npm - @metamask-previews/profile-sync-controller - Versions diffs - 32.1.1-preview-d3f9964be → 32.2.0-preview-aecbce4ff - Mend

@metamask-previews/profile-sync-controller 32.1.1-preview-d3f9964be → 32.2.0-preview-aecbce4ff

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (38) hide show

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,KAAK,EACL,OAAO,EACP,OAAO,EACP,GAAG,EACH,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,EACP,MAAM,EACN,SAAS,EACT,IAAI,EACJ,MAAM,EACN,WAAW,EACX,IAAI,EACJ,KAAK,GACN,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAU,CAAC;AAEtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnE,MAAM,0BAA0B,GAAG,IAAI,CAAC;IACtC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,EAAE,EAAE,MAAM,EAAE;IACZ,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;IAC/D,EAAE,EAAE,IAAI,CAAC;QACP,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAM,EAAE;KACf,CAAC;IACF,IAAI,EAAE,IAAI,CAAC;QACT,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CACrB,IAAI,CAAC;QACH,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;QAC3B,GAAG,EAAE,OAAO,EAAE;KACf,CAAC,CACH;IACD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/D,sBAAsB,EAAE,QAAQ,CAC9B,IAAI,CAAC;QACH,uBAAuB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACrC,CAAC,CACH;IACD,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,4CAA4C;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3C,SAAS,EAAE,2CAA2C;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CACrD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CACvD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,SAAS,EAAE,MAAM,EAAE;QACnB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KACzC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAE1B,UAAU,EAAE,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,mBAAmB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACtC,sEAAsE;IACtE,wEAAwE;IAExE,eAAe,EAAE,MAAM,EAAE;IACzB,MAAM,EAAE,MAAM,EAAE;IAEhB,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IACzC,KAAK,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAChD,MAAM,CAAC;IACL,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,iBAAiB;CAC1B,CAAC,EACF,wBAAwB,EACxB,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,4CAA4C,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpE,MAAM,qBAAqB,GAAG,KAAK,CAAC;IAClC,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,WAAW,EAAE,8BAA8B;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;IAC7C,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,SAAS,EAAE,gCAAgC;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;IAClD,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAChD,IAAI,CAAC;IACH,GAAG,EAAE,MAAM,EAAE;IACb,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,OAAO,EAAE;IACd,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;CACtE,CAAC,CACH,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,KAAK;SACT,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IAMvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAY;QACrB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;QAC5B,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;KAC7B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KACxD,CAAC;AACJ,CAAC","sourcesContent":["import {\n array,\n assert,\n boolean,\n enums,\n integer,\n literal,\n min,\n nullable,\n object,\n optional,\n pattern,\n refine,\n sensitive,\n size,\n string,\n StructError,\n type,\n union,\n} from '@metamask/superstruct';\nimport type { Struct } from '@metamask/superstruct';\n\nimport { ElevatedTokenInvalidError, MfaError } from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\n\nexport const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp'] as const;\n\nexport const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);\n\nconst CredentialDescriptorStruct = type({\n type: literal('public-key'),\n id: string(),\n transports: optional(array(string())),\n});\n\nconst ExtensionsStruct = type({});\n\nexport const PublicKeyCredentialCreationOptionsJSONStruct = type({\n rp: type({\n id: string(),\n name: string(),\n }),\n user: type({\n id: sensitive(string()),\n name: sensitive(string()),\n displayName: sensitive(string()),\n }),\n challenge: sensitive(string()),\n pubKeyCredParams: array(\n type({\n type: literal('public-key'),\n alg: integer(),\n }),\n ),\n excludeCredentials: optional(array(CredentialDescriptorStruct)),\n authenticatorSelection: optional(\n type({\n authenticatorAttachment: optional(string()),\n residentKey: optional(string()),\n requireResidentKey: optional(boolean()),\n userVerification: optional(string()),\n }),\n ),\n attestation: optional(string()),\n timeout: optional(integer()),\n extensions: optional(ExtensionsStruct),\n});\n\nexport const PublicKeyCredentialRequestOptionsJSONStruct = type({\n challenge: sensitive(string()),\n rpId: optional(string()),\n allowCredentials: optional(array(CredentialDescriptorStruct)),\n userVerification: optional(string()),\n timeout: optional(integer()),\n extensions: optional(ExtensionsStruct),\n});\n\nexport const PasskeyCreateDataStruct = type({\n publicKey: PublicKeyCredentialCreationOptionsJSONStruct,\n});\n\nexport const PasskeyRequestDataStruct = type({\n publicKey: PublicKeyCredentialRequestOptionsJSONStruct,\n});\n\nexport const RegistrationResponseJSONStruct = sensitive(\n type({\n id: string(),\n rawId: string(),\n type: literal('public-key'),\n response: type({\n attestationObject: string(),\n clientDataJSON: string(),\n transports: optional(array(string())),\n publicKeyAlgorithm: optional(integer()),\n publicKey: optional(string()),\n authenticatorData: optional(string()),\n }),\n authenticatorAttachment: optional(nullable(string())),\n clientExtensionResults: optional(ExtensionsStruct),\n }),\n);\n\nexport const AuthenticationResponseJSONStruct = sensitive(\n type({\n id: string(),\n rawId: string(),\n type: literal('public-key'),\n response: type({\n authenticatorData: string(),\n clientDataJSON: string(),\n signature: string(),\n userHandle: optional(nullable(string())),\n }),\n authenticatorAttachment: optional(nullable(string())),\n clientExtensionResults: optional(ExtensionsStruct),\n }),\n);\n\n/*\n Only the assertion JWT is consumed from the verification response; the\n * profile fields on the wire duplicate what the login flow already resolved.\n /\nexport const MfaVerifyCompleteResponseStruct = type({\n token: sensitive(string()),\n\n expires_in: integer(),\n});\n\nexport const MfaEnrollResponseStruct = type({\n flow_id: string(),\n\n expires_at: string(),\n\n passkey_create_data: optional(sensitive(string())),\n});\n\nexport const MfaEnrollCompleteResponseStruct = type({\n status: literal('enrolled'),\n});\n\nexport const MfaVerifyResponseStruct = type({\n flow_id: string(),\n\n expires_at: string(),\n\n passkey_request_data: optional(sensitive(string())),\n});\n\nexport const MfaPasskeyDetailStruct = type({\n display_name: optional(sensitive(string())),\n\n added_at: optional(string()),\n});\n\nexport const MfaEmailDetailStruct = type({\n address: optional(sensitive(string())),\n verified: optional(boolean()),\n});\n\nexport const MfaCredentialStruct = type({\n // Intentionally accepts strings so future server credential types and\n // statuses can be ignored without making the complete response invalid.\n\n credential_type: string(),\n status: string(),\n\n enrolled_at: optional(string()),\n passkey: optional(MfaPasskeyDetailStruct),\n email: optional(MfaEmailDetailStruct),\n});\n\nexport const MfaCredentialsResponseStruct = type({\n credentials: array(MfaCredentialStruct),\n});\n\nexport const MfaErrorResponseStruct = type({\n code: optional(string()),\n message: string(),\n});\n\nexport const TokenReasonStruct = object({\n operation: pattern(string(), /^[A-Za-z0-9_.:-]{1,64}$/u),\n});\n\nexport const BeginEnrollmentRequestStruct = refine(\n object({\n type: MfaCredentialTypeStruct,\n email: optional(sensitive(size(string(), 3, 254))),\n reason: TokenReasonStruct,\n }),\n 'BeginEnrollmentRequest',\n (value) => {\n if (value.type === 'email_otp' && value.email === undefined) {\n return 'email is required for email_otp enrollment';\n }\n if (value.type === 'passkey' && value.email !== undefined) {\n return 'email is not accepted for passkey enrollment';\n }\n return true;\n },\n);\n\nconst EmailOtpCodeStruct = sensitive(pattern(string(), /^\\d{6}$/u));\n\nconst EnrollmentProofStruct = union([\n object({\n type: literal('passkey'),\n attestation: RegistrationResponseJSONStruct,\n }),\n object({\n type: literal('email_otp'),\n code: EmailOtpCodeStruct,\n }),\n]);\n\nexport const CompleteEnrollmentRequestStruct = object({\n flowId: string(),\n proof: EnrollmentProofStruct,\n reason: TokenReasonStruct,\n});\n\nexport const BeginStepUpRequestStruct = object({\n type: MfaCredentialTypeStruct,\n reason: TokenReasonStruct,\n});\n\nconst StepUpProofStruct = union([\n object({\n type: literal('passkey'),\n assertion: AuthenticationResponseJSONStruct,\n }),\n object({\n type: literal('email_otp'),\n code: EmailOtpCodeStruct,\n }),\n]);\n\nexport const CompleteStepUpRequestStruct = object({\n flowId: string(),\n proof: StepUpProofStruct,\n reason: TokenReasonStruct,\n});\n\nexport const GetElevatedTokenRequestStruct = object({\n maxSessionAgeMs: optional(min(integer(), 0)),\n});\n\nexport const ElevatedTokenClaimsStruct = sensitive(\n type({\n sub: string(),\n aal: literal(2),\n exp: integer(),\n amr: union([MfaCredentialTypeStruct, array(MfaCredentialTypeStruct)]),\n }),\n);\n\nfunction formatStructError(error: StructError): string {\n return error\n .failures()\n .map(({ path, message }) => `[${path.join('.')}] ${message}`)\n .join(', ');\n}\n\n/\n Validates data received from the authentication service.\n \n @param value - Untrusted response data.\n * @param struct - Expected response structure.\n * @throws MfaError if the response does not match the structure.\n /\nexport function assertValidMfaResponse<Value>(\n value: unknown,\n struct: Struct<Value>,\n): asserts value is Value {\n try {\n assert(value, struct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new MfaError('invalid_response', formatStructError(error));\n }\n / istanbul ignore next /\n throw error;\n }\n}\n\n/\n Validates data received from an untyped controller boundary.\n \n @param value - Untrusted request data.\n * @param struct - Expected request structure.\n * @throws MfaError if the request does not match the structure.\n /\nexport function assertValidMfaRequest<Value>(\n value: unknown,\n struct: Struct<Value>,\n): asserts value is Value {\n try {\n assert(value, struct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new MfaError('invalid_request', formatStructError(error));\n }\n / istanbul ignore next /\n throw error;\n }\n}\n\n/\n Validates and normalizes claims from an elevated access token.\n \n Hydra places hook-supplied claims under `ext` unless they are promoted to\n * the top level, so `aal` and `amr` are read from either location.\n \n @param payload - Decoded JWT payload.\n * @returns Validated claims with `amr` represented as an array.\n * @throws ElevatedTokenInvalidError if claims are missing or invalid.\n /\nexport function parseElevatedTokenClaims(payload: unknown): {\n sub: string;\n aal: 2;\n exp: number;\n amr: ('passkey' \| 'email_otp')[];\n} {\n const record = asRecord(payload);\n const ext = asRecord(record?.ext);\n const value: unknown = {\n sub: record?.sub,\n exp: record?.exp,\n aal: record?.aal ?? ext?.aal,\n amr: record?.amr ?? ext?.amr,\n };\n\n try {\n assert(value, ElevatedTokenClaimsStruct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new ElevatedTokenInvalidError(formatStructError(error));\n }\n / istanbul ignore next */\n throw error;\n }\n\n return {\n sub: value.sub,\n aal: value.aal,\n exp: value.exp,\n amr: Array.isArray(value.amr) ? value.amr : [value.amr],\n };\n}\n"]}
1	+ {"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,KAAK,EACL,OAAO,EACP,OAAO,EACP,GAAG,EACH,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,EACP,MAAM,EACN,SAAS,EACT,IAAI,EACJ,MAAM,EACN,WAAW,EACX,IAAI,EACJ,KAAK,GACN,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAU,CAAC;AAEtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnE,MAAM,0BAA0B,GAAG,IAAI,CAAC;IACtC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,EAAE,EAAE,MAAM,EAAE;IACZ,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;IAC/D,EAAE,EAAE,IAAI,CAAC;QACP,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAM,EAAE;KACf,CAAC;IACF,IAAI,EAAE,IAAI,CAAC;QACT,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CACrB,IAAI,CAAC;QACH,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;QAC3B,GAAG,EAAE,OAAO,EAAE;KACf,CAAC,CACH;IACD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/D,sBAAsB,EAAE,QAAQ,CAC9B,IAAI,CAAC;QACH,uBAAuB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACrC,CAAC,CACH;IACD,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,4CAA4C;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3C,SAAS,EAAE,2CAA2C;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CACrD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CACvD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,SAAS,EAAE,MAAM,EAAE;QACnB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KACzC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAE1B,UAAU,EAAE,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,mBAAmB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACtC,sEAAsE;IACtE,wEAAwE;IAExE,eAAe,EAAE,MAAM,EAAE;IACzB,MAAM,EAAE,MAAM,EAAE;IAEhB,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IACzC,KAAK,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE;IACjB,mBAAmB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAChD,MAAM,CAAC;IACL,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,iBAAiB;CAC1B,CAAC,EACF,wBAAwB,EACxB,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,4CAA4C,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpE,MAAM,qBAAqB,GAAG,KAAK,CAAC;IAClC,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,WAAW,EAAE,8BAA8B;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;IAC7C,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,SAAS,EAAE,gCAAgC;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;IAClD,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAChD,IAAI,CAAC;IACH,GAAG,EAAE,MAAM,EAAE;IACb,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,OAAO,EAAE;IACd,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;CACtE,CAAC,CACH,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,KAAK;SACT,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IAMvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAY;QACrB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;QAC5B,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;KAC7B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KACxD,CAAC;AACJ,CAAC","sourcesContent":["import {\n array,\n assert,\n boolean,\n enums,\n integer,\n literal,\n min,\n nullable,\n object,\n optional,\n pattern,\n refine,\n sensitive,\n size,\n string,\n StructError,\n type,\n union,\n} from '@metamask/superstruct';\nimport type { Struct } from '@metamask/superstruct';\n\nimport { ElevatedTokenInvalidError, MfaError } from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\n\nexport const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp'] as const;\n\nexport const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);\n\nconst CredentialDescriptorStruct = type({\n type: literal('public-key'),\n id: string(),\n transports: optional(array(string())),\n});\n\nconst ExtensionsStruct = type({});\n\nexport const PublicKeyCredentialCreationOptionsJSONStruct = type({\n rp: type({\n id: string(),\n name: string(),\n }),\n user: type({\n id: sensitive(string()),\n name: sensitive(string()),\n displayName: sensitive(string()),\n }),\n challenge: sensitive(string()),\n pubKeyCredParams: array(\n type({\n type: literal('public-key'),\n alg: integer(),\n }),\n ),\n excludeCredentials: optional(array(CredentialDescriptorStruct)),\n authenticatorSelection: optional(\n type({\n authenticatorAttachment: optional(string()),\n residentKey: optional(string()),\n requireResidentKey: optional(boolean()),\n userVerification: optional(string()),\n }),\n ),\n attestation: optional(string()),\n timeout: optional(integer()),\n extensions: optional(ExtensionsStruct),\n});\n\nexport const PublicKeyCredentialRequestOptionsJSONStruct = type({\n challenge: sensitive(string()),\n rpId: optional(string()),\n allowCredentials: optional(array(CredentialDescriptorStruct)),\n userVerification: optional(string()),\n timeout: optional(integer()),\n extensions: optional(ExtensionsStruct),\n});\n\nexport const PasskeyCreateDataStruct = type({\n publicKey: PublicKeyCredentialCreationOptionsJSONStruct,\n});\n\nexport const PasskeyRequestDataStruct = type({\n publicKey: PublicKeyCredentialRequestOptionsJSONStruct,\n});\n\nexport const RegistrationResponseJSONStruct = sensitive(\n type({\n id: string(),\n rawId: string(),\n type: literal('public-key'),\n response: type({\n attestationObject: string(),\n clientDataJSON: string(),\n transports: optional(array(string())),\n publicKeyAlgorithm: optional(integer()),\n publicKey: optional(string()),\n authenticatorData: optional(string()),\n }),\n authenticatorAttachment: optional(nullable(string())),\n clientExtensionResults: optional(ExtensionsStruct),\n }),\n);\n\nexport const AuthenticationResponseJSONStruct = sensitive(\n type({\n id: string(),\n rawId: string(),\n type: literal('public-key'),\n response: type({\n authenticatorData: string(),\n clientDataJSON: string(),\n signature: string(),\n userHandle: optional(nullable(string())),\n }),\n authenticatorAttachment: optional(nullable(string())),\n clientExtensionResults: optional(ExtensionsStruct),\n }),\n);\n\n/*\n Only the assertion JWT is consumed from the verification response; the\n * profile fields on the wire duplicate what the login flow already resolved.\n /\nexport const MfaVerifyCompleteResponseStruct = type({\n token: sensitive(string()),\n\n expires_in: integer(),\n});\n\nexport const MfaEnrollResponseStruct = type({\n flow_id: string(),\n\n expires_at: string(),\n\n passkey_create_data: optional(sensitive(string())),\n});\n\nexport const MfaEnrollCompleteResponseStruct = type({\n status: literal('enrolled'),\n});\n\nexport const MfaVerifyResponseStruct = type({\n flow_id: string(),\n\n expires_at: string(),\n\n passkey_request_data: optional(sensitive(string())),\n});\n\nexport const MfaPasskeyDetailStruct = type({\n display_name: optional(sensitive(string())),\n\n added_at: optional(string()),\n});\n\nexport const MfaEmailDetailStruct = type({\n address: optional(sensitive(string())),\n verified: optional(boolean()),\n});\n\nexport const MfaCredentialStruct = type({\n // Intentionally accepts strings so future server credential types and\n // statuses can be ignored without making the complete response invalid.\n\n credential_type: string(),\n status: string(),\n\n enrolled_at: optional(string()),\n passkey: optional(MfaPasskeyDetailStruct),\n email: optional(MfaEmailDetailStruct),\n});\n\nexport const MfaCredentialsResponseStruct = type({\n credentials: array(MfaCredentialStruct),\n});\n\nexport const MfaErrorResponseStruct = type({\n code: optional(string()),\n message: string(),\n retry_after_seconds: optional(integer()),\n});\n\nexport const TokenReasonStruct = object({\n operation: pattern(string(), /^[A-Za-z0-9_.:-]{1,64}$/u),\n});\n\nexport const BeginEnrollmentRequestStruct = refine(\n object({\n type: MfaCredentialTypeStruct,\n email: optional(sensitive(size(string(), 3, 254))),\n reason: TokenReasonStruct,\n }),\n 'BeginEnrollmentRequest',\n (value) => {\n if (value.type === 'email_otp' && value.email === undefined) {\n return 'email is required for email_otp enrollment';\n }\n if (value.type === 'passkey' && value.email !== undefined) {\n return 'email is not accepted for passkey enrollment';\n }\n return true;\n },\n);\n\nconst EmailOtpCodeStruct = sensitive(pattern(string(), /^\\d{6}$/u));\n\nconst EnrollmentProofStruct = union([\n object({\n type: literal('passkey'),\n attestation: RegistrationResponseJSONStruct,\n }),\n object({\n type: literal('email_otp'),\n code: EmailOtpCodeStruct,\n }),\n]);\n\nexport const CompleteEnrollmentRequestStruct = object({\n flowId: string(),\n proof: EnrollmentProofStruct,\n reason: TokenReasonStruct,\n});\n\nexport const BeginStepUpRequestStruct = object({\n type: MfaCredentialTypeStruct,\n reason: TokenReasonStruct,\n});\n\nconst StepUpProofStruct = union([\n object({\n type: literal('passkey'),\n assertion: AuthenticationResponseJSONStruct,\n }),\n object({\n type: literal('email_otp'),\n code: EmailOtpCodeStruct,\n }),\n]);\n\nexport const CompleteStepUpRequestStruct = object({\n flowId: string(),\n proof: StepUpProofStruct,\n reason: TokenReasonStruct,\n});\n\nexport const GetElevatedTokenRequestStruct = object({\n maxSessionAgeMs: optional(min(integer(), 0)),\n});\n\nexport const ElevatedTokenClaimsStruct = sensitive(\n type({\n sub: string(),\n aal: literal(2),\n exp: integer(),\n amr: union([MfaCredentialTypeStruct, array(MfaCredentialTypeStruct)]),\n }),\n);\n\nfunction formatStructError(error: StructError): string {\n return error\n .failures()\n .map(({ path, message }) => `[${path.join('.')}] ${message}`)\n .join(', ');\n}\n\n/\n Validates data received from the authentication service.\n \n @param value - Untrusted response data.\n * @param struct - Expected response structure.\n * @throws MfaError if the response does not match the structure.\n /\nexport function assertValidMfaResponse<Value>(\n value: unknown,\n struct: Struct<Value>,\n): asserts value is Value {\n try {\n assert(value, struct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new MfaError('invalid_response', formatStructError(error));\n }\n / istanbul ignore next /\n throw error;\n }\n}\n\n/\n Validates data received from an untyped controller boundary.\n \n @param value - Untrusted request data.\n * @param struct - Expected request structure.\n * @throws MfaError if the request does not match the structure.\n /\nexport function assertValidMfaRequest<Value>(\n value: unknown,\n struct: Struct<Value>,\n): asserts value is Value {\n try {\n assert(value, struct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new MfaError('invalid_request', formatStructError(error));\n }\n / istanbul ignore next /\n throw error;\n }\n}\n\n/\n Validates and normalizes claims from an elevated access token.\n \n Hydra places hook-supplied claims under `ext` unless they are promoted to\n * the top level, so `aal` and `amr` are read from either location.\n \n @param payload - Decoded JWT payload.\n * @returns Validated claims with `amr` represented as an array.\n * @throws ElevatedTokenInvalidError if claims are missing or invalid.\n /\nexport function parseElevatedTokenClaims(payload: unknown): {\n sub: string;\n aal: 2;\n exp: number;\n amr: ('passkey' \| 'email_otp')[];\n} {\n const record = asRecord(payload);\n const ext = asRecord(record?.ext);\n const value: unknown = {\n sub: record?.sub,\n exp: record?.exp,\n aal: record?.aal ?? ext?.aal,\n amr: record?.amr ?? ext?.amr,\n };\n\n try {\n assert(value, ElevatedTokenClaimsStruct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new ElevatedTokenInvalidError(formatStructError(error));\n }\n / istanbul ignore next */\n throw error;\n }\n\n return {\n sub: value.sub,\n aal: value.aal,\n exp: value.exp,\n amr: Array.isArray(value.amr) ? value.amr : [value.amr],\n };\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/services.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;~~AAiClD~~,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAEjB,gBAAgB,EAEhB,gBAAgB,EAChB,sCAAsC,IAAI,sBAAsB,EAChE,qCAAqC,IAAI,qBAAqB,EAC9D,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,KAAK,uBAAuB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,qBAAqB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAEhC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;CAChD,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAElC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;AA8BF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAY5E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAY5E;~~AAyJD~~;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,uBAAuB,CAAC,CAclC;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAMD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,GACxB,kBAAkB,GAAG,IAAI,CAmC3B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B"}
1	+ {"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAkClD,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAEjB,gBAAgB,EAEhB,gBAAgB,EAChB,sCAAsC,IAAI,sBAAsB,EAChE,qCAAqC,IAAI,qBAAqB,EAC9D,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,KAAK,uBAAuB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,qBAAqB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAEhC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;CAChD,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAElC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;AA8BF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAY5E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAY5E;AAwLD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,uBAAuB,CAAC,CAclC;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAMD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,GACxB,kBAAkB,GAAG,IAAI,CAmC3B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B"}

