npm - @metamask-previews/profile-sync-controller - Versions diffs - 34.1.0-preview-e4c191e3a → 34.1.0-preview-aeb52ce4f - Mend

@metamask-previews/profile-sync-controller 34.1.0-preview-e4c191e3a → 34.1.0-preview-aeb52ce4f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/dist/sdk/authentication-jwt-bearer/flow-srp.js CHANGED Viewed

@@ -127,19 +127,6 @@ export class SRPJwtBearerAuth {
                 publicKey: result.publicKey,
             };
         }
-        if (type === 'totp') {
-            if (!result.totp) {
-                throw new MfaError('invalid_response', 'TOTP enrollment response is missing the secret or QR code');
-            }
-            return {
-                type,
-                flowId: result.flowId,
-                expiresAt: result.expiresAt,
-                secret: result.totp.secret,
-                qrCode: result.totp.qrCode,
-                setupUri: result.totp.setupUri,
-            };
-        }
         return {
             type,
             flowId: result.flowId,
@@ -150,7 +137,7 @@ export class SRPJwtBearerAuth {
      * Completes enrollment of an MFA credential.
      *
      * @param flowId - Identifier returned by the begin call.
-     * @param proof - Platform attestation, or email or authenticator app code.
+     * @param proof - Platform attestation or email code.
      * @param entropySourceId - Entropy source whose profile owns the credential.
      * @param accessToken - Bearer token to use instead of the entropy source's,
      * such as the verification token that began the enrollment.
@@ -199,7 +186,7 @@ export class SRPJwtBearerAuth {
      * Completes verification with an enrolled credential.
      *
      * @param flowId - Identifier returned by the begin call.
-     * @param proof - Platform assertion, or email or authenticator app code.
+     * @param proof - Platform assertion or email code.
      * @param entropySourceId - Entropy source whose profile owns the credential.
      * @returns Assertion issued after verification.
      */

package/dist/sdk/authentication-jwt-bearer/flow-srp.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"flow-srp.js","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,WAAW,EACX,eAAe,GAChB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,iBAAiB,EACjB,SAAS,EACT,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EACL,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,QAAQ,EACR,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,WAAW,GACZ,MAAM,eAAe,CAAC;AAoBvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAuB7C,0EAA0E;AAC1E,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAa;IAEpB,QAAQ,CAGf;IAEO,YAAY,CAAmB;IAExC,yDAAyD;IAChD,cAAc,GAAG,IAAI,GAAG,EAG9B,CAAC;IAEJ,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACxD,gBAAgB,GAAG,IAAI,GAAG,EAGhC,CAAC;IAEJ,sDAAsD;IAC7C,kBAAkB,CAAS;IAEpC,uDAAuD;IAC9C,gBAAgB,CAAS;IAEzB,YAAY,CAAsD;IAElE,uBAAuB,CAEE;IAElC,eAAe,CAAmB;IAElC,YACE,MAA2C,EAC3C,OAGC;QAED,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,IAAI,CAAC,eAAe,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QAExC,4CAA4C;QAC5C,IAAI,CAAC,kBAAkB;YACrB,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAuB,CAClC,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,WAAW,EACX,MAAM,EACN,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,kBAAkB,CACtB,IAAuB,EACvB,OAIC;QAED,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,WAAW,GACf,OAAO,EAAE,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,sDAAsD,CACvD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;aAC/B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAsB,EACtB,eAAwB,EACxB,WAAoB;QAEpB,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE;YACvD,eAAe,EAAE,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,MAAM;YACf,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,WAAW,EAAE;gBAC5C,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,IAAuB,EACvB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QAEH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,uBAAuB,CAC3B,MAAc,EACd,KAAwB,EACxB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,MAAM;YACf,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE;gBACxC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC7C,OAAO,MAAM,aAAa,CACxB,YAAY,EACZ,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,OAAO,MAAM,oBAAoB,CAC/B,MAAM,EACN,eAAe,EACf,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,yBAAyB,CAC7B,MAAyB;QAEzB,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,YAAY,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAC1B,YAAY,EACZ,eAAe,EACf,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;QACF,yEAAyE;QACzE,4CAA4C;QAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC7B,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,gBAAgB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,mEAAmE;YACnE,0CAA0C;YAC1C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC7B,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;aAC3C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,oCAAoC;YACpC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,eAAe,CACnB,eAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;QAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAwB;QACnC,gDAAgD;QAChD,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,QAAQ;QACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7D,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,cAAc,GAClB,CAAC,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAC/C,QAAQ,CAAC,KAAK,EACd,SAAS,EACT,GAAG,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAEtE,eAAe;QACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,YAAY,EACjB,cAAc,CACf,CAAC;QAEF,2CAA2C;QAC3C,oFAAoF;QACpF,8DAA8D;QAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;QAE5C,IAAI,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,kBAAkB,GAAG,mBAAmB,CAC5C,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;YAEF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAC/D,CAAC;YAEF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,WAAW,GACf,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;gBACjE,eAAe,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAEhD,YAAY;QACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;QAEF,OAAO;QACP,MAAM,MAAM,GAAkB;YAC5B,OAAO;YACP,KAAK,EAAE,aAAa;SACrB,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAEtE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,qEAAqE;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,6BAA6B;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAE3D,+BAA+B;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,iCAAiC;YACjC,OAAO,MAAM,YAAY,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,sDAAsD;YACtD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,eAAwB;QAC5C,uDAAuD;QACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,wCAAwC;gBACxC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACrC,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,2CAA2C;gBAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC;gBACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAE9B,0BAA0B;YAC5B,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,yBAAyB,CACvB,KAAa,EACb,SAAiB,EACjB,GAAiB;QAIjB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,YAAY,KAAK,IAAI,SAAS,IAAI,GAAG,EAAW,CAAC;QAC1D,CAAC;QACD,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;IACnD,CAAC;CACF","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { MetaMetricsAuth } from '../../shared/types/services.js';\nimport { MfaError, ValidationError, RateLimitedError } from '../errors.js';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider.js';\nimport {\n MESSAGE_SIGNING_SNAP,\n assertMessageStartsWithMetamask,\n connectSnap,\n isSnapConnected,\n} from '../utils/messaging-signing-snap-requests.js';\nimport { validateLoginResponse } from '../utils/validate-login-response.js';\nimport {\n getMfaCredentials,\n mfaEnroll,\n mfaEnrollComplete,\n mfaVerify,\n mfaVerifyComplete,\n} from './mfa/services.js';\nimport type { MfaVerificationAssertion } from './mfa/services.js';\nimport type {\n EnrolledCredential,\n EnrollmentChallenge,\n EnrollmentProof,\n MfaCredentialType,\n VerificationChallenge,\n VerificationProof,\n} from './mfa/types.js';\nimport {\n authenticate,\n authorizeOIDC,\n getCustomerServiceToken,\n getNonce,\n getPartnerIdentityToken,\n getUserProfileLineage,\n pairProfiles,\n pairSocialIdentifier,\n socialLogin,\n} from './services.js';\nimport type { PairProfilesResponse } from './services.js';\nimport type {\n AuthConfig,\n AccessToken,\n AuthSigningOptions,\n AuthStorageOptions,\n AuthType,\n IBaseAuth,\n LoginIdentifierType,\n LoginResponse,\n OidcTokenAudience,\n OidcTokenClaims,\n PairSocialIdentifierParams,\n ProfileIdentifier,\n SocialLoginParams,\n SrpLoginTag,\n UserProfile,\n UserProfileLineage,\n} from './types.js';\nimport { computeIdentifierId } from './utils/identifier.js';\nimport * as timeUtils from './utils/time.js';\n\ntype JwtBearerAuth_SRP_Options = {\n storage: AuthStorageOptions;\n signing?: AuthSigningOptions;\n /*\n Resolves the login tag for a given entropy source.