@metamask-previews/profile-sync-controller 32.1.1-preview-d43f7b9f4 → 32.1.1-preview-2731bd7

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js

@@ -0,0 +1,269 @@
+import { array, assert, boolean, enums, integer, literal, min, nullable, object, optional, pattern, refine, size, string, StructError, type, union, } from '@metamask/superstruct';
+import { ElevatedTokenInvalidError, MfaError } from '../../errors.js';
+export const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp'];
+export const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);
+const CredentialDescriptorStruct = type({
+    type: literal('public-key'),
+    id: string(),
+    transports: optional(array(string())),
+});
+const ExtensionsStruct = type({});
+export const PublicKeyCredentialCreationOptionsJSONStruct = type({
+    rp: type({
+        id: string(),
+        name: string(),
+    }),
+    user: type({
+        id: string(),
+        name: string(),
+        displayName: string(),
+    }),
+    challenge: string(),
+    pubKeyCredParams: array(type({
+        type: literal('public-key'),
+        alg: integer(),
+    })),
+    excludeCredentials: optional(array(CredentialDescriptorStruct)),
+    authenticatorSelection: optional(type({
+        authenticatorAttachment: optional(string()),
+        residentKey: optional(string()),
+        requireResidentKey: optional(boolean()),
+        userVerification: optional(string()),
+    })),
+    attestation: optional(string()),
+    timeout: optional(integer()),
+    extensions: optional(ExtensionsStruct),
+});
+export const PublicKeyCredentialRequestOptionsJSONStruct = type({
+    challenge: string(),
+    rpId: optional(string()),
+    allowCredentials: optional(array(CredentialDescriptorStruct)),
+    userVerification: optional(string()),
+    timeout: optional(integer()),
+    extensions: optional(ExtensionsStruct),
+});
+export const PasskeyCreateDataStruct = type({
+    publicKey: PublicKeyCredentialCreationOptionsJSONStruct,
+});
+export const PasskeyRequestDataStruct = type({
+    publicKey: PublicKeyCredentialRequestOptionsJSONStruct,
+});
+export const RegistrationResponseJSONStruct = type({
+    id: string(),
+    rawId: string(),
+    type: literal('public-key'),
+    response: type({
+        attestationObject: string(),
+        clientDataJSON: string(),
+        transports: optional(array(string())),
+        publicKeyAlgorithm: optional(integer()),
+        publicKey: optional(string()),
+        authenticatorData: optional(string()),
+    }),
+    authenticatorAttachment: optional(nullable(string())),
+    clientExtensionResults: optional(ExtensionsStruct),
+});
+export const AuthenticationResponseJSONStruct = type({
+    id: string(),
+    rawId: string(),
+    type: literal('public-key'),
+    response: type({
+        authenticatorData: string(),
+        clientDataJSON: string(),
+        signature: string(),
+        userHandle: optional(nullable(string())),
+    }),
+    authenticatorAttachment: optional(nullable(string())),
+    clientExtensionResults: optional(ExtensionsStruct),
+});
+/**
+ * Only the assertion JWT is consumed from the verification response; the
+ * profile fields on the wire duplicate what the login flow already resolved.
+ */
+export const MfaVerifyCompleteResponseStruct = type({
+    token: string(),
+    expires_in: integer(),
+});
+export const MfaEnrollResponseStruct = type({
+    flow_id: string(),
+    expires_at: string(),
+    passkey_create_data: optional(string()),
+});
+export const MfaEnrollCompleteResponseStruct = type({
+    status: literal('enrolled'),
+});
+export const MfaVerifyResponseStruct = type({
+    flow_id: string(),
+    expires_at: string(),
+    passkey_request_data: optional(string()),
+});
+export const MfaPasskeyDetailStruct = type({
+    display_name: optional(string()),
+    added_at: optional(string()),
+});
+export const MfaEmailDetailStruct = type({
+    address: optional(string()),
+    verified: optional(boolean()),
+});
+export const MfaCredentialStruct = type({
+    // Intentionally accepts strings so future server credential types and
+    // statuses can be ignored without making the complete response invalid.
+    credential_type: string(),
+    status: string(),
+    enrolled_at: optional(string()),
+    passkey: optional(MfaPasskeyDetailStruct),
+    email: optional(MfaEmailDetailStruct),
+});
+export const MfaCredentialsResponseStruct = type({
+    credentials: array(MfaCredentialStruct),
+});
+export const MfaErrorResponseStruct = type({
+    code: optional(string()),
