.body === undefined ? {} : { body: JSON.stringify(init.body) }),\n    });\n  } catch (error) {\n    const message = toErrorMessage(error);\n    throw new MfaUnavailableError(`MFA request failed: ${message}`);\n  }\n\n  if (!response.ok) {\n    return await throwMfaError(response, 'MFA request failed');\n  }\n\n  try {\n    return await response.json();\n  } catch (error) {\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message, {\n      status: response.status,\n    });\n  }\n}\n\n/**\n * Begins enrollment of an MFA credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Enrollment request.\n * @returns Validated enrollment flow data.\n */\nexport async function mfaEnroll(\n  env: Env,\n  accessToken: string,\n  body: MfaEnrollRequest,\n): Promise<EnrollmentServiceResult> {\n  const json = await requestJson(MFA_ENROLL_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaEnrollResponseStruct);\n\n  return {\n    flowId: json.flow_id,\n    expiresAt: parseExpiresAt(json.expires_at),\n    ...(json.passkey_create_data\n      ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }\n      : {}),\n  };\n}\n\n/**\n * Completes enrollment of an MFA credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and enrollment proof.\n */\nexport async function mfaEnrollComplete(\n  env: Env,\n  accessToken: string,\n  params: EnrollmentCompletionParams,\n): Promise<void> {\n  let body: MfaEnrollCompleteRequest = {\n    credential_type: params.credential_type,\n    flow_id: params.flow_id,\n    ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n  };\n  if (params.passkey_attestation) {\n    assertValidMfaRequest(\n      params.passkey_attestation,\n      RegistrationResponseJSONStruct,\n    );\n    body = {\n      ...body,\n      passkey_attestation: JSON.stringify(params.passkey_attestation),\n    };\n  }\n\n  const json = await requestJson(MFA_ENROLL_COMPLETE_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaEnrollCompleteResponseStruct);\n}\n\n/**\n * Begins step-up verification with an enrolled credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Verification request.\n * @returns Validated verification flow data.\n */\nexport async function mfaVerify(\n  env: Env,\n  accessToken: string,\n  body: MfaVerifyRequest,\n): Promise<VerificationServiceResult> {\n  const json = await requestJson(MFA_VERIFY_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaVerifyResponseStruct);\n\n  return {\n    flowId: json.flow_id,\n    expiresAt: parseExpiresAt(json.expires_at),\n    ...(json.passkey_request_data\n      ? { publicKey: parsePasskeyRequestData(json.passkey_request_data) }\n      : {}),\n  };\n}\n\n/**\n * Completes step-up verification with an enrolled credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and verification proof.\n * @returns The AAL2 assertion JWT and its lifetime in seconds.\n */\nexport async function mfaVerifyComplete(\n  env: Env,\n  accessToken: string,\n  params: VerificationCompletionParams,\n): Promise<MfaStepUpAssertion> {\n  let body: MfaVerifyCompleteRequest = {\n    credential_type: params.credential_type,\n    flow_id: params.flow_id,\n    ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n  };\n  if (params.passkey_assertion) {\n    assertValidMfaRequest(\n      params.passkey_assertion,\n      AuthenticationResponseJSONStruct,\n    );\n    body = {\n      ...body,\n      passkey_assertion: JSON.stringify(params.passkey_assertion),\n    };\n  }\n\n  const json = await requestJson(MFA_VERIFY_COMPLETE_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaVerifyCompleteResponseStruct);\n  return { token: json.token, expiresIn: json.expires_in };\n}\n\nfunction isSupportedStatus(status: string): status is MfaCredentialStatus {\n  return status === 'active' || status === 'pending';\n}\n\n/**\n * Maps a server credential to its public controller representation.\n *\n * Unknown credential types or statuses are dropped so the server can extend\n * either without invalidating the whole list.\n *\n * @param credential - Validated server credential.\n * @returns A supported credential, or null when it cannot be represented.\n */\nexport function toEnrolledCredential(\n  credential: MfaCredential,\n): EnrolledCredential | null {\n  const { credential_type: type, status } = credential;\n  if (!isSupportedStatus(status)) {\n    log.warn(`Ignoring MFA credential with unsupported status: ${status}`);\n    return null;\n  }\n\n  const enrolledAt = parseEnrolledAt(credential.enrolled_at);\n  const base = {\n    status,\n    ...(enrolledAt === undefined ? {} : { enrolledAt }),\n  };\n\n  if (type === 'passkey') {\n    return {\n      type,\n      ...base,\n      ...(credential.passkey?.display_name\n        ? { displayName: credential.passkey.display_name }\n        : {}),\n    };\n  }\n\n  if (type === 'email_otp' && credential.email?.address !== undefined) {\n    return {\n      type,\n      ...base,\n      email: credential.email.address,\n      // The spec marks `verified` optional; an active row is verified.\n      verified: credential.email.verified ?? status === 'active',\n    };\n  }\n\n  log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);\n  return null;\n}\n\n/**\n * Gets the credentials enrolled on the canonical profile.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @returns Supported enrolled credentials.\n */\nexport async function getMfaCredentials(\n  env: Env,\n  accessToken: string,\n): Promise<EnrolledCredential[]> {\n  const json = await requestJson(MFA_CREDENTIALS_URL(env), accessToken);\n  assertValidMfaResponse(json, MfaCredentialsResponseStruct);\n  return json.credentials\n    .map(toEnrolledCredential)\n    .filter((credential): credential is EnrolledCredential =>\n      Boolean(credential),\n    );\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts

@@ -1,125 +0,0 @@
-import type { Infer } from '@metamask/superstruct';
-import type { AuthenticationResponseJSONStruct, MfaCredentialStruct, MfaCredentialsResponseStruct, MfaEmailDetailStruct, MfaEnrollCompleteResponseStruct, MfaEnrollResponseStruct, MfaPasskeyDetailStruct, MfaVerifyCompleteResponseStruct, MfaVerifyResponseStruct, PublicKeyCredentialCreationOptionsJSONStruct, PublicKeyCredentialRequestOptionsJSONStruct, RegistrationResponseJSONStruct } from './schemas.js';
-import { MFA_CREDENTIAL_TYPES } from './schemas.js';
-export { MFA_CREDENTIAL_TYPES };
-export type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];
-export type MfaCredentialStatus = 'active' | 'pending';
-export type PublicKeyCredentialCreationOptionsJSON = Infer<typeof PublicKeyCredentialCreationOptionsJSONStruct>;
-export type PublicKeyCredentialRequestOptionsJSON = Infer<typeof PublicKeyCredentialRequestOptionsJSONStruct>;
-export type RegistrationResponseJSON = Infer<typeof RegistrationResponseJSONStruct>;
-export type AuthenticationResponseJSON = Infer<typeof AuthenticationResponseJSONStruct>;
-export type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;
-export type MfaEnrollCompleteResponse = Infer<typeof MfaEnrollCompleteResponseStruct>;
-export type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;
-export type MfaVerifyCompleteResponse = Infer<typeof MfaVerifyCompleteResponseStruct>;
-export type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;
-export type MfaCredential = Infer<typeof MfaCredentialStruct>;
-export type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;
-export type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;
-export type MfaEnrollRequest = {
-    credential_type: MfaCredentialType;
-    identifier?: string;
-};
-export type MfaEnrollCompleteRequest = {
-    credential_type: MfaCredentialType;
-    flow_id: string;
-    otp_code?: string;
-    passkey_attestation?: string;
-};
-export type MfaVerifyRequest = {
-    credential_type: MfaCredentialType;
-};
-export type MfaVerifyCompleteRequest = {
-    credential_type: MfaCredentialType;
-    flow_id: string;
-    passkey_assertion?: string;
-    otp_code?: string;
-};
-export type EnrolledCredential = {
-    type: 'passkey';
-    status: MfaCredentialStatus;
-    enrolledAt?: number;
-    displayName?: string;
-} | {
-    type: 'email_otp';
-    status: MfaCredentialStatus;
-    enrolledAt?: number;
-    email: string;
-    verified: boolean;
-};
-/**
- * Caller-supplied context attached to MFA trace spans. `operation` names the
- * client flow that needs the credential (for example `money.signTransaction`).
- */
-export type TokenReason = {
-    operation: string;
-};
-export type EnrollmentChallenge = {
-    type: 'passkey';
-    flowId: string;
-    expiresAt: number;
-    publicKey: PublicKeyCredentialCreationOptionsJSON;
-} | {
-    type: 'email_otp';
-    flowId: string;
-    expiresAt: number;
-};
-export type EnrollmentProof = {
-    type: 'passkey';
-    attestation: RegistrationResponseJSON;
-} | {
-    type: 'email_otp';
-    code: string;
-};
-export type StepUpChallenge = {
-    type: 'passkey';
-    flowId: string;
-    expiresAt: number;
-    publicKey: PublicKeyCredentialRequestOptionsJSON;
-} | {
-    type: 'email_otp';
-    flowId: string;
-    expiresAt: number;
-};
-export type StepUpProof = {
-    type: 'passkey';
-    assertion: AuthenticationResponseJSON;
-} | {
-    type: 'email_otp';
-    code: string;
-};
-export type ElevatedProfileToken = {
-    accessToken: string;
-    expiresIn: number;
-    obtainedAt: number;
-    claims: {
-        sub: string;
-        aal: 2;
-        amr: MfaCredentialType[];
-        exp: number;
-    };
-};
-export type BeginEnrollmentRequest = {
-    type: MfaCredentialType;
-    email?: string;
-    reason: TokenReason;
-};
-export type CompleteEnrollmentRequest = {
-    flowId: string;
-    proof: EnrollmentProof;
-    reason: TokenReason;
-};
-export type BeginStepUpRequest = {
-    type: MfaCredentialType;
-    reason: TokenReason;
-};
-export type CompleteStepUpRequest = {
-    flowId: string;
-    proof: StepUpProof;
-    reason: TokenReason;
-};
-export type GetElevatedTokenRequest = {
-    maxSessionAgeMs?: number;
-};
-export type MfaErrorCode = 'max_passkeys_reached' | 'max_identifiers_reached' | 'email_already_enrolled' | 'credential_already_enrolled' | 'credential_not_enrolled' | 'mfa_identity_missing' | 'otp_resend_cooldown' | 'rate_limited' | 'kratos_unavailable' | 'flow_expired' | 'invalid_flow' | 'invalid_attestation' | 'invalid_code' | 'invalid_assertion' | 'too_many_attempts' | 'elevated_token_invalid' | 'authentication_required' | 'server_error' | 'invalid_response' | 'invalid_request';
-//# sourceMappingURL=types.d.ts.map