package/dist/sdk/authentication-jwt-bearer/mfa/services.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import log from 'loglevel';
 import { getEnvUrls } from '../../../shared/env.js';
 import { HTTP_STATUS_CODES } from '../../constants.js';
-import { CredentialAlreadyEnrolledError, CredentialNotEnrolledError, MaxIdentifiersReachedError, MaxPasskeysReachedError, MfaError, MfaFlowExpiredError, MfaIdentityMissingError, MfaRateLimitedError, MfaUnavailableError, MfaVerificationFailedError, OtpResendCooldownError, TooManyAttemptsError, } from '../../errors.js';
+import { CredentialAlreadyEnrolledError, CredentialNotEnrolledError, MaxIdentifiersReachedError, MaxPasskeysReachedError, MfaError, MfaFlowExpiredError, MfaIdentityMissingError, MfaRateLimitedError, MfaUnavailableError, MfaVerificationFailedError, OtpResendCooldownError, StepUpRequiredError, TooManyAttemptsError, } from '../../errors.js';
 import { asRecord } from '../../utils/as-record.js';
 import { toErrorMessage } from '../../utils/to-error-message.js';
 import { AuthenticationResponseJSONStruct, MfaCredentialsResponseStruct, MfaEnrollCompleteResponseStruct, MfaEnrollResponseStruct, MfaErrorResponseStruct, MfaVerifyCompleteResponseStruct, MfaVerifyResponseStruct, PasskeyCreateDataStruct, PasskeyRequestDataStruct, RegistrationResponseJSONStruct, assertValidMfaRequest, assertValidMfaResponse, } from './schemas.js';
@@ -96,16 +96,18 @@ function parseRetryAfter(response) {
     return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());
 }
 /**
- * Reads and validates the JSON error body of a failed MFA request.
+ * Prefers the documented `retry_after_seconds` error field over the
+ * `Retry-After` header.
  *
- * When the body parses as JSON but does not match the documented error
- * shape, a `message` field is salvaged if present so callers still get a
- * useful diagnostic instead of a content-free fallback.
- *
- * @param response - The failed response.
- * @returns The validated error body, a best-effort salvage of it, or
- * undefined when the body could not be parsed as JSON at all.
+ * @param body - The parsed error body, if any.
+ * @param response - The throttled response.
+ * @returns The delay in milliseconds, or undefined when neither is usable.
  */
+function resolveRetryAfterMs(body, response) {
+    return body?.retry_after_seconds === undefined
+        ? parseRetryAfter(response)
+        : body.retry_after_seconds * 1000;
+}
 async function readErrorBody(response) {
     let body;
     try {
@@ -137,9 +139,12 @@ async function throwMfaError(response, errorPrefix) {
     switch (code) {
         case 'credential_already_enrolled':
         case 'email_already_enrolled':
+        case 'email_socially_verified':
             throw new CredentialAlreadyEnrolledError(code, message, status);
         case 'credential_not_enrolled':
             throw new CredentialNotEnrolledError(message, status);
+        case 'aal2_required':
+            throw new StepUpRequiredError(message, status);
         case 'flow_expired':
         case 'invalid_flow':
             throw new MfaFlowExpiredError(code, message, status);
@@ -156,14 +161,14 @@ async function throwMfaError(response, errorPrefix) {
         case 'max_identifiers_reached':
             throw new MaxIdentifiersReachedError(message, status);
         case 'otp_resend_cooldown':
-            throw new OtpResendCooldownError(message, parseRetryAfter(response), status);
+            throw new OtpResendCooldownError(message, resolveRetryAfterMs(body, response), status);
         case 'kratos_unavailable':
             throw new MfaUnavailableError(message, status);
         default:
             break;
     }
     if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
-        throw new MfaRateLimitedError(message, parseRetryAfter(response), status);
+        throw new MfaRateLimitedError(message, resolveRetryAfterMs(body, response), status);
     }
     if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {
         throw new MfaUnavailableError(message, status);