\n * When omitted, `raw_message` stays untagged (`metamask:<nonce>:<pubkey>`).\n /\n getLoginTag?: (entropySourceId?: string) => Promise<SrpLoginTag>;\n /\n Resolves the metametrics `identifier_type` for a given entropy source.\n * Defaults to `'SRP'` when omitted.\n /\n getLoginIdentifierType?: (\n entropySourceId?: string,\n ) => Promise<LoginIdentifierType>;\n rateLimitRetry?: {\n cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n maxLoginRetries?: number; // maximum number of login retries on rate limit\n };\n};\n\n// How long a successful pairing result stays cached so identical payloads\n// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.\nexport const PAIR_DEDUPE_TTL_MS = 30_000;\n\nconst getDefaultEIP6963Provider = async () => {\n const provider = await getMetaMaskProviderEIP6963();\n if (!provider) {\n throw new ValidationError('No MetaMask wallet connected');\n }\n return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n getIdentifier: async (entropySourceId?: string): Promise<string> => {\n const provider = customProvider ?? (await getDefaultEIP6963Provider());\n return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n },\n signMessage: async (\n message: string,\n entropySourceId?: string,\n ): Promise<string> => {\n const provider = customProvider ?? (await getDefaultEIP6963Provider());\n assertMessageStartsWithMetamask(message);\n return await MESSAGE_SIGNING_SNAP.signMessage(\n provider,\n message,\n entropySourceId,\n );\n },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n readonly #config: AuthConfig;\n\n readonly #options: {\n storage: AuthStorageOptions;\n signing: AuthSigningOptions;\n };\n\n readonly #metametrics?: MetaMetricsAuth;\n\n // Map to store ongoing login promises by entropySourceId\n readonly #ongoingLogins = new Map<\n string \| undefined,\n Promise<LoginResponse>\n >();\n\n // Map to dedupe pairing calls by an order-insensitive token-set key.\n // Holds the in-flight promise (coalescing concurrent callers) and keeps it\n // for a short TTL after success (collapsing sequential retries).\n readonly #ongoingPairings = new Map<\n string,\n { promise: Promise<PairProfilesResponse>; expiresAt: number }\n >();\n\n // Default cooldown when 429 has no Retry-After header\n readonly #cooldownDefaultMs: number;\n\n // Maximum number of login retries on rate limit errors\n readonly #maxLoginRetries: number;\n\n readonly #getLoginTag?: (entropySourceId?: string) => Promise<SrpLoginTag>;\n\n readonly #getLoginIdentifierType?: (\n entropySourceId?: string,\n ) => Promise<LoginIdentifierType>;\n\n #customProvider?: Eip1193Provider;\n\n constructor(\n config: AuthConfig & { type: AuthType.SRP },\n options: JwtBearerAuth_SRP_Options & {\n customProvider?: Eip1193Provider;\n metametrics?: MetaMetricsAuth;\n },\n ) {\n this.#config = config;\n this.#customProvider = options.customProvider;\n this.#getLoginTag = options.getLoginTag;\n this.#getLoginIdentifierType = options.getLoginIdentifierType;\n this.#options = {\n storage: options.storage,\n signing:\n options.signing ??\n getDefaultEIP6963SigningOptions(this.#customProvider),\n };\n this.#metametrics = options.metametrics;\n\n // Apply rate limit retry config if provided\n this.#cooldownDefaultMs =\n options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n }\n\n setCustomProvider(provider: Eip1193Provider) {\n this.#customProvider = provider;\n this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n }\n\n // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n async getAccessToken(entropySourceId?: string): Promise<string> {\n const session = await this.#getAuthSession(entropySourceId);\n if (session) {\n return session.token.accessToken;\n }\n\n const loginResponse = await this.#login(entropySourceId);\n return loginResponse.token.accessToken;\n }\n\n async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n const session = await this.#getAuthSession(entropySourceId);\n if (session) {\n return session.profile;\n }\n\n const loginResponse = await this.#login(entropySourceId);\n return loginResponse.profile;\n }\n\n async getIdentifier(entropySourceId?: string): Promise<string> {\n return await this.#options.signing.getIdentifier(entropySourceId);\n }\n\n async getUserProfileLineage(\n entropySourceId?: string,\n ): Promise<UserProfileLineage> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await getUserProfileLineage(this.#config.env, accessToken);\n }\n\n async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await getCustomerServiceToken(this.#config.env, accessToken);\n }\n\n async getPartnerIdentityToken(\n claims: OidcTokenClaims,\n audience: OidcTokenAudience,\n entropySourceId?: string,\n ): Promise<string> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await getPartnerIdentityToken(\n this.#config.env,\n accessToken,\n claims,\n audience,\n );\n }\n\n /\n Begins enrollment of an MFA credential for the primary profile.\n \n @param type - Credential type to enroll.\n * @param options - Enrollment options.\n * @param options.email - Email address, required for email OTP.\n * @param options.entropySourceId - Entropy source whose profile owns the\n * credential.\n * @param options.accessToken - Bearer to use instead of the base session\n * token; the server requires an AAL2 token once a credential that proves\n * AAL2 is enrolled.\n * @returns Enrollment challenge for the client ceremony.\n /\n async beginMfaEnrollment(\n type: MfaCredentialType,\n options?: {\n email?: string;\n entropySourceId?: string;\n accessToken?: string;\n },\n ): Promise<EnrollmentChallenge> {\n const { email, entropySourceId } = options ?? {};\n const accessToken =\n options?.accessToken ?? (await this.getAccessToken(entropySourceId));\n const result = await mfaEnroll(this.#config.env, accessToken, {\n credential_type: type,\n ...(email ? { identifier: email } : {}),\n });\n\n if (type === 'passkey') {\n if (!result.publicKey) {\n throw new MfaError(\n 'invalid_response',\n 'Passkey enrollment response is missing creation data',\n );\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n publicKey: result.publicKey,\n };\n }\n if (type === 'totp') {\n if (!result.totp) {\n throw new MfaError(\n 'invalid_response',\n 'TOTP enrollment response is missing the secret or QR code',\n );\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n secret: result.totp.secret,\n qrCode: result.totp.qrCode,\n setupUri: result.totp.setupUri,\n };\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n };\n }\n\n /\n Completes enrollment of an MFA credential.\n \n @param flowId - Identifier returned by the begin call.\n * @param proof - Platform attestation, or email or authenticator app code.\n * @param entropySourceId - Entropy source whose profile owns the credential.\n * @param accessToken - Bearer token to use instead of the entropy source's,\n * such as the verification token that began the enrollment.\n * @returns Assertion proving the enrolled credential.\n /\n async completeMfaEnrollment(\n flowId: string,\n proof: EnrollmentProof,\n entropySourceId?: string,\n accessToken?: string,\n ): Promise<MfaVerificationAssertion> {\n const bearer = accessToken ?? (await this.getAccessToken(entropySourceId));\n return await mfaEnrollComplete(this.#config.env, bearer, {\n credential_type: proof.type,\n flow_id: flowId,\n ...(proof.type === 'passkey'\n ? { passkey_attestation: proof.attestation }\n : { otp_code: proof.code }),\n });\n }\n\n /\n Begins verification with an enrolled credential.\n \n @param type - Credential type to verify.\n * @param entropySourceId - Entropy source whose profile owns the credential.\n * @returns Verification challenge for the client ceremony.\n /\n async beginMfaVerification(\n type: MfaCredentialType,\n entropySourceId?: string,\n ): Promise<VerificationChallenge> {\n const accessToken = await this.getAccessToken(entropySourceId);\n const result = await mfaVerify(this.#config.env, accessToken, {\n credential_type: type,\n });\n\n if (type === 'passkey') {\n if (!result.publicKey) {\n throw new MfaError(\n 'invalid_response',\n 'Passkey verification response is missing request data',\n );\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n publicKey: result.publicKey,\n };\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n };\n }\n\n /\n Completes verification with an enrolled credential.\n \n @param flowId - Identifier returned by the begin call.\n * @param proof - Platform assertion, or email or authenticator app code.