+    message: string(),
+});
+export const TokenReasonStruct = object({
+    operation: pattern(string(), /^[A-Za-z0-9_.:-]{1,64}$/u),
+});
+export const BeginEnrollmentRequestStruct = refine(object({
+    type: MfaCredentialTypeStruct,
+    email: optional(size(string(), 3, 254)),
+    reason: TokenReasonStruct,
+}), 'BeginEnrollmentRequest', (value) => {
+    if (value.type === 'email_otp' && value.email === undefined) {
+        return 'email is required for email_otp enrollment';
+    }
+    if (value.type === 'passkey' && value.email !== undefined) {
+        return 'email is not accepted for passkey enrollment';
+    }
+    return true;
+});
+const EmailOtpCodeStruct = pattern(string(), /^\d{6}$/u);
+const EnrollmentProofStruct = union([
+    object({
+        type: literal('passkey'),
+        attestation: RegistrationResponseJSONStruct,
+    }),
+    object({
+        type: literal('email_otp'),
+        code: EmailOtpCodeStruct,
+    }),
+]);
+export const CompleteEnrollmentRequestStruct = object({
+    flowId: string(),
+    proof: EnrollmentProofStruct,
+    reason: TokenReasonStruct,
+});
+export const BeginStepUpRequestStruct = object({
+    type: MfaCredentialTypeStruct,
+    reason: TokenReasonStruct,
+});
+const StepUpProofStruct = union([
+    object({
+        type: literal('passkey'),
+        assertion: AuthenticationResponseJSONStruct,
+    }),
+    object({
+        type: literal('email_otp'),
+        code: EmailOtpCodeStruct,
+    }),
+]);
+export const CompleteStepUpRequestStruct = object({
+    flowId: string(),
+    proof: StepUpProofStruct,
+    reason: TokenReasonStruct,
+});
+export const GetElevatedTokenRequestStruct = object({
+    maxSessionAgeMs: optional(min(integer(), 0)),
+});
+export const ElevatedTokenClaimsStruct = type({
+    sub: string(),
+    aal: literal(2),
+    exp: integer(),
+    amr: union([MfaCredentialTypeStruct, array(MfaCredentialTypeStruct)]),
+});
+function formatStructError(error) {
+    return error
+        .failures()
+        .map(({ path, message }) => `[${path.join('.')}] ${message}`)
+        .join(', ');
+}
+/**
+ * Validates data received from the authentication service.
+ *
+ * @param value - Untrusted response data.
+ * @param struct - Expected response structure.
+ * @throws MfaError if the response does not match the structure.
+ */
+export function assertValidMfaResponse(value, struct) {
+    try {
+        assert(value, struct);
+    }
+    catch (error) {
+        if (error instanceof StructError) {
+            throw new MfaError('invalid_response', formatStructError(error));
+        }
+        /* istanbul ignore next */
+        throw error;
+    }
+}
+/**
+ * Validates data received from an untyped controller boundary.
+ *
+ * @param value - Untrusted request data.
+ * @param struct - Expected request structure.
+ * @throws MfaError if the request does not match the structure.
+ */
+export function assertValidMfaRequest(value, struct) {
+    try {
+        assert(value, struct);
+    }
+    catch (error) {
+        if (error instanceof StructError) {
+            throw new MfaError('invalid_request', formatStructError(error));
+        }
+        /* istanbul ignore next */
+        throw error;
+    }
+}
+function asRecord(value) {
+    return typeof value === 'object' && value !== null
+        ? value
+        : undefined;
+}
+/**
+ * Validates and normalizes claims from an elevated access token.
+ *
+ * Hydra places hook-supplied claims under `ext` unless they are promoted to
+ * the top level, so `aal` and `amr` are read from either location.
+ *
+ * @param payload - Decoded JWT payload.
+ * @returns Validated claims with `amr` represented as an array.
+ * @throws ElevatedTokenInvalidError if claims are missing or invalid.
+ */
+export function parseElevatedTokenClaims(payload) {
+    const record = asRecord(payload);
+    const ext = asRecord(record?.ext);
+    const value = {
+        sub: record?.sub,
+        exp: record?.exp,
+        aal: record?.aal ?? ext?.aal,
+        amr: record?.amr ?? ext?.amr,
+    };
+    try {
+        assert(value, ElevatedTokenClaimsStruct);
+    }
+    catch (error) {
+        if (error instanceof StructError) {
+            throw new ElevatedTokenInvalidError(formatStructError(error));
+        }
+        /* istanbul ignore next */
+        throw error;
+    }
+    return {
+        sub: value.sub,
+        aal: value.aal,
+        exp: value.exp,
+        amr: Array.isArray(value.amr) ? value.amr : [value.amr],
+    };
+}
+//# sourceMappingURL=schemas.js.map