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,sCAAsC,GAAG,KAAK,CACxD,OAAO,4CAA4C,CACpD,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,KAAK,CACvD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAC1C,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,sCAAsC,CAAC;CACnD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qCAAqC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,WAAW,GACnB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,CAAC,CAAC;QACP,GAAG,EAAE,iBAAiB,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,YAAY,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,yBAAyB,GACzB,sBAAsB,GACtB,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,yBAAyB,GACzB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC"}

package/dist/sdk/authentication-jwt-bearer/mfa/types.js

@@ -1,3 +0,0 @@
-import { MFA_CREDENTIAL_TYPES } from './schemas.js';
-export { MFA_CREDENTIAL_TYPES };
-//# sourceMappingURL=types.js.map

package/dist/sdk/authentication-jwt-bearer/mfa/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { Infer } from '@metamask/superstruct';\n\nimport type {\n  AuthenticationResponseJSONStruct,\n  MfaCredentialStruct,\n  MfaCredentialsResponseStruct,\n  MfaEmailDetailStruct,\n  MfaEnrollCompleteResponseStruct,\n  MfaEnrollResponseStruct,\n  MfaPasskeyDetailStruct,\n  MfaVerifyCompleteResponseStruct,\n  MfaVerifyResponseStruct,\n  PublicKeyCredentialCreationOptionsJSONStruct,\n  PublicKeyCredentialRequestOptionsJSONStruct,\n  RegistrationResponseJSONStruct,\n} from './schemas.js';\nimport { MFA_CREDENTIAL_TYPES } from './schemas.js';\n\nexport { MFA_CREDENTIAL_TYPES };\n\nexport type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];\n\nexport type MfaCredentialStatus = 'active' | 'pending';\n\nexport type PublicKeyCredentialCreationOptionsJSON = Infer<\n  typeof PublicKeyCredentialCreationOptionsJSONStruct\n>;\n\nexport type PublicKeyCredentialRequestOptionsJSON = Infer<\n  typeof PublicKeyCredentialRequestOptionsJSONStruct\n>;\n\nexport type RegistrationResponseJSON = Infer<\n  typeof RegistrationResponseJSONStruct\n>;\n\nexport type AuthenticationResponseJSON = Infer<\n  typeof AuthenticationResponseJSONStruct\n>;\n\nexport type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;\n\nexport type MfaEnrollCompleteResponse = Infer<\n  typeof MfaEnrollCompleteResponseStruct\n>;\n\nexport type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;\n\nexport type MfaVerifyCompleteResponse = Infer<\n  typeof MfaVerifyCompleteResponseStruct\n>;\n\nexport type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;\n\nexport type MfaCredential = Infer<typeof MfaCredentialStruct>;\n\nexport type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;\n\nexport type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;\n\nexport type MfaEnrollRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  identifier?: string;\n};\n\nexport type MfaEnrollCompleteRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_attestation?: string;\n};\n\nexport type MfaVerifyRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n};\n\nexport type MfaVerifyCompleteRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_assertion?