package/dist/sdk/authentication-jwt-bearer/mfa/services.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAgBtB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AA2CzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,aAAa,CAC1B,QAAkB;IAElB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,OAAO,IAAI,QAAQ,MAAM,EAAE,EAAE,CAAC;IAEvE,uEAAuE;IACvE,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,KAAK,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,6BAA6B,CAAC;QACnC,KAAK,wBAAwB;YAC3B,MAAM,IAAI,8BAA8B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,cAAc,CAAC;QACpB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB;YACtB,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,mBAAmB;YACtB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,qBAAqB;YACxB,MAAM,IAAI,sBAAsB,CAC9B,OAAO,EACP,eAAe,CAAC,QAAQ,CAAC,EACzB,MAAM,CACP,CAAC;QACJ,KAAK,oBAAoB;YACvB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD;YACE,MAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,GAAG,WAAW,qCAAqC,MAAM,GAAG,EAC5D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,IAA+C;IAE/C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC5C;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,mBAAmB;YAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAkC;IAElC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,qBAAqB,CACnB,MAAM,CAAC,mBAAmB,EAC1B,8BAA8B,CAC/B,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oBAAoB;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAoC;IAEpC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,qBAAqB,CACnB,MAAM,CAAC,iBAAiB,EACxB,gCAAgC,CACjC,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAyB;IAEzB,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oDAAoD,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,MAAM;QACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;IAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY;gBAClC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;YAC/B,iEAAiE;YACjE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,KAAK,QAAQ;SAC3D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW;SACpB,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,CAAC,UAAU,EAAoC,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;AACN,CAAC","sourcesContent":["import type { Json } from '@metamask/utils';\nimport log from 'loglevel';\n\nimport type { Env } from '../../../shared/env.js';\nimport { getEnvUrls } from '../../../shared/env.js';\nimport { HTTP_STATUS_CODES } from '../../constants.js';\nimport {\n CredentialAlreadyEnrolledError,\n CredentialNotEnrolledError,\n MaxIdentifiersReachedError,\n MaxPasskeysReachedError,\n MfaError,\n MfaFlowExpiredError,\n MfaIdentityMissingError,\n MfaRateLimitedError,\n MfaUnavailableError,\n MfaVerificationFailedError,\n OtpResendCooldownError,\n TooManyAttemptsError,\n} from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\nimport { toErrorMessage } from '../../utils/to-error-message.js';\nimport {\n AuthenticationResponseJSONStruct,\n MfaCredentialsResponseStruct,\n MfaEnrollCompleteResponseStruct,\n MfaEnrollResponseStruct,\n MfaErrorResponseStruct,\n MfaVerifyCompleteResponseStruct,\n MfaVerifyResponseStruct,\n PasskeyCreateDataStruct,\n PasskeyRequestDataStruct,\n RegistrationResponseJSONStruct,\n assertValidMfaRequest,\n assertValidMfaResponse,\n} from './schemas.js';\nimport type {\n AuthenticationResponseJSON,\n EnrolledCredential,\n MfaCredential,\n MfaCredentialStatus,\n MfaCredentialType,\n MfaEnrollCompleteRequest,\n MfaEnrollRequest,\n MfaVerifyCompleteRequest,\n MfaVerifyRequest,\n PublicKeyCredentialCreationOptionsJSON as PasskeyCreationOptions,\n PublicKeyCredentialRequestOptionsJSON as PasskeyRequestOptions,\n RegistrationResponseJSON,\n} from './types.js';\n\nexport const MFA_ENROLL_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll`;\n\nexport const MFA_ENROLL_COMPLETE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll/complete`;\n\nexport const MFA_VERIFY_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify`;\n\nexport const MFA_VERIFY_COMPLETE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;\n\nexport const MFA_CREDENTIALS_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;\n\ntype EnrollmentServiceResult = {\n flowId: string;\n expiresAt: number;\n publicKey?: PasskeyCreationOptions;\n};\n\ntype VerificationServiceResult = {\n flowId: string;\n expiresAt: number;\n publicKey?: PasskeyRequestOptions;\n};\n\nexport type MfaStepUpAssertion = {\n /** AAL2 assertion JWT to exchange at Hydra for an elevated access token. /\n token: string;\n /* Assertion lifetime in seconds. /\n expiresIn: number;\n};\n\ntype EnrollmentCompletionParams = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_attestation?: RegistrationResponseJSON;\n};\n\ntype VerificationCompletionParams = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_assertion?: AuthenticationResponseJSON;\n};\n\n/\n Reads a credential's enrollment date. Unlike flow deadlines, this is display\n * metadata, so an unparsable value is dropped instead of rejecting the whole\n * credential list.\n \n @param value - The raw `enrolled_at` value, if the server sent one.\n * @returns The epoch milliseconds, or undefined when absent or unparsable.\n /\nfunction parseEnrolledAt(value: string \| undefined): number \| undefined {\n if (!value) {\n return undefined;\n }\n const enrolledAt = Date.parse(value);\n if (Number.isNaN(enrolledAt)) {\n log.warn(`Ignoring unparsable MFA credential enrolled_at: ${value}`);\n return undefined;\n }\n return enrolledAt;\n}\n\nfunction parseExpiresAt(value: string): number {\n const expiresAt = Date.parse(value);\n if (Number.isNaN(expiresAt)) {\n throw new MfaError('invalid_response', `Invalid expires_at: ${value}`);\n }\n return expiresAt;\n}\n\n/\n Parses passkey creation data embedded in an enrollment response.\n \n @param value - JSON-encoded creation options.\n * @returns Validated public-key creation options.\n /\nexport function parsePasskeyCreateData(value: string): PasskeyCreationOptions {\n try {\n const parsed: unknown = JSON.parse(value);\n assertValidMfaResponse(parsed, PasskeyCreateDataStruct);\n return parsed.publicKey;\n } catch (error) {\n if (error instanceof MfaError) {\n throw error;\n }\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message);\n }\n}\n\n/\n Parses passkey request data embedded in a verification response.\n \n @param value - JSON-encoded request options.\n * @returns Validated public-key request options.\n /\nexport function parsePasskeyRequestData(value: string): PasskeyRequestOptions {\n try {\n const parsed: unknown = JSON.parse(value);\n assertValidMfaResponse(parsed, PasskeyRequestDataStruct);\n return parsed.publicKey;\n } catch (error) {\n if (error instanceof MfaError) {\n throw error;\n }\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message);\n }\n}\n\n/\n Reads a `Retry-After` header as a delay. The human-readable error message is\n * deliberately not parsed: the API documents it as unstable.\n \n @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined without a usable header.\n /\nfunction parseRetryAfter(response: Response): number \| undefined {\n const header = response.headers.get('Retry-After');\n if (!header) {\n return undefined;\n }\n const seconds = Number(header);\n if (Number.isInteger(seconds)) {\n return Math.max(0, seconds 1000);\n }\n const date = Date.parse(header);\n return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\n/*\n Reads and validates the JSON error body of a failed MFA request.\n \n When the body parses as JSON but does not match the documented error\n * shape, a `message` field is salvaged if present so callers still get a\n * useful diagnostic instead of a content-free fallback.\n \n @param response - The failed response.\n * @returns The validated error body, a best-effort salvage of it, or\n * undefined when the body could not be parsed as JSON at all.\n /\nasync function readErrorBody(\n response: Response,\n): Promise<{ code?: string; message: string } \| undefined> {\n let body: unknown;\n try {\n body = await response.json();\n } catch {\n return undefined;\n }\n\n try {\n assertValidMfaResponse(body, MfaErrorResponseStruct);\n return body;\n } catch {\n const message = asRecord(body)?.message;\n return typeof message === 'string' ? { message } : undefined;\n }\n}\n\nasync function throwMfaError(\n response: Response,\n errorPrefix: string,\n): Promise<never> {\n const { status } = response;\n const body = await readErrorBody(response);\n const message = `${errorPrefix}: ${body?.message ?? `HTTP ${status}`}`;\n\n // Status-only classification first: gateways and load balancers answer\n // 401/429/502 without the service's JSON body, and the caller still needs\n // to invalidate its session, honour Retry-After, or back off.\n if (status === HTTP_STATUS_CODES.UNAUTHORIZED) {\n throw new MfaError('authentication_required', message, { status });\n }\n\n const code = body?.code;\n switch (code) {\n case 'credential_already_enrolled':\n case 'email_already_enrolled':\n throw new CredentialAlreadyEnrolledError(code, message, status);\n case 'credential_not_enrolled':\n throw new CredentialNotEnrolledError(message, status);\n case 'flow_expired':\n case 'invalid_flow':\n throw new MfaFlowExpiredError(code, message, status);\n case 'mfa_identity_missing':\n throw new MfaIdentityMissingError(message, status);\n case 'invalid_code':\n case 'invalid_attestation':\n case 'invalid_assertion':\n throw new MfaVerificationFailedError(code, message, status);\n case 'too_many_attempts':\n throw new TooManyAttemptsError(message, status);\n case 'max_passkeys_reached':\n throw new MaxPasskeysReachedError(message, status);\n case 'max_identifiers_reached':\n throw new MaxIdentifiersReachedError(message, status);\n case 'otp_resend_cooldown':\n throw new OtpResendCooldownError(\n message,\n parseRetryAfter(response),\n status,\n );\n case 'kratos_unavailable':\n throw new MfaUnavailableError(message, status);\n default:\n break;\n }\n\n if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n throw new MfaRateLimitedError(message, parseRetryAfter(response), status);\n }\n if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {\n throw new MfaUnavailableError(message, status);\n }\n if (!body) {\n throw new MfaError(\n 'invalid_response',\n `${errorPrefix}: Unexpected error response (HTTP ${status})`,\n { status },\n );\n }\n throw new MfaError(code ?? 'server_error', message, { status });\n}\n\nasync function requestJson(\n url: string,\n accessToken: string,\n init?: { method?: 'GET' \| 'POST'; body?: Json },\n): Promise<Json> {\n let response: Response;\n try {\n response = await fetch(url, {\n method: init?.method ?? 'GET',\n headers: {\n Authorization: `Bearer ${accessToken}`,\n ...(init?.body === undefined\n ? {}\n : { 'Content-Type': 'application/json' }),\n },\n ...(init?.body === undefined ? {} : { body: JSON.stringify(init.body) }),\n });\n } catch (error) {\n const message = toErrorMessage(error);\n throw new MfaUnavailableError(`MFA request failed: ${message}`);\n }\n\n if (!response.ok) {\n return await throwMfaError(response, 'MFA request failed');\n }\n\n try {\n return await response.json();\n } catch (error) {\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message, {\n status: response.status,\n });\n }\n}\n\n/\n Begins enrollment of an MFA credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Enrollment request.\n * @returns Validated enrollment flow data.\n /\nexport async function mfaEnroll(\n env: Env,\n accessToken: string,\n body: MfaEnrollRequest,\n): Promise<EnrollmentServiceResult> {\n const json = await requestJson(MFA_ENROLL_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaEnrollResponseStruct);\n\n return {\n flowId: json.flow_id,\n expiresAt: parseExpiresAt(json.expires_at),\n ...(json.passkey_create_data\n ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }\n : {}),\n };\n}\n\n/\n Completes enrollment of an MFA credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and enrollment proof.\n /\nexport async function mfaEnrollComplete(\n env: Env,\n accessToken: string,\n params: EnrollmentCompletionParams,\n): Promise<void> {\n let body: MfaEnrollCompleteRequest = {\n credential_type: params.credential_type,\n flow_id: params.flow_id,\n ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n };\n if (params.passkey_attestation) {\n assertValidMfaRequest(\n params.passkey_attestation,\n RegistrationResponseJSONStruct,\n );\n body = {\n ...body,\n passkey_attestation: JSON.stringify(params.passkey_attestation),\n };\n }\n\n const json = await requestJson(MFA_ENROLL_COMPLETE_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaEnrollCompleteResponseStruct);\n}\n\n/\n Begins step-up verification with an enrolled credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Verification request.\n * @returns Validated verification flow data.\n /\nexport async function mfaVerify(\n env: Env,\n accessToken: string,\n body: MfaVerifyRequest,\n): Promise<VerificationServiceResult> {\n const json = await requestJson(MFA_VERIFY_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaVerifyResponseStruct);\n\n return {\n flowId: json.flow_id,\n expiresAt: parseExpiresAt(json.expires_at),\n ...(json.passkey_request_data\n ? { publicKey: parsePasskeyRequestData(json.passkey_request_data) }\n : {}),\n };\n}\n\n/\n Completes step-up verification with an enrolled credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and verification proof.\n * @returns The AAL2 assertion JWT and its lifetime in seconds.\n /\nexport async function mfaVerifyComplete(\n env: Env,\n accessToken: string,\n params: VerificationCompletionParams,\n): Promise<MfaStepUpAssertion> {\n let body: MfaVerifyCompleteRequest = {\n credential_type: params.credential_type,\n flow_id: params.flow_id,\n ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n };\n if (params.passkey_assertion) {\n assertValidMfaRequest(\n params.passkey_assertion,\n AuthenticationResponseJSONStruct,\n );\n body = {\n ...body,\n passkey_assertion: JSON.stringify(params.passkey_assertion),\n };\n }\n\n const json = await requestJson(MFA_VERIFY_COMPLETE_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaVerifyCompleteResponseStruct);\n return { token: json.token, expiresIn: json.expires_in };\n}\n\nfunction isSupportedStatus(status: string): status is MfaCredentialStatus {\n return status === 'active' \|\| status === 'pending';\n}\n\n/\n Maps a server credential to its public controller representation.\n \n Unknown credential types or statuses are dropped so the server can extend\n * either without invalidating the whole list.\n \n @param credential - Validated server credential.\n * @returns A supported credential, or null when it cannot be represented.\n /\nexport function toEnrolledCredential(\n credential: MfaCredential,\n): EnrolledCredential \| null {\n const { credential_type: type, status } = credential;\n if (!isSupportedStatus(status)) {\n log.warn(`Ignoring MFA credential with unsupported status: ${status}`);\n return null;\n }\n\n const enrolledAt = parseEnrolledAt(credential.enrolled_at);\n const base = {\n status,\n ...(enrolledAt === undefined ? {} : { enrolledAt }),\n };\n\n if (type === 'passkey') {\n return {\n type,\n ...base,\n ...(credential.passkey?.display_name\n ? { displayName: credential.passkey.display_name }\n : {}),\n };\n }\n\n if (type === 'email_otp' && credential.email?.address !== undefined) {\n return {\n type,\n ...base,\n email: credential.email.address,\n // The spec marks `verified` optional; an active row is verified.\n verified: credential.email.verified ?? status === 'active',\n };\n }\n\n log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);\n return null;\n}\n\n/\n Gets the credentials enrolled on the canonical profile.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @returns Supported enrolled credentials.\n */\nexport async function getMfaCredentials(\n env: Env,\n accessToken: string,\n): Promise<EnrolledCredential[]> {\n const json = await requestJson(MFA_CREDENTIALS_URL(env), accessToken);\n assertValidMfaResponse(json, MfaCredentialsResponseStruct);\n return json.credentials\n .map(toEnrolledCredential)\n .filter((credential): credential is EnrolledCredential =>\n Boolean(credential),\n );\n}\n"]}