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,KAAK,EACL,OAAO,EACP,OAAO,EACP,GAAG,EACH,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,EACP,MAAM,EACN,IAAI,EACJ,MAAM,EACN,WAAW,EACX,IAAI,EACJ,KAAK,GACN,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAU,CAAC;AAEtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnE,MAAM,0BAA0B,GAAG,IAAI,CAAC;IACtC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,EAAE,EAAE,MAAM,EAAE;IACZ,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;IAC/D,EAAE,EAAE,IAAI,CAAC;QACP,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAM,EAAE;KACf,CAAC;IACF,IAAI,EAAE,IAAI,CAAC;QACT,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAM,EAAE;QACd,WAAW,EAAE,MAAM,EAAE;KACtB,CAAC;IACF,SAAS,EAAE,MAAM,EAAE;IACnB,gBAAgB,EAAE,KAAK,CACrB,IAAI,CAAC;QACH,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;QAC3B,GAAG,EAAE,OAAO,EAAE;KACf,CAAC,CACH;IACD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/D,sBAAsB,EAAE,QAAQ,CAC9B,IAAI,CAAC;QACH,uBAAuB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACrC,CAAC,CACH;IACD,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,MAAM,EAAE;IACnB,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,4CAA4C;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3C,SAAS,EAAE,2CAA2C;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;IACjD,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;IACnD,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,SAAS,EAAE,MAAM,EAAE;QACnB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KACzC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,KAAK,EAAE,MAAM,EAAE;IAEf,UAAU,EAAE,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,mBAAmB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,oBAAoB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAEhC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACtC,sEAAsE;IACtE,wEAAwE;IAExE,eAAe,EAAE,MAAM,EAAE;IACzB,MAAM,EAAE,MAAM,EAAE;IAEhB,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IACzC,KAAK,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAChD,MAAM,CAAC;IACL,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,EAAE,iBAAiB;CAC1B,CAAC,EACF,wBAAwB,EACxB,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,4CAA4C,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;AAEzD,MAAM,qBAAqB,GAAG,KAAK,CAAC;IAClC,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,WAAW,EAAE,8BAA8B;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;IAC7C,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,SAAS,EAAE,gCAAgC;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;IAClD,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;IAC5C,GAAG,EAAE,MAAM,EAAE;IACb,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,OAAO,EAAE;IACd,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;CACtE,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,KAAK;SACT,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IAMvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAY;QACrB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;QAC5B,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;KAC7B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KACxD,CAAC;AACJ,CAAC","sourcesContent":["import {\n  array,\n  assert,\n  boolean,\n  enums,\n  integer,\n  literal,\n  min,\n  nullable,\n  object,\n  optional,\n  pattern,\n  refine,\n  size,\n  string,\n  StructError,\n  type,\n  union,\n} from '@metamask/superstruct';\nimport type { Struct } from '@metamask/superstruct';\n\nimport { ElevatedTokenInvalidError, MfaError } from '../../errors.js';\n\nexport const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp'] as const;\n\nexport const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);\n\nconst CredentialDescriptorStruct = type({\n  type: literal('public-key'),\n  id: string(),\n  transports: optional(array(string())),\n});\n\nconst ExtensionsStruct = type({});\n\nexport const PublicKeyCredentialCreationOptionsJSONStruct = type({\n  rp: type({\n    id: string(),\n    name: string(),\n  }),\n  user: type({\n    id: string(),\n    name: string(),\n    displayName: string(),\n  }),\n  challenge: string(),\n  pubKeyCredParams: array(\n    type({\n      type: literal('public-key'),\n      alg: integer(),\n    }),\n  ),\n  excludeCredentials: optional(array(CredentialDescriptorStruct)),\n  authenticatorSelection: optional(\n    type({\n      authenticatorAttachment: optional(string()),\n      residentKey: optional(string()),\n      requireResidentKey: optional(boolean()),\n      userVerification: optional(string()),\n    }),\n  ),\n  attestation: optional(string()),\n  timeout: optional(integer()),\n  extensions: optional(ExtensionsStruct),\n});\n\nexport const PublicKeyCredentialRequestOptionsJSONStruct = type({\n  challenge: string(),\n  rpId: optional(string()),\n  allowCredentials: optional(array(CredentialDescriptorStruct)),\n  userVerification: optional(string()),\n  timeout: optional(integer()),\n  extensions: optional(ExtensionsStruct),\n});\n\nexport const PasskeyCreateDataStruct = type({\n  publicKey: PublicKeyCredentialCreationOptionsJSONStruct,\n});\n\nexport const PasskeyRequestDataStruct = type({\n  publicKey: PublicKeyCredentialRequestOptionsJSONStruct,\n});\n\nexport const RegistrationResponseJSONStruct = type({\n  id: string(),\n  rawId: string(),\n  type: literal('public-key'),\n  response: type({\n    attestationObject: string(),\n    clientDataJSON: string(),\n    transports: optional(array(string())),\n    publicKeyAlgorithm: optional(integer()),\n    publicKey: optional(string()),\n    authenticatorData: optional(string()),\n  }),\n  authenticatorAttachment: optional(nullable(string())),\n  clientExtensionResults: optional(ExtensionsStruct),\n});\n\nexport const AuthenticationResponseJSONStruct = type({\n  id: string(),\n  rawId: string(),\n  type: literal('public-key'),\n  response: type({\n    authenticatorData: string(),\n    clientDataJSON: string(),\n    signature: string(),\n    userHandle: optional(nullable(string())),\n  }),\n  authenticatorAttachment: optional(nullable(string())),\n  clientExtensionResults: optional(ExtensionsStruct),\n});\n\n/**\n * Only the assertion JWT is consumed from the verification response; the\n * profile fields on the wire duplicate what the login flow already resolved.\n */\nexport const MfaVerifyCompleteResponseStruct = type({\n  token: string(),\n\n  expires_in: integer(),\n});\n\nexport const MfaEnrollResponseStruct = type({\n  flow_id: string(),\n\n  expires_at: string(),\n\n  passkey_create_data: optional(string()),\n});\n\nexport const MfaEnrollCompleteResponseStruct = type({\n  status: literal('enrolled'),\n});\n\nexport const MfaVerifyResponseStruct = type({\n  flow_id: string(),\n\n  expires_at: string(),\n\n  passkey_request_data: optional(string()),\n});\n\nexport const MfaPasskeyDetailStruct = type({\n  display_name: optional(string()),\n\n  added_at: optional(string()),\n});\n\nexport const MfaEmailDetailStruct = type({\n  address: optional(string()),\n  verified: optional(boolean()),\n});\n\nexport const MfaCredentialStruct = type({\n  // Intentionally accepts strings so future server credential types and\n  // statuses can be ignored without making the complete response invalid.\n\n  credential_type: string(),\n  status: string(),\n\n  enrolled_at: optional(string()),\n  passkey: optional(MfaPasskeyDetailStruct),\n  email: optional(MfaEmailDetailStruct),\n});\n\nexport const MfaCredentialsResponseStruct = type({\n  credentials: array(MfaCredentialStruct),\n});\n\nexport const MfaErrorResponseStruct = type({\n  code: optional(string()),\n  message: string(),\n});\n\nexport const TokenReasonStruct = object({\n  operation: pattern(string(), /^[A-Za-z0-9_.:-]{1,64}$/u),\n});\n\nexport const BeginEnrollmentRequestStruct = refine(\n  object({\n    type: MfaCredentialTypeStruct,\n    email: optional(size(string(), 3, 254)),\n    reason: TokenReasonStruct,\n  }),\n  'BeginEnrollmentRequest',\n  (value) => {\n    if (value.type === 'email_otp' && value.email === undefined) {\n      return 'email is required for email_otp enrollment';\n    }\n    if (value.type === 'passkey' && value.email !