\n * @param entropySourceId - Entropy source whose profile owns the credential.\n * @returns Assertion issued after verification.\n /\n async completeMfaVerification(\n flowId: string,\n proof: VerificationProof,\n entropySourceId?: string,\n ): Promise<MfaVerificationAssertion> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await mfaVerifyComplete(this.#config.env, accessToken, {\n credential_type: proof.type,\n flow_id: flowId,\n ...(proof.type === 'passkey'\n ? { passkey_assertion: proof.assertion }\n : { otp_code: proof.code }),\n });\n }\n\n /\n Gets credentials enrolled on the primary profile.\n \n @param entropySourceId - Entropy source whose profile owns the credentials.\n * @returns Supported enrolled credentials.\n /\n async getMfaCredentials(\n entropySourceId?: string,\n ): Promise<EnrolledCredential[]> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await getMfaCredentials(this.#config.env, accessToken);\n }\n\n /\n Exchanges an MFA verification assertion for an access token carrying the\n * assurance level the assertion proves.\n \n @param assertionJwt - Verification assertion.\n * @returns Access token.\n /\n async exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken> {\n return await authorizeOIDC(\n assertionJwt,\n this.#config.env,\n this.#config.platform,\n );\n }\n\n async pairSocialIdentifier(\n params: PairSocialIdentifierParams,\n authAccessToken: string,\n ): Promise<ProfileIdentifier[] \| undefined> {\n return await pairSocialIdentifier(\n params,\n authAccessToken,\n this.#config.env,\n );\n }\n\n /\n Exchanges a social access token for an access token and the canonical\n * profile its identifier is paired to. Nothing is stored: SRP\n * sessions stay the source of truth for `getAccessToken`.\n \n @param params - Social identifier type and social JWT.\n * @returns The access token and canonical profile.\n /\n async exchangeSocialAccessToken(\n params: SocialLoginParams,\n ): Promise<LoginResponse> {\n const authResponse = await socialLogin(params, this.#config.env);\n const token = await authorizeOIDC(\n authResponse.token,\n this.#config.env,\n this.#config.platform,\n );\n return { profile: authResponse.profile, token };\n }\n\n async pairSrpProfiles(\n accessTokens: string[],\n authAccessToken: string,\n ): Promise<PairProfilesResponse> {\n // Order-insensitive key: the same token set in any order maps to the same\n // entry. Sort a copy so the request payload itself stays primary-first.\n const key = JSON.stringify([...accessTokens].sort());\n\n const cached = this.#ongoingPairings.get(key);\n if (cached && cached.expiresAt > Date.now()) {\n return await cached.promise;\n }\n\n const promise = pairProfiles(\n accessTokens,\n authAccessToken,\n this.#config.env,\n );\n // Store the in-flight promise immediately so concurrent callers coalesce\n // regardless of how long the request takes.\n this.#ongoingPairings.set(key, {\n promise,\n expiresAt: Number.MAX_SAFE_INTEGER,\n });\n\n try {\n const result = await promise;\n // Keep the resolved result cached for a short window so sequential\n // retries with the same payload reuse it.\n this.#ongoingPairings.set(key, {\n promise,\n expiresAt: Date.now() + PAIR_DEDUPE_TTL_MS,\n });\n return result;\n } catch (error) {\n // Never cache failures: the pairing retry loop must be able to re-hit\n // the endpoint on the next attempt.\n this.#ongoingPairings.delete(key);\n throw error;\n }\n }\n\n async signMessage(\n message: string,\n entropySourceId?: string,\n ): Promise<string> {\n return await this.#options.signing.signMessage(message, entropySourceId);\n }\n\n async isSnapConnected(): Promise<boolean> {\n const provider =\n this.#customProvider ?? (await getDefaultEIP6963Provider());\n if (!provider) {\n return false;\n }\n\n const isConnected = await isSnapConnected(provider);\n return isConnected;\n }\n\n async connectSnap(): Promise<string> {\n const provider =\n this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n const res = await connectSnap(provider);\n return res;\n }\n\n // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n async #getAuthSession(\n entropySourceId?: string,\n ): Promise<LoginResponse \| null> {\n const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n if (!validateLoginResponse(auth)) {\n return null;\n }\n\n // get canonical profile id from server if not present in the cached session\n if (!auth.profile.canonicalProfileId) {\n return null;\n }\n\n const currentTime = Date.now();\n const sessionAge = currentTime - auth.token.obtainedAt;\n const refreshThreshold = auth.token.expiresIn 1000 * 0.9;\n\n if (sessionAge < refreshThreshold) {\n return auth;\n }\n return null;\n }\n\n async #login(entropySourceId?: string): Promise<LoginResponse> {\n // Use a deferred login to avoid race conditions\n return await this.#deferredLogin(entropySourceId);\n }\n\n async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n // Nonce\n const publicKey = await this.getIdentifier(entropySourceId);\n const nonceRes = await getNonce(publicKey, this.#config.env);\n\n // Tag only when the wallet supplies getLoginTag. SDK callers keep the\n // legacy 3-part message rather than guessing `primary`.\n const tag = await this.#getLoginTag?.(entropySourceId);\n const identifierType =\n (await this.#getLoginIdentifierType?.(entropySourceId)) ?? 'SRP';\n const rawMessage = this.#createSrpLoginRawMessage(\n nonceRes.nonce,\n publicKey,\n tag,\n );\n const signature = await this.signMessage(rawMessage, entropySourceId);\n\n // Authenticate\n const authResponse = await authenticate(\n rawMessage,\n signature,\n this.#config.type,\n this.#config.env,\n this.#metametrics,\n identifierType,\n );\n\n // Resolve original profileId from aliases.\n // This is done mainly to preserve the original profileId for storage key derivation\n // until we migrate to the canonical profileId storage system.\n const canonicalProfileId = authResponse.profile.profileId;\n const profile = { ...authResponse.profile };\n\n if (authResponse.profileAliases?.length > 0) {\n const targetIdentifierId = computeIdentifierId(\n publicKey,\n this.#config.env,\n );\n\n const matchingAliases = authResponse.profileAliases.filter((alias) =>\n alias.identifierIds.some((id) => id.id === targetIdentifierId),\n );\n\n // Prefer the leaf alias (single identifier) — it's the original profile\n // created for this SRP. Multi-identifier aliases are former canonicals\n // that absorbed other profiles; they are correct only when this SRP's\n // original profile was itself a canonical before being absorbed.\n const targetAlias =\n matchingAliases.find((alias) => alias.identifierIds.length === 1) ??\n matchingAliases[0];\n\n if (targetAlias) {\n profile.profileId = targetAlias.aliasProfileId;\n }\n }\n\n profile.canonicalProfileId = canonicalProfileId;\n\n // Authorize\n const tokenResponse = await authorizeOIDC(\n authResponse.token,\n this.#config.env,\n this.#config.platform,\n );\n\n // Save\n const result: LoginResponse = {\n profile,\n token: tokenResponse,\n };\n\n await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n return result;\n }\n\n async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n // Check if there's already an ongoing login for this entropySourceId\n const existingLogin = this.#ongoingLogins.get(entropySourceId);\n if (existingLogin) {\n return existingLogin;\n }\n\n // Create a new login promise\n const loginPromise = this.#loginWithRetry(entropySourceId);\n\n // Store the promise in the map\n this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n try {\n // Wait for the login to complete\n return await loginPromise;\n } finally {\n // Always clean up the ongoing login promise when done\n this.#ongoingLogins.delete(entropySourceId);\n }\n }\n\n async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n // Allow max attempts: initial + maxLoginRetries on 429\n for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n try {\n return await this.#performLogin(entropySourceId);\n } catch (e) {\n // Only retry on rate-limit (429) errors\n if (!RateLimitedError.isRateLimitError(e)) {\n throw e;\n }\n\n // If we've exhausted attempts, rethrow\n if (attempt >= this.#maxLoginRetries) {\n throw e;\n }\n\n // Wait for Retry-After or default cooldown\n const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n await timeUtils.delay(waitMs);\n\n // Loop continues to retry\n }\n }\n\n // Should never reach here due to loop logic, but TypeScript needs a return\n throw new Error('Unexpected: login loop exhausted without result');\n }\n\n #createSrpLoginRawMessage(\n nonce: string,\n publicKey: string,\n tag?: SrpLoginTag,\n ):\n \| `metamask:${string}:${string}`\n \| `metamask:${string}:${string}:${SrpLoginTag}` {\n if (tag) {\n return `metamask:${nonce}:${publicKey}:${tag}` as const;\n }\n return `metamask:${nonce}:${publicKey}` as const;\n }\n}\n"]}
