@metamask-previews/profile-sync-controller 32.3.1-preview-3c2e73813 → 32.3.1-preview-33429d645

package/dist/sdk/authentication-jwt-bearer/mfa/services.js.map

@@ -1 +1 @@
-{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAgBtB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AA2CzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAoBD;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,IAA8B,EAC9B,QAAkB;IAElB,OAAO,IAAI,EAAE,mBAAmB,KAAK,SAAS;QAC5C,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB;IAElB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,OAAO,IAAI,QAAQ,MAAM,EAAE,EAAE,CAAC;IAEvE,uEAAuE;IACvE,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,KAAK,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,6BAA6B,CAAC;QACnC,KAAK,wBAAwB,CAAC;QAC9B,KAAK,yBAAyB;YAC5B,MAAM,IAAI,8BAA8B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,eAAe;YAClB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,cAAc,CAAC;QACpB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB;YACtB,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,mBAAmB;YACtB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,qBAAqB;YACxB,MAAM,IAAI,sBAAsB,CAC9B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;QACJ,KAAK,oBAAoB;YACvB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD;YACE,MAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,GAAG,WAAW,qCAAqC,MAAM,GAAG,EAC5D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,IAA+C;IAE/C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC5C;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,mBAAmB;YAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAkC;IAElC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,qBAAqB,CACnB,MAAM,CAAC,mBAAmB,EAC1B,8BAA8B,CAC/B,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oBAAoB;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAoC;IAEpC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,qBAAqB,CACnB,MAAM,CAAC,iBAAiB,EACxB,gCAAgC,CACjC,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAyB;IAEzB,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oDAAoD,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,MAAM;QACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;IAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY;gBAClC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,IAAI,UAAU,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;YAC/B,iEAAiE;YACjE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,KAAK,QAAQ;SAC3D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW;SACpB,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,CAAC,UAAU,EAAoC,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;AACN,CAAC","sourcesContent":["import type { Json } from '@metamask/utils';\nimport log from 'loglevel';\n\nimport type { Env } from '../../../shared/env.js';\nimport { getEnvUrls } from '../../../shared/env.js';\nimport { HTTP_STATUS_CODES } from '../../constants.js';\nimport {\n  CredentialAlreadyEnrolledError,\n  CredentialNotEnrolledError,\n  MaxIdentifiersReachedError,\n  MaxPasskeysReachedError,\n  MfaError,\n  MfaFlowExpiredError,\n  MfaIdentityMissingError,\n  MfaRateLimitedError,\n  MfaUnavailableError,\n  MfaVerificationFailedError,\n  OtpResendCooldownError,\n  StepUpRequiredError,\n  TooManyAttemptsError,\n} from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\nimport { toErrorMessage } from '../../utils/to-error-message.js';\nimport {\n  AuthenticationResponseJSONStruct,\n  MfaCredentialsResponseStruct,\n  MfaEnrollCompleteResponseStruct,\n  MfaEnrollResponseStruct,\n  MfaErrorResponseStruct,\n  MfaVerifyCompleteResponseStruct,\n  MfaVerifyResponseStruct,\n  PasskeyCreateDataStruct,\n  PasskeyRequestDataStruct,\n  RegistrationResponseJSONStruct,\n  assertValidMfaRequest,\n  assertValidMfaResponse,\n} from './schemas.js';\nimport type {\n  AuthenticationResponseJSON,\n  EnrolledCredential,\n  MfaCredential,\n  MfaCredentialStatus,\n  MfaCredentialType,\n  MfaEnrollCompleteRequest,\n  MfaEnrollRequest,\n  MfaVerifyCompleteRequest,\n  MfaVerifyRequest,\n  PublicKeyCredentialCreationOptionsJSON as PasskeyCreationOptions,\n  PublicKeyCredentialRequestOptionsJSON as PasskeyRequestOptions,\n  RegistrationResponseJSON,\n} from './types.js';\n\nexport const MFA_ENROLL_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll`;\n\nexport const MFA_ENROLL_COMPLETE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll/complete`;\n\nexport const MFA_VERIFY_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify`;\n\nexport const MFA_VERIFY_COMPLETE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;\n\nexport const MFA_CREDENTIALS_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;\n\ntype EnrollmentServiceResult = {\n  flowId: string;\n  expiresAt: number;\n  publicKey?: PasskeyCreationOptions;\n};\n\ntype VerificationServiceResult = {\n  flowId: string;\n  expiresAt: number;\n  publicKey?: PasskeyRequestOptions;\n};\n\nexport type MfaStepUpAssertion = {\n  /** AAL2 assertion JWT to exchange at Hydra for an elevated access token. */\n  token: string;\n  /** Assertion lifetime in seconds. */\n  expiresIn: number;\n};\n\ntype EnrollmentCompletionParams = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_attestation?: RegistrationResponseJSON;\n};\n\ntype VerificationCompletionParams = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_assertion?: AuthenticationResponseJSON;\n};\n\n/**\n * Reads a credential's enrollment date. Unlike flow deadlines, this is display\n * metadata, so an unparsable value is dropped instead of rejecting the whole\n * credential list.\n *\n * @param value - The raw `enrolled_at` value, if the server sent one.\n * @returns The epoch milliseconds, or undefined when absent or unparsable.\n */\nfunction parseEnrolledAt(value: string | undefined): number | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const enrolledAt = Date.parse(value);\n  if (Number.isNaN(enrolledAt)) {\n    log.warn(`Ignoring unparsable MFA credential enrolled_at: ${value}`);\n    return undefined;\n  }\n  return enrolledAt;\n}\n\nfunction parseExpiresAt(value: string): number {\n  const expiresAt = Date.parse(value);\n  if (Number.isNaN(expiresAt)) {\n    throw new MfaError('invalid_response', `Invalid expires_at: ${value}`);\n  }\n  return expiresAt;\n}\n\n/**\n * Parses passkey creation data embedded in an enrollment response.\n *\n * @param value - JSON-encoded creation options.\n * @returns Validated public-key creation options.\n */\nexport function parsePasskeyCreateData(value: string): PasskeyCreationOptions {\n  try {\n    const parsed: unknown = JSON.parse(value);\n    assertValidMfaResponse(parsed, PasskeyCreateDataStruct);\n    return parsed.publicKey;\n  } catch (error) {\n    if (error instanceof MfaError) {\n      throw error;\n    }\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message);\n  }\n}\n\n/**\n * Parses passkey request data embedded in a verification response.\n *\n * @param value - JSON-encoded request options.\n * @returns Validated public-key request options.\n */\nexport function parsePasskeyRequestData(value: string): PasskeyRequestOptions {\n  try {\n    const parsed: unknown = JSON.parse(value);\n    assertValidMfaResponse(parsed, PasskeyRequestDataStruct);\n    return parsed.publicKey;\n  } catch (error) {\n    if (error instanceof MfaError) {\n      throw error;\n    }\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message);\n  }\n}\n\n/**\n * Reads a `Retry-After` header as a delay. The human-readable error message is\n * deliberately not parsed: the API documents it as unstable.\n *\n * @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined without a usable header.\n */\nfunction parseRetryAfter(response: Response): number | undefined {\n  const header = response.headers.get('Retry-After');\n  if (!header) {\n    return undefined;\n  }\n  const seconds = Number(header);\n  if (Number.isInteger(seconds)) {\n    return Math.max(0, seconds * 1000);\n  }\n  const date = Date.parse(header);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\n/**\n * Reads and validates the JSON error body of a failed MFA request.\n *\n * When the body parses as JSON but does not match the documented error\n * shape, a `message` field is salvaged if present so callers still get a\n * useful diagnostic instead of a content-free fallback.\n *\n * @param response - The failed response.\n * @returns The validated error body, a best-effort salvage of it, or\n * undefined when the body could not be parsed as JSON at all.\n */\ntype MfaErrorBody = {\n  code?: string;\n  message: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  retry_after_seconds?: number;\n};\n\n/**\n * Prefers the documented `retry_after_seconds` error field over the\n * `Retry-After` header.\n *\n * @param body - The parsed error body, if any.\n * @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined when neither is usable.\n */\nfunction resolveRetryAfterMs(\n  body: MfaErrorBody | undefined,\n  response: Response,\n): number | undefined {\n  return body?.retry_after_seconds === undefined\n    ? parseRetryAfter(response)\n    : body.retry_after_seconds * 1000;\n}\n\nasync function readErrorBody(\n  response: Response,\n): Promise<MfaErrorBody | undefined> {\n  let body: unknown;\n  try {\n    body = await response.json();\n  } catch {\n    return undefined;\n  }\n\n  try {\n    assertValidMfaResponse(body, MfaErrorResponseStruct);\n    return body;\n  } catch {\n    const message = asRecord(body)?.message;\n    return typeof message === 'string' ? { message } : undefined;\n  }\n}\n\nasync function throwMfaError(\n  response: Response,\n  errorPrefix: string,\n): Promise<never> {\n  const { status } = response;\n  const body = await readErrorBody(response);\n  const message = `${errorPrefix}: ${body?.message ?? `HTTP ${status}`}`;\n\n  // Status-only classification first: gateways and load balancers answer\n  // 401/429/502 without the service's JSON body, and the caller still needs\n  // to invalidate its session, honour Retry-After, or back off.\n  if (status === HTTP_STATUS_CODES.UNAUTHORIZED) {\n    throw new MfaError('authentication_required', message, { status });\n  }\n\n  const code = body?.code;\n  switch (code) {\n    case 'credential_already_enrolled':\n    case 'email_already_enrolled':\n    case 'email_socially_verified':\n      throw new CredentialAlreadyEnrolledError(code, message, status);\n    case 'credential_not_enrolled':\n      throw new CredentialNotEnrolledError(message, status);\n    case 'aal2_required':\n      throw new StepUpRequiredError(message, status);\n    case 'flow_expired':\n    case 'invalid_flow':\n      throw new MfaFlowExpiredError(code, message, status);\n    case 'mfa_identity_missing':\n      throw new MfaIdentityMissingError(message, status);\n    case 'invalid_code':\n    case 'invalid_attestation':\n    case 'invalid_assertion':\n      throw new MfaVerificationFailedError(code, message, status);\n    case 'too_many_attempts':\n      throw new TooManyAttemptsError(message, status);\n    case 'max_passkeys_reached':\n      throw new MaxPasskeysReachedError(message, status);\n    case 'max_identifiers_reached':\n      throw new MaxIdentifiersReachedError(message, status);\n    case 'otp_resend_cooldown':\n      throw new OtpResendCooldownError(\n        message,\n        resolveRetryAfterMs(body, response),\n        status,\n      );\n    case 'kratos_unavailable':\n      throw new MfaUnavailableError(message, status);\n    default:\n      break;\n  }\n\n  if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n    throw new MfaRateLimitedError(\n      message,\n      resolveRetryAfterMs(body, response),\n      status,\n    );\n  }\n  if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {\n    throw new MfaUnavailableError(message, status);\n  }\n  if (!body) {\n    throw new MfaError(\n      'invalid_response',\n      `${errorPrefix}: Unexpected error response (HTTP ${status})`,\n      { status },\n    );\n  }\n  throw new MfaError(code ?? 'server_error', message, { status });\n}\n\nasync function requestJson(\n  url: string,\n  accessToken: string,\n  init?: { method?: 'GET' | 'POST'; body?: Json },\n): Promise<Json> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      method: init?.method ?? 'GET',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        ...(init?.body === undefined\n          ? {}\n          : { 'Content-Type': 'application/json' }),\n      },\n      ...(init?.body === undefined ? {} : { body: JSON.stringify(init.body) }),\n    });\n  } catch (error) {\n    const message = toErrorMessage(error);\n    throw new MfaUnavailableError(`MFA request failed: ${message}`);\n  }\n\n  if (!response.ok) {\n    return await throwMfaError(response, 'MFA request failed');\n  }\n\n  try {\n    return await response.json();\n  } catch (error) {\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message, {\n      status: response.status,\n    });\n  }\n}\n\n/**\n * Begins enrollment of an MFA credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Enrollment request.\n * @returns Validated enrollment flow data.\n */\nexport async function mfaEnroll(\n  env: Env,\n  accessToken: string,\n  body: MfaEnrollRequest,\n): Promise<EnrollmentServiceResult> {\n  const json = await requestJson(MFA_ENROLL_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaEnrollResponseStruct);\n\n  return {\n    flowId: json.flow_id,\n    expiresAt: parseExpiresAt(json.expires_at),\n    ...(json.passkey_create_data\n      ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }\n      : {}),\n  };\n}\n\n/**\n * Completes enrollment of an MFA credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and enrollment proof.\n */\nexport async function mfaEnrollComplete(\n  env: Env,\n  accessToken: string,\n  params: EnrollmentCompletionParams,\n): Promise<void> {\n  let body: MfaEnrollCompleteRequest = {\n    credential_type: params.credential_type,\n    flow_id: params.flow_id,\n    ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n  };\n  if (params.passkey_attestation) {\n    assertValidMfaRequest(\n      params.passkey_attestation,\n      RegistrationResponseJSONStruct,\n    );\n    body = {\n      ...body,\n      passkey_attestation: JSON.stringify(params.passkey_attestation),\n    };\n  }\n\n  const json = await requestJson(MFA_ENROLL_COMPLETE_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaEnrollCompleteResponseStruct);\n}\n\n/**\n * Begins step-up verification with an enrolled credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Verification request.\n * @returns Validated verification flow data.\n */\nexport async function mfaVerify(\n  env: Env,\n  accessToken: string,\n  body: MfaVerifyRequest,\n): Promise<VerificationServiceResult> {\n  const json = await requestJson(MFA_VERIFY_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaVerifyResponseStruct);\n\n  return {\n    flowId: json.flow_id,\n    expiresAt: parseExpiresAt(json.expires_at),\n    ...(json.passkey_request_data\n      ? { publicKey: parsePasskeyRequestData(json.passkey_request_data) }\n      : {}),\n  };\n}\n\n/**\n * Completes step-up verification with an enrolled credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and verification proof.\n * @returns The AAL2 assertion JWT and its lifetime in seconds.\n */\nexport async function mfaVerifyComplete(\n  env: Env,\n  accessToken: string,\n  params: VerificationCompletionParams,\n): Promise<MfaStepUpAssertion> {\n  let body: MfaVerifyCompleteRequest = {\n    credential_type: params.credential_type,\n    flow_id: params.flow_id,\n    ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n  };\n  if (params.passkey_assertion) {\n    assertValidMfaRequest(\n      params.passkey_assertion,\n      AuthenticationResponseJSONStruct,\n    );\n    body = {\n      ...body,\n      passkey_assertion: JSON.stringify(params.passkey_assertion),\n    };\n  }\n\n  const json = await requestJson(MFA_VERIFY_COMPLETE_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaVerifyCompleteResponseStruct);\n  return { token: json.token, expiresIn: json.expires_in };\n}\n\nfunction isSupportedStatus(status: string): status is MfaCredentialStatus {\n  return status === 'active' || status === 'pending';\n}\n\n/**\n * Maps a server credential to its public controller representation.\n *\n * Unknown credential types or statuses are dropped so the server can extend\n * either without invalidating the whole list.\n *\n * @param credential - Validated server credential.\n * @returns A supported credential, or null when it cannot be represented.\n */\nexport function toEnrolledCredential(\n  credential: MfaCredential,\n): EnrolledCredential | null {\n  const { credential_type: type, status } = credential;\n  if (!isSupportedStatus(status)) {\n    log.warn(`Ignoring MFA credential with unsupported status: ${status}`);\n    return null;\n  }\n\n  const enrolledAt = parseEnrolledAt(credential.enrolled_at);\n  const base = {\n    status,\n    ...(enrolledAt === undefined ? {} : { enrolledAt }),\n  };\n\n  if (type === 'passkey') {\n    return {\n      type,\n      ...base,\n      ...(credential.passkey?.display_name\n        ? { displayName: credential.passkey.display_name }\n        : {}),\n    };\n  }\n\n  if (type === 'email_otp' && credential.email?.address !== undefined) {\n    return {\n      type,\n      ...base,\n      email: credential.email.address,\n      // The spec marks `verified` optional; an active row is verified.\n      verified: credential.email.verified ?? status === 'active',\n    };\n  }\n\n  log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);\n  return null;\n}\n\n/**\n * Gets the credentials enrolled on the canonical profile.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @returns Supported enrolled credentials.\n */\nexport async function getMfaCredentials(\n  env: Env,\n  accessToken: string,\n): Promise<EnrolledCredential[]> {\n  const json = await requestJson(MFA_CREDENTIALS_URL(env), accessToken);\n  assertValidMfaResponse(json, MfaCredentialsResponseStruct);\n  return json.credentials\n    .map(toEnrolledCredential)\n    .filter((credential): credential is EnrolledCredential =>\n      Boolean(credential),\n    );\n}\n"]}