== undefined) {\n      return 'email is not accepted for passkey enrollment';\n    }\n    return true;\n  },\n);\n\nconst EmailOtpCodeStruct = pattern(string(), /^\\d{6}$/u);\n\nconst EnrollmentProofStruct = union([\n  object({\n    type: literal('passkey'),\n    attestation: RegistrationResponseJSONStruct,\n  }),\n  object({\n    type: literal('email_otp'),\n    code: EmailOtpCodeStruct,\n  }),\n]);\n\nexport const CompleteEnrollmentRequestStruct = object({\n  flowId: string(),\n  proof: EnrollmentProofStruct,\n  reason: TokenReasonStruct,\n});\n\nexport const BeginStepUpRequestStruct = object({\n  type: MfaCredentialTypeStruct,\n  reason: TokenReasonStruct,\n});\n\nconst StepUpProofStruct = union([\n  object({\n    type: literal('passkey'),\n    assertion: AuthenticationResponseJSONStruct,\n  }),\n  object({\n    type: literal('email_otp'),\n    code: EmailOtpCodeStruct,\n  }),\n]);\n\nexport const CompleteStepUpRequestStruct = object({\n  flowId: string(),\n  proof: StepUpProofStruct,\n  reason: TokenReasonStruct,\n});\n\nexport const GetElevatedTokenRequestStruct = object({\n  maxSessionAgeMs: optional(min(integer(), 0)),\n});\n\nexport const ElevatedTokenClaimsStruct = type({\n  sub: string(),\n  aal: literal(2),\n  exp: integer(),\n  amr: union([MfaCredentialTypeStruct, array(MfaCredentialTypeStruct)]),\n});\n\nfunction formatStructError(error: StructError): string {\n  return error\n    .failures()\n    .map(({ path, message }) => `[${path.join('.')}] ${message}`)\n    .join(', ');\n}\n\n/**\n * Validates data received from the authentication service.\n *\n * @param value - Untrusted response data.\n * @param struct - Expected response structure.\n * @throws MfaError if the response does not match the structure.\n */\nexport function assertValidMfaResponse<Value>(\n  value: unknown,\n  struct: Struct<Value>,\n): asserts value is Value {\n  try {\n    assert(value, struct);\n  } catch (error) {\n    if (error instanceof StructError) {\n      throw new MfaError('invalid_response', formatStructError(error));\n    }\n    /* istanbul ignore next */\n    throw error;\n  }\n}\n\n/**\n * Validates data received from an untyped controller boundary.\n *\n * @param value - Untrusted request data.\n * @param struct - Expected request structure.\n * @throws MfaError if the request does not match the structure.\n */\nexport function assertValidMfaRequest<Value>(\n  value: unknown,\n  struct: Struct<Value>,\n): asserts value is Value {\n  try {\n    assert(value, struct);\n  } catch (error) {\n    if (error instanceof StructError) {\n      throw new MfaError('invalid_request', formatStructError(error));\n    }\n    /* istanbul ignore next */\n    throw error;\n  }\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> | undefined {\n  return typeof value === 'object' && value !== null\n    ? (value as Record<string, unknown>)\n    : undefined;\n}\n\n/**\n * Validates and normalizes claims from an elevated access token.\n *\n * Hydra places hook-supplied claims under `ext` unless they are promoted to\n * the top level, so `aal` and `amr` are read from either location.\n *\n * @param payload - Decoded JWT payload.\n * @returns Validated claims with `amr` represented as an array.\n * @throws ElevatedTokenInvalidError if claims are missing or invalid.\n */\nexport function parseElevatedTokenClaims(payload: unknown): {\n  sub: string;\n  aal: 2;\n  exp: number;\n  amr: ('passkey' | 'email_otp')[];\n} {\n  const record = asRecord(payload);\n  const ext = asRecord(record?.ext);\n  const value: unknown = {\n    sub: record?.sub,\n    exp: record?.exp,\n    aal: record?.aal ?? ext?.aal,\n    amr: record?.amr ?? ext?.amr,\n  };\n\n  try {\n    assert(value, ElevatedTokenClaimsStruct);\n  } catch (error) {\n    if (error instanceof StructError) {\n      throw new ElevatedTokenInvalidError(formatStructError(error));\n    }\n    /* istanbul ignore next */\n    throw error;\n  }\n\n  return {\n    sub: value.sub,\n    aal: value.aal,\n    exp: value.exp,\n    amr: Array.isArray(value.amr) ? value.amr : [value.amr],\n  };\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts

@@ -0,0 +1,125 @@
+import type { Infer } from '@metamask/superstruct';
+import type { AuthenticationResponseJSONStruct, MfaCredentialStruct, MfaCredentialsResponseStruct, MfaEmailDetailStruct, MfaEnrollCompleteResponseStruct, MfaEnrollResponseStruct, MfaPasskeyDetailStruct, MfaVerifyCompleteResponseStruct, MfaVerifyResponseStruct, PublicKeyCredentialCreationOptionsJSONStruct, PublicKeyCredentialRequestOptionsJSONStruct, RegistrationResponseJSONStruct } from './schemas.js';
+import { MFA_CREDENTIAL_TYPES } from './schemas.js';
+export { MFA_CREDENTIAL_TYPES };
+export type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];
+export type MfaCredentialStatus = 'active' | 'pending';
+export type PublicKeyCredentialCreationOptionsJSON = Infer<typeof PublicKeyCredentialCreationOptionsJSONStruct>;
+export type PublicKeyCredentialRequestOptionsJSON = Infer<typeof PublicKeyCredentialRequestOptionsJSONStruct>;
+export type RegistrationResponseJSON = Infer<typeof RegistrationResponseJSONStruct>;
+export type AuthenticationResponseJSON = Infer<typeof AuthenticationResponseJSONStruct>;
+export type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;
+export type MfaEnrollCompleteResponse = Infer<typeof MfaEnrollCompleteResponseStruct>;
+export type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;
+export type MfaVerifyCompleteResponse = Infer<typeof MfaVerifyCompleteResponseStruct>;
+export type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;
+export type MfaCredential = Infer<typeof MfaCredentialStruct>;
+export type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;
+export type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;
+export type MfaEnrollRequest = {
+    credential_type: MfaCredentialType;
+    identifier?: string;
+};
+export type MfaEnrollCompleteRequest = {
+    credential_type: MfaCredentialType;
+    flow_id: string;
+    otp_code?: string;
+    passkey_attestation?: string;
+};
+export type MfaVerifyRequest = {
+    credential_type: MfaCredentialType;
+};
+export type MfaVerifyCompleteRequest = {
+    credential_type: MfaCredentialType;
+    flow_id: string;
+    passkey_assertion?: string;
+    otp_code?: string;
+};
+export type EnrolledCredential = {
+    type: 'passkey';
+    status: MfaCredentialStatus;
+    enrolledAt?: number;
+    displayName?: string;
+} | {
+    type: 'email_otp';
+    status: MfaCredentialStatus;
+    enrolledAt?: number;
+    email: string;
+    verified: boolean;
+};
+/**
+ * Caller-supplied context attached to MFA trace spans. `operation` names the
+ * client flow that needs the credential (for example `money.signTransaction`).
+ */
+export type TokenReason = {
+    operation: string;
+};
+export type EnrollmentChallenge = {
+    type: 'passkey';
+    flowId: string;
+    expiresAt: number;
+    publicKey: PublicKeyCredentialCreationOptionsJSON;
+} | {
+    type: 'email_otp';
+    flowId: string;
+    expiresAt: number;
+};
+export type EnrollmentProof = {
+    type: 'passkey';
+    attestation: RegistrationResponseJSON;
+} | {
+    type: 'email_otp';
+    code: string;
+};
+export type StepUpChallenge = {
+    type: 'passkey';
+    flowId: string;
+    expiresAt: number;
+    publicKey: PublicKeyCredentialRequestOptionsJSON;
+} | {
+    type: 'email_otp';
+    flowId: string;
+    expiresAt: number;
+};
+export type StepUpProof = {
+    type: 'passkey';
+    assertion: AuthenticationResponseJSON;
+} | {
+    type: 'email_otp';
+    code: string;
+};
+export type ElevatedProfileToken = {
+    accessToken: string;
+    expiresIn: number;
+    obtainedAt: number;
+    claims: {
+        sub: string;
+        aal: 2;
+        amr: MfaCredentialType[];
+        exp: number;
+    };
+};
+export type BeginEnrollmentRequest = {
+    type: MfaCredentialType;
+    email?: string;
+    reason: TokenReason;
+};
+export type CompleteEnrollmentRequest = {
+    flowId: string;
+    proof: EnrollmentProof;
+    reason: TokenReason;
+};
+export type BeginStepUpRequest = {
+    type: MfaCredentialType;
+    reason: TokenReason;
+};
+export type CompleteStepUpRequest = {
+    flowId: string;
+    proof: StepUpProof;
+    reason: TokenReason;
+};
+export type GetElevatedTokenRequest = {
+    maxSessionAgeMs?: number;
+};
+export type MfaErrorCode = 'max_passkeys_reached' | 'max_identifiers_reached' | 'email_already_enrolled' | 'credential_already_enrolled' | 'credential_not_enrolled' | 'mfa_identity_missing' | 'otp_resend_cooldown' | 'rate_limited' | 'kratos_unavailable' | 'flow_expired' | 'invalid_flow' | 'invalid_attestation' | 'invalid_code' | 'invalid_assertion' | 'too_many_attempts' | 'elevated_token_invalid' | 'authentication_required' | 'server_error' | 'invalid_response' | 'invalid_request';
+//# sourceMappingURL=types.d.ts.map