1	+ {"version":3,"file":"flow-srp.js","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,WAAW,EACX,eAAe,GAChB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,iBAAiB,EACjB,SAAS,EACT,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EACL,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,QAAQ,EACR,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,WAAW,GACZ,MAAM,eAAe,CAAC;AAoBvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAC;AAuB7C,0EAA0E;AAC1E,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAa;IAEpB,QAAQ,CAGf;IAEO,YAAY,CAAmB;IAExC,yDAAyD;IAChD,cAAc,GAAG,IAAI,GAAG,EAG9B,CAAC;IAEJ,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACxD,gBAAgB,GAAG,IAAI,GAAG,EAGhC,CAAC;IAEJ,sDAAsD;IAC7C,kBAAkB,CAAS;IAEpC,uDAAuD;IAC9C,gBAAgB,CAAS;IAEzB,YAAY,CAAsD;IAElE,uBAAuB,CAEE;IAElC,eAAe,CAAmB;IAElC,YACE,MAA2C,EAC3C,OAGC;QAED,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,IAAI,CAAC,eAAe,CAAC;SACxD,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QAExC,4CAA4C;QAC5C,IAAI,CAAC,kBAAkB;YACrB,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAwB;QACpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,MAAuB,EACvB,QAA2B,EAC3B,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,uBAAuB,CAClC,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,WAAW,EACX,MAAM,EACN,QAAQ,CACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,kBAAkB,CACtB,IAAuB,EACvB,OAIC;QAED,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QACjD,MAAM,WAAW,GACf,OAAO,EAAE,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,IAAI;YACrB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QAEH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,sDAAsD,CACvD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAsB,EACtB,eAAwB,EACxB,WAAoB;QAEpB,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE;YACvD,eAAe,EAAE,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,MAAM;YACf,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,WAAW,EAAE;gBAC5C,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,IAAuB,EACvB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QAEH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,uBAAuB,CAC3B,MAAc,EACd,KAAwB,EACxB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,eAAe,EAAE,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,MAAM;YACf,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE;gBACxC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC7C,OAAO,MAAM,aAAa,CACxB,YAAY,EACZ,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,eAAuB;QAEvB,OAAO,MAAM,oBAAoB,CAC/B,MAAM,EACN,eAAe,EACf,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,yBAAyB,CAC7B,MAAyB;QAEzB,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,YAAY,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAC1B,YAAY,EACZ,eAAe,EACf,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;QACF,yEAAyE;QACzE,4CAA4C;QAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC7B,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,gBAAgB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,mEAAmE;YACnE,0CAA0C;YAC1C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC7B,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;aAC3C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,oCAAoC;YACpC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,eAAe,CACnB,eAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;QAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,eAAwB;QACnC,gDAAgD;QAChD,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,QAAQ;QACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7D,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,cAAc,GAClB,CAAC,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,CAC/C,QAAQ,CAAC,KAAK,EACd,SAAS,EACT,GAAG,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAEtE,eAAe;QACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,YAAY,EACjB,cAAc,CACf,CAAC;QAEF,2CAA2C;QAC3C,oFAAoF;QACpF,8DAA8D;QAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;QAE5C,IAAI,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,kBAAkB,GAAG,mBAAmB,CAC5C,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;YAEF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAC/D,CAAC;YAEF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,WAAW,GACf,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;gBACjE,eAAe,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAEhD,YAAY;QACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,IAAI,CAAC,OAAO,CAAC,GAAG,EAChB,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC;QAEF,OAAO;QACP,MAAM,MAAM,GAAkB;YAC5B,OAAO;YACP,KAAK,EAAE,aAAa;SACrB,CAAC;QAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAEtE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,qEAAqE;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,6BAA6B;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAE3D,+BAA+B;QAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,iCAAiC;YACjC,OAAO,MAAM,YAAY,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,sDAAsD;YACtD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,eAAwB;QAC5C,uDAAuD;QACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,wCAAwC;gBACxC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,uCAAuC;gBACvC,IAAI,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACrC,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,2CAA2C;gBAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC;gBACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAE9B,0BAA0B;YAC5B,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,yBAAyB,CACvB,KAAa,EACb,SAAiB,EACjB,GAAiB;QAIjB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,YAAY,KAAK,IAAI,SAAS,IAAI,GAAG,EAAW,CAAC;QAC1D,CAAC;QACD,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;IACnD,CAAC;CACF","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { MetaMetricsAuth } from '../../shared/types/services.js';\nimport { MfaError, ValidationError, RateLimitedError } from '../errors.js';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider.js';\nimport {\n MESSAGE_SIGNING_SNAP,\n assertMessageStartsWithMetamask,\n connectSnap,\n isSnapConnected,\n} from '../utils/messaging-signing-snap-requests.js';\nimport { validateLoginResponse } from '../utils/validate-login-response.js';\nimport {\n getMfaCredentials,\n mfaEnroll,\n mfaEnrollComplete,\n mfaVerify,\n mfaVerifyComplete,\n} from './mfa/services.js';\nimport type { MfaVerificationAssertion } from './mfa/services.js';\nimport type {\n EnrolledCredential,\n EnrollmentChallenge,\n EnrollmentProof,\n MfaCredentialType,\n VerificationChallenge,\n VerificationProof,\n} from './mfa/types.js';\nimport {\n authenticate,\n authorizeOIDC,\n getCustomerServiceToken,\n getNonce,\n getPartnerIdentityToken,\n getUserProfileLineage,\n pairProfiles,\n pairSocialIdentifier,\n socialLogin,\n} from './services.js';\nimport type { PairProfilesResponse } from './services.js';\nimport type {\n AuthConfig,\n AccessToken,\n AuthSigningOptions,\n AuthStorageOptions,\n AuthType,\n IBaseAuth,\n LoginIdentifierType,\n LoginResponse,\n OidcTokenAudience,\n OidcTokenClaims,\n PairSocialIdentifierParams,\n ProfileIdentifier,\n SocialLoginParams,\n SrpLoginTag,\n UserProfile,\n UserProfileLineage,\n} from './types.js';\nimport { computeIdentifierId } from './utils/identifier.js';\nimport * as timeUtils from './utils/time.js';\n\ntype JwtBearerAuth_SRP_Options = {\n storage: AuthStorageOptions;\n signing?: AuthSigningOptions;\n /*\n Resolves the login tag for a given entropy source.\n * When omitted, `raw_message` stays untagged (`metamask:<nonce>:<pubkey>`).\n /\n getLoginTag?: (entropySourceId?: string) => Promise<SrpLoginTag>;\n /\n Resolves the metametrics `identifier_type` for a given entropy source.\n * Defaults to `'SRP'` when omitted.\n /\n getLoginIdentifierType?: (\n entropySourceId?: string,\n ) => Promise<LoginIdentifierType>;\n rateLimitRetry?: {\n cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n maxLoginRetries?: number; // maximum number of login retries on rate limit\n };\n};\n\n// How long a successful pairing result stays cached so identical payloads\n// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.