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAgBtB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC1D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,6BAA6B,CAAC;AAE7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AA2CzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,QAAkB;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC;AAoBD;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,IAA8B,EAC9B,QAAkB;IAElB,OAAO,IAAI,EAAE,mBAAmB,KAAK,SAAS;QAC5C,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB;IAElB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,OAAO,IAAI,QAAQ,MAAM,EAAE,EAAE,CAAC;IAEvE,uEAAuE;IACvE,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,KAAK,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,6BAA6B,CAAC;QACnC,KAAK,wBAAwB,CAAC;QAC9B,KAAK,yBAAyB;YAC5B,MAAM,IAAI,8BAA8B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,eAAe;YAClB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,cAAc,CAAC;QACpB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,mBAAmB;YACtB,MAAM,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,mBAAmB;YACtB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,KAAK,sBAAsB;YACzB,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,yBAAyB;YAC5B,MAAM,IAAI,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,KAAK,qBAAqB;YACxB,MAAM,IAAI,sBAAsB,CAC9B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;QACJ,KAAK,oBAAoB;YACvB,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD;YACE,MAAM;IACV,CAAC;IAED,IAAI,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAC3B,OAAO,EACP,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACnC,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,GAAG,WAAW,qCAAqC,MAAM,GAAG,EAC5D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,WAAmB,EACnB,IAA+C;IAE/C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK;YAC7B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS;oBAC1B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;aAC5C;YACD,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,EAAE;YAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,mBAAmB;YAC1B,CAAC,CAAC,EAAE,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAkC;IAElC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,qBAAqB,CACnB,MAAM,CAAC,mBAAmB,EAC1B,8BAA8B,CAC/B,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,WAAmB,EACnB,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAEtD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oBAAoB;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,uBAAuB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB,EACnB,MAAoC;IAEpC,IAAI,IAAI,GAA6B;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,qBAAqB,CACnB,MAAM,CAAC,iBAAiB,EACxB,gCAAgC,CACjC,CAAC;QACF,IAAI,GAAG;YACL,GAAG,IAAI;YACP,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI;KACL,CAAC,CAAC;IACH,sBAAsB,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAyB;IAEzB,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;IACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oDAAoD,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,MAAM;QACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;IAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY;gBAClC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,oEAAoE;QACpE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,GAAG,IAAI;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACpD,iEAAiE;YACjE,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,IAAI,MAAM,KAAK,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAQ,EACR,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACtE,sBAAsB,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW;SACpB,GAAG,CAAC,oBAAoB,CAAC;SACzB,MAAM,CAAC,CAAC,UAAU,EAAoC,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;AACN,CAAC","sourcesContent":["import type { Json } from '@metamask/utils';\nimport log from 'loglevel';\n\nimport type { Env } from '../../../shared/env.js';\nimport { getEnvUrls } from '../../../shared/env.js';\nimport { HTTP_STATUS_CODES } from '../../constants.js';\nimport {\n  CredentialAlreadyEnrolledError,\n  CredentialNotEnrolledError,\n  MaxIdentifiersReachedError,\n  MaxPasskeysReachedError,\n  MfaError,\n  MfaFlowExpiredError,\n  MfaIdentityMissingError,\n  MfaRateLimitedError,\n  MfaUnavailableError,\n  MfaVerificationFailedError,\n  OtpResendCooldownError,\n  StepUpRequiredError,\n  TooManyAttemptsError,\n} from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\nimport { toErrorMessage } from '../../utils/to-error-message.js';\nimport {\n  AuthenticationResponseJSONStruct,\n  MfaCredentialsResponseStruct,\n  MfaEnrollCompleteResponseStruct,\n  MfaEnrollResponseStruct,\n  MfaErrorResponseStruct,\n  MfaVerifyCompleteResponseStruct,\n  MfaVerifyResponseStruct,\n  PasskeyCreateDataStruct,\n  PasskeyRequestDataStruct,\n  RegistrationResponseJSONStruct,\n  assertValidMfaRequest,\n  assertValidMfaResponse,\n} from './schemas.js';\nimport type {\n  AuthenticationResponseJSON,\n  EnrolledCredential,\n  MfaCredential,\n  MfaCredentialStatus,\n  MfaCredentialType,\n  MfaEnrollCompleteRequest,\n  MfaEnrollRequest,\n  MfaVerifyCompleteRequest,\n  MfaVerifyRequest,\n  PublicKeyCredentialCreationOptionsJSON as PasskeyCreationOptions,\n  PublicKeyCredentialRequestOptionsJSON as PasskeyRequestOptions,\n  RegistrationResponseJSON,\n} from './types.js';\n\nexport const MFA_ENROLL_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll`;\n\nexport const MFA_ENROLL_COMPLETE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/enroll/complete`;\n\nexport const MFA_VERIFY_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify`;\n\nexport const MFA_VERIFY_COMPLETE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/verify/complete`;\n\nexport const MFA_CREDENTIALS_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/mfa/credentials`;\n\ntype EnrollmentServiceResult = {\n  flowId: string;\n  expiresAt: number;\n  publicKey?: PasskeyCreationOptions;\n};\n\ntype VerificationServiceResult = {\n  flowId: string;\n  expiresAt: number;\n  publicKey?: PasskeyRequestOptions;\n};\n\nexport type MfaVerificationAssertion = {\n  /** Assertion JWT to exchange at Hydra for an access token. */\n  token: string;\n  /** Assertion lifetime in seconds. */\n  expiresIn: number;\n};\n\ntype EnrollmentCompletionParams = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_attestation?: RegistrationResponseJSON;\n};\n\ntype VerificationCompletionParams = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_assertion?: AuthenticationResponseJSON;\n};\n\n/**\n * Reads a credential's enrollment date. Unlike flow deadlines, this is display\n * metadata, so an unparsable value is dropped instead of rejecting the whole\n * credential list.\n *\n * @param value - The raw `enrolled_at` value, if the server sent one.\n * @returns The epoch milliseconds, or undefined when absent or unparsable.\n */\nfunction parseEnrolledAt(value: string | undefined): number | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const enrolledAt = Date.parse(value);\n  if (Number.isNaN(enrolledAt)) {\n    log.warn(`Ignoring unparsable MFA credential enrolled_at: ${value}`);\n    return undefined;\n  }\n  return enrolledAt;\n}\n\nfunction parseExpiresAt(value: string): number {\n  const expiresAt = Date.parse(value);\n  if (Number.isNaN(expiresAt)) {\n    throw new MfaError('invalid_response', `Invalid expires_at: ${value}`);\n  }\n  return expiresAt;\n}\n\n/**\n * Parses passkey creation data embedded in an enrollment response.\n *\n * @param value - JSON-encoded creation options.\n * @returns Validated public-key creation options.\n */\nexport function parsePasskeyCreateData(value: string): PasskeyCreationOptions {\n  try {\n    const parsed: unknown = JSON.parse(value);\n    assertValidMfaResponse(parsed, PasskeyCreateDataStruct);\n    return parsed.publicKey;\n  } catch (error) {\n    if (error instanceof MfaError) {\n      throw error;\n    }\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message);\n  }\n}\n\n/**\n * Parses passkey request data embedded in a verification response.\n *\n * @param value - JSON-encoded request options.\n * @returns Validated public-key request options.\n */\nexport function parsePasskeyRequestData(value: string): PasskeyRequestOptions {\n  try {\n    const parsed: unknown = JSON.parse(value);\n    assertValidMfaResponse(parsed, PasskeyRequestDataStruct);\n    return parsed.publicKey;\n  } catch (error) {\n    if (error instanceof MfaError) {\n      throw error;\n    }\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message);\n  }\n}\n\n/**\n * Reads a `Retry-After` header as a delay. The human-readable error message is\n * deliberately not parsed: the API documents it as unstable.\n *\n * @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined without a usable header.\n */\nfunction parseRetryAfter(response: Response): number | undefined {\n  const header = response.headers.get('Retry-After');\n  if (!header) {\n    return undefined;\n  }\n  const seconds = Number(header);\n  if (Number.isInteger(seconds)) {\n    return Math.max(0, seconds * 1000);\n  }\n  const date = Date.parse(header);\n  return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());\n}\n\n/**\n * Reads and validates the JSON error body of a failed MFA request.\n *\n * When the body parses as JSON but does not match the documented error\n * shape, a `message` field is salvaged if present so callers still get a\n * useful diagnostic instead of a content-free fallback.\n *\n * @param response - The failed response.\n * @returns The validated error body, a best-effort salvage of it, or\n * undefined when the body could not be parsed as JSON at all.\n */\ntype MfaErrorBody = {\n  code?: string;\n  message: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  retry_after_seconds?: number;\n};\n\n/**\n * Prefers the documented `retry_after_seconds` error field over the\n * `Retry-After` header.\n *\n * @param body - The parsed error body, if any.\n * @param response - The throttled response.\n * @returns The delay in milliseconds, or undefined when neither is usable.\n */\nfunction resolveRetryAfterMs(\n  body: MfaErrorBody | undefined,\n  response: Response,\n): number | undefined {\n  return body?.retry_after_seconds === undefined\n    ? parseRetryAfter(response)\n    : body.retry_after_seconds * 1000;\n}\n\nasync function readErrorBody(\n  response: Response,\n): Promise<MfaErrorBody | undefined> {\n  let body: unknown;\n  try {\n    body = await response.json();\n  } catch {\n    return undefined;\n  }\n\n  try {\n    assertValidMfaResponse(body, MfaErrorResponseStruct);\n    return body;\n  } catch {\n    const message = asRecord(body)?.message;\n    return typeof message === 'string' ? { message } : undefined;\n  }\n}\n\nasync function throwMfaError(\n  response: Response,\n  errorPrefix: string,\n): Promise<never> {\n  const { status } = response;\n  const body = await readErrorBody(response);\n  const message = `${errorPrefix}: ${body?.message ?? `HTTP ${status}`}`;\n\n  // Status-only classification first: gateways and load balancers answer\n  // 401/429/502 without the service's JSON body, and the caller still needs\n  // to invalidate its session, honour Retry-After, or back off.\n  if (status === HTTP_STATUS_CODES.UNAUTHORIZED) {\n    throw new MfaError('authentication_required', message, { status });\n  }\n\n  const code = body?.code;\n  switch (code) {\n    case 'credential_already_enrolled':\n    case 'email_already_enrolled':\n    case 'email_socially_verified':\n      throw new CredentialAlreadyEnrolledError(code, message, status);\n    case 'credential_not_enrolled':\n      throw new CredentialNotEnrolledError(message, status);\n    case 'aal2_required':\n      throw new StepUpRequiredError(message, status);\n    case 'flow_expired':\n    case 'invalid_flow':\n      throw new MfaFlowExpiredError(code, message, status);\n    case 'mfa_identity_missing':\n      throw new MfaIdentityMissingError(message, status);\n    case 'invalid_code':\n    case 'invalid_attestation':\n    case 'invalid_assertion':\n      throw new MfaVerificationFailedError(code, message, status);\n    case 'too_many_attempts':\n      throw new TooManyAttemptsError(message, status);\n    case 'max_passkeys_reached':\n      throw new MaxPasskeysReachedError(message, status);\n    case 'max_identifiers_reached':\n      throw new MaxIdentifiersReachedError(message, status);\n    case 'otp_resend_cooldown':\n      throw new OtpResendCooldownError(\n        message,\n        resolveRetryAfterMs(body, response),\n        status,\n      );\n    case 'kratos_unavailable':\n      throw new MfaUnavailableError(message, status);\n    default:\n      break;\n  }\n\n  if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n    throw new MfaRateLimitedError(\n      message,\n      resolveRetryAfterMs(body, response),\n      status,\n    );\n  }\n  if (status === HTTP_STATUS_CODES.BAD_GATEWAY) {\n    throw new MfaUnavailableError(message, status);\n  }\n  if (!body) {\n    throw new MfaError(\n      'invalid_response',\n      `${errorPrefix}: Unexpected error response (HTTP ${status})`,\n      { status },\n    );\n  }\n  throw new MfaError(code ?? 'server_error', message, { status });\n}\n\nasync function requestJson(\n  url: string,\n  accessToken: string,\n  init?: { method?: 'GET' | 'POST'; body?: Json },\n): Promise<Json> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      method: init?.method ?? 'GET',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n        ...(init?.body === undefined\n          ? {}\n          : { 'Content-Type': 'application/json' }),\n      },\n      ...(init?.body === undefined ? {} : { body: JSON.stringify(init.body) }),\n    });\n  } catch (error) {\n    const message = toErrorMessage(error);\n    throw new MfaUnavailableError(`MFA request failed: ${message}`);\n  }\n\n  if (!response.ok) {\n    return await throwMfaError(response, 'MFA request failed');\n  }\n\n  try {\n    return await response.json();\n  } catch (error) {\n    const message = toErrorMessage(error);\n    throw new MfaError('invalid_response', message, {\n      status: response.status,\n    });\n  }\n}\n\n/**\n * Begins enrollment of an MFA credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Enrollment request.\n * @returns Validated enrollment flow data.\n */\nexport async function mfaEnroll(\n  env: Env,\n  accessToken: string,\n  body: MfaEnrollRequest,\n): Promise<EnrollmentServiceResult> {\n  const json = await requestJson(MFA_ENROLL_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaEnrollResponseStruct);\n\n  return {\n    flowId: json.flow_id,\n    expiresAt: parseExpiresAt(json.expires_at),\n    ...(json.passkey_create_data\n      ? { publicKey: parsePasskeyCreateData(json.passkey_create_data) }\n      : {}),\n  };\n}\n\n/**\n * Completes enrollment of an MFA credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and enrollment proof.\n */\nexport async function mfaEnrollComplete(\n  env: Env,\n  accessToken: string,\n  params: EnrollmentCompletionParams,\n): Promise<void> {\n  let body: MfaEnrollCompleteRequest = {\n    credential_type: params.credential_type,\n    flow_id: params.flow_id,\n    ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n  };\n  if (params.passkey_attestation) {\n    assertValidMfaRequest(\n      params.passkey_attestation,\n      RegistrationResponseJSONStruct,\n    );\n    body = {\n      ...body,\n      passkey_attestation: JSON.stringify(params.passkey_attestation),\n    };\n  }\n\n  const json = await requestJson(MFA_ENROLL_COMPLETE_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaEnrollCompleteResponseStruct);\n}\n\n/**\n * Begins verification with an enrolled credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param body - Verification request.\n * @returns Validated verification flow data.\n */\nexport async function mfaVerify(\n  env: Env,\n  accessToken: string,\n  body: MfaVerifyRequest,\n): Promise<VerificationServiceResult> {\n  const json = await requestJson(MFA_VERIFY_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaVerifyResponseStruct);\n\n  return {\n    flowId: json.flow_id,\n    expiresAt: parseExpiresAt(json.expires_at),\n    ...(json.passkey_request_data\n      ? { publicKey: parsePasskeyRequestData(json.passkey_request_data) }\n      : {}),\n  };\n}\n\n/**\n * Completes verification with an enrolled credential.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @param params - Flow identifier and verification proof.\n * @returns The assertion JWT and its lifetime in seconds.\n */\nexport async function mfaVerifyComplete(\n  env: Env,\n  accessToken: string,\n  params: VerificationCompletionParams,\n): Promise<MfaVerificationAssertion> {\n  let body: MfaVerifyCompleteRequest = {\n    credential_type: params.credential_type,\n    flow_id: params.flow_id,\n    ...(params.otp_code ? { otp_code: params.otp_code } : {}),\n  };\n  if (params.passkey_assertion) {\n    assertValidMfaRequest(\n      params.passkey_assertion,\n      AuthenticationResponseJSONStruct,\n    );\n    body = {\n      ...body,\n      passkey_assertion: JSON.stringify(params.passkey_assertion),\n    };\n  }\n\n  const json = await requestJson(MFA_VERIFY_COMPLETE_URL(env), accessToken, {\n    method: 'POST',\n    body,\n  });\n  assertValidMfaResponse(json, MfaVerifyCompleteResponseStruct);\n  return { token: json.token, expiresIn: json.expires_in };\n}\n\nfunction isSupportedStatus(status: string): status is MfaCredentialStatus {\n  return status === 'active' || status === 'pending';\n}\n\n/**\n * Maps a server credential to its public controller representation.\n *\n * Unknown credential types or statuses are dropped so the server can extend\n * either without invalidating the whole list.\n *\n * @param credential - Validated server credential.\n * @returns A supported credential, or null when it cannot be represented.\n */\nexport function toEnrolledCredential(\n  credential: MfaCredential,\n): EnrolledCredential | null {\n  const { credential_type: type, status } = credential;\n  if (!isSupportedStatus(status)) {\n    log.warn(`Ignoring MFA credential with unsupported status: ${status}`);\n    return null;\n  }\n\n  const enrolledAt = parseEnrolledAt(credential.enrolled_at);\n  const base = {\n    status,\n    ...(enrolledAt === undefined ? {} : { enrolledAt }),\n  };\n\n  if (type === 'passkey') {\n    return {\n      type,\n      ...base,\n      ...(credential.passkey?.display_name\n        ? { displayName: credential.passkey.display_name }\n        : {}),\n    };\n  }\n\n  if (type === 'email_otp') {\n    // The API marks the address optional, so a row without one is kept.\n    const address = credential.email?.address;\n    return {\n      type,\n      ...base,\n      ...(address === undefined ? {} : { email: address }),\n      // The spec marks `verified` optional; an active row is verified.\n      verified: credential.email?.verified ?? status === 'active',\n    };\n  }\n\n  log.warn(`Ignoring unsupported or incomplete MFA credential: ${type}`);\n  return null;\n}\n\n/**\n * Gets the credentials enrolled on the canonical profile.\n *\n * @param env - Authentication environment.\n * @param accessToken - Primary profile access token.\n * @returns Supported enrolled credentials.\n */\nexport async function getMfaCredentials(\n  env: Env,\n  accessToken: string,\n): Promise<EnrolledCredential[]> {\n  const json = await requestJson(MFA_CREDENTIALS_URL(env), accessToken);\n  assertValidMfaResponse(json, MfaCredentialsResponseStruct);\n  return json.credentials\n    .map(toEnrolledCredential)\n    .filter((credential): credential is EnrolledCredential =>\n      Boolean(credential),\n    );\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts

@@ -44,7 +44,11 @@ export type EnrolledCredential = {
     type: 'email_otp';
     status: MfaCredentialStatus;
     enrolledAt?: number;
-    email: string;
+    /**
+     * Absent when the server lists an email method without its address; the
+     * API marks the address optional.
+     */
+    email?: string;
     verified: boolean;
 };
 /**
@@ -71,7 +75,7 @@ export type EnrollmentProof = {
     type: 'email_otp';
     code: string;
 };
-export type StepUpChallenge = {
+export type VerificationChallenge = {
     type: 'passkey';
     flowId: string;
     expiresAt: number;
@@ -81,21 +85,24 @@ export type StepUpChallenge = {
     flowId: string;
     expiresAt: number;
 };
-export type StepUpProof = {
+export type VerificationProof = {
     type: 'passkey';
     assertion: AuthenticationResponseJSON;
 } | {
     type: 'email_otp';
     code: string;
 };
-export type ElevatedProfileToken = {
+export type VerificationToken = {
     accessToken: string;
     expiresIn: number;
     obtainedAt: number;
     claims: {
         sub: string;
-        aal: 2;
-        amr: MfaCredentialType[];
+        /**
+         * Methods the verification used. Usually an `MfaCredentialType`, but the
+         * server may report other method names.
+         */
+        amr: (MfaCredentialType | (string & Record<never, never>))[];
         exp: number;
     };
 };
@@ -103,23 +110,30 @@ export type BeginEnrollmentRequest = {
     type: MfaCredentialType;
     email?: string;
     reason: TokenReason;
+    /**
+     * Maximum age, in milliseconds, of a verification session that may authorize
+     * this enrollment. Defaults to `ENROLLMENT_MAX_SESSION_AGE_MS`. A setup flow
+     * that proved a factor itself may pass the time elapsed since it started.
+     * Zero never uses the session.
+     */
+    maxSessionAgeMs?: number;
 };
 export type CompleteEnrollmentRequest = {
     flowId: string;
     proof: EnrollmentProof;
     reason: TokenReason;
 };
-export type BeginStepUpRequest = {
+export type BeginVerificationRequest = {
     type: MfaCredentialType;
     reason: TokenReason;
 };
-export type CompleteStepUpRequest = {
+export type CompleteVerificationRequest = {
     flowId: string;
-    proof: StepUpProof;
+    proof: VerificationProof;
     reason: TokenReason;
 };
-export type GetElevatedTokenRequest = {
+export type GetVerificationTokenRequest = {
     maxSessionAgeMs?: number;
 };
-export type MfaErrorCode = 'max_passkeys_reached' | 'max_identifiers_reached' | 'email_already_enrolled' | 'credential_already_enrolled' | 'credential_not_enrolled' | 'email_socially_verified' | 'mfa_identity_missing' | 'multi_primary_srp' | 'aal2_required' | 'otp_resend_cooldown' | 'rate_limited' | 'kratos_unavailable' | 'flow_expired' | 'invalid_flow' | 'invalid_attestation' | 'invalid_code' | 'invalid_assertion' | 'too_many_attempts' | 'elevated_token_invalid' | 'authentication_required' | 'server_error' | 'invalid_response' | 'invalid_request';
+export type MfaErrorCode = 'max_passkeys_reached' | 'max_identifiers_reached' | 'email_already_enrolled' | 'credential_already_enrolled' | 'credential_not_enrolled' | 'email_socially_verified' | 'mfa_identity_missing' | 'multi_primary_srp' | 'aal2_required' | 'otp_resend_cooldown' | 'rate_limited' | 'kratos_unavailable' | 'flow_expired' | 'invalid_flow' | 'invalid_attestation' | 'invalid_code' | 'invalid_assertion' | 'too_many_attempts' | 'verification_token_invalid' | 'authentication_required' | 'server_error' | 'invalid_response' | 'invalid_request';
 //# sourceMappingURL=types.d.ts.map