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n};\n\nexport type EnrolledCredential =\n  | {\n      type: 'passkey';\n      status: MfaCredentialStatus;\n      enrolledAt?: number;\n      displayName?: string;\n    }\n  | {\n      type: 'email_otp';\n      status: MfaCredentialStatus;\n      enrolledAt?: number;\n      email: string;\n      verified: boolean;\n    };\n\n/**\n * Caller-supplied context attached to MFA trace spans. `operation` names the\n * client flow that needs the credential (for example `money.signTransaction`).\n */\nexport type TokenReason = {\n  operation: string;\n};\n\nexport type EnrollmentChallenge =\n  | {\n      type: 'passkey';\n      flowId: string;\n      expiresAt: number;\n      publicKey: PublicKeyCredentialCreationOptionsJSON;\n    }\n  | {\n      type: 'email_otp';\n      flowId: string;\n      expiresAt: number;\n    };\n\nexport type EnrollmentProof =\n  | {\n      type: 'passkey';\n      attestation: RegistrationResponseJSON;\n    }\n  | {\n      type: 'email_otp';\n      code: string;\n    };\n\nexport type StepUpChallenge =\n  | {\n      type: 'passkey';\n      flowId: string;\n      expiresAt: number;\n      publicKey: PublicKeyCredentialRequestOptionsJSON;\n    }\n  | {\n      type: 'email_otp';\n      flowId: string;\n      expiresAt: number;\n    };\n\nexport type StepUpProof =\n  | {\n      type: 'passkey';\n      assertion: AuthenticationResponseJSON;\n    }\n  | {\n      type: 'email_otp';\n      code: string;\n    };\n\nexport type ElevatedProfileToken = {\n  accessToken: string;\n  expiresIn: number;\n  obtainedAt: number;\n  claims: {\n    sub: string;\n    aal: 2;\n    amr: MfaCredentialType[];\n    exp: number;\n  };\n};\n\nexport type BeginEnrollmentRequest = {\n  type: MfaCredentialType;\n  email?: string;\n  reason: TokenReason;\n};\n\nexport type CompleteEnrollmentRequest = {\n  flowId: string;\n  proof: EnrollmentProof;\n  reason: TokenReason;\n};\n\nexport type BeginStepUpRequest = {\n  type: MfaCredentialType;\n  reason: TokenReason;\n};\n\nexport type CompleteStepUpRequest = {\n  flowId: string;\n  proof: StepUpProof;\n  reason: TokenReason;\n};\n\nexport type GetElevatedTokenRequest = {\n  maxSessionAgeMs?: number;\n};\n\nexport type MfaErrorCode =\n  | 'max_passkeys_reached'\n  | 'max_identifiers_reached'\n  | 'email_already_enrolled'\n  | 'credential_already_enrolled'\n  | 'credential_not_enrolled'\n  | 'mfa_identity_missing'\n  | 'otp_resend_cooldown'\n  | 'rate_limited'\n  | 'kratos_unavailable'\n  | 'flow_expired'\n  | 'invalid_flow'\n  | 'invalid_attestation'\n  | 'invalid_code'\n  | 'invalid_assertion'\n  | 'too_many_attempts'\n  | 'elevated_token_invalid'\n  | 'authentication_required'\n  | 'server_error'\n  | 'invalid_response'\n  | 'invalid_request';\n"]}