\nexport const PAIR_DEDUPE_TTL_MS = 30_000;\n\nconst getDefaultEIP6963Provider = async () => {\n const provider = await getMetaMaskProviderEIP6963();\n if (!provider) {\n throw new ValidationError('No MetaMask wallet connected');\n }\n return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n getIdentifier: async (entropySourceId?: string): Promise<string> => {\n const provider = customProvider ?? (await getDefaultEIP6963Provider());\n return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n },\n signMessage: async (\n message: string,\n entropySourceId?: string,\n ): Promise<string> => {\n const provider = customProvider ?? (await getDefaultEIP6963Provider());\n assertMessageStartsWithMetamask(message);\n return await MESSAGE_SIGNING_SNAP.signMessage(\n provider,\n message,\n entropySourceId,\n );\n },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n readonly #config: AuthConfig;\n\n readonly #options: {\n storage: AuthStorageOptions;\n signing: AuthSigningOptions;\n };\n\n readonly #metametrics?: MetaMetricsAuth;\n\n // Map to store ongoing login promises by entropySourceId\n readonly #ongoingLogins = new Map<\n string \| undefined,\n Promise<LoginResponse>\n >();\n\n // Map to dedupe pairing calls by an order-insensitive token-set key.\n // Holds the in-flight promise (coalescing concurrent callers) and keeps it\n // for a short TTL after success (collapsing sequential retries).\n readonly #ongoingPairings = new Map<\n string,\n { promise: Promise<PairProfilesResponse>; expiresAt: number }\n >();\n\n // Default cooldown when 429 has no Retry-After header\n readonly #cooldownDefaultMs: number;\n\n // Maximum number of login retries on rate limit errors\n readonly #maxLoginRetries: number;\n\n readonly #getLoginTag?: (entropySourceId?: string) => Promise<SrpLoginTag>;\n\n readonly #getLoginIdentifierType?: (\n entropySourceId?: string,\n ) => Promise<LoginIdentifierType>;\n\n #customProvider?: Eip1193Provider;\n\n constructor(\n config: AuthConfig & { type: AuthType.SRP },\n options: JwtBearerAuth_SRP_Options & {\n customProvider?: Eip1193Provider;\n metametrics?: MetaMetricsAuth;\n },\n ) {\n this.#config = config;\n this.#customProvider = options.customProvider;\n this.#getLoginTag = options.getLoginTag;\n this.#getLoginIdentifierType = options.getLoginIdentifierType;\n this.#options = {\n storage: options.storage,\n signing:\n options.signing ??\n getDefaultEIP6963SigningOptions(this.#customProvider),\n };\n this.#metametrics = options.metametrics;\n\n // Apply rate limit retry config if provided\n this.#cooldownDefaultMs =\n options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n }\n\n setCustomProvider(provider: Eip1193Provider) {\n this.#customProvider = provider;\n this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n }\n\n // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n async getAccessToken(entropySourceId?: string): Promise<string> {\n const session = await this.#getAuthSession(entropySourceId);\n if (session) {\n return session.token.accessToken;\n }\n\n const loginResponse = await this.#login(entropySourceId);\n return loginResponse.token.accessToken;\n }\n\n async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n const session = await this.#getAuthSession(entropySourceId);\n if (session) {\n return session.profile;\n }\n\n const loginResponse = await this.#login(entropySourceId);\n return loginResponse.profile;\n }\n\n async getIdentifier(entropySourceId?: string): Promise<string> {\n return await this.#options.signing.getIdentifier(entropySourceId);\n }\n\n async getUserProfileLineage(\n entropySourceId?: string,\n ): Promise<UserProfileLineage> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await getUserProfileLineage(this.#config.env, accessToken);\n }\n\n async getCustomerServiceToken(entropySourceId?: string): Promise<string> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await getCustomerServiceToken(this.#config.env, accessToken);\n }\n\n async getPartnerIdentityToken(\n claims: OidcTokenClaims,\n audience: OidcTokenAudience,\n entropySourceId?: string,\n ): Promise<string> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await getPartnerIdentityToken(\n this.#config.env,\n accessToken,\n claims,\n audience,\n );\n }\n\n /\n Begins enrollment of an MFA credential for the primary profile.\n \n @param type - Credential type to enroll.\n * @param options - Enrollment options.\n * @param options.email - Email address, required for email OTP.\n * @param options.entropySourceId - Entropy source whose profile owns the\n * credential.\n * @param options.accessToken - Bearer to use instead of the base session\n * token; the server requires an AAL2 token once a credential that proves\n * AAL2 is enrolled.\n * @returns Enrollment challenge for the client ceremony.\n /\n async beginMfaEnrollment(\n type: MfaCredentialType,\n options?: {\n email?: string;\n entropySourceId?: string;\n accessToken?: string;\n },\n ): Promise<EnrollmentChallenge> {\n const { email, entropySourceId } = options ?? {};\n const accessToken =\n options?.accessToken ?? (await this.getAccessToken(entropySourceId));\n const result = await mfaEnroll(this.#config.env, accessToken, {\n credential_type: type,\n ...(email ? { identifier: email } : {}),\n });\n\n if (type === 'passkey') {\n if (!result.publicKey) {\n throw new MfaError(\n 'invalid_response',\n 'Passkey enrollment response is missing creation data',\n );\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n publicKey: result.publicKey,\n };\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n };\n }\n\n /\n Completes enrollment of an MFA credential.\n \n @param flowId - Identifier returned by the begin call.\n * @param proof - Platform attestation or email code.\n * @param entropySourceId - Entropy source whose profile owns the credential.\n * @param accessToken - Bearer token to use instead of the entropy source's,\n * such as the verification token that began the enrollment.\n * @returns Assertion proving the enrolled credential.\n /\n async completeMfaEnrollment(\n flowId: string,\n proof: EnrollmentProof,\n entropySourceId?: string,\n accessToken?: string,\n ): Promise<MfaVerificationAssertion> {\n const bearer = accessToken ?? (await this.getAccessToken(entropySourceId));\n return await mfaEnrollComplete(this.#config.env, bearer, {\n credential_type: proof.type,\n flow_id: flowId,\n ...(proof.type === 'passkey'\n ? { passkey_attestation: proof.attestation }\n : { otp_code: proof.code }),\n });\n }\n\n /\n Begins verification with an enrolled credential.\n \n @param type - Credential type to verify.\n * @param entropySourceId - Entropy source whose profile owns the credential.\n * @returns Verification challenge for the client ceremony.\n /\n async beginMfaVerification(\n type: MfaCredentialType,\n entropySourceId?: string,\n ): Promise<VerificationChallenge> {\n const accessToken = await this.getAccessToken(entropySourceId);\n const result = await mfaVerify(this.#config.env, accessToken, {\n credential_type: type,\n });\n\n if (type === 'passkey') {\n if (!result.publicKey) {\n throw new MfaError(\n 'invalid_response',\n 'Passkey verification response is missing request data',\n );\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n publicKey: result.publicKey,\n };\n }\n return {\n type,\n flowId: result.flowId,\n expiresAt: result.expiresAt,\n };\n }\n\n /\n Completes verification with an enrolled credential.\n \n @param flowId - Identifier returned by the begin call.\n * @param proof - Platform assertion or email code.\n * @param entropySourceId - Entropy source whose profile owns the credential.\n * @returns Assertion issued after verification.\n /\n async completeMfaVerification(\n flowId: string,\n proof: VerificationProof,\n entropySourceId?: string,\n ): Promise<MfaVerificationAssertion> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await mfaVerifyComplete(this.#config.env, accessToken, {\n credential_type: proof.type,\n flow_id: flowId,\n ...(proof.type === 'passkey'\n ? { passkey_assertion: proof.assertion }\n : { otp_code: proof.code }),\n });\n }\n\n /\n Gets credentials enrolled on the primary profile.\n \n @param entropySourceId - Entropy source whose profile owns the credentials.\n * @returns Supported enrolled credentials.\n /\n async getMfaCredentials(\n entropySourceId?: string,\n ): Promise<EnrolledCredential[]> {\n const accessToken = await this.getAccessToken(entropySourceId);\n return await getMfaCredentials(this.#config.env, accessToken);\n }\n\n /\n Exchanges an MFA verification assertion for an access token carrying the\n * assurance level the assertion proves.\n \n @param assertionJwt - Verification assertion.\n * @returns Access token.\n /\n async exchangeMfaAssertion(assertionJwt: string): Promise<AccessToken> {\n return await authorizeOIDC(\n assertionJwt,\n this.#config.env,\n this.#config.platform,\n );\n }\n\n async pairSocialIdentifier(\n params: PairSocialIdentifierParams,\n authAccessToken: string,\n ): Promise<ProfileIdentifier[] \| undefined> {\n return await pairSocialIdentifier(\n params,\n authAccessToken,\n this.#config.env,\n );\n }\n\n /\n Exchanges a social access token for an access token and the canonical\n * profile its identifier is paired to. Nothing is stored: SRP\n * sessions stay the source of truth for `getAccessToken`.\n \n @param params - Social identifier type and social JWT.