package/dist/sdk/authentication-jwt-bearer/mfa/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,sCAAsC,GAAG,KAAK,CACxD,OAAO,4CAA4C,CACpD,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,KAAK,CACvD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAC1C,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,sCAAsC,CAAC;CACnD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qCAAqC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,WAAW,GACnB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,CAAC,CAAC;QACP,GAAG,EAAE,iBAAiB,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,YAAY,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,sBAAsB,GACtB,mBAAmB,GACnB,eAAe,GACf,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,yBAAyB,GACzB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,+BAA+B,EAC/B,uBAAuB,EACvB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,4CAA4C,EAC5C,2CAA2C,EAC3C,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,sCAAsC,GAAG,KAAK,CACxD,OAAO,4CAA4C,CACpD,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,KAAK,CACvD,OAAO,2CAA2C,CACnD,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAC1C,OAAO,8BAA8B,CACtC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,KAAK,CAC5C,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAC3C,OAAO,+BAA+B,CACvC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEhF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE9D,MAAM,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEpE,MAAM,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,eAAe,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IAErC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,sCAAsC,CAAC;CACnD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,eAAe,GACvB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,wBAAwB,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,qBAAqB,GAC7B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qCAAqC,CAAC;CAClD,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEN,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEN,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,CAAC;QACZ;;;WAGG;QACH,GAAG,EAAE,CAAC,iBAAiB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,iBAAiB,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,YAAY,GACpB,sBAAsB,GACtB,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,yBAAyB,GACzB,yBAAyB,GACzB,sBAAsB,GACtB,mBAAmB,GACnB,eAAe,GACf,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,mBAAmB,GACnB,mBAAmB,GACnB,4BAA4B,GAC5B,yBAAyB,GACzB,cAAc,GACd,kBAAkB,GAClB,iBAAiB,CAAC"}

package/dist/sdk/authentication-jwt-bearer/mfa/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { Infer } from '@metamask/superstruct';\n\nimport type {\n  AuthenticationResponseJSONStruct,\n  MfaCredentialStruct,\n  MfaCredentialsResponseStruct,\n  MfaEmailDetailStruct,\n  MfaEnrollCompleteResponseStruct,\n  MfaEnrollResponseStruct,\n  MfaPasskeyDetailStruct,\n  MfaVerifyCompleteResponseStruct,\n  MfaVerifyResponseStruct,\n  PublicKeyCredentialCreationOptionsJSONStruct,\n  PublicKeyCredentialRequestOptionsJSONStruct,\n  RegistrationResponseJSONStruct,\n} from './schemas.js';\nimport { MFA_CREDENTIAL_TYPES } from './schemas.js';\n\nexport { MFA_CREDENTIAL_TYPES };\n\nexport type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];\n\nexport type MfaCredentialStatus = 'active' | 'pending';\n\nexport type PublicKeyCredentialCreationOptionsJSON = Infer<\n  typeof PublicKeyCredentialCreationOptionsJSONStruct\n>;\n\nexport type PublicKeyCredentialRequestOptionsJSON = Infer<\n  typeof PublicKeyCredentialRequestOptionsJSONStruct\n>;\n\nexport type RegistrationResponseJSON = Infer<\n  typeof RegistrationResponseJSONStruct\n>;\n\nexport type AuthenticationResponseJSON = Infer<\n  typeof AuthenticationResponseJSONStruct\n>;\n\nexport type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;\n\nexport type MfaEnrollCompleteResponse = Infer<\n  typeof MfaEnrollCompleteResponseStruct\n>;\n\nexport type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;\n\nexport type MfaVerifyCompleteResponse = Infer<\n  typeof MfaVerifyCompleteResponseStruct\n>;\n\nexport type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;\n\nexport type MfaCredential = Infer<typeof MfaCredentialStruct>;\n\nexport type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;\n\nexport type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;\n\nexport type MfaEnrollRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  identifier?: string;\n};\n\nexport type MfaEnrollCompleteRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_attestation?: string;\n};\n\nexport type MfaVerifyRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n};\n\nexport type MfaVerifyCompleteRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_assertion?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n};\n\nexport type EnrolledCredential =\n  | {\n      type: 'passkey';\n      status: MfaCredentialStatus;\n      enrolledAt?: number;\n      displayName?: string;\n    }\n  | {\n      type: 'email_otp';\n      status: MfaCredentialStatus;\n      enrolledAt?: number;\n      email: string;\n      verified: boolean;\n    };\n\n/**\n * Caller-supplied context attached to MFA trace spans. `operation` names the\n * client flow that needs the credential (for example `money.signTransaction`).\n */\nexport type TokenReason = {\n  operation: string;\n};\n\nexport type EnrollmentChallenge =\n  | {\n      type: 'passkey';\n      flowId: string;\n      expiresAt: number;\n      publicKey: PublicKeyCredentialCreationOptionsJSON;\n    }\n  | {\n      type: 'email_otp';\n      flowId: string;\n      expiresAt: number;\n    };\n\nexport type EnrollmentProof =\n  | {\n      type: 'passkey';\n      attestation: RegistrationResponseJSON;\n    }\n  | {\n      type: 'email_otp';\n      code: string;\n    };\n\nexport type StepUpChallenge =\n  | {\n      type: 'passkey';\n      flowId: string;\n      expiresAt: number;\n      publicKey: PublicKeyCredentialRequestOptionsJSON;\n    }\n  | {\n      type: 'email_otp';\n      flowId: string;\n      expiresAt: number;\n    };\n\nexport type StepUpProof =\n  | {\n      type: 'passkey';\n      assertion: AuthenticationResponseJSON;\n    }\n  | {\n      type: 'email_otp';\n      code: string;\n    };\n\nexport type ElevatedProfileToken = {\n  accessToken: string;\n  expiresIn: number;\n  obtainedAt: number;\n  claims: {\n    sub: string;\n    aal: 2;\n    amr: MfaCredentialType[];\n    exp: number;\n  };\n};\n\nexport type BeginEnrollmentRequest = {\n  type: MfaCredentialType;\n  email?: string;\n  reason: TokenReason;\n};\n\nexport type CompleteEnrollmentRequest = {\n  flowId: string;\n  proof: EnrollmentProof;\n  reason: TokenReason;\n};\n\nexport type BeginStepUpRequest = {\n  type: MfaCredentialType;\n  reason: TokenReason;\n};\n\nexport type CompleteStepUpRequest = {\n  flowId: string;\n  proof: StepUpProof;\n  reason: TokenReason;\n};\n\nexport type GetElevatedTokenRequest = {\n  maxSessionAgeMs?: number;\n};\n\nexport type MfaErrorCode =\n  | 'max_passkeys_reached'\n  | 'max_identifiers_reached'\n  | 'email_already_enrolled'\n  | 'credential_already_enrolled'\n  | 'credential_not_enrolled'\n  | 'email_socially_verified'\n  | 'mfa_identity_missing'\n  | 'multi_primary_srp'\n  | 'aal2_required'\n  | 'otp_resend_cooldown'\n  | 'rate_limited'\n  | 'kratos_unavailable'\n  | 'flow_expired'\n  | 'invalid_flow'\n  | 'invalid_attestation'\n  | 'invalid_code'\n  | 'invalid_assertion'\n  | 'too_many_attempts'\n  | 'elevated_token_invalid'\n  | 'authentication_required'\n  | 'server_error'\n  | 'invalid_response'\n  | 'invalid_request';\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,CAAC","sourcesContent":["import type { Infer } from '@metamask/superstruct';\n\nimport type {\n  AuthenticationResponseJSONStruct,\n  MfaCredentialStruct,\n  MfaCredentialsResponseStruct,\n  MfaEmailDetailStruct,\n  MfaEnrollCompleteResponseStruct,\n  MfaEnrollResponseStruct,\n  MfaPasskeyDetailStruct,\n  MfaVerifyCompleteResponseStruct,\n  MfaVerifyResponseStruct,\n  PublicKeyCredentialCreationOptionsJSONStruct,\n  PublicKeyCredentialRequestOptionsJSONStruct,\n  RegistrationResponseJSONStruct,\n} from './schemas.js';\nimport { MFA_CREDENTIAL_TYPES } from './schemas.js';\n\nexport { MFA_CREDENTIAL_TYPES };\n\nexport type MfaCredentialType = (typeof MFA_CREDENTIAL_TYPES)[number];\n\nexport type MfaCredentialStatus = 'active' | 'pending';\n\nexport type PublicKeyCredentialCreationOptionsJSON = Infer<\n  typeof PublicKeyCredentialCreationOptionsJSONStruct\n>;\n\nexport type PublicKeyCredentialRequestOptionsJSON = Infer<\n  typeof PublicKeyCredentialRequestOptionsJSONStruct\n>;\n\nexport type RegistrationResponseJSON = Infer<\n  typeof RegistrationResponseJSONStruct\n>;\n\nexport type AuthenticationResponseJSON = Infer<\n  typeof AuthenticationResponseJSONStruct\n>;\n\nexport type MfaEnrollResponse = Infer<typeof MfaEnrollResponseStruct>;\n\nexport type MfaEnrollCompleteResponse = Infer<\n  typeof MfaEnrollCompleteResponseStruct\n>;\n\nexport type MfaVerifyResponse = Infer<typeof MfaVerifyResponseStruct>;\n\nexport type MfaVerifyCompleteResponse = Infer<\n  typeof MfaVerifyCompleteResponseStruct\n>;\n\nexport type MfaCredentialsResponse = Infer<typeof MfaCredentialsResponseStruct>;\n\nexport type MfaCredential = Infer<typeof MfaCredentialStruct>;\n\nexport type MfaPasskeyDetail = Infer<typeof MfaPasskeyDetailStruct>;\n\nexport type MfaEmailDetail = Infer<typeof MfaEmailDetailStruct>;\n\nexport type MfaEnrollRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  identifier?: string;\n};\n\nexport type MfaEnrollCompleteRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_attestation?: string;\n};\n\nexport type MfaVerifyRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n};\n\nexport type MfaVerifyCompleteRequest = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  credential_type: MfaCredentialType;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  flow_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  passkey_assertion?: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  otp_code?: string;\n};\n\nexport type EnrolledCredential =\n  | {\n      type: 'passkey';\n      status: MfaCredentialStatus;\n      enrolledAt?: number;\n      displayName?: string;\n    }\n  | {\n      type: 'email_otp';\n      status: MfaCredentialStatus;\n      enrolledAt?: number;\n      /**\n       * Absent when the server lists an email method without its address; the\n       * API marks the address optional.\n       */\n      email?: string;\n      verified: boolean;\n    };\n\n/**\n * Caller-supplied context attached to MFA trace spans. `operation` names the\n * client flow that needs the credential (for example `money.signTransaction`).\n */\nexport type TokenReason = {\n  operation: string;\n};\n\nexport type EnrollmentChallenge =\n  | {\n      type: 'passkey';\n      flowId: string;\n      expiresAt: number;\n      publicKey: PublicKeyCredentialCreationOptionsJSON;\n    }\n  | {\n      type: 'email_otp';\n      flowId: string;\n      expiresAt: number;\n    };\n\nexport type EnrollmentProof =\n  | {\n      type: 'passkey';\n      attestation: RegistrationResponseJSON;\n    }\n  | {\n      type: 'email_otp';\n      code: string;\n    };\n\nexport type VerificationChallenge =\n  | {\n      type: 'passkey';\n      flowId: string;\n      expiresAt: number;\n      publicKey: PublicKeyCredentialRequestOptionsJSON;\n    }\n  | {\n      type: 'email_otp';\n      flowId: string;\n      expiresAt: number;\n    };\n\nexport type VerificationProof =\n  | {\n      type: 'passkey';\n      assertion: AuthenticationResponseJSON;\n    }\n  | {\n      type: 'email_otp';\n      code: string;\n    };\n\nexport type VerificationToken = {\n  accessToken: string;\n  expiresIn: number;\n  obtainedAt: number;\n  claims: {\n    sub: string;\n    /**\n     * Methods the verification used. Usually an `MfaCredentialType`, but the\n     * server may report other method names.\n     */\n    amr: (MfaCredentialType | (string & Record<never, never>))[];\n    exp: number;\n  };\n};\n\nexport type BeginEnrollmentRequest = {\n  type: MfaCredentialType;\n  email?: string;\n  reason: TokenReason;\n  /**\n   * Maximum age, in milliseconds, of a verification session that may authorize\n   * this enrollment. Defaults to `ENROLLMENT_MAX_SESSION_AGE_MS`. A setup flow\n   * that proved a factor itself may pass the time elapsed since it started.\n   * Zero never uses the session.\n   */\n  maxSessionAgeMs?: number;\n};\n\nexport type CompleteEnrollmentRequest = {\n  flowId: string;\n  proof: EnrollmentProof;\n  reason: TokenReason;\n};\n\nexport type BeginVerificationRequest = {\n  type: MfaCredentialType;\n  reason: TokenReason;\n};\n\nexport type CompleteVerificationRequest = {\n  flowId: string;\n  proof: VerificationProof;\n  reason: TokenReason;\n};\n\nexport type GetVerificationTokenRequest = {\n  maxSessionAgeMs?: number;\n};\n\nexport type MfaErrorCode =\n  | 'max_passkeys_reached'\n  | 'max_identifiers_reached'\n  | 'email_already_enrolled'\n  | 'credential_already_enrolled'\n  | 'credential_not_enrolled'\n  | 'email_socially_verified'\n  | 'mfa_identity_missing'\n  | 'multi_primary_srp'\n  | 'aal2_required'\n  | 'otp_resend_cooldown'\n  | 'rate_limited'\n  | 'kratos_unavailable'\n  | 'flow_expired'\n  | 'invalid_flow'\n  | 'invalid_attestation'\n  | 'invalid_code'\n  | 'invalid_assertion'\n  | 'too_many_attempts'\n  | 'verification_token_invalid'\n  | 'authentication_required'\n  | 'server_error'\n  | 'invalid_response'\n  | 'invalid_request';\n"]}