1	+ {"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAgBtB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AA2CzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAoBD;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,IAA8B,EAC9B,QAAkB;IAElB,OAAO,IAAI,EAAE,mBAAmB,KAAK,SAAS;QAC5C,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB;IAElB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,OAAO,IAAI,QAAQ,MAAM,EAAE,EAAE,CAAC;IAEvE,uEAAuE;IACvE,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,KAAK,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,6BAA6B,CAAC;QACnC,KAAK,wBAAwB,CAAC;QAC9B,KAAK,yBAAyB;YAC5B,MAAM,IAAI,8BAA8B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,eAAe;YAClB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,cAAc,CAAC;QACpB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB;YACtB,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,mBAAmB;YACtB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,qBAAqB;YACxB,MAAM,IAAI,sBAAsB,CAC9B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;QACJ,KAAK,oBAAoB;YACvB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD;YACE,MAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,GAAG,WAAW,qCAAqC,MAAM,GAAG,EAC5D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,IAA+C;IAE/C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC5C;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,mBAAmB;YAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAkC;IAElC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,qBAAqB,CACnB,MAAM,CAAC,mBAAmB,EAC1B,8BAA8B,CAC/B,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oBAAoB;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAoC;IAEpC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,qBAAqB,CACnB,MAAM,CAAC,iBAAiB,EACxB,gCAAgC,CACjC,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAyB;IAEzB,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oDAAoD,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,MAAM;QACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;IAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY;gBAClC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;YAC/B,iEAAiE;YACjE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,KAAK,QAAQ;SAC3D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW;SACpB,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,CAAC,UAAU,EAAoC,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;AACN,CAAC","sourcesContent":["import type { Json } from '@metamask/utils';\nimport log from 'loglevel';\n\nimport type { Env } from '../../../shared/env.js';\nimport { getEnvUrls } from '../../../shared/env.js';\nimport { HTTP_STATUS_CODES } from '../../constants.js';\nimport {\n CredentialAlreadyEnrolledError,\n CredentialNotEnrolledError,\n MaxIdentifiersReachedError,\n MaxPasskeysReachedError,\n MfaError,\n MfaFlowExpiredError,\n MfaIdentityMissingError,\n MfaRateLimitedError,\n MfaUnavailableError,\n MfaVerificationFailedError,\n OtpResendCooldownError,\n StepUpRequiredError,\n TooManyAttemptsError,\n} from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\nimport { toErrorMessage } from '../../utils/to-error-message.js';\nimport {\n AuthenticationResponseJSONStruct,\n MfaCredentialsResponseStruct,\n MfaEnrollCompleteResponseStruct,\n MfaEnrollResponseStruct,\n MfaErrorResponseStruct,\n MfaVerifyCompleteResponseStruct,\n MfaVerifyResponseStruct,\n PasskeyCreateDataStruct,\n PasskeyRequestDataStruct,\n RegistrationResponseJSONStruct,\n assertValidMfaRequest,\n assertValidMfaResponse,\n} from './schemas.js';\nimport type {\n AuthenticationResponseJSON,\n EnrolledCredential,\n MfaCredential,\n MfaCredentialStatus,\n MfaCredentialType,\n MfaEnrollCompleteRequest,\n MfaEnrollRequest,\n MfaVerifyCompleteRequest,\n MfaVerifyRequest,\n PublicKeyCredentialCreationOptionsJSON as PasskeyCreationOptions,\n PublicKeyCredentialRequestOptionsJSON as PasskeyRequestOptions,\n RegistrationResponseJSON,\n} from './types.js';\n\nexport const MFA_ENROLL_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll`;\n\nexport const MFA_ENROLL_COMPLETE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll/complete`;\n\nexport const MFA_VERIFY_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify`;\n\nexport const MFA_VERIFY_COMPLETE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;\n\nexport const MFA_CREDENTIALS_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;\n\ntype EnrollmentServiceResult = {\n flowId: string;\n expiresAt: number;\n publicKey?: PasskeyCreationOptions;\n};\n\ntype VerificationServiceResult = {\n flowId: string;\n expiresAt: number;\n publicKey?: PasskeyRequestOptions;\n};\n\nexport type MfaStepUpAssertion = {\n /** AAL2 assertion JWT to exchange at Hydra for an elevated access token. /\n token: string;\n /* Assertion lifetime in seconds. /\n expiresIn: number;\n};\n\ntype EnrollmentCompletionParams = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_attestation?: RegistrationResponseJSON;\n};\n\ntype VerificationCompletionParams = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_assertion?: AuthenticationResponseJSON;\n};\n\n/\n Reads a credential's enrollment date. Unlike flow deadlines, this is display\n * metadata, so an unparsable value is dropped instead of rejecting the whole\n * credential list.\n \n @param value - The raw `enrolled_at` value, if the server sent one.\n * @returns The epoch milliseconds, or undefined when absent or unparsable.\n /\nfunction parseEnrolledAt(value: string \| undefined): number \| undefined {\n if (!value) {\n return undefined;\n }\n const enrolledAt = Date.parse(value);\n if (Number.isNaN(enrolledAt)) {\n log.warn(`Ignoring unparsable MFA credential enrolled_at: ${value}`);\n return undefined;\n }\n return enrolledAt;\n}\n\nfunction parseExpiresAt(value: string): number {\n const expiresAt = Date.parse(value);\n if (Number.isNaN(expiresAt)) {\n throw new MfaError('invalid_response', `Invalid expires_at: ${value}`);\n }\n return expiresAt;\n}\n\n/\n Parses passkey creation data embedded in an enrollment response.\n \n @param value - JSON-encoded creation options.\n * @returns Validated public-key creation options.\n /\nexport function parsePasskeyCreateData(value: string): PasskeyCreationOptions {\n try {\n const parsed: unknown = JSON.parse(value);\n assertValidMfaResponse(parsed, PasskeyCreateDataStruct);\n return parsed.publicKey;\n } catch (error) {\n if (error instanceof MfaError) {\n throw error;\n }\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message);\n }\n}\n\n/\n Parses passkey request data embedded in a verification response.\n \n @param value - JSON-encoded request options.\n * @returns Validated public-key request options.\n /\nexport function parsePasskeyRequestData(value: string): PasskeyRequestOptions {\n try {\n const parsed: unknown = JSON.parse(value);\n assertValidMfaResponse(parsed, PasskeyRequestDataStruct);\n return parsed.publicKey;\n } catch (error) {\n if (error instanceof MfaError) {\n throw error;\n }\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message);\n }\n}\n\n/\n Reads a `Retry-After` header as a delay. The human-readable error message is\n * deliberately not parsed: the API documents it as unstable.\n \n @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined without a usable header.\n /\nfunction parseRetryAfter(response: Response): number \| undefined {\n const header = response.headers.get('Retry-After');\n if (!header) {\n return undefined;\n }\n const seconds = Number(header);\n if (Number.isInteger(seconds)) {\n return Math.max(0, seconds 1000);\n }\n const date = Date.parse(header);\n return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\n/*\n Reads and validates the JSON error body of a failed MFA request.\n \n When the body parses as JSON but does not match the documented error\n * shape, a `message` field is salvaged if present so callers still get a\n * useful diagnostic instead of a content-free fallback.\n \n @param response - The failed response.\n * @returns The validated error body, a best-effort salvage of it, or\n * undefined when the body could not be parsed as JSON at all.\n /\ntype MfaErrorBody = {\n code?: string;\n message: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n retry_after_seconds?: number;\n};\n\n/\n Prefers the documented `retry_after_seconds` error field over the\n * `Retry-After` header.\n \n @param body - The parsed error body, if any.\n * @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined when neither is usable.\n /\nfunction resolveRetryAfterMs(\n body: MfaErrorBody \| undefined,\n response: Response,\n): number \| undefined {\n return body?.retry_after_seconds === undefined\n ? parseRetryAfter(response)\n : body.retry_after_seconds 1000;\n}\n\nasync function readErrorBody(\n response: Response,\n): Promise<MfaErrorBody \| undefined> {\n let body: unknown;\n try {\n body = await response.json();\n } catch {\n return undefined;\n }\n\n try {\n assertValidMfaResponse(body, MfaErrorResponseStruct);\n return body;\n } catch {\n const message = asRecord(body)?.message;\n return typeof message === 'string' ? { message } : undefined;\n }\n}\n\nasync function throwMfaError(\n response: Response,\n errorPrefix: string,\n): Promise<never> {\n const { status } = response;\n const body = await readErrorBody(response);\n const message = `${errorPrefix}: ${body?.message ?? `HTTP ${status}`}`;\n\n // Status-only classification first: gateways and load balancers answer\n // 401/429/502 without the service's JSON body, and the caller still needs\n // to invalidate its session, honour Retry-After, or back off.\n if (status === HTTP_STATUS_CODES.UNAUTHORIZED) {\n throw new MfaError('authentication_required', message, { status });\n }\n\n const code = body?.code;\n switch (code) {\n case 'credential_already_enrolled':\n case 'email_already_enrolled':\n case 'email_socially_verified':\n throw new CredentialAlreadyEnrolledError(code, message, status);\n case 'credential_not_enrolled':\n throw new CredentialNotEnrolledError(message, status);\n case 'aal2_required':\n throw new StepUpRequiredError(message, status);\n case 'flow_expired':\n case 'invalid_flow':\n throw new MfaFlowExpiredError(code, message, status);\n case 'mfa_identity_missing':\n throw new MfaIdentityMissingError(message, status);\n case 'invalid_code':\n case 'invalid_attestation':\n case 'invalid_assertion':\n throw new MfaVerificationFailedError(code, message, status);\n case 'too_many_attempts':\n throw new TooManyAttemptsError(message, status);\n case 'max_passkeys_reached':\n throw new MaxPasskeysReachedError(message, status);\n case 'max_identifiers_reached':\n throw new MaxIdentifiersReachedError(message, status);\n case 'otp_resend_cooldown':\n throw new OtpResendCooldownError(\n message,\n resolveRetryAfterMs(body, response),\n status,\n );\n case 'kratos_unavailable':\n throw new MfaUnavailableError(message, status);\n default:\n break;\n }\n\n if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n throw new MfaRateLimitedError(\n message,\n resolveRetryAfterMs(body, response),\n status,\n );\n }\n if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {\n throw new MfaUnavailableError(message, status);\n }\n if (!body) {\n throw new MfaError(\n 'invalid_response',\n `${errorPrefix}: Unexpected error response (HTTP ${status})`,\n { status },\n );\n }\n throw new MfaError(code ?? 'server_error', message, { status });\n}\n\nasync function requestJson(\n url: string,\n accessToken: string,\n init?: { method?: 'GET' \| 'POST'; body?: Json },\n): Promise<Json> {\n let response: Response;\n try {\n response = await fetch(url, {\n method: init?.method ?? 'GET',\n headers: {\n Authorization: `Bearer ${accessToken}`,\n ...(init?.body === undefined\n ? {}\n : { 'Content-Type': 'application/json' }),\n },\n ...(init?.body === undefined ? {} : { body: JSON.stringify(init.body) }),\n });\n } catch (error) {\n const message = toErrorMessage(error);\n throw new MfaUnavailableError(`MFA request failed: ${message}`);\n }\n\n if (!response.ok) {\n return await throwMfaError(response, 'MFA request failed');\n }\n\n try {\n return await response.json();\n } catch (error) {\n const message = toErrorMessage(error);\n throw new MfaError('invalid_response', message, {\n status: response.status,\n });\n }\n}\n\n/*\n Begins enrollment of an MFA credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Enrollment request.\n * @returns Validated enrollment flow data.\n /\nexport async function mfaEnroll(\n env: Env,\n accessToken: string,\n body: MfaEnrollRequest,\n): Promise<EnrollmentServiceResult> {\n const json = await requestJson(MFA_ENROLL_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaEnrollResponseStruct);\n\n return {\n flowId: json.flow_id,\n expiresAt: parseExpiresAt(json.expires_at),\n ...(json.passkey_create_data\n ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }\n : {}),\n };\n}\n\n/\n Completes enrollment of an MFA credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and enrollment proof.\n /\nexport async function mfaEnrollComplete(\n env: Env,\n accessToken: string,\n params: EnrollmentCompletionParams,\n): Promise<void> {\n let body: MfaEnrollCompleteRequest = {\n credential_type: params.credential_type,\n flow_id: params.flow_id,\n ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n };\n if (params.passkey_attestation) {\n assertValidMfaRequest(\n params.passkey_attestation,\n RegistrationResponseJSONStruct,\n );\n body = {\n ...body,\n passkey_attestation: JSON.stringify(params.passkey_attestation),\n };\n }\n\n const json = await requestJson(MFA_ENROLL_COMPLETE_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaEnrollCompleteResponseStruct);\n}\n\n/\n Begins step-up verification with an enrolled credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Verification request.\n * @returns Validated verification flow data.\n /\nexport async function mfaVerify(\n env: Env,\n accessToken: string,\n body: MfaVerifyRequest,\n): Promise<VerificationServiceResult> {\n const json = await requestJson(MFA_VERIFY_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaVerifyResponseStruct);\n\n return {\n flowId: json.flow_id,\n expiresAt: parseExpiresAt(json.expires_at),\n ...(json.passkey_request_data\n ? { publicKey: parsePasskeyRequestData(json.passkey_request_data) }\n : {}),\n };\n}\n\n/\n Completes step-up verification with an enrolled credential.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and verification proof.\n * @returns The AAL2 assertion JWT and its lifetime in seconds.\n /\nexport async function mfaVerifyComplete(\n env: Env,\n accessToken: string,\n params: VerificationCompletionParams,\n): Promise<MfaStepUpAssertion> {\n let body: MfaVerifyCompleteRequest = {\n credential_type: params.credential_type,\n flow_id: params.flow_id,\n ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n };\n if (params.passkey_assertion) {\n assertValidMfaRequest(\n params.passkey_assertion,\n AuthenticationResponseJSONStruct,\n );\n body = {\n ...body,\n passkey_assertion: JSON.stringify(params.passkey_assertion),\n };\n }\n\n const json = await requestJson(MFA_VERIFY_COMPLETE_URL(env), accessToken, {\n method: 'POST',\n body,\n });\n assertValidMfaResponse(json, MfaVerifyCompleteResponseStruct);\n return { token: json.token, expiresIn: json.expires_in };\n}\n\nfunction isSupportedStatus(status: string): status is MfaCredentialStatus {\n return status === 'active' \|\| status === 'pending';\n}\n\n/\n Maps a server credential to its public controller representation.\n \n Unknown credential types or statuses are dropped so the server can extend\n * either without invalidating the whole list.\n \n @param credential - Validated server credential.\n * @returns A supported credential, or null when it cannot be represented.\n /\nexport function toEnrolledCredential(\n credential: MfaCredential,\n): EnrolledCredential \| null {\n const { credential_type: type, status } = credential;\n if (!isSupportedStatus(status)) {\n log.warn(`Ignoring MFA credential with unsupported status: ${status}`);\n return null;\n }\n\n const enrolledAt = parseEnrolledAt(credential.enrolled_at);\n const base = {\n status,\n ...(enrolledAt === undefined ? {} : { enrolledAt }),\n };\n\n if (type === 'passkey') {\n return {\n type,\n ...base,\n ...(credential.passkey?.display_name\n ? { displayName: credential.passkey.display_name }\n : {}),\n };\n }\n\n if (type === 'email_otp' && credential.email?.address !== undefined) {\n return {\n type,\n ...base,\n email: credential.email.address,\n // The spec marks `verified` optional; an active row is verified.\n verified: credential.email.verified ?? status === 'active',\n };\n }\n\n log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);\n return null;\n}\n\n/\n Gets the credentials enrolled on the canonical profile.\n \n @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @returns Supported enrolled credentials.\n */\nexport async function getMfaCredentials(\n env: Env,\n accessToken: string,\n): Promise<EnrolledCredential[]> {\n const json = await requestJson(MFA_CREDENTIALS_URL(env), accessToken);\n assertValidMfaResponse(json, MfaCredentialsResponseStruct);\n return json.credentials\n .map(toEnrolledCredential)\n .filter((credential): credential is EnrolledCredential =>\n Boolean(credential),\n );\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts CHANGED Viewed