\n * @returns The access token and canonical profile.\n /\n async exchangeSocialAccessToken(\n params: SocialLoginParams,\n ): Promise<LoginResponse> {\n const authResponse = await socialLogin(params, this.#config.env);\n const token = await authorizeOIDC(\n authResponse.token,\n this.#config.env,\n this.#config.platform,\n );\n return { profile: authResponse.profile, token };\n }\n\n async pairSrpProfiles(\n accessTokens: string[],\n authAccessToken: string,\n ): Promise<PairProfilesResponse> {\n // Order-insensitive key: the same token set in any order maps to the same\n // entry. Sort a copy so the request payload itself stays primary-first.\n const key = JSON.stringify([...accessTokens].sort());\n\n const cached = this.#ongoingPairings.get(key);\n if (cached && cached.expiresAt > Date.now()) {\n return await cached.promise;\n }\n\n const promise = pairProfiles(\n accessTokens,\n authAccessToken,\n this.#config.env,\n );\n // Store the in-flight promise immediately so concurrent callers coalesce\n // regardless of how long the request takes.\n this.#ongoingPairings.set(key, {\n promise,\n expiresAt: Number.MAX_SAFE_INTEGER,\n });\n\n try {\n const result = await promise;\n // Keep the resolved result cached for a short window so sequential\n // retries with the same payload reuse it.\n this.#ongoingPairings.set(key, {\n promise,\n expiresAt: Date.now() + PAIR_DEDUPE_TTL_MS,\n });\n return result;\n } catch (error) {\n // Never cache failures: the pairing retry loop must be able to re-hit\n // the endpoint on the next attempt.\n this.#ongoingPairings.delete(key);\n throw error;\n }\n }\n\n async signMessage(\n message: string,\n entropySourceId?: string,\n ): Promise<string> {\n return await this.#options.signing.signMessage(message, entropySourceId);\n }\n\n async isSnapConnected(): Promise<boolean> {\n const provider =\n this.#customProvider ?? (await getDefaultEIP6963Provider());\n if (!provider) {\n return false;\n }\n\n const isConnected = await isSnapConnected(provider);\n return isConnected;\n }\n\n async connectSnap(): Promise<string> {\n const provider =\n this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n const res = await connectSnap(provider);\n return res;\n }\n\n // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n async #getAuthSession(\n entropySourceId?: string,\n ): Promise<LoginResponse \| null> {\n const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n if (!validateLoginResponse(auth)) {\n return null;\n }\n\n // get canonical profile id from server if not present in the cached session\n if (!auth.profile.canonicalProfileId) {\n return null;\n }\n\n const currentTime = Date.now();\n const sessionAge = currentTime - auth.token.obtainedAt;\n const refreshThreshold = auth.token.expiresIn 1000 * 0.9;\n\n if (sessionAge < refreshThreshold) {\n return auth;\n }\n return null;\n }\n\n async #login(entropySourceId?: string): Promise<LoginResponse> {\n // Use a deferred login to avoid race conditions\n return await this.#deferredLogin(entropySourceId);\n }\n\n async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n // Nonce\n const publicKey = await this.getIdentifier(entropySourceId);\n const nonceRes = await getNonce(publicKey, this.#config.env);\n\n // Tag only when the wallet supplies getLoginTag. SDK callers keep the\n // legacy 3-part message rather than guessing `primary`.\n const tag = await this.#getLoginTag?.(entropySourceId);\n const identifierType =\n (await this.#getLoginIdentifierType?.(entropySourceId)) ?? 'SRP';\n const rawMessage = this.#createSrpLoginRawMessage(\n nonceRes.nonce,\n publicKey,\n tag,\n );\n const signature = await this.signMessage(rawMessage, entropySourceId);\n\n // Authenticate\n const authResponse = await authenticate(\n rawMessage,\n signature,\n this.#config.type,\n this.#config.env,\n this.#metametrics,\n identifierType,\n );\n\n // Resolve original profileId from aliases.\n // This is done mainly to preserve the original profileId for storage key derivation\n // until we migrate to the canonical profileId storage system.\n const canonicalProfileId = authResponse.profile.profileId;\n const profile = { ...authResponse.profile };\n\n if (authResponse.profileAliases?.length > 0) {\n const targetIdentifierId = computeIdentifierId(\n publicKey,\n this.#config.env,\n );\n\n const matchingAliases = authResponse.profileAliases.filter((alias) =>\n alias.identifierIds.some((id) => id.id === targetIdentifierId),\n );\n\n // Prefer the leaf alias (single identifier) — it's the original profile\n // created for this SRP. Multi-identifier aliases are former canonicals\n // that absorbed other profiles; they are correct only when this SRP's\n // original profile was itself a canonical before being absorbed.\n const targetAlias =\n matchingAliases.find((alias) => alias.identifierIds.length === 1) ??\n matchingAliases[0];\n\n if (targetAlias) {\n profile.profileId = targetAlias.aliasProfileId;\n }\n }\n\n profile.canonicalProfileId = canonicalProfileId;\n\n // Authorize\n const tokenResponse = await authorizeOIDC(\n authResponse.token,\n this.#config.env,\n this.#config.platform,\n );\n\n // Save\n const result: LoginResponse = {\n profile,\n token: tokenResponse,\n };\n\n await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n return result;\n }\n\n async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n // Check if there's already an ongoing login for this entropySourceId\n const existingLogin = this.#ongoingLogins.get(entropySourceId);\n if (existingLogin) {\n return existingLogin;\n }\n\n // Create a new login promise\n const loginPromise = this.#loginWithRetry(entropySourceId);\n\n // Store the promise in the map\n this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n try {\n // Wait for the login to complete\n return await loginPromise;\n } finally {\n // Always clean up the ongoing login promise when done\n this.#ongoingLogins.delete(entropySourceId);\n }\n }\n\n async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n // Allow max attempts: initial + maxLoginRetries on 429\n for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n try {\n return await this.#performLogin(entropySourceId);\n } catch (e) {\n // Only retry on rate-limit (429) errors\n if (!RateLimitedError.isRateLimitError(e)) {\n throw e;\n }\n\n // If we've exhausted attempts, rethrow\n if (attempt >= this.#maxLoginRetries) {\n throw e;\n }\n\n // Wait for Retry-After or default cooldown\n const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n await timeUtils.delay(waitMs);\n\n // Loop continues to retry\n }\n }\n\n // Should never reach here due to loop logic, but TypeScript needs a return\n throw new Error('Unexpected: login loop exhausted without result');\n }\n\n #createSrpLoginRawMessage(\n nonce: string,\n publicKey: string,\n tag?: SrpLoginTag,\n ):\n \| `metamask:${string}:${string}`\n \| `metamask:${string}:${string}:${SrpLoginTag}` {\n if (tag) {\n return `metamask:${nonce}:${publicKey}:${tag}` as const;\n }\n return `metamask:${nonce}:${publicKey}` as const;\n }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.d.ts CHANGED Viewed

@@ -1,9 +1,8 @@
 import type { Struct } from '@metamask/superstruct';
-export declare const MFA_CREDENTIAL_TYPES: readonly ['passkey', 'email_otp', 'totp'];
-export declare const MfaCredentialTypeStruct: Struct<"email_otp" | "passkey" | "totp", {
+export declare const MFA_CREDENTIAL_TYPES: readonly ['passkey', 'email_otp'];
+export declare const MfaCredentialTypeStruct: Struct<"email_otp" | "passkey", {
     email_otp: "email_otp";
     passkey: "passkey";
-    totp: "totp";
 }>;
 export declare const PublicKeyCredentialCreationOptionsJSONStruct: Struct<{
     rp: {
@@ -366,14 +365,10 @@ export declare const MfaEnrollResponseStruct: Struct<{
     flow_id: string;
     expires_at: string;
     passkey_create_data?: string | undefined;
-    totp_secret?: string | undefined;
-    totp_qr?: string | undefined;
 }, {
     flow_id: Struct<string, null>;
     expires_at: Struct<string, null>;
     passkey_create_data: Struct<string | undefined, null>;
-    totp_secret: Struct<string | undefined, null>;
-    totp_qr: Struct<string | undefined, null>;
 }>;
 /**
  * Enrollment returns the same assertion as verification, proving the
@@ -413,7 +408,6 @@ export declare const MfaCredentialStruct: Struct<{
     credential_type: string;
     status: string;
     enrolled_at?: string | undefined;
-    last_used_at?: string | undefined;
     passkey?: {
         display_name?: string | undefined;
         added_at?: string | undefined;
@@ -426,7 +420,6 @@ export declare const MfaCredentialStruct: Struct<{
     credential_type: Struct<string, null>;
     status: Struct<string, null>;
     enrolled_at: Struct<string | undefined, null>;