package/dist/sdk/authentication.d.ts

@@ -2,8 +2,8 @@ import type { PublicInterface } from '@metamask/utils';
 import type { Eip1193Provider } from 'ethers';
 import { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';
 import { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';
-import type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';
-import type { EnrolledCredential, EnrollmentChallenge, EnrollmentProof, MfaCredentialType, StepUpChallenge, StepUpProof } from './authentication-jwt-bearer/mfa/types.js';
+import type { MfaVerificationAssertion } from './authentication-jwt-bearer/mfa/services.js';
+import type { EnrolledCredential, EnrollmentChallenge, EnrollmentProof, MfaCredentialType, VerificationChallenge, VerificationProof } from './authentication-jwt-bearer/mfa/types.js';
 import type { PairProfilesResponse } from './authentication-jwt-bearer/services.js';
 import type { AccessToken, UserProfile, Pair, PairSocialIdentifierParams, ProfileIdentifier, OidcTokenAudience, OidcTokenClaims, UserProfileLineage } from './authentication-jwt-bearer/types.js';
 type SIWEInterface = PublicInterface<SIWEJwtBearerAuth>;
@@ -29,8 +29,8 @@ export declare class JwtBearerAuth implements SIWEInterface, SRPInterface {
         accessToken?: string;
     }): Promise<EnrollmentChallenge>;
     completeMfaEnrollment(flowId: string, proof: EnrollmentProof, entropySourceId?: string): Promise<void>;
-    beginMfaVerification(type: MfaCredentialType, entropySourceId?: string): Promise<StepUpChallenge>;
-    completeMfaVerification(flowId: string, proof: StepUpProof, entropySourceId?: string): Promise<MfaStepUpAssertion>;
+    beginMfaVerification(type: MfaCredentialType, entropySourceId?: string): Promise<VerificationChallenge>;
+    completeMfaVerification(flowId: string, proof: VerificationProof, entropySourceId?: string): Promise<MfaVerificationAssertion>;
     getMfaCredentials(entropySourceId?: string): Promise<EnrolledCredential[]>;
     exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken>;
     pairSrpProfiles(accessTokens: string[], authAccessToken: string): Promise<PairProfilesResponse>;

package/dist/sdk/authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAKlD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,IAAI,EACJ,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,sCAAsC,CAAC;AAM9C,KAAK,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAE7D,KAAK,UAAU,GAAG,qBAAqB,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,KAAK,SAAS,GAAG,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,KAAK,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAAC;AAElD,qBAAa,aAAc,YAAW,aAAa,EAAE,YAAY;;IAO/D,YAAY,GAAG,IAAI,EAAE,mBAAmB,EAevC;IAED,iBAAiB,CAAC,QAAQ,EAAE,eAAe,QAG1C;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;IAEK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAGnC;IAEK,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxC;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnE;IAEK,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAEK,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;IAEK,uBAAuB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;IAEK,uBAAuB,CAC3B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAMjB;IAEK,kBAAkB,CACtB,IAAI,EAAE,iBAAiB,EACvB,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAG9B;IAEK,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,oBAAoB,CACxB,IAAI,EAAE,iBAAiB,EACvB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,eAAe,CAAC,CAG1B;IAEK,uBAAuB,CAC3B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;IAEK,iBAAiB,CACrB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAG/B;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAGrE;IAEK,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAG/B;IAEK,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,iBAAiB,EAAE,GAAG,SAAS,CAAC,CAG1C;IAEK,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAEjB;IAEK,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAGP;CA2BF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC"}
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,0CAA0C,CAAC;AAKlD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,IAAI,EACJ,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EACnB,MAAM,sCAAsC,CAAC;AAM9C,KAAK,aAAa,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAE7D,KAAK,UAAU,GAAG,qBAAqB,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAClE,KAAK,SAAS,GAAG,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,KAAK,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAAC;AAElD,qBAAa,aAAc,YAAW,aAAa,EAAE,YAAY;;IAO/D,YAAY,GAAG,IAAI,EAAE,mBAAmB,EAevC;IAED,iBAAiB,CAAC,QAAQ,EAAE,eAAe,QAG1C;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9D;IAEK,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAGnC;IAEK,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxC;IAEK,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnE;IAEK,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7D;IAEK,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;IAEK,uBAAuB,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;IAEK,uBAAuB,CAC3B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAMjB;IAEK,kBAAkB,CACtB,IAAI,EAAE,iBAAiB,EACvB,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GACA,OAAO,CAAC,mBAAmB,CAAC,CAG9B;IAEK,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAGf;IAEK,oBAAoB,CACxB,IAAI,EAAE,iBAAiB,EACvB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;IAEK,uBAAuB,CAC3B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,iBAAiB,EACxB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,wBAAwB,CAAC,CAOnC;IAEK,iBAAiB,CACrB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAG/B;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAGrE;IAEK,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAG/B;IAEK,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,iBAAiB,EAAE,GAAG,SAAS,CAAC,CAG1C;IAEK,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAEjB;IAEK,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BpD;IAED,OAAO,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAGP;CA2BF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC"}