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,sCAAsC,GAAG,KAAK,CACxD,OAAO,4CAA4C,CACpD,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,KAAK,CACvD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAC1C,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,sCAAsC,CAAC;CACnD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qCAAqC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,WAAW,GACnB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,CAAC,CAAC;QACP,GAAG,EAAE,iBAAiB,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,YAAY,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,yBAAyB,GACzB,sBAAsB,GACtB,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,yBAAyB,GACzB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC"}

package/dist/sdk/authentication-jwt-bearer/mfa/types.js

@@ -0,0 +1,3 @@
+import { MFA_CREDENTIAL_TYPES } from './schemas.js';
+export { MFA_CREDENTIAL_TYPES };
+//# sourceMappingURL=types.js.map

package/dist/sdk/authentication-jwt-bearer/mfa/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { Infer } from '@metamask/superstruct';\n\nimport type {\n  AuthenticationResponseJSONStruct,\n  MfaCredentialStruct,\n  MfaCredentialsResponseStruct,\n  MfaEmailDetailStruct,\n  MfaEnrollCompleteResponseStruct,\n  MfaEnrollResponseStruct,\n  MfaPasskeyDetailStruct,\n  MfaVerifyCompleteResponseStruct,\n  MfaVerifyResponseStruct,\n  PublicKeyCredentialCreationOptionsJSONStruct,\n  PublicKeyCredentialRequestOptionsJSONStruct,\n  RegistrationResponseJSONStruct,\n} from './schemas.js';\nimport { MFA_CREDENTIAL_TYPES } from './schemas.js';\n\nexport { MFA_CREDENTIAL_TYPES };\n\nexport type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];\n\nexport type MfaCredentialStatus = 'active' | 'pending';\n\nexport type PublicKeyCredentialCreationOptionsJSON = Infer<\n  typeof PublicKeyCredentialCreationOptionsJSONStruct\n>;\n\nexport type PublicKeyCredentialRequestOptionsJSON = Infer<\n  typeof PublicKeyCredentialRequestOptionsJSONStruct\n>;\n\nexport type RegistrationResponseJSON = Infer<\n  typeof RegistrationResponseJSONStruct\n>;\n\nexport type AuthenticationResponseJSON = Infer<\n  typeof AuthenticationResponseJSONStruct\n>;\n\nexport type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;\n\nexport type MfaEnrollCompleteResponse = Infer<\n  typeof MfaEnrollCompleteResponseStruct\n>;\n\nexport type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;\n\nexport type MfaVerifyCompleteResponse = Infer<\n  typeof MfaVerifyCompleteResponseStruct\n>;\n\nexport type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;\n\nexport type MfaCredential = Infer<typeof MfaCredentialStruct>;\n\nexport type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;\n\nexport type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;\n\nexport type MfaEnrollRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  identifier?: string;\n};\n\nexport type MfaEnrollCompleteRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_attestation?: string;\n};\n\nexport type MfaVerifyRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n};\n\nexport type MfaVerifyCompleteRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_assertion?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n};\n\nexport type EnrolledCredential =\n  | {\n      type: 'passkey';\n      status: MfaCredentialStatus;\n      enrolledAt?: number;\n      displayName?: string;\n    }\n  | {\n      type: 'email_otp';\n      status: MfaCredentialStatus;\n      enrolledAt?: number;\n      email: string;\n      verified: boolean;\n    };\n\n/**\n * Caller-supplied context attached to MFA trace spans. `operation` names the\n * client flow that needs the credential (for example `money.signTransaction`).\n */\nexport type TokenReason = {\n  operation: string;\n};\n\nexport type EnrollmentChallenge =\n  | {\n      type: 'passkey';\n      flowId: string;\n      expiresAt: number;\n      publicKey: PublicKeyCredentialCreationOptionsJSON;\n    }\n  | {\n      type: 'email_otp';\n      flowId: string;\n      expiresAt: number;\n    };\n\nexport type EnrollmentProof =\n  | {\n      type: 'passkey';\n      attestation: RegistrationResponseJSON;\n    }\n  | {\n      type: 'email_otp';\n      code: string;\n    };\n\nexport type StepUpChallenge =\n  | {\n      type: 'passkey';\n      flowId: string;\n      expiresAt: number;\n      publicKey: PublicKeyCredentialRequestOptionsJSON;\n    }\n  | {\n      type: 'email_otp';\n      flowId: string;\n      expiresAt: number;\n    };\n\nexport type StepUpProof =\n  | {\n      type: 'passkey';\n      assertion: AuthenticationResponseJSON;\n    }\n  | {\n      type: 'email_otp';\n      code: string;\n    };\n\nexport type ElevatedProfileToken = {\n  accessToken: string;\n  expiresIn: number;\n  obtainedAt: number;\n  claims: {\n    sub: string;\n    aal: 2;\n    amr: MfaCredentialType[];\n    exp: number;\n  };\n};\n\nexport type BeginEnrollmentRequest = {\n  type: MfaCredentialType;\n  email?: string;\n  reason: TokenReason;\n};\n\nexport type CompleteEnrollmentRequest = {\n  flowId: string;\n  proof: EnrollmentProof;\n  reason: TokenReason;\n};\n\nexport type BeginStepUpRequest = {\n  type: MfaCredentialType;\n  reason: TokenReason;\n};\n\nexport type CompleteStepUpRequest = {\n  flowId: string;\n  proof: StepUpProof;\n  reason: TokenReason;\n};\n\nexport type GetElevatedTokenRequest = {\n  maxSessionAgeMs?: number;\n};\n\nexport type MfaErrorCode =\n  | 'max_passkeys_reached'\n  | 'max_identifiers_reached'\n  | 'email_already_enrolled'\n  | 'credential_already_enrolled'\n  | 'credential_not_enrolled'\n  | 'mfa_identity_missing'\n  | 'otp_resend_cooldown'\n  | 'rate_limited'\n  | 'kratos_unavailable'\n  | 'flow_expired'\n  | 'invalid_flow'\n  | 'invalid_attestation'\n  | 'invalid_code'\n  | 'invalid_assertion'\n  | 'too_many_attempts'\n  | 'elevated_token_invalid'\n  | 'authentication_required'\n  | 'server_error'\n  | 'invalid_response'\n  | 'invalid_request';\n"]}

package/dist/sdk/constants.d.ts

@@ -1,6 +1,8 @@
 export declare const HTTP_STATUS_CODES: {
+    UNAUTHORIZED: number;
     CONFLICT: number;
     UNPROCESSABLE_ENTITY: number;
     TOO_MANY_REQUESTS: number;
+    BAD_GATEWAY: number;
 };
 //# sourceMappingURL=constants.d.ts.map

package/dist/sdk/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;IAC5B,QAAQ;IACR,oBAAoB;IACpB,iBAAiB;CAClB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB;IAC5B,YAAY;IACZ,QAAQ;IACR,oBAAoB;IACpB,iBAAiB;IACjB,WAAW;CACZ,CAAC"}

package/dist/sdk/constants.js

@@ -1,6 +1,8 @@
 export const HTTP_STATUS_CODES = {
+    UNAUTHORIZED: 401,
     CONFLICT: 409,
     UNPROCESSABLE_ENTITY: 422,
     TOO_MANY_REQUESTS: 429,
+    BAD_GATEWAY: 502,
 };
 //# sourceMappingURL=constants.js.map