@@ -121,5 +121,5 @@ export type CompleteStepUpRequest = {
 export type GetElevatedTokenRequest = {
     maxSessionAgeMs?: number;
 };
-export type MfaErrorCode = 'max_passkeys_reached' | 'max_identifiers_reached' | 'email_already_enrolled' | 'credential_already_enrolled' | 'credential_not_enrolled' | 'mfa_identity_missing' | 'otp_resend_cooldown' | 'rate_limited' | 'kratos_unavailable' | 'flow_expired' | 'invalid_flow' | 'invalid_attestation' | 'invalid_code' | 'invalid_assertion' | 'too_many_attempts' | 'elevated_token_invalid' | 'authentication_required' | 'server_error' | 'invalid_response' | 'invalid_request';
+export type MfaErrorCode = 'max_passkeys_reached' | 'max_identifiers_reached' | 'email_already_enrolled' | 'credential_already_enrolled' | 'credential_not_enrolled' | 'email_socially_verified' | 'mfa_identity_missing' | 'multi_primary_srp' | 'aal2_required' | 'otp_resend_cooldown' | 'rate_limited' | 'kratos_unavailable' | 'flow_expired' | 'invalid_flow' | 'invalid_attestation' | 'invalid_code' | 'invalid_assertion' | 'too_many_attempts' | 'elevated_token_invalid' | 'authentication_required' | 'server_error' | 'invalid_response' | 'invalid_request';
 //# sourceMappingURL=types.d.ts.map