package/dist/sdk/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAU3E,OAAO,EACL,QAAQ,EACR,eAAe,GAChB,MAAM,yCAAyC,CAAC;AAYjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAWlE,MAAM,OAAO,aAAa;IACf,KAAK,CAAW;IAEhB,IAAI,CAAM;IAEV,IAAI,CAAuC;IAEpD,YAAY,GAAG,IAAyB;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAExB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAuB,EACvB,OAIC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAsB,EACtB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,IAAuB,EACvB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAc,EACd,KAAkB,EAClB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,KAAK,EACL,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO;oBACL,SAAS,EAAE,GAAG;oBACd,WAAW,EAAE,GAAG;oBAChB,qBAAqB,EAAE,CAAC,CAAC,mBAAmB;oBAC5C,eAAe,EAAE,CAAC,CAAC,cAAc;iBAClC,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,0BAA0B;gBAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,IAAI,SAAS,CACjB,mCAAmC,YAAY,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,MAKP;QACC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,WAAW,CACT,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,UAAU,CACR,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,iDAAiD,CAClD,CAAC;IACJ,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC","sourcesContent":["import type { PublicInterface } from '@metamask/utils';\nimport type { Eip1193Provider } from 'ethers';\n\nimport type { Env } from '../shared/env.js';\nimport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nimport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nimport type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';\nimport type {\n  EnrolledCredential,\n  EnrollmentChallenge,\n  EnrollmentProof,\n  MfaCredentialType,\n  StepUpChallenge,\n  StepUpProof,\n} from './authentication-jwt-bearer/mfa/types.js';\nimport {\n  getNonce,\n  pairIdentifiers,\n} from './authentication-jwt-bearer/services.js';\nimport type { PairProfilesResponse } from './authentication-jwt-bearer/services.js';\nimport type {\n  AccessToken,\n  UserProfile,\n  Pair,\n  PairSocialIdentifierParams,\n  ProfileIdentifier,\n  OidcTokenAudience,\n  OidcTokenClaims,\n  UserProfileLineage,\n} from './authentication-jwt-bearer/types.js';\nimport { AuthType } from './authentication-jwt-bearer/types.js';\nimport { PairError, UnsupportedAuthTypeError } from './errors.js';\n\n// Computing the Classes, so we only get back the public methods for the interface.\n\ntype SIWEInterface = PublicInterface<SIWEJwtBearerAuth>;\nexport type SRPInterface = PublicInterface<SRPJwtBearerAuth>;\n\ntype SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;\ntype SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;\ntype JwtBearerAuthParams = SiweParams | SRPParams;\n\nexport class JwtBearerAuth implements SIWEInterface, SRPInterface {\n  readonly #type: AuthType;\n\n  readonly #env: Env;\n\n  readonly #sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth;\n\n  constructor(...args: JwtBearerAuthParams) {\n    this.#type = args[0].type;\n    this.#env = args[0].env;\n\n    if (args[0].type === AuthType.SRP) {\n      this.#sdk = new SRPJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    if (args[0].type === AuthType.SiWE) {\n      this.#sdk = new SIWEJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError('unsupported auth type');\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#assertSRP(this.#type, this.#sdk);\n    this.#sdk.setCustomProvider(provider);\n  }\n\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getAccessToken(entropySourceId);\n  }\n\n  async connectSnap(): Promise<string> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return this.#sdk.connectSnap();\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return this.#sdk.isSnapConnected();\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    return await this.#sdk.getUserProfile(entropySourceId);\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    return await this.#sdk.getUserProfileLineage(entropySourceId);\n  }\n\n  async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getCustomerServiceToken(entropySourceId);\n  }\n\n  async getPartnerIdentityToken(\n    claims: OidcTokenClaims,\n    audience: OidcTokenAudience,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#sdk.getPartnerIdentityToken(\n      claims,\n      audience,\n      entropySourceId,\n    );\n  }\n\n  async beginMfaEnrollment(\n    type: MfaCredentialType,\n    options?: {\n      email?: string;\n      entropySourceId?: string;\n      accessToken?: string;\n    },\n  ): Promise<EnrollmentChallenge> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.beginMfaEnrollment(type, options);\n  }\n\n  async completeMfaEnrollment(\n    flowId: string,\n    proof: EnrollmentProof,\n    entropySourceId?: string,\n  ): Promise<void> {\n    this.#assertSRP(this.#type, this.#sdk);\n    await this.#sdk.completeMfaEnrollment(flowId, proof, entropySourceId);\n  }\n\n  async beginMfaVerification(\n    type: MfaCredentialType,\n    entropySourceId?: string,\n  ): Promise<StepUpChallenge> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.beginMfaVerification(type, entropySourceId);\n  }\n\n  async completeMfaVerification(\n    flowId: string,\n    proof: StepUpProof,\n    entropySourceId?: string,\n  ): Promise<MfaStepUpAssertion> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.completeMfaVerification(\n      flowId,\n      proof,\n      entropySourceId,\n    );\n  }\n\n  async getMfaCredentials(\n    entropySourceId?: string,\n  ): Promise<EnrolledCredential[]> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.getMfaCredentials(entropySourceId);\n  }\n\n  async exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.exchangeMfaAssertion(assertionJwt);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.pairSrpProfiles(accessTokens, authAccessToken);\n  }\n\n  async pairSocialIdentifier(\n    params: PairSocialIdentifierParams,\n    authAccessToken: string,\n  ): Promise<ProfileIdentifier[] | undefined> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.pairSocialIdentifier(params, authAccessToken);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#sdk.signMessage(message, entropySourceId);\n  }\n\n  async pairIdentifiers(pairing: Pair[]): Promise<void> {\n    const profile = await this.getUserProfile();\n    const n = await getNonce(profile.profileId, this.#env);\n\n    const logins = await Promise.all(\n      pairing.map(async (p) => {\n        try {\n          const raw = `metamask:${n.nonce}:${p.identifier}`;\n          const sig = await p.signMessage(raw);\n          return {\n            signature: sig,\n            raw_message: raw,\n            encrypted_storage_key: p.encryptedStorageKey,\n            identifier_type: p.identifierType,\n          };\n        } catch (e) {\n          /* istanbul ignore next */\n          const errorMessage =\n            e instanceof Error ? e.message : JSON.stringify(e ?? '');\n          throw new PairError(\n            `failed to sign pairing message: ${errorMessage}`,\n          );\n        }\n      }),\n    );\n\n    const accessToken = await this.getAccessToken();\n    await pairIdentifiers(n.nonce, logins, accessToken, this.#env);\n  }\n\n  prepare(signer: {\n    address: string;\n    chainId: number;\n    signMessage: (message: string) => Promise<string>;\n    domain: string;\n  }): void {\n    this.#assertSIWE(this.#type, this.#sdk);\n    this.#sdk.prepare(signer);\n  }\n\n  #assertSIWE(\n    type: AuthType,\n    _sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts _sdk is SIWEJwtBearerAuth {\n    if (type === AuthType.SiWE) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SIWE auth type',\n    );\n  }\n\n  #assertSRP(\n    type: AuthType,\n    _sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts _sdk is SRPJwtBearerAuth {\n    if (type === AuthType.SRP) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SRP auth type',\n    );\n  }\n}\n\nexport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nexport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nexport * from './authentication-jwt-bearer/types.js';\n"]}
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../src/sdk/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAU3E,OAAO,EACL,QAAQ,EACR,eAAe,GAChB,MAAM,yCAAyC,CAAC;AAYjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAWlE,MAAM,OAAO,aAAa;IACf,KAAK,CAAW;IAEhB,IAAI,CAAM;IAEV,IAAI,CAAuC;IAEpD,YAAY,GAAG,IAAyB;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAExB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,QAAQ,EACR,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAuB,EACvB,OAIC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAsB,EACtB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,IAAuB,EACvB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAc,EACd,KAAwB,EACxB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAC5C,MAAM,EACN,KAAK,EACL,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,eAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrC,OAAO;oBACL,SAAS,EAAE,GAAG;oBACd,WAAW,EAAE,GAAG;oBAChB,qBAAqB,EAAE,CAAC,CAAC,mBAAmB;oBAC5C,eAAe,EAAE,CAAC,CAAC,cAAc;iBAClC,CAAC;YACJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,0BAA0B;gBAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3D,MAAM,IAAI,SAAS,CACjB,mCAAmC,YAAY,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,MAKP;QACC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,WAAW,CACT,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,UAAU,CACR,IAAc,EACd,IAA0C;QAE1C,IAAI,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,wBAAwB,CAChC,iDAAiD,CAClD,CAAC;IACJ,CAAC;CACF;AAED,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,cAAc,sCAAsC,CAAC","sourcesContent":["import type { PublicInterface } from '@metamask/utils';\nimport type { Eip1193Provider } from 'ethers';\n\nimport type { Env } from '../shared/env.js';\nimport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nimport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nimport type { MfaVerificationAssertion } from './authentication-jwt-bearer/mfa/services.js';\nimport type {\n  EnrolledCredential,\n  EnrollmentChallenge,\n  EnrollmentProof,\n  MfaCredentialType,\n  VerificationChallenge,\n  VerificationProof,\n} from './authentication-jwt-bearer/mfa/types.js';\nimport {\n  getNonce,\n  pairIdentifiers,\n} from './authentication-jwt-bearer/services.js';\nimport type { PairProfilesResponse } from './authentication-jwt-bearer/services.js';\nimport type {\n  AccessToken,\n  UserProfile,\n  Pair,\n  PairSocialIdentifierParams,\n  ProfileIdentifier,\n  OidcTokenAudience,\n  OidcTokenClaims,\n  UserProfileLineage,\n} from './authentication-jwt-bearer/types.js';\nimport { AuthType } from './authentication-jwt-bearer/types.js';\nimport { PairError, UnsupportedAuthTypeError } from './errors.js';\n\n// Computing the Classes, so we only get back the public methods for the interface.\n\ntype SIWEInterface = PublicInterface<SIWEJwtBearerAuth>;\nexport type SRPInterface = PublicInterface<SRPJwtBearerAuth>;\n\ntype SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;\ntype SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;\ntype JwtBearerAuthParams = SiweParams | SRPParams;\n\nexport class JwtBearerAuth implements SIWEInterface, SRPInterface {\n  readonly #type: AuthType;\n\n  readonly #env: Env;\n\n  readonly #sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth;\n\n  constructor(...args: JwtBearerAuthParams) {\n    this.#type = args[0].type;\n    this.#env = args[0].env;\n\n    if (args[0].type === AuthType.SRP) {\n      this.#sdk = new SRPJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    if (args[0].type === AuthType.SiWE) {\n      this.#sdk = new SIWEJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError('unsupported auth type');\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#assertSRP(this.#type, this.#sdk);\n    this.#sdk.setCustomProvider(provider);\n  }\n\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getAccessToken(entropySourceId);\n  }\n\n  async connectSnap(): Promise<string> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return this.#sdk.connectSnap();\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return this.#sdk.isSnapConnected();\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    return await this.#sdk.getUserProfile(entropySourceId);\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    return await this.#sdk.getUserProfileLineage(entropySourceId);\n  }\n\n  async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n    return await this.#sdk.getCustomerServiceToken(entropySourceId);\n  }\n\n  async getPartnerIdentityToken(\n    claims: OidcTokenClaims,\n    audience: OidcTokenAudience,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#sdk.getPartnerIdentityToken(\n      claims,\n      audience,\n      entropySourceId,\n    );\n  }\n\n  async beginMfaEnrollment(\n    type: MfaCredentialType,\n    options?: {\n      email?: string;\n      entropySourceId?: string;\n      accessToken?: string;\n    },\n  ): Promise<EnrollmentChallenge> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.beginMfaEnrollment(type, options);\n  }\n\n  async completeMfaEnrollment(\n    flowId: string,\n    proof: EnrollmentProof,\n    entropySourceId?: string,\n  ): Promise<void> {\n    this.#assertSRP(this.#type, this.#sdk);\n    await this.#sdk.completeMfaEnrollment(flowId, proof, entropySourceId);\n  }\n\n  async beginMfaVerification(\n    type: MfaCredentialType,\n    entropySourceId?: string,\n  ): Promise<VerificationChallenge> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.beginMfaVerification(type, entropySourceId);\n  }\n\n  async completeMfaVerification(\n    flowId: string,\n    proof: VerificationProof,\n    entropySourceId?: string,\n  ): Promise<MfaVerificationAssertion> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.completeMfaVerification(\n      flowId,\n      proof,\n      entropySourceId,\n    );\n  }\n\n  async getMfaCredentials(\n    entropySourceId?: string,\n  ): Promise<EnrolledCredential[]> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.getMfaCredentials(entropySourceId);\n  }\n\n  async exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.exchangeMfaAssertion(assertionJwt);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.pairSrpProfiles(accessTokens, authAccessToken);\n  }\n\n  async pairSocialIdentifier(\n    params: PairSocialIdentifierParams,\n    authAccessToken: string,\n  ): Promise<ProfileIdentifier[] | undefined> {\n    this.#assertSRP(this.#type, this.#sdk);\n    return await this.#sdk.pairSocialIdentifier(params, authAccessToken);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#sdk.signMessage(message, entropySourceId);\n  }\n\n  async pairIdentifiers(pairing: Pair[]): Promise<void> {\n    const profile = await this.getUserProfile();\n    const n = await getNonce(profile.profileId, this.#env);\n\n    const logins = await Promise.all(\n      pairing.map(async (p) => {\n        try {\n          const raw = `metamask:${n.nonce}:${p.identifier}`;\n          const sig = await p.signMessage(raw);\n          return {\n            signature: sig,\n            raw_message: raw,\n            encrypted_storage_key: p.encryptedStorageKey,\n            identifier_type: p.identifierType,\n          };\n        } catch (e) {\n          /* istanbul ignore next */\n          const errorMessage =\n            e instanceof Error ? e.message : JSON.stringify(e ?? '');\n          throw new PairError(\n            `failed to sign pairing message: ${errorMessage}`,\n          );\n        }\n      }),\n    );\n\n    const accessToken = await this.getAccessToken();\n    await pairIdentifiers(n.nonce, logins, accessToken, this.#env);\n  }\n\n  prepare(signer: {\n    address: string;\n    chainId: number;\n    signMessage: (message: string) => Promise<string>;\n    domain: string;\n  }): void {\n    this.#assertSIWE(this.#type, this.#sdk);\n    this.#sdk.prepare(signer);\n  }\n\n  #assertSIWE(\n    type: AuthType,\n    _sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts _sdk is SIWEJwtBearerAuth {\n    if (type === AuthType.SiWE) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SIWE auth type',\n    );\n  }\n\n  #assertSRP(\n    type: AuthType,\n    _sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts _sdk is SRPJwtBearerAuth {\n    if (type === AuthType.SRP) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SRP auth type',\n    );\n  }\n}\n\nexport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe.js';\nexport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp.js';\nexport * from './authentication-jwt-bearer/types.js';\n"]}

package/dist/sdk/errors.d.ts

@@ -26,9 +26,9 @@ export declare class CredentialAlreadyEnrolledError extends MfaError {
     constructor(code: 'credential_already_enrolled' | 'email_already_enrolled' | 'email_socially_verified', message: string, status?: number);
 }
 /**
- * The profile already has MFA credentials, so enrolling another requires an
- * `aal:2` access token; the client must complete a step-up and retry with the
- * same flow.
+ * The profile already has a credential that proves AAL2, so enrolling another
+ * requires an `aal:2` access token; the client must complete a verification
+ * and retry with the same flow.
  */
 export declare class StepUpRequiredError extends MfaError {
     constructor(message: string, status?: number);
@@ -78,7 +78,7 @@ export declare class MfaRateLimitedError extends MfaError {
 export declare class MfaUnavailableError extends MfaError {
     constructor(message: string, status?: number);
 }
-export declare class ElevatedTokenInvalidError extends MfaError {
+export declare class VerificationTokenInvalidError extends MfaError {
     constructor(message: string);
 }
 /**

package/dist/sdk/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED;;;;;;GAMG;AACH,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,EACA,6BAA6B,GAC7B,wBAAwB,GACxB,yBAAyB,EAC7B,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA8B,EAGhE;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAI7E,KAAK,sBAAsB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YACE,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAOrD;CACF;AAED;;;;;;GAMG;AACH,qBAAa,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAAI,EACA,6BAA6B,GAC7B,wBAAwB,GACxB,yBAAyB,EAC7B,OAAO,EAAE,MAAM,EACf,MAAM,SAA6B,EAIpC;CACF;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA8B,EAGhE;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAI,EAAE,cAAc,GAAG,qBAAqB,GAAG,mBAAmB,EAClE,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EAIhB;CACF;AAED,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAO,EAAE,MAAM,EACf,MAAM,SAAyC,EAIhD;CACF;AAED,qBAAa,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,SAA6B,EAG/D;CACF;AAED,qBAAa,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,SAAsC,EAI7C;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,6BAA8B,SAAQ,QAAQ;IACzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAsBpC;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,GAAG,KAAK,EAAE,sBAAsB,EAAE,GACjC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,SAA8B;IAE7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,SAA0C;IAEzD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,SAAuC;IAEtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,EAIjD;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,gBAAgB,CAQzD;CACF"}

package/dist/sdk/errors.js

@@ -32,9 +32,9 @@ export class CredentialAlreadyEnrolledError extends MfaError {
     }
 }
 /**
- * The profile already has MFA credentials, so enrolling another requires an
- * `aal:2` access token; the client must complete a step-up and retry with the
- * same flow.
+ * The profile already has a credential that proves AAL2, so enrolling another
+ * requires an `aal:2` access token; the client must complete a verification
+ * and retry with the same flow.
  */
 export class StepUpRequiredError extends MfaError {
     constructor(message, status = HTTP_STATUS_CODES.FORBIDDEN) {
@@ -117,10 +117,10 @@ export class MfaUnavailableError extends MfaError {
         this.name = 'MfaUnavailableError';
     }
 }
-export class ElevatedTokenInvalidError extends MfaError {
+export class VerificationTokenInvalidError extends MfaError {
     constructor(message) {
-        super('elevated_token_invalid', message);
-        this.name = 'ElevatedTokenInvalidError';
+        super('verification_token_invalid', message);
+        this.name = 'VerificationTokenInvalidError';
     }
 }
 /**