package/dist/sdk/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;CACvB,CAAC","sourcesContent":["export const HTTP_STATUS_CODES = {\n  CONFLICT: 409,\n  UNPROCESSABLE_ENTITY: 422,\n  TOO_MANY_REQUESTS: 429,\n};\n"]}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/sdk/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY,EAAE,GAAG;IACjB,QAAQ,EAAE,GAAG;IACb,oBAAoB,EAAE,GAAG;IACzB,iBAAiB,EAAE,GAAG;IACtB,WAAW,EAAE,GAAG;CACjB,CAAC","sourcesContent":["export const HTTP_STATUS_CODES = {\n  UNAUTHORIZED: 401,\n  CONFLICT: 409,\n  UNPROCESSABLE_ENTITY: 422,\n  TOO_MANY_REQUESTS: 429,\n  BAD_GATEWAY: 502,\n};\n"]}

package/dist/sdk/errors.d.ts

@@ -1,3 +1,93 @@
+import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';
+type ExtensibleMfaErrorCode = MfaErrorCode | (string & {});
+/**
+ * Base error for MFA operations.
+ *
+ * The machine-readable code is an enumerable own property so it survives
+ * JSON-RPC error serialization.
+ */
+export declare class MfaError extends Error {
+    readonly mfaCode: ExtensibleMfaErrorCode;
+    readonly status?: number;
+    readonly retryAfterMs?: number;
+    constructor(mfaCode: ExtensibleMfaErrorCode, message: string, options?: {
+        status?: number;
+        retryAfterMs?: number;
+    });
+}
+export declare class CredentialAlreadyEnrolledError extends MfaError {
+    constructor(code: 'credential_already_enrolled' | 'email_already_enrolled', message: string, status?: number);
+}
+export declare class CredentialNotEnrolledError extends MfaError {
+    constructor(message: string, status?: number);
+}
+/**
+ * The begin/complete flow is stale or unknown; the client must restart it.
+ */
+export declare class MfaFlowExpiredError extends MfaError {
+    constructor(code: 'flow_expired' | 'invalid_flow', message: string, status?: number);
+}
+/**
+ * The profile has no identity-provider record yet. Not a stale flow: the
+ * user must enroll a first credential before verifying.
+ */
+export declare class MfaIdentityMissingError extends MfaError {
+    constructor(message: string, status?: number);
+}
+export declare class MfaVerificationFailedError extends MfaError {
+    constructor(code: 'invalid_code' | 'invalid_attestation' | 'invalid_assertion', message: string, status?: number);
+}
+export declare class TooManyAttemptsError extends MfaError {
+    constructor(message: string, status?: number);
+}
+export declare class MaxPasskeysReachedError extends MfaError {
+    constructor(message: string, status?: number);
+}
+export declare class MaxIdentifiersReachedError extends MfaError {
+    constructor(message: string, status?: number);
+}
+export declare class OtpResendCooldownError extends MfaError {
+    constructor(message: string, retryAfterMs?: number, status?: number);
+}
+/**
+ * A 429 without an MFA-specific code: generic throttling, not an OTP resend
+ * cooldown.
+ */
+export declare class MfaRateLimitedError extends MfaError {
+    constructor(message: string, retryAfterMs?: number, status?: number);
+}
+/**
+ * The identity provider or the network is unreachable. Safe to retry.
+ * `status` is only set when the service answered.
+ */
+export declare class MfaUnavailableError extends MfaError {
+    constructor(message: string, status?: number);
+}
+export declare class ElevatedTokenInvalidError extends MfaError {
+    constructor(message: string);
+}
+/**
+ * Gets an MFA code from direct, serialized, or message-only errors.
+ *
+ * @param error - Value to inspect.
+ * @returns The stable code, if present.
+ */
+export declare function getMfaErrorCode(error: unknown): ExtensibleMfaErrorCode | undefined;
+/**
+ * Checks whether a value carries an MFA error code.
+ *
+ * @param error - Value to inspect.
+ * @param codes - Optional codes to match.
+ * @returns Whether the value is an MFA error with a requested code.
+ */
+export declare function isMfaError(error: unknown, ...codes: ExtensibleMfaErrorCode[]): boolean;
+/**
+ * Gets a retry delay from direct or serialized MFA errors.
+ *
+ * @param error - Value to inspect.
+ * @returns Retry delay in milliseconds, if present.
+ */
+export declare function getMfaRetryAfterMs(error: unknown): number | undefined;
 export declare class NonceRetrievalError extends Error {
     constructor(message: string);
 }
@@ -49,4 +139,5 @@ export declare class RateLimitedError extends Error {
      */
     static isRateLimitError(e: unknown): e is RateLimitedError;
 }
+export {};
 //# sourceMappingURL=errors.d.ts.map

package/dist/sdk/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAEA,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAG7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAU3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,EAAE,6BAA6B,GAAG,wBAAwB,EAC9D,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}