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,sCAAsC,GAAG,KAAK,CACxD,OAAO,4CAA4C,CACpD,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,KAAK,CACvD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAC1C,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,sCAAsC,CAAC;CACnD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qCAAqC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,WAAW,GACnB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,CAAC,CAAC;QACP,GAAG,EAAE,iBAAiB,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,YAAY,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,yBAAyB,GACzB,sBAAsB,GACtB,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,yBAAyB,GACzB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,sCAAsC,GAAG,KAAK,CACxD,OAAO,4CAA4C,CACpD,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,KAAK,CACvD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAC1C,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,sCAAsC,CAAC;CACnD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qCAAqC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,WAAW,GACnB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,CAAC,CAAC;QACP,GAAG,EAAE,iBAAiB,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,YAAY,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,sBAAsB,GACtB,mBAAmB,GACnB,eAAe,GACf,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,yBAAyB,GACzB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC"}

package/dist/sdk/authentication-jwt-bearer/mfa/types.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { Infer } from '@metamask/superstruct';\n\nimport type {\n AuthenticationResponseJSONStruct,\n MfaCredentialStruct,\n MfaCredentialsResponseStruct,\n MfaEmailDetailStruct,\n MfaEnrollCompleteResponseStruct,\n MfaEnrollResponseStruct,\n MfaPasskeyDetailStruct,\n MfaVerifyCompleteResponseStruct,\n MfaVerifyResponseStruct,\n PublicKeyCredentialCreationOptionsJSONStruct,\n PublicKeyCredentialRequestOptionsJSONStruct,\n RegistrationResponseJSONStruct,\n} from './schemas.js';\nimport { MFA_CREDENTIAL_TYPES } from './schemas.js';\n\nexport { MFA_CREDENTIAL_TYPES };\n\nexport type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];\n\nexport type MfaCredentialStatus = 'active' \| 'pending';\n\nexport type PublicKeyCredentialCreationOptionsJSON = Infer<\n typeof PublicKeyCredentialCreationOptionsJSONStruct\n>;\n\nexport type PublicKeyCredentialRequestOptionsJSON = Infer<\n typeof PublicKeyCredentialRequestOptionsJSONStruct\n>;\n\nexport type RegistrationResponseJSON = Infer<\n typeof RegistrationResponseJSONStruct\n>;\n\nexport type AuthenticationResponseJSON = Infer<\n typeof AuthenticationResponseJSONStruct\n>;\n\nexport type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;\n\nexport type MfaEnrollCompleteResponse = Infer<\n typeof MfaEnrollCompleteResponseStruct\n>;\n\nexport type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;\n\nexport type MfaVerifyCompleteResponse = Infer<\n typeof MfaVerifyCompleteResponseStruct\n>;\n\nexport type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;\n\nexport type MfaCredential = Infer<typeof MfaCredentialStruct>;\n\nexport type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;\n\nexport type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;\n\nexport type MfaEnrollRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n identifier?: string;\n};\n\nexport type MfaEnrollCompleteRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_attestation?: string;\n};\n\nexport type MfaVerifyRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n};\n\nexport type MfaVerifyCompleteRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_assertion?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n};\n\nexport type EnrolledCredential =\n \| {\n type: 'passkey';\n status: MfaCredentialStatus;\n enrolledAt?: number;\n displayName?: string;\n }\n \| {\n type: 'email_otp';\n status: MfaCredentialStatus;\n enrolledAt?: number;\n email: string;\n verified: boolean;\n };\n\n/*\n Caller-supplied context attached to MFA trace spans. `operation` names the\n * client flow that needs the credential (for example `money.signTransaction`).\n */\nexport type TokenReason = {\n operation: string;\n};\n\nexport type EnrollmentChallenge =\n \| {\n type: 'passkey';\n flowId: string;\n expiresAt: number;\n publicKey: PublicKeyCredentialCreationOptionsJSON;\n }\n \| {\n type: 'email_otp';\n flowId: string;\n expiresAt: number;\n };\n\nexport type EnrollmentProof =\n \| {\n type: 'passkey';\n attestation: RegistrationResponseJSON;\n }\n \| {\n type: 'email_otp';\n code: string;\n };\n\nexport type StepUpChallenge =\n \| {\n type: 'passkey';\n flowId: string;\n expiresAt: number;\n publicKey: PublicKeyCredentialRequestOptionsJSON;\n }\n \| {\n type: 'email_otp';\n flowId: string;\n expiresAt: number;\n };\n\nexport type StepUpProof =\n \| {\n type: 'passkey';\n assertion: AuthenticationResponseJSON;\n }\n \| {\n type: 'email_otp';\n code: string;\n };\n\nexport type ElevatedProfileToken = {\n accessToken: string;\n expiresIn: number;\n obtainedAt: number;\n claims: {\n sub: string;\n aal: 2;\n amr: MfaCredentialType[];\n exp: number;\n };\n};\n\nexport type BeginEnrollmentRequest = {\n type: MfaCredentialType;\n email?: string;\n reason: TokenReason;\n};\n\nexport type CompleteEnrollmentRequest = {\n flowId: string;\n proof: EnrollmentProof;\n reason: TokenReason;\n};\n\nexport type BeginStepUpRequest = {\n type: MfaCredentialType;\n reason: TokenReason;\n};\n\nexport type CompleteStepUpRequest = {\n flowId: string;\n proof: StepUpProof;\n reason: TokenReason;\n};\n\nexport type GetElevatedTokenRequest = {\n maxSessionAgeMs?: number;\n};\n\nexport type MfaErrorCode =\n \| 'max_passkeys_reached'\n \| 'max_identifiers_reached'\n \| 'email_already_enrolled'\n \| 'credential_already_enrolled'\n \| 'credential_not_enrolled'\n \| 'mfa_identity_missing'\n \| 'otp_resend_cooldown'\n \| 'rate_limited'\n \| 'kratos_unavailable'\n \| 'flow_expired'\n \| 'invalid_flow'\n \| 'invalid_attestation'\n \| 'invalid_code'\n \| 'invalid_assertion'\n \| 'too_many_attempts'\n \| 'elevated_token_invalid'\n \| 'authentication_required'\n \| 'server_error'\n \| 'invalid_response'\n \| 'invalid_request';\n"]}
1	+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { Infer } from '@metamask/superstruct';\n\nimport type {\n AuthenticationResponseJSONStruct,\n MfaCredentialStruct,\n MfaCredentialsResponseStruct,\n MfaEmailDetailStruct,\n MfaEnrollCompleteResponseStruct,\n MfaEnrollResponseStruct,\n MfaPasskeyDetailStruct,\n MfaVerifyCompleteResponseStruct,\n MfaVerifyResponseStruct,\n PublicKeyCredentialCreationOptionsJSONStruct,\n PublicKeyCredentialRequestOptionsJSONStruct,\n RegistrationResponseJSONStruct,\n} from './schemas.js';\nimport { MFA_CREDENTIAL_TYPES } from './schemas.js';\n\nexport { MFA_CREDENTIAL_TYPES };\n\nexport type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];\n\nexport type MfaCredentialStatus = 'active' \| 'pending';\n\nexport type PublicKeyCredentialCreationOptionsJSON = Infer<\n typeof PublicKeyCredentialCreationOptionsJSONStruct\n>;\n\nexport type PublicKeyCredentialRequestOptionsJSON = Infer<\n typeof PublicKeyCredentialRequestOptionsJSONStruct\n>;\n\nexport type RegistrationResponseJSON = Infer<\n typeof RegistrationResponseJSONStruct\n>;\n\nexport type AuthenticationResponseJSON = Infer<\n typeof AuthenticationResponseJSONStruct\n>;\n\nexport type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;\n\nexport type MfaEnrollCompleteResponse = Infer<\n typeof MfaEnrollCompleteResponseStruct\n>;\n\nexport type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;\n\nexport type MfaVerifyCompleteResponse = Infer<\n typeof MfaVerifyCompleteResponseStruct\n>;\n\nexport type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;\n\nexport type MfaCredential = Infer<typeof MfaCredentialStruct>;\n\nexport type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;\n\nexport type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;\n\nexport type MfaEnrollRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n identifier?: string;\n};\n\nexport type MfaEnrollCompleteRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_attestation?: string;\n};\n\nexport type MfaVerifyRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n};\n\nexport type MfaVerifyCompleteRequest = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n credential_type: MfaCredentialType;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n flow_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n passkey_assertion?: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n otp_code?: string;\n};\n\nexport type EnrolledCredential =\n \| {\n type: 'passkey';\n status: MfaCredentialStatus;\n enrolledAt?: number;\n displayName?: string;\n }\n \| {\n type: 'email_otp';\n status: MfaCredentialStatus;\n enrolledAt?: number;\n email: string;\n verified: boolean;\n };\n\n/*\n Caller-supplied context attached to MFA trace spans. `operation` names the\n * client flow that needs the credential (for example `money.signTransaction`).\n */\nexport type TokenReason = {\n operation: string;\n};\n\nexport type EnrollmentChallenge =\n \| {\n type: 'passkey';\n flowId: string;\n expiresAt: number;\n publicKey: PublicKeyCredentialCreationOptionsJSON;\n }\n \| {\n type: 'email_otp';\n flowId: string;\n expiresAt: number;\n };\n\nexport type EnrollmentProof =\n \| {\n type: 'passkey';\n attestation: RegistrationResponseJSON;\n }\n \| {\n type: 'email_otp';\n code: string;\n };\n\nexport type StepUpChallenge =\n \| {\n type: 'passkey';\n flowId: string;\n expiresAt: number;\n publicKey: PublicKeyCredentialRequestOptionsJSON;\n }\n \| {\n type: 'email_otp';\n flowId: string;\n expiresAt: number;\n };\n\nexport type StepUpProof =\n \| {\n type: 'passkey';\n assertion: AuthenticationResponseJSON;\n }\n \| {\n type: 'email_otp';\n code: string;\n };\n\nexport type ElevatedProfileToken = {\n accessToken: string;\n expiresIn: number;\n obtainedAt: number;\n claims: {\n sub: string;\n aal: 2;\n amr: MfaCredentialType[];\n exp: number;\n };\n};\n\nexport type BeginEnrollmentRequest = {\n type: MfaCredentialType;\n email?: string;\n reason: TokenReason;\n};\n\nexport type CompleteEnrollmentRequest = {\n flowId: string;\n proof: EnrollmentProof;\n reason: TokenReason;\n};\n\nexport type BeginStepUpRequest = {\n type: MfaCredentialType;\n reason: TokenReason;\n};\n\nexport type CompleteStepUpRequest = {\n flowId: string;\n proof: StepUpProof;\n reason: TokenReason;\n};\n\nexport type GetElevatedTokenRequest = {\n maxSessionAgeMs?: number;\n};\n\nexport type MfaErrorCode =\n \| 'max_passkeys_reached'\n \| 'max_identifiers_reached'\n \| 'email_already_enrolled'\n \| 'credential_already_enrolled'\n \| 'credential_not_enrolled'\n \| 'email_socially_verified'\n \| 'mfa_identity_missing'\n \| 'multi_primary_srp'\n \| 'aal2_required'\n \| 'otp_resend_cooldown'\n \| 'rate_limited'\n \| 'kratos_unavailable'\n \| 'flow_expired'\n \| 'invalid_flow'\n \| 'invalid_attestation'\n \| 'invalid_code'\n \| 'invalid_assertion'\n \| 'too_many_attempts'\n \| 'elevated_token_invalid'\n \| 'authentication_required'\n \| 'server_error'\n \| 'invalid_response'\n \| 'invalid_request';\n"]}

package/dist/sdk/authentication.d.ts CHANGED Viewed

@@ -26,6 +26,7 @@ export declare class JwtBearerAuth implements SIWEInterface, SRPInterface {
     beginMfaEnrollment(type: MfaCredentialType, options?: {
         email?: string;
         entropySourceId?: string;
+        accessToken?: string;
     }): Promise<EnrollmentChallenge>;
     completeMfaEnrollment(flowId: string, proof: EnrollmentProof, entropySourceId?: string): Promise<void>;
     beginMfaVerification(type: MfaCredentialType, entropySourceId?: string): Promise<StepUpChallenge>;