package/dist/sdk/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,OAAO,CAAyB;IAEhC,MAAM,CAAU;IAEhB,YAAY,CAAU;IAE/B,YACE,OAA+B,EAC/B,OAAe,EACf,OAAoD;QAEpD,KAAK,CAAC,OAAO,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAG6B,EAC7B,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAEnC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,SAAS;QAC/D,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAqC,EACrC,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAkE,EAClE,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,oBAAoB;QAE/C,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc;IAEd,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,KAAc,EACd,GAAG,KAA+B;IAElC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ;QAC5C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IACrC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;IAE7C,YAAY,CAAU;IAE/B,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAU;QAChC,OAAO,CACL,CAAC,YAAY,gBAAgB;YAC7B,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpB,CAAC,KAAK,IAAI;gBACV,QAAQ,IAAI,CAAC;gBACb,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,CAAC,CACpD,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';\nimport { HTTP_STATUS_CODES } from './constants.js';\nimport { asRecord } from './utils/as-record.js';\n\ntype ExtensibleMfaErrorCode = MfaErrorCode | (string & {});\n\n/**\n * Base error for MFA operations.\n *\n * The machine-readable code is an enumerable own property so it survives\n * JSON-RPC error serialization.\n */\nexport class MfaError extends Error {\n  readonly mfaCode: ExtensibleMfaErrorCode;\n\n  readonly status?: number;\n\n  readonly retryAfterMs?: number;\n\n  constructor(\n    mfaCode: ExtensibleMfaErrorCode,\n    message: string,\n    options?: { status?: number; retryAfterMs?: number },\n  ) {\n    super(`MFA[${mfaCode}]: ${message}`);\n    this.name = 'MfaError';\n    this.mfaCode = mfaCode;\n    this.status = options?.status;\n    this.retryAfterMs = options?.retryAfterMs;\n  }\n}\n\n/**\n * The credential cannot be enrolled because an equivalent one already exists:\n * `email_already_enrolled` (this profile already has a verified email),\n * `email_socially_verified` (the email is verified through a social login), or\n * `credential_already_enrolled` (the email or passkey is enrolled on another\n * profile; the profiles must be paired or the credential removed).\n */\nexport class CredentialAlreadyEnrolledError extends MfaError {\n  constructor(\n    code:\n      | 'credential_already_enrolled'\n      | 'email_already_enrolled'\n      | 'email_socially_verified',\n    message: string,\n    status = HTTP_STATUS_CODES.CONFLICT,\n  ) {\n    super(code, message, { status });\n    this.name = 'CredentialAlreadyEnrolledError';\n  }\n}\n\n/**\n * The profile already has MFA credentials, so enrolling another requires an\n * `aal:2` access token; the client must complete a step-up and retry with the\n * same flow.\n */\nexport class StepUpRequiredError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.FORBIDDEN) {\n    super('aal2_required', message, { status });\n    this.name = 'StepUpRequiredError';\n  }\n}\n\nexport class CredentialNotEnrolledError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('credential_not_enrolled', message, { status });\n    this.name = 'CredentialNotEnrolledError';\n  }\n}\n\n/**\n * The begin/complete flow is stale or unknown; the client must restart it.\n */\nexport class MfaFlowExpiredError extends MfaError {\n  constructor(\n    code: 'flow_expired' | 'invalid_flow',\n    message: string,\n    status?: number,\n  ) {\n    super(code, message, { status });\n    this.name = 'MfaFlowExpiredError';\n  }\n}\n\n/**\n * The profile has no identity-provider record yet. Not a stale flow: the\n * user must enroll a first credential before verifying.\n */\nexport class MfaIdentityMissingError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('mfa_identity_missing', message, { status });\n    this.name = 'MfaIdentityMissingError';\n  }\n}\n\nexport class MfaVerificationFailedError extends MfaError {\n  constructor(\n    code: 'invalid_code' | 'invalid_attestation' | 'invalid_assertion',\n    message: string,\n    status?: number,\n  ) {\n    super(code, message, { status });\n    this.name = 'MfaVerificationFailedError';\n  }\n}\n\nexport class TooManyAttemptsError extends MfaError {\n  constructor(message: string, status?: number) {\n    super('too_many_attempts', message, { status });\n    this.name = 'TooManyAttemptsError';\n  }\n}\n\nexport class MaxPasskeysReachedError extends MfaError {\n  constructor(\n    message: string,\n    status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY,\n  ) {\n    super('max_passkeys_reached', message, { status });\n    this.name = 'MaxPasskeysReachedError';\n  }\n}\n\nexport class MaxIdentifiersReachedError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('max_identifiers_reached', message, { status });\n    this.name = 'MaxIdentifiersReachedError';\n  }\n}\n\nexport class OtpResendCooldownError extends MfaError {\n  constructor(\n    message: string,\n    retryAfterMs?: number,\n    status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n  ) {\n    super('otp_resend_cooldown', message, { status, retryAfterMs });\n    this.name = 'OtpResendCooldownError';\n  }\n}\n\n/**\n * A 429 without an MFA-specific code: generic throttling, not an OTP resend\n * cooldown.\n */\nexport class MfaRateLimitedError extends MfaError {\n  constructor(\n    message: string,\n    retryAfterMs?: number,\n    status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n  ) {\n    super('rate_limited', message, { status, retryAfterMs });\n    this.name = 'MfaRateLimitedError';\n  }\n}\n\n/**\n * The identity provider or the network is unreachable. Safe to retry.\n * `status` is only set when the service answered.\n */\nexport class MfaUnavailableError extends MfaError {\n  constructor(message: string, status?: number) {\n    super('kratos_unavailable', message, { status });\n    this.name = 'MfaUnavailableError';\n  }\n}\n\nexport class ElevatedTokenInvalidError extends MfaError {\n  constructor(message: string) {\n    super('elevated_token_invalid', message);\n    this.name = 'ElevatedTokenInvalidError';\n  }\n}\n\n/**\n * Gets an MFA code from direct, serialized, or message-only errors.\n *\n * @param error - Value to inspect.\n * @returns The stable code, if present.\n */\nexport function getMfaErrorCode(\n  error: unknown,\n): ExtensibleMfaErrorCode | undefined {\n  const direct = asRecord(error);\n  if (typeof direct?.mfaCode === 'string') {\n    return direct.mfaCode;\n  }\n\n  const data = asRecord(direct?.data);\n  const cause = asRecord(data?.cause);\n  if (typeof cause?.mfaCode === 'string') {\n    return cause.mfaCode;\n  }\n\n  const messages = [direct?.message, cause?.message];\n  for (const message of messages) {\n    if (typeof message === 'string') {\n      const match = /^MFA\\[([^\\]]+)\\]:/u.exec(message);\n      if (match?.[1]) {\n        return match[1];\n      }\n    }\n  }\n  return undefined;\n}\n\n/**\n * Checks whether a value carries an MFA error code.\n *\n * @param error - Value to inspect.\n * @param codes - Optional codes to match.\n * @returns Whether the value is an MFA error with a requested code.\n */\nexport function isMfaError(\n  error: unknown,\n  ...codes: ExtensibleMfaErrorCode[]\n): boolean {\n  const code = getMfaErrorCode(error);\n  return code !== undefined && (codes.length === 0 || codes.includes(code));\n}\n\n/**\n * Gets a retry delay from direct or serialized MFA errors.\n *\n * @param error - Value to inspect.\n * @returns Retry delay in milliseconds, if present.\n */\nexport function getMfaRetryAfterMs(error: unknown): number | undefined {\n  const direct = asRecord(error);\n  if (typeof direct?.retryAfterMs === 'number') {\n    return direct.retryAfterMs;\n  }\n  const data = asRecord(direct?.data);\n  const cause = asRecord(data?.cause);\n  return typeof cause?.retryAfterMs === 'number'\n    ? cause.retryAfterMs\n    : undefined;\n}\n\nexport class NonceRetrievalError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NonceRetrievalError';\n  }\n}\n\nexport class SignInError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignInError';\n  }\n}\n\nexport class PairError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/profile/pair/identifier` returns 409 Conflict:\n * the social identifier already belongs to another canonical profile.\n * Retrying the same request cannot succeed.\n */\nexport class PairConflictError extends PairError {\n  readonly status = HTTP_STATUS_CODES.CONFLICT;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairConflictError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/oidc/token` returns 422: this profile has no\n * verified email on record. Consumers should send the user through email\n * OTP (or Google pair) and retry.\n */\nexport class EmailRequiredError extends Error {\n  readonly status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'EmailRequiredError';\n  }\n}\n\nexport class UserStorageError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UserStorageError';\n  }\n}\n\nexport class ValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UnsupportedAuthTypeError';\n  }\n}\n\nexport class NotFoundError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class RateLimitedError extends Error {\n  readonly status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS;\n\n  readonly retryAfterMs?: number;\n\n  constructor(message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = 'RateLimitedError';\n    this.retryAfterMs = retryAfterMs;\n  }\n\n  /**\n   * Check if an unknown error is a rate limit error (429 status).\n   *\n   * @param e - The error to check\n   * @returns True if the error is a rate limit error\n   */\n  static isRateLimitError(e: unknown): e is RateLimitedError {\n    return (\n      e instanceof RateLimitedError ||\n      (typeof e === 'object' &&\n        e !== null &&\n        'status' in e &&\n        e.status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS)\n    );\n  }\n}\n"]}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,OAAO,CAAyB;IAEhC,MAAM,CAAU;IAEhB,YAAY,CAAU;IAE/B,YACE,OAA+B,EAC/B,OAAe,EACf,OAAoD;QAEpD,KAAK,CAAC,OAAO,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAG6B,EAC7B,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAEnC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,SAAS;QAC/D,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAqC,EACrC,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAkE,EAClE,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,oBAAoB;QAE/C,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,QAAQ;IACzD,YAAY,OAAe;QACzB,KAAK,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc;IAEd,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,KAAc,EACd,GAAG,KAA+B;IAElC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ;QAC5C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IACrC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;IAE7C,YAAY,CAAU;IAE/B,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAU;QAChC,OAAO,CACL,CAAC,YAAY,gBAAgB;YAC7B,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpB,CAAC,KAAK,IAAI;gBACV,QAAQ,IAAI,CAAC;gBACb,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,CAAC,CACpD,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';\nimport { HTTP_STATUS_CODES } from './constants.js';\nimport { asRecord } from './utils/as-record.js';\n\ntype ExtensibleMfaErrorCode = MfaErrorCode | (string & {});\n\n/**\n * Base error for MFA operations.\n *\n * The machine-readable code is an enumerable own property so it survives\n * JSON-RPC error serialization.\n */\nexport class MfaError extends Error {\n  readonly mfaCode: ExtensibleMfaErrorCode;\n\n  readonly status?: number;\n\n  readonly retryAfterMs?: number;\n\n  constructor(\n    mfaCode: ExtensibleMfaErrorCode,\n    message: string,\n    options?: { status?: number; retryAfterMs?: number },\n  ) {\n    super(`MFA[${mfaCode}]: ${message}`);\n    this.name = 'MfaError';\n    this.mfaCode = mfaCode;\n    this.status = options?.status;\n    this.retryAfterMs = options?.retryAfterMs;\n  }\n}\n\n/**\n * The credential cannot be enrolled because an equivalent one already exists:\n * `email_already_enrolled` (this profile already has a verified email),\n * `email_socially_verified` (the email is verified through a social login), or\n * `credential_already_enrolled` (the email or passkey is enrolled on another\n * profile; the profiles must be paired or the credential removed).\n */\nexport class CredentialAlreadyEnrolledError extends MfaError {\n  constructor(\n    code:\n      | 'credential_already_enrolled'\n      | 'email_already_enrolled'\n      | 'email_socially_verified',\n    message: string,\n    status = HTTP_STATUS_CODES.CONFLICT,\n  ) {\n    super(code, message, { status });\n    this.name = 'CredentialAlreadyEnrolledError';\n  }\n}\n\n/**\n * The profile already has a credential that proves AAL2, so enrolling another\n * requires an `aal:2` access token; the client must complete a verification\n * and retry with the same flow.\n */\nexport class StepUpRequiredError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.FORBIDDEN) {\n    super('aal2_required', message, { status });\n    this.name = 'StepUpRequiredError';\n  }\n}\n\nexport class CredentialNotEnrolledError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('credential_not_enrolled', message, { status });\n    this.name = 'CredentialNotEnrolledError';\n  }\n}\n\n/**\n * The begin/complete flow is stale or unknown; the client must restart it.\n */\nexport class MfaFlowExpiredError extends MfaError {\n  constructor(\n    code: 'flow_expired' | 'invalid_flow',\n    message: string,\n    status?: number,\n  ) {\n    super(code, message, { status });\n    this.name = 'MfaFlowExpiredError';\n  }\n}\n\n/**\n * The profile has no identity-provider record yet. Not a stale flow: the\n * user must enroll a first credential before verifying.\n */\nexport class MfaIdentityMissingError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('mfa_identity_missing', message, { status });\n    this.name = 'MfaIdentityMissingError';\n  }\n}\n\nexport class MfaVerificationFailedError extends MfaError {\n  constructor(\n    code: 'invalid_code' | 'invalid_attestation' | 'invalid_assertion',\n    message: string,\n    status?: number,\n  ) {\n    super(code, message, { status });\n    this.name = 'MfaVerificationFailedError';\n  }\n}\n\nexport class TooManyAttemptsError extends MfaError {\n  constructor(message: string, status?: number) {\n    super('too_many_attempts', message, { status });\n    this.name = 'TooManyAttemptsError';\n  }\n}\n\nexport class MaxPasskeysReachedError extends MfaError {\n  constructor(\n    message: string,\n    status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY,\n  ) {\n    super('max_passkeys_reached', message, { status });\n    this.name = 'MaxPasskeysReachedError';\n  }\n}\n\nexport class MaxIdentifiersReachedError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('max_identifiers_reached', message, { status });\n    this.name = 'MaxIdentifiersReachedError';\n  }\n}\n\nexport class OtpResendCooldownError extends MfaError {\n  constructor(\n    message: string,\n    retryAfterMs?: number,\n    status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n  ) {\n    super('otp_resend_cooldown', message, { status, retryAfterMs });\n    this.name = 'OtpResendCooldownError';\n  }\n}\n\n/**\n * A 429 without an MFA-specific code: generic throttling, not an OTP resend\n * cooldown.\n */\nexport class MfaRateLimitedError extends MfaError {\n  constructor(\n    message: string,\n    retryAfterMs?: number,\n    status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n  ) {\n    super('rate_limited', message, { status, retryAfterMs });\n    this.name = 'MfaRateLimitedError';\n  }\n}\n\n/**\n * The identity provider or the network is unreachable. Safe to retry.\n * `status` is only set when the service answered.\n */\nexport class MfaUnavailableError extends MfaError {\n  constructor(message: string, status?: number) {\n    super('kratos_unavailable', message, { status });\n    this.name = 'MfaUnavailableError';\n  }\n}\n\nexport class VerificationTokenInvalidError extends MfaError {\n  constructor(message: string) {\n    super('verification_token_invalid', message);\n    this.name = 'VerificationTokenInvalidError';\n  }\n}\n\n/**\n * Gets an MFA code from direct, serialized, or message-only errors.\n *\n * @param error - Value to inspect.\n * @returns The stable code, if present.\n */\nexport function getMfaErrorCode(\n  error: unknown,\n): ExtensibleMfaErrorCode | undefined {\n  const direct = asRecord(error);\n  if (typeof direct?.mfaCode === 'string') {\n    return direct.mfaCode;\n  }\n\n  const data = asRecord(direct?.data);\n  const cause = asRecord(data?.cause);\n  if (typeof cause?.mfaCode === 'string') {\n    return cause.mfaCode;\n  }\n\n  const messages = [direct?.message, cause?.message];\n  for (const message of messages) {\n    if (typeof message === 'string') {\n      const match = /^MFA\\[([^\\]]+)\\]:/u.exec(message);\n      if (match?.[1]) {\n        return match[1];\n      }\n    }\n  }\n  return undefined;\n}\n\n/**\n * Checks whether a value carries an MFA error code.\n *\n * @param error - Value to inspect.\n * @param codes - Optional codes to match.\n * @returns Whether the value is an MFA error with a requested code.\n */\nexport function isMfaError(\n  error: unknown,\n  ...codes: ExtensibleMfaErrorCode[]\n): boolean {\n  const code = getMfaErrorCode(error);\n  return code !== undefined && (codes.length === 0 || codes.includes(code));\n}\n\n/**\n * Gets a retry delay from direct or serialized MFA errors.\n *\n * @param error - Value to inspect.\n * @returns Retry delay in milliseconds, if present.\n */\nexport function getMfaRetryAfterMs(error: unknown): number | undefined {\n  const direct = asRecord(error);\n  if (typeof direct?.retryAfterMs === 'number') {\n    return direct.retryAfterMs;\n  }\n  const data = asRecord(direct?.data);\n  const cause = asRecord(data?.cause);\n  return typeof cause?.retryAfterMs === 'number'\n    ? cause.retryAfterMs\n    : undefined;\n}\n\nexport class NonceRetrievalError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NonceRetrievalError';\n  }\n}\n\nexport class SignInError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignInError';\n  }\n}\n\nexport class PairError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/profile/pair/identifier` returns 409 Conflict:\n * the social identifier already belongs to another canonical profile.\n * Retrying the same request cannot succeed.\n */\nexport class PairConflictError extends PairError {\n  readonly status = HTTP_STATUS_CODES.CONFLICT;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairConflictError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/oidc/token` returns 422: this profile has no\n * verified email on record. Consumers should send the user through email\n * OTP (or Google pair) and retry.\n */\nexport class EmailRequiredError extends Error {\n  readonly status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'EmailRequiredError';\n  }\n}\n\nexport class UserStorageError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UserStorageError';\n  }\n}\n\nexport class ValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UnsupportedAuthTypeError';\n  }\n}\n\nexport class NotFoundError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class RateLimitedError extends Error {\n  readonly status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS;\n\n  readonly retryAfterMs?: number;\n\n  constructor(message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = 'RateLimitedError';\n    this.retryAfterMs = retryAfterMs;\n  }\n\n  /**\n   * Check if an unknown error is a rate limit error (429 status).\n   *\n   * @param e - The error to check\n   * @returns True if the error is a rate limit error\n   */\n  static isRateLimitError(e: unknown): e is RateLimitedError {\n    return (\n      e instanceof RateLimitedError ||\n      (typeof e === 'object' &&\n        e !== null &&\n        'status' in e &&\n        e.status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS)\n    );\n  }\n}\n"]}