-    last_used_at: Struct<string | undefined, null>;
     passkey: Struct<{
         display_name?: string | undefined;
         added_at?: string | undefined;
@@ -447,7 +440,6 @@ export declare const MfaCredentialsResponseStruct: Struct<{
         credential_type: string;
         status: string;
         enrolled_at?: string | undefined;
-        last_used_at?: string | undefined;
         passkey?: {
             display_name?: string | undefined;
             added_at?: string | undefined;
@@ -462,7 +454,6 @@ export declare const MfaCredentialsResponseStruct: Struct<{
         credential_type: string;
         status: string;
         enrolled_at?: string | undefined;
-        last_used_at?: string | undefined;
         passkey?: {
             display_name?: string | undefined;
             added_at?: string | undefined;
@@ -475,7 +466,6 @@ export declare const MfaCredentialsResponseStruct: Struct<{
         credential_type: string;
         status: string;
         enrolled_at?: string | undefined;
-        last_used_at?: string | undefined;
         passkey?: {
             display_name?: string | undefined;
             added_at?: string | undefined;
@@ -488,7 +478,6 @@ export declare const MfaCredentialsResponseStruct: Struct<{
         credential_type: Struct<string, null>;
         status: Struct<string, null>;
         enrolled_at: Struct<string | undefined, null>;
-        last_used_at: Struct<string | undefined, null>;
         passkey: Struct<{
             display_name?: string | undefined;
             added_at?: string | undefined;
@@ -520,17 +509,16 @@ export declare const TokenReasonStruct: Struct<{
     operation: Struct<string, null>;
 }>;
 export declare const BeginEnrollmentRequestStruct: Struct<{
-    type: "email_otp" | "passkey" | "totp";
+    type: "email_otp" | "passkey";
     email?: string | undefined;
     reason: {
         operation: string;
     };
     maxSessionAgeMs?: number | undefined;
 }, {
-    type: Struct<"email_otp" | "passkey" | "totp", {
+    type: Struct<"email_otp" | "passkey", {
         email_otp: "email_otp";
         passkey: "passkey";
-        totp: "totp";
     }>;
     email: Struct<string | undefined, null>;
     reason: Struct<{
@@ -560,7 +548,7 @@ export declare const CompleteEnrollmentRequestStruct: Struct<{
             clientExtensionResults?: {} | undefined;
         };
     } | {
-        type: "email_otp" | "totp";
+        type: "email_otp";
         code: string;
     };
     reason: {
@@ -586,7 +574,7 @@ export declare const CompleteEnrollmentRequestStruct: Struct<{
             clientExtensionResults?: {} | undefined;
         };
     } | {
-        type: "email_otp" | "totp";
+        type: "email_otp";
         code: string;
     }, null>;
     reason: Struct<{
@@ -596,15 +584,14 @@ export declare const CompleteEnrollmentRequestStruct: Struct<{
     }>;
 }>;
 export declare const BeginVerificationRequestStruct: Struct<{
-    type: "email_otp" | "passkey" | "totp";
+    type: "email_otp" | "passkey";
     reason: {
         operation: string;
     };
 }, {
-    type: Struct<"email_otp" | "passkey" | "totp", {
+    type: Struct<"email_otp" | "passkey", {
         email_otp: "email_otp";
         passkey: "passkey";
-        totp: "totp";
     }>;
     reason: Struct<{
         operation: string;
@@ -630,7 +617,7 @@ export declare const CompleteVerificationRequestStruct: Struct<{
             clientExtensionResults?: {} | undefined;
         };
     } | {
-        type: "email_otp" | "totp";
+        type: "email_otp";
         code: string;
     };
     reason: {
@@ -654,7 +641,7 @@ export declare const CompleteVerificationRequestStruct: Struct<{
             clientExtensionResults?: {} | undefined;
         };
     } | {
-        type: "email_otp" | "totp";
+        type: "email_otp";
         code: string;
     }, null>;
     reason: Struct<{

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/schemas.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAKpD,eAAO,MAAM,oBAAoB,YAAI,SAAS,EAAE,WAAW,~~EAAE,MAAM,~~CAAU,CAAC;~~AAE9E~~,eAAO,MAAM,uBAAuB~~;;;;~~EAA8B,CAAC;AAUnE,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BvD,CAAC;AAEH,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOtD,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAElC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEnC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB1C,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc5C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;EAI1C,CAAC;~~AAaH~~,eAAO,MAAM,uBAAuB~~;;;;;;;;;;;;EAUlC~~,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;EAAkC,CAAC;AAE/E,eAAO,MAAM,uBAAuB;;;;;;;;EAMlC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;EAIjC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;EAG/B,CAAC;AAEH,eAAO,MAAM,mBAAmB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW9B~~,CAAC;AAEH,eAAO,MAAM,4BAA4B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~EAEvC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;EAIjC,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;EAE5B,CAAC;AAEH,eAAO,MAAM,4BAA4B~~;;;;;;;;;;;;;;;;;;;;~~EAiBxC,CAAC;~~AAgBF~~,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI1C,CAAC;AAEH,eAAO,MAAM,8BAA8B~~;;;;;;;;;;;;;;;;~~EAGzC,CAAC;AAaH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;EAE5C,CAAC;AAIH,eAAO,MAAM,6BAA6B;;;;;;;;EAQzC,CAAC;AASF;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAC1C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GACpB,OAAO,CAAC,KAAK,IAAI,KAAK,CAUxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EACzC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GACpB,OAAO,CAAC,KAAK,IAAI,KAAK,CAUxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,OAAO,GAAG;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;CACf,CAwBA"}
1	+ {"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/schemas.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAKpD,eAAO,MAAM,oBAAoB,YAAI,SAAS,EAAE,WAAW,CAAU,CAAC;AAEtE,eAAO,MAAM,uBAAuB;;;EAA8B,CAAC;AAUnE,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BvD,CAAC;AAEH,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOtD,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAElC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEnC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB1C,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc5C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;EAI1C,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;EAMlC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;EAAkC,CAAC;AAE/E,eAAO,MAAM,uBAAuB;;;;;;;;EAMlC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;EAIjC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;EAG/B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU9B,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEvC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;EAIjC,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;EAE5B,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;EAiBxC,CAAC;AAeF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI1C,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;EAGzC,CAAC;AAaH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;EAE5C,CAAC;AAIH,eAAO,MAAM,6BAA6B;;;;;;;;EAQzC,CAAC;AASF;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAC1C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GACpB,OAAO,CAAC,KAAK,IAAI,KAAK,CAUxB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EACzC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GACpB,OAAO,CAAC,KAAK,IAAI,KAAK,CAUxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,OAAO,GAAG;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;CACf,CAwBA"}

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import { array, assert, boolean, enums, integer, literal, min, nullable, object, optional, pattern, refine, sensitive, size, string, StructError, type, union, } from '@metamask/superstruct';
 import { VerificationTokenInvalidError, MfaError } from '../../errors.js';
 import { asRecord } from '../../utils/as-record.js';
-export const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp', 'totp'];
+export const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp'];
 export const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);
 const CredentialDescriptorStruct = type({
     type: literal('public-key'),
@@ -85,19 +85,10 @@ export const MfaVerifyCompleteResponseStruct = type({
     token: sensitive(string()),
     expires_in: integer(),
 });
-/** Base32 secret for an authenticator app, as `totp_secret` sends it. */
-const TotpSecretStruct = sensitive(pattern(string(), /^[A-Z2-7]+=*$/u));
-/**
- * QR code for an authenticator app, as `totp_qr` sends it: a PNG data URL that
- * clients can render as-is. It encodes the secret, so it is just as sensitive.