package/dist/sdk/utils/as-record.d.ts

@@ -1,10 +0,0 @@
-/**
- * Narrows an unknown value to a plain record, for reading optional fields off
- * untrusted data (parsed JSON, decoded JWT payloads) before it has been
- * validated against a struct.
- *
- * @param value - The value to narrow.
- * @returns The value as a record, or undefined if it is not an object.
- */
-export declare function asRecord(value: unknown): Record<string, unknown> | undefined;
-//# sourceMappingURL=as-record.d.ts.map

package/dist/sdk/utils/as-record.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"as-record.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/as-record.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAI5E"}

package/dist/sdk/utils/as-record.js

@@ -1,14 +0,0 @@
-/**
- * Narrows an unknown value to a plain record, for reading optional fields off
- * untrusted data (parsed JSON, decoded JWT payloads) before it has been
- * validated against a struct.
- *
- * @param value - The value to narrow.
- * @returns The value as a record, or undefined if it is not an object.
- */
-export function asRecord(value) {
-    return typeof value === 'object' && value !== null
-        ? value
-        : undefined;
-}
-//# sourceMappingURL=as-record.js.map

package/dist/sdk/utils/as-record.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"as-record.js","sourceRoot":"","sources":["../../../src/sdk/utils/as-record.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Narrows an unknown value to a plain record, for reading optional fields off\n * untrusted data (parsed JSON, decoded JWT payloads) before it has been\n * validated against a struct.\n *\n * @param value - The value to narrow.\n * @returns The value as a record, or undefined if it is not an object.\n */\nexport function asRecord(value: unknown): Record<string, unknown> | undefined {\n  return typeof value === 'object' && value !== null\n    ? (value as Record<string, unknown>)\n    : undefined;\n}\n"]}

package/dist/sdk/utils/jwt.d.ts

@@ -1,13 +0,0 @@
-/**
- * Decodes a JWT payload without verifying its signature.
- *
- * Use this only for inspecting claims on a token received from a trusted
- * exchange. Signature verification remains the authorization server's
- * responsibility.
- *
- * @param token - JWT to decode.
- * @returns The parsed payload.
- * @throws If the token or payload is malformed.
- */
-export declare function decodeJwtPayload(token: string): unknown;
-//# sourceMappingURL=jwt.d.ts.map

package/dist/sdk/utils/jwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASvD"}

package/dist/sdk/utils/jwt.js

@@ -1,21 +0,0 @@
-/**
- * Decodes a JWT payload without verifying its signature.
- *
- * Use this only for inspecting claims on a token received from a trusted
- * exchange. Signature verification remains the authorization server's
- * responsibility.
- *
- * @param token - JWT to decode.
- * @returns The parsed payload.
- * @throws If the token or payload is malformed.
- */
-export function decodeJwtPayload(token) {
-    const parts = token.split('.');
-    if (parts.length !== 3 || !parts[1]) {
-        throw new Error('Invalid JWT');
-    }
-    const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');
-    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
-    return JSON.parse(atob(padded));
-}
-//# sourceMappingURL=jwt.js.map

package/dist/sdk/utils/jwt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/sdk/utils/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAClC,CAAC","sourcesContent":["/**\n * Decodes a JWT payload without verifying its signature.\n *\n * Use this only for inspecting claims on a token received from a trusted\n * exchange. Signature verification remains the authorization server's\n * responsibility.\n *\n * @param token - JWT to decode.\n * @returns The parsed payload.\n * @throws If the token or payload is malformed.\n */\nexport function decodeJwtPayload(token: string): unknown {\n  const parts = token.split('.');\n  if (parts.length !== 3 || !parts[1]) {\n    throw new Error('Invalid JWT');\n  }\n\n  const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');\n  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n  return JSON.parse(atob(padded));\n}\n"]}