package/dist/sdk/authentication.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAKlD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,IAAI,EACJ,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,sCAAsC,CAAC;AAM9C,KAAK,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAE7D,KAAK,UAAU,GAAG,qBAAqB,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,KAAK,SAAS,GAAG,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,KAAK,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAAC;AAElD,qBAAa,aAAc,YAAW,aAAa,EAAE,YAAY;;IAO/D,YAAY,GAAG,IAAI,EAAE,mBAAmB,EAevC;IAED,iBAAiB,CAAC,QAAQ,EAAE,eAAe,QAG1C;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;IAEK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAGnC;IAEK,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxC;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnE;IAEK,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAEK,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;IAEK,uBAAuB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;IAEK,uBAAuB,CAC3B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAMjB;IAEK,kBAAkB,CACtB,IAAI,EAAE,iBAAiB,EACvB,OAAO,CAAC,EAAE;~~QAAE~~,KAAK,CAAC,EAAE,MAAM,CAAC;~~QAAC~~,eAAe,CAAC,EAAE,MAAM,~~CAAA~~;~~KAAE~~,~~GACrD~~,OAAO,CAAC,mBAAmB,CAAC,CAG9B;IAEK,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,oBAAoB,CACxB,IAAI,EAAE,iBAAiB,EACvB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,eAAe,CAAC,CAG1B;IAEK,uBAAuB,CAC3B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;IAEK,iBAAiB,CACrB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAG/B;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAGrE;IAEK,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAG/B;IAEK,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAEjB;IAEK,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAGP;CA2BF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC"}
1	+ {"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAKlD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,IAAI,EACJ,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,sCAAsC,CAAC;AAM9C,KAAK,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAE7D,KAAK,UAAU,GAAG,qBAAqB,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,KAAK,SAAS,GAAG,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,KAAK,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAAC;AAElD,qBAAa,aAAc,YAAW,aAAa,EAAE,YAAY;;IAO/D,YAAY,GAAG,IAAI,EAAE,mBAAmB,EAevC;IAED,iBAAiB,CAAC,QAAQ,EAAE,eAAe,QAG1C;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;IAEK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAGnC;IAEK,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxC;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnE;IAEK,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAEK,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;IAEK,uBAAuB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;IAEK,uBAAuB,CAC3B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAMjB;IAEK,kBAAkB,CACtB,IAAI,EAAE,iBAAiB,EACvB,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAG9B;IAEK,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,oBAAoB,CACxB,IAAI,EAAE,iBAAiB,EACvB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,eAAe,CAAC,CAG1B;IAEK,uBAAuB,CAC3B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;IAEK,iBAAiB,CACrB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAG/B;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAGrE;IAEK,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAG/B;IAEK,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAEjB;IAEK,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAGP;CA2BF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC"}

package/dist/sdk/authentication.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAU3E,OAAO,EACL,QAAQ,EACR,eAAe,GAChB,MAAM,yCAAyC,CAAC;AAWjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAWlE,MAAM,OAAO,aAAa;IACf,KAAK,CAAW;IAEhB,IAAI,CAAM;IAEV,IAAI,CAAuC;IAEpD,YAAY,GAAG,IAAyB;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAExB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAuB,EACvB,OAAsD;QAEtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAsB,EACtB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,IAAuB,EACvB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAc,EACd,KAAkB,EAClB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,KAAK,EACL,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO;oBACL,SAAS,EAAE,GAAG;oBACd,WAAW,EAAE,GAAG;oBAChB,qBAAqB,EAAE,CAAC,CAAC,mBAAmB;oBAC5C,eAAe,EAAE,CAAC,CAAC,cAAc;iBAClC,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,0BAA0B;gBAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,IAAI,SAAS,CACjB,mCAAmC,YAAY,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,MAKP;QACC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,WAAW,CACT,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,UAAU,CACR,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,iDAAiD,CAClD,CAAC;IACJ,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC","sourcesContent":["import type { PublicInterface } from '@metamask/utils';\nimport type { Eip1193Provider } from 'ethers';\n\nimport type { Env } from '../shared/env.js';\nimport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nimport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nimport type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';\nimport type {\n EnrolledCredential,\n EnrollmentChallenge,\n EnrollmentProof,\n MfaCredentialType,\n StepUpChallenge,\n StepUpProof,\n} from './authentication-jwt-bearer/mfa/types.js';\nimport {\n getNonce,\n pairIdentifiers,\n} from './authentication-jwt-bearer/services.js';\nimport type { PairProfilesResponse } from './authentication-jwt-bearer/services.js';\nimport type {\n AccessToken,\n UserProfile,\n Pair,\n PairSocialIdentifierParams,\n OidcTokenAudience,\n OidcTokenClaims,\n UserProfileLineage,\n} from './authentication-jwt-bearer/types.js';\nimport { AuthType } from './authentication-jwt-bearer/types.js';\nimport { PairError, UnsupportedAuthTypeError } from './errors.js';\n\n// Computing the Classes, so we only get back the public methods for the interface.\n\ntype SIWEInterface = PublicInterface<SIWEJwtBearerAuth>;\nexport type SRPInterface = PublicInterface<SRPJwtBearerAuth>;\n\ntype SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;\ntype SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;\ntype JwtBearerAuthParams = SiweParams \| SRPParams;\n\nexport class JwtBearerAuth implements SIWEInterface, SRPInterface {\n readonly #type: AuthType;\n\n readonly #env: Env;\n\n readonly #sdk: SIWEJwtBearerAuth \| SRPJwtBearerAuth;\n\n constructor(...args: JwtBearerAuthParams) {\n this.#type = args[0].type;\n this.#env = args[0].env;\n\n if (args[0].type === AuthType.SRP) {\n this.#sdk = new SRPJwtBearerAuth(args[0], args[1]);\n return;\n }\n\n if (args[0].type === AuthType.SiWE) {\n this.#sdk = new SIWEJwtBearerAuth(args[0], args[1]);\n return;\n }\n\n throw new UnsupportedAuthTypeError('unsupported auth type');\n }\n\n setCustomProvider(provider: Eip1193Provider) {\n this.#assertSRP(this.#type, this.#sdk);\n this.#sdk.setCustomProvider(provider);\n }\n\n async getAccessToken(entropySourceId?: string): Promise<string> {\n return await this.#sdk.getAccessToken(entropySourceId);\n }\n\n async connectSnap(): Promise<string> {\n this.#assertSRP(this.#type, this.#sdk);\n return this.#sdk.connectSnap();\n }\n\n async isSnapConnected(): Promise<boolean> {\n this.#assertSRP(this.#type, this.#sdk);\n return this.#sdk.isSnapConnected();\n }\n\n async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n return await this.#sdk.getUserProfile(entropySourceId);\n }\n\n async getIdentifier(entropySourceId?: string): Promise<string> {\n return await this.#sdk.getIdentifier(entropySourceId);\n }\n\n async getUserProfileLineage(\n entropySourceId?: string,\n ): Promise<UserProfileLineage> {\n return await this.#sdk.getUserProfileLineage(entropySourceId);\n }\n\n async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n return await this.#sdk.getCustomerServiceToken(entropySourceId);\n }\n\n async getPartnerIdentityToken(\n claims: OidcTokenClaims,\n audience: OidcTokenAudience,\n entropySourceId?: string,\n ): Promise<string> {\n return await this.#sdk.getPartnerIdentityToken(\n claims,\n audience,\n entropySourceId,\n );\n }\n\n async beginMfaEnrollment(\n type: MfaCredentialType,\n options?: { email?: string; entropySourceId?: string },\n ): Promise<EnrollmentChallenge> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.beginMfaEnrollment(type, options);\n }\n\n async completeMfaEnrollment(\n flowId: string,\n proof: EnrollmentProof,\n entropySourceId?: string,\n ): Promise<void> {\n this.#assertSRP(this.#type, this.#sdk);\n await this.#sdk.completeMfaEnrollment(flowId, proof, entropySourceId);\n }\n\n async beginMfaVerification(\n type: MfaCredentialType,\n entropySourceId?: string,\n ): Promise<StepUpChallenge> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.beginMfaVerification(type, entropySourceId);\n }\n\n async completeMfaVerification(\n flowId: string,\n proof: StepUpProof,\n entropySourceId?: string,\n ): Promise<MfaStepUpAssertion> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.completeMfaVerification(\n flowId,\n proof,\n entropySourceId,\n );\n }\n\n async getMfaCredentials(\n entropySourceId?: string,\n ): Promise<EnrolledCredential[]> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.getMfaCredentials(entropySourceId);\n }\n\n async exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.exchangeMfaAssertion(assertionJwt);\n }\n\n async pairSrpProfiles(\n accessTokens: string[],\n authAccessToken: string,\n ): Promise<PairProfilesResponse> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.pairSrpProfiles(accessTokens, authAccessToken);\n }\n\n async pairSocialIdentifier(\n params: PairSocialIdentifierParams,\n authAccessToken: string,\n ): Promise<void> {\n this.#assertSRP(this.#type, this.#sdk);\n await this.#sdk.pairSocialIdentifier(params, authAccessToken);\n }\n\n async signMessage(\n message: string,\n entropySourceId?: string,\n ): Promise<string> {\n return await this.#sdk.signMessage(message, entropySourceId);\n }\n\n async pairIdentifiers(pairing: Pair[]): Promise<void> {\n const profile = await this.getUserProfile();\n const n = await getNonce(profile.profileId, this.#env);\n\n const logins = await Promise.all(\n pairing.map(async (p) => {\n try {\n const raw = `metamask:${n.nonce}:${p.identifier}`;\n const sig = await p.signMessage(raw);\n return {\n signature: sig,\n raw_message: raw,\n encrypted_storage_key: p.encryptedStorageKey,\n identifier_type: p.identifierType,\n };\n } catch (e) {\n /* istanbul ignore next /\n const errorMessage =\n e instanceof Error ? e.message : JSON.stringify(e ?? '');\n throw new PairError(\n `failed to sign pairing message: ${errorMessage}`,\n );\n }\n }),\n );\n\n const accessToken = await this.getAccessToken();\n await pairIdentifiers(n.nonce, logins, accessToken, this.#env);\n }\n\n prepare(signer: {\n address: string;\n chainId: number;\n signMessage: (message: string) => Promise<string>;\n domain: string;\n }): void {\n this.#assertSIWE(this.#type, this.#sdk);\n this.#sdk.prepare(signer);\n }\n\n #assertSIWE(\n type: AuthType,\n _sdk: SIWEJwtBearerAuth \| SRPJwtBearerAuth,\n ): asserts _sdk is SIWEJwtBearerAuth {\n if (type === AuthType.SiWE) {\n return;\n }\n\n throw new UnsupportedAuthTypeError(\n 'This method is only available via SIWE auth type',\n );\n }\n\n #assertSRP(\n type: AuthType,\n _sdk: SIWEJwtBearerAuth \| SRPJwtBearerAuth,\n ): asserts _sdk is SRPJwtBearerAuth {\n if (type === AuthType.SRP) {\n return;\n }\n\n throw new UnsupportedAuthTypeError(\n 'This method is only available via SRP auth type',\n );\n }\n}\n\nexport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nexport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nexport from './authentication-jwt-bearer/types.js';\n"]}
1	+ {"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAU3E,OAAO,EACL,QAAQ,EACR,eAAe,GAChB,MAAM,yCAAyC,CAAC;AAWjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAWlE,MAAM,OAAO,aAAa;IACf,KAAK,CAAW;IAEhB,IAAI,CAAM;IAEV,IAAI,CAAuC;IAEpD,YAAY,GAAG,IAAyB;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAExB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAuB,EACvB,OAIC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAsB,EACtB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,IAAuB,EACvB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAc,EACd,KAAkB,EAClB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,KAAK,EACL,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO;oBACL,SAAS,EAAE,GAAG;oBACd,WAAW,EAAE,GAAG;oBAChB,qBAAqB,EAAE,CAAC,CAAC,mBAAmB;oBAC5C,eAAe,EAAE,CAAC,CAAC,cAAc;iBAClC,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,0BAA0B;gBAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,IAAI,SAAS,CACjB,mCAAmC,YAAY,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,MAKP;QACC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,WAAW,CACT,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,UAAU,CACR,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,iDAAiD,CAClD,CAAC;IACJ,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC","sourcesContent":["import type { PublicInterface } from '@metamask/utils';\nimport type { Eip1193Provider } from 'ethers';\n\nimport type { Env } from '../shared/env.js';\nimport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nimport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nimport type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';\nimport type {\n EnrolledCredential,\n EnrollmentChallenge,\n EnrollmentProof,\n MfaCredentialType,\n StepUpChallenge,\n StepUpProof,\n} from './authentication-jwt-bearer/mfa/types.js';\nimport {\n getNonce,\n pairIdentifiers,\n} from './authentication-jwt-bearer/services.js';\nimport type { PairProfilesResponse } from './authentication-jwt-bearer/services.js';\nimport type {\n AccessToken,\n UserProfile,\n Pair,\n PairSocialIdentifierParams,\n OidcTokenAudience,\n OidcTokenClaims,\n UserProfileLineage,\n} from './authentication-jwt-bearer/types.js';\nimport { AuthType } from './authentication-jwt-bearer/types.js';\nimport { PairError, UnsupportedAuthTypeError } from './errors.js';\n\n// Computing the Classes, so we only get back the public methods for the interface.\n\ntype SIWEInterface = PublicInterface<SIWEJwtBearerAuth>;\nexport type SRPInterface = PublicInterface<SRPJwtBearerAuth>;\n\ntype SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;\ntype SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;\ntype JwtBearerAuthParams = SiweParams \| SRPParams;\n\nexport class JwtBearerAuth implements SIWEInterface, SRPInterface {\n readonly #type: AuthType;\n\n readonly #env: Env;\n\n readonly #sdk: SIWEJwtBearerAuth \| SRPJwtBearerAuth;\n\n constructor(...args: JwtBearerAuthParams) {\n this.#type = args[0].type;\n this.#env = args[0].env;\n\n if (args[0].type === AuthType.SRP) {\n this.#sdk = new SRPJwtBearerAuth(args[0], args[1]);\n return;\n }\n\n if (args[0].type === AuthType.SiWE) {\n this.#sdk = new SIWEJwtBearerAuth(args[0], args[1]);\n return;\n }\n\n throw new UnsupportedAuthTypeError('unsupported auth type');\n }\n\n setCustomProvider(provider: Eip1193Provider) {\n this.#assertSRP(this.#type, this.#sdk);\n this.#sdk.setCustomProvider(provider);\n }\n\n async getAccessToken(entropySourceId?: string): Promise<string> {\n return await this.#sdk.getAccessToken(entropySourceId);\n }\n\n async connectSnap(): Promise<string> {\n this.#assertSRP(this.#type, this.#sdk);\n return this.#sdk.connectSnap();\n }\n\n async isSnapConnected(): Promise<boolean> {\n this.#assertSRP(this.#type, this.#sdk);\n return this.#sdk.isSnapConnected();\n }\n\n async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n return await this.#sdk.getUserProfile(entropySourceId);\n }\n\n async getIdentifier(entropySourceId?: string): Promise<string> {\n return await this.#sdk.getIdentifier(entropySourceId);\n }\n\n async getUserProfileLineage(\n entropySourceId?: string,\n ): Promise<UserProfileLineage> {\n return await this.#sdk.getUserProfileLineage(entropySourceId);\n }\n\n async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n return await this.#sdk.getCustomerServiceToken(entropySourceId);\n }\n\n async getPartnerIdentityToken(\n claims: OidcTokenClaims,\n audience: OidcTokenAudience,\n entropySourceId?: string,\n ): Promise<string> {\n return await this.#sdk.getPartnerIdentityToken(\n claims,\n audience,\n entropySourceId,\n );\n }\n\n async beginMfaEnrollment(\n type: MfaCredentialType,\n options?: {\n email?: string;\n entropySourceId?: string;\n accessToken?: string;\n },\n ): Promise<EnrollmentChallenge> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.beginMfaEnrollment(type, options);\n }\n\n async completeMfaEnrollment(\n flowId: string,\n proof: EnrollmentProof,\n entropySourceId?: string,\n ): Promise<void> {\n this.#assertSRP(this.#type, this.#sdk);\n await this.#sdk.completeMfaEnrollment(flowId, proof, entropySourceId);\n }\n\n async beginMfaVerification(\n type: MfaCredentialType,\n entropySourceId?: string,\n ): Promise<StepUpChallenge> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.beginMfaVerification(type, entropySourceId);\n }\n\n async completeMfaVerification(\n flowId: string,\n proof: StepUpProof,\n entropySourceId?: string,\n ): Promise<MfaStepUpAssertion> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.completeMfaVerification(\n flowId,\n proof,\n entropySourceId,\n );\n }\n\n async getMfaCredentials(\n entropySourceId?: string,\n ): Promise<EnrolledCredential[]> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.getMfaCredentials(entropySourceId);\n }\n\n async exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.exchangeMfaAssertion(assertionJwt);\n }\n\n async pairSrpProfiles(\n accessTokens: string[],\n authAccessToken: string,\n ): Promise<PairProfilesResponse> {\n this.#assertSRP(this.#type, this.#sdk);\n return await this.#sdk.pairSrpProfiles(accessTokens, authAccessToken);\n }\n\n async pairSocialIdentifier(\n params: PairSocialIdentifierParams,\n authAccessToken: string,\n ): Promise<void> {\n this.#assertSRP(this.#type, this.#sdk);\n await this.#sdk.pairSocialIdentifier(params, authAccessToken);\n }\n\n async signMessage(\n message: string,\n entropySourceId?: string,\n ): Promise<string> {\n return await this.#sdk.signMessage(message, entropySourceId);\n }\n\n async pairIdentifiers(pairing: Pair[]): Promise<void> {\n const profile = await this.getUserProfile();\n const n = await getNonce(profile.profileId, this.#env);\n\n const logins = await Promise.all(\n pairing.map(async (p) => {\n try {\n const raw = `metamask:${n.nonce}:${p.identifier}`;\n const sig = await p.signMessage(raw);\n return {\n signature: sig,\n raw_message: raw,\n encrypted_storage_key: p.encryptedStorageKey,\n identifier_type: p.identifierType,\n };\n } catch (e) {\n /* istanbul ignore next /\n const errorMessage =\n e instanceof Error ? e.message : JSON.stringify(e ?? '');\n throw new PairError(\n `failed to sign pairing message: ${errorMessage}`,\n );\n }\n }),\n );\n\n const accessToken = await this.getAccessToken();\n await pairIdentifiers(n.nonce, logins, accessToken, this.#env);\n }\n\n prepare(signer: {\n address: string;\n chainId: number;\n signMessage: (message: string) => Promise<string>;\n domain: string;\n }): void {\n this.#assertSIWE(this.#type, this.#sdk);\n this.#sdk.prepare(signer);\n }\n\n #assertSIWE(\n type: AuthType,\n _sdk: SIWEJwtBearerAuth \| SRPJwtBearerAuth,\n ): asserts _sdk is SIWEJwtBearerAuth {\n if (type === AuthType.SiWE) {\n return;\n }\n\n throw new UnsupportedAuthTypeError(\n 'This method is only available via SIWE auth type',\n );\n }\n\n #assertSRP(\n type: AuthType,\n _sdk: SIWEJwtBearerAuth \| SRPJwtBearerAuth,\n ): asserts _sdk is SRPJwtBearerAuth {\n if (type === AuthType.SRP) {\n return;\n }\n\n throw new UnsupportedAuthTypeError(\n 'This method is only available via SRP auth type',\n );\n }\n}\n\nexport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nexport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nexport from './authentication-jwt-bearer/types.js';\n"]}