package/dist/sdk/index.d.ts

@@ -1,7 +1,7 @@
 export * from './authentication.js';
 export { MFA_CREDENTIAL_TYPES } from './authentication-jwt-bearer/mfa/types.js';
-export type { MfaCredentialType, MfaCredentialStatus, MfaErrorCode, EnrolledCredential, TokenReason, EnrollmentChallenge, EnrollmentProof, StepUpChallenge, StepUpProof, ElevatedProfileToken, BeginEnrollmentRequest, CompleteEnrollmentRequest, BeginStepUpRequest, CompleteStepUpRequest, GetElevatedTokenRequest, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, AuthenticationResponseJSON, } from './authentication-jwt-bearer/mfa/types.js';
-export type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';
+export type { MfaCredentialType, MfaCredentialStatus, MfaErrorCode, EnrolledCredential, TokenReason, EnrollmentChallenge, EnrollmentProof, VerificationChallenge, VerificationProof, VerificationToken, BeginEnrollmentRequest, CompleteEnrollmentRequest, BeginVerificationRequest, CompleteVerificationRequest, GetVerificationTokenRequest, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, AuthenticationResponseJSON, } from './authentication-jwt-bearer/mfa/types.js';
+export type { MfaVerificationAssertion } from './authentication-jwt-bearer/mfa/services.js';
 export * from './user-storage.js';
 export * from './errors.js';
 export * from './utils/messaging-signing-snap-requests.js';

package/dist/sdk/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACtF,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,YAAY,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AAC5F,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC"}

package/dist/sdk/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAuBhF,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC","sourcesContent":["export * from './authentication.js';\nexport { MFA_CREDENTIAL_TYPES } from './authentication-jwt-bearer/mfa/types.js';\nexport type {\n  MfaCredentialType,\n  MfaCredentialStatus,\n  MfaErrorCode,\n  EnrolledCredential,\n  TokenReason,\n  EnrollmentChallenge,\n  EnrollmentProof,\n  StepUpChallenge,\n  StepUpProof,\n  ElevatedProfileToken,\n  BeginEnrollmentRequest,\n  CompleteEnrollmentRequest,\n  BeginStepUpRequest,\n  CompleteStepUpRequest,\n  GetElevatedTokenRequest,\n  PublicKeyCredentialCreationOptionsJSON,\n  PublicKeyCredentialRequestOptionsJSON,\n  RegistrationResponseJSON,\n  AuthenticationResponseJSON,\n} from './authentication-jwt-bearer/mfa/types.js';\nexport type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';\nexport * from './user-storage.js';\nexport * from './errors.js';\nexport * from './utils/messaging-signing-snap-requests.js';\nexport * from '../shared/encryption/index.js';\nexport * from '../shared/env.js';\nexport * from '../shared/storage-schema.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAuBhF,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC","sourcesContent":["export * from './authentication.js';\nexport { MFA_CREDENTIAL_TYPES } from './authentication-jwt-bearer/mfa/types.js';\nexport type {\n  MfaCredentialType,\n  MfaCredentialStatus,\n  MfaErrorCode,\n  EnrolledCredential,\n  TokenReason,\n  EnrollmentChallenge,\n  EnrollmentProof,\n  VerificationChallenge,\n  VerificationProof,\n  VerificationToken,\n  BeginEnrollmentRequest,\n  CompleteEnrollmentRequest,\n  BeginVerificationRequest,\n  CompleteVerificationRequest,\n  GetVerificationTokenRequest,\n  PublicKeyCredentialCreationOptionsJSON,\n  PublicKeyCredentialRequestOptionsJSON,\n  RegistrationResponseJSON,\n  AuthenticationResponseJSON,\n} from './authentication-jwt-bearer/mfa/types.js';\nexport type { MfaVerificationAssertion } from './authentication-jwt-bearer/mfa/services.js';\nexport * from './user-storage.js';\nexport * from './errors.js';\nexport * from './utils/messaging-signing-snap-requests.js';\nexport * from '../shared/encryption/index.js';\nexport * from '../shared/env.js';\nexport * from '../shared/storage-schema.js';\n"]}

package/dist/sdk/mocks/auth.d.ts

@@ -67,8 +67,8 @@ export declare const MOCK_MFA_CREDENTIALS_RESPONSE: {
         };
     })[];
 };
-export declare const MOCK_ELEVATED_ACCESS_JWT = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmODgyMjdiZC1iNjE1LTQxYTMtYjBiZS00NjdkZDc4MWE0YWQiLCJhYWwiOjIsImFtciI6WyJwYXNza2V5Il0sImV4cCI6NDEwMjQ0NDgwMH0.signature";
-export declare const MOCK_ELEVATED_ACCESS_TOKEN_RESPONSE: {
+export declare const MOCK_VERIFICATION_ACCESS_JWT = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmODgyMjdiZC1iNjE1LTQxYTMtYjBiZS00NjdkZDc4MWE0YWQiLCJhYWwiOjIsImFtciI6WyJwYXNza2V5Il0sImV4cCI6NDEwMjQ0NDgwMH0.signature";
+export declare const MOCK_VERIFICATION_ACCESS_TOKEN_RESPONSE: {
     access_token: string;
     expires_in: number;
 };

package/dist/sdk/mocks/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAqBpD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,sBAAsB,QAA6B,CAAC;AACjE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AACrE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AA6BrE,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,mBAAmB;CACpB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,iCAAiC;IAC5C,MAAM;CACP,CAAC;AAEF,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,oBAAoB;CACrB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,sBAAsB,uKACmI,CAAC;AAEvK,eAAO,MAAM,iCAAiC;;;;QAI1C,UAAU;QACV,aAAa;QAEb,eAAe;;;CAGlB,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;YAOlC,YAAY;YACZ,QAAQ;;;;;;;;;YAQR,OAAO;YACP,QAAQ;;;CAIf,CAAC;AAEF,eAAO,MAAM,wBAAwB,0KACoI,CAAC;AAE1K,eAAO,MAAM,mCAAmC;;;CAG/C,CAAC;AAEF,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,sLACyJ,CAAC;AAEtL,eAAO,MAAM,mBAAmB;IAC9B,KAAK;IACL,UAAU;IACV,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;QAIjC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;CAExB,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;QAIhC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;;CAGxB,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,2BAA2B;IACtC,OAAO;QACL,aAAa;QACb,cAAc;QACd,UAAU;;IAEZ,eAAe;CAChB,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;QAG7C,UAAU;QACV,aAAa;QACb,eAAe;QACf,UAAU;;;CAGb,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAqBpD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,sBAAsB,QAA6B,CAAC;AACjE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AACrE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AA6BrE,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,mBAAmB;CACpB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,iCAAiC;IAC5C,MAAM;CACP,CAAC;AAEF,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,oBAAoB;CACrB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,sBAAsB,uKACmI,CAAC;AAEvK,eAAO,MAAM,iCAAiC;;;;QAI1C,UAAU;QACV,aAAa;QAEb,eAAe;;;CAGlB,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;YAOlC,YAAY;YACZ,QAAQ;;;;;;;;;YAQR,OAAO;YACP,QAAQ;;;CAIf,CAAC;AAEF,eAAO,MAAM,4BAA4B,0KACgI,CAAC;AAE1K,eAAO,MAAM,uCAAuC;;;CAGnD,CAAC;AAEF,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,sLACyJ,CAAC;AAEtL,eAAO,MAAM,mBAAmB;IAC9B,KAAK;IACL,UAAU;IACV,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;QAIjC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;CAExB,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;QAIhC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;;CAGxB,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,2BAA2B;IACtC,OAAO;QACL,aAAa;QACb,cAAc;QACd,UAAU;;IAEZ,eAAe;CAChB,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;QAG7C,UAAU;QACV,aAAa;QACb,eAAe;QACf,UAAU;;;CAGb,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}