package/dist/sdk/constants.d.ts CHANGED Viewed

@@ -1,5 +1,6 @@
 export declare const HTTP_STATUS_CODES: {
     UNAUTHORIZED: number;
+    FORBIDDEN: number;
     CONFLICT: number;
     UNPROCESSABLE_ENTITY: number;
     TOO_MANY_REQUESTS: number;

package/dist/sdk/constants.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;IAC5B,YAAY;IACZ,QAAQ;IACR,oBAAoB;IACpB,iBAAiB;IACjB,WAAW;CACZ,CAAC"}
1	+ {"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;IAC5B,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,oBAAoB;IACpB,iBAAiB;IACjB,WAAW;CACZ,CAAC"}

package/dist/sdk/constants.js CHANGED Viewed

@@ -1,5 +1,6 @@
 export const HTTP_STATUS_CODES = {
     UNAUTHORIZED: 401,
+    FORBIDDEN: 403,
     CONFLICT: 409,
     UNPROCESSABLE_ENTITY: 422,
     TOO_MANY_REQUESTS: 429,

package/dist/sdk/constants.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY,EAAE,GAAG;IACjB,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,WAAW,EAAE,GAAG;CACjB,CAAC","sourcesContent":["export const HTTP_STATUS_CODES = {\n UNAUTHORIZED: 401,\n CONFLICT: 409,\n UNPROCESSABLE_ENTITY: 422,\n TOO_MANY_REQUESTS: 429,\n BAD_GATEWAY: 502,\n};\n"]}
1	+ {"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;IACd,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,WAAW,EAAE,GAAG;CACjB,CAAC","sourcesContent":["export const HTTP_STATUS_CODES = {\n UNAUTHORIZED: 401,\n FORBIDDEN: 403,\n CONFLICT: 409,\n UNPROCESSABLE_ENTITY: 422,\n TOO_MANY_REQUESTS: 429,\n BAD_GATEWAY: 502,\n};\n"]}

package/dist/sdk/errors.d.ts CHANGED Viewed

@@ -15,8 +15,23 @@ export declare class MfaError extends Error {
         retryAfterMs?: number;
     });
 }
+/**
+ * The credential cannot be enrolled because an equivalent one already exists:
+ * `email_already_enrolled` (this profile already has a verified email),
+ * `email_socially_verified` (the email is verified through a social login), or
+ * `credential_already_enrolled` (the email or passkey is enrolled on another
+ * profile; the profiles must be paired or the credential removed).
+ */
 export declare class CredentialAlreadyEnrolledError extends MfaError {
-    constructor(code: 'credential_already_enrolled' | 'email_already_enrolled', message: string, status?: number);
+    constructor(code: 'credential_already_enrolled' | 'email_already_enrolled' | 'email_socially_verified', message: string, status?: number);
+}
+/**
+ * The profile already has MFA credentials, so enrolling another requires an
+ * `aal:2` access token; the client must complete a step-up and retry with the
+ * same flow.
+ */
+export declare class StepUpRequiredError extends MfaError {
+    constructor(message: string, status?: number);
 }
 export declare class CredentialNotEnrolledError extends MfaError {
     constructor(message: string, status?: number);

package/dist/sdk/errors.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,~~EAAE~~,6BAA6B,~~GAAG~~,wBAAwB,~~EAC9D~~,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}
1	+ {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED;;;;;;GAMG;AACH,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,EACA,6BAA6B,GAC7B,wBAAwB,GACxB,yBAAyB,EAC7B,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA8B,EAGhE;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}

package/dist/sdk/errors.js CHANGED Viewed

@@ -18,12 +18,30 @@ export class MfaError extends Error {
         this.retryAfterMs = options?.retryAfterMs;
     }
 }
+/**
+ * The credential cannot be enrolled because an equivalent one already exists:
+ * `email_already_enrolled` (this profile already has a verified email),
+ * `email_socially_verified` (the email is verified through a social login), or
+ * `credential_already_enrolled` (the email or passkey is enrolled on another
+ * profile; the profiles must be paired or the credential removed).
+ */
 export class CredentialAlreadyEnrolledError extends MfaError {
     constructor(code, message, status = HTTP_STATUS_CODES.CONFLICT) {
         super(code, message, { status });
         this.name = 'CredentialAlreadyEnrolledError';
     }
 }
+/**
+ * The profile already has MFA credentials, so enrolling another requires an
+ * `aal:2` access token; the client must complete a step-up and retry with the
+ * same flow.
+ */
+export class StepUpRequiredError extends MfaError {
+    constructor(message, status = HTTP_STATUS_CODES.FORBIDDEN) {
+        super('aal2_required', message, { status });
+        this.name = 'StepUpRequiredError';
+    }
+}
 export class CredentialNotEnrolledError extends MfaError {
     constructor(message, status = HTTP_STATUS_CODES.CONFLICT) {
         super('credential_not_enrolled', message, { status });