- */
-const TotpQrCodeStruct = sensitive(pattern(string(), /^data:image\/png;base64,[A-Za-z0-9+/]+=*$/u));
 export const MfaEnrollResponseStruct = type({
     flow_id: string(),
     expires_at: string(),
     passkey_create_data: optional(sensitive(string())),
-    totp_secret: optional(TotpSecretStruct),
-    totp_qr: optional(TotpQrCodeStruct),
 });
 /**
  * Enrollment returns the same assertion as verification, proving the
@@ -123,7 +114,6 @@ export const MfaCredentialStruct = type({
     credential_type: string(),
     status: string(),
     enrolled_at: optional(string()),
-    last_used_at: optional(string()),
     passkey: optional(MfaPasskeyDetailStruct),
     email: optional(MfaEmailDetailStruct),
 });
@@ -147,21 +137,20 @@ export const BeginEnrollmentRequestStruct = refine(object({
     if (value.type === 'email_otp' && value.email === undefined) {
         return 'email is required for email_otp enrollment';
     }
-    if (value.type !== 'email_otp' && value.email !== undefined) {
-        return `email is not accepted for ${value.type} enrollment`;
+    if (value.type === 'passkey' && value.email !== undefined) {
+        return 'email is not accepted for passkey enrollment';
     }
     return true;
 });
-/** A 6-digit code, from an email or an authenticator app. */
-const OtpCodeStruct = sensitive(pattern(string(), /^\d{6}$/u));
+const EmailOtpCodeStruct = sensitive(pattern(string(), /^\d{6}$/u));
 const EnrollmentProofStruct = union([
     object({
         type: literal('passkey'),
         attestation: RegistrationResponseJSONStruct,
     }),
     object({
-        type: enums(['email_otp', 'totp']),
-        code: OtpCodeStruct,
+        type: literal('email_otp'),
+        code: EmailOtpCodeStruct,
     }),
 ]);
 export const CompleteEnrollmentRequestStruct = object({
@@ -179,8 +168,8 @@ const VerificationProofStruct = union([
         assertion: AuthenticationResponseJSONStruct,
     }),
     object({
-        type: enums(['email_otp', 'totp']),
-        code: OtpCodeStruct,
+        type: literal('email_otp'),
+        code: EmailOtpCodeStruct,
     }),
 ]);
 export const CompleteVerificationRequestStruct = object({

package/dist/sdk/authentication-jwt-bearer/mfa/schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,KAAK,EACL,OAAO,EACP,OAAO,EACP,GAAG,EACH,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,EACP,MAAM,EACN,SAAS,EACT,IAAI,EACJ,MAAM,EACN,WAAW,EACX,IAAI,EACJ,KAAK,GACN,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAU,CAAC;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnE,MAAM,0BAA0B,GAAG,IAAI,CAAC;IACtC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,EAAE,EAAE,MAAM,EAAE;IACZ,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;IAC/D,EAAE,EAAE,IAAI,CAAC;QACP,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAM,EAAE;KACf,CAAC;IACF,IAAI,EAAE,IAAI,CAAC;QACT,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CACrB,IAAI,CAAC;QACH,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;QAC3B,GAAG,EAAE,OAAO,EAAE;KACf,CAAC,CACH;IACD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/D,sBAAsB,EAAE,QAAQ,CAC9B,IAAI,CAAC;QACH,uBAAuB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACrC,CAAC,CACH;IACD,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,4CAA4C;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3C,SAAS,EAAE,2CAA2C;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CACrD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CACvD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,SAAS,EAAE,MAAM,EAAE;QACnB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KACzC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAE1B,UAAU,EAAE,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAExE;;;GAGG;AACH,MAAM,gBAAgB,GAAG,SAAS,CAChC,OAAO,CAAC,MAAM,EAAE,EAAE,4CAA4C,CAAC,CAChE,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,mBAAmB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAElD,WAAW,EAAE,QAAQ,CAAC,gBAAgB,CAAC;IAEvC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACpC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,+BAA+B,CAAC;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACtC,sEAAsE;IACtE,wEAAwE;IAExE,eAAe,EAAE,MAAM,EAAE;IACzB,MAAM,EAAE,MAAM,EAAE;IAEhB,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChC,OAAO,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IACzC,KAAK,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE;IACjB,mBAAmB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAChD,MAAM,CAAC;IACL,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,iBAAiB;IACzB,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;CAC7C,CAAC,EACF,wBAAwB,EACxB,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,4CAA4C,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,6BAA6B,KAAK,CAAC,IAAI,aAAa,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;AAE/D,MAAM,qBAAqB,GAAG,KAAK,CAAC;IAClC,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,WAAW,EAAE,8BAA8B;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,EAAE,aAAa;KACpB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;IACnD,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,KAAK,CAAC;IACpC,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,SAAS,EAAE,gCAAgC;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,EAAE,aAAa;KACpB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;IACtD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,uBAAuB;IAC9B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;IACtD,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CACpD,IAAI,CAAC;IACH,GAAG,EAAE,MAAM,EAAE;IACb,GAAG,EAAE,OAAO,EAAE;IACd,yEAAyE;IACzE,6DAA6D;IAC7D,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;CACxC,CAAC,CACH,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,KAAK;SACT,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAK3D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAY;QACrB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;KAC7B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,6BAA6B,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KACxD,CAAC;AACJ,CAAC","sourcesContent":["import {\n array,\n assert,\n boolean,\n enums,\n integer,\n literal,\n min,\n nullable,\n object,\n optional,\n pattern,\n refine,\n sensitive,\n size,\n string,\n StructError,\n type,\n union,\n} from '@metamask/superstruct';\nimport type { Struct } from '@metamask/superstruct';\n\nimport { VerificationTokenInvalidError, MfaError } from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\n\nexport const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp', 'totp'] as const;\n\nexport const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);\n\nconst CredentialDescriptorStruct = type({\n type: literal('public-key'),\n id: string(),\n transports: optional(array(string())),\n});\n\nconst ExtensionsStruct = type({});\n\nexport const PublicKeyCredentialCreationOptionsJSONStruct = type({\n rp: type({\n id: string(),\n name: string(),\n }),\n user: type({\n id: sensitive(string()),\n name: sensitive(string()),\n displayName: sensitive(string()),\n }),\n challenge: sensitive(string()),\n pubKeyCredParams: array(\n type({\n type: literal('public-key'),\n alg: integer(),\n }),\n ),\n excludeCredentials: optional(array(CredentialDescriptorStruct)),\n authenticatorSelection: optional(\n type({\n authenticatorAttachment: optional(string()),\n residentKey: optional(string()),\n requireResidentKey: optional(boolean()),\n userVerification: optional(string()),\n }),\n ),\n attestation: optional(string()),\n timeout: optional(integer()),\n extensions: optional(ExtensionsStruct),\n});\n\nexport const PublicKeyCredentialRequestOptionsJSONStruct = type({\n challenge: sensitive(string()),\n rpId: optional(string()),\n allowCredentials: optional(array(CredentialDescriptorStruct)),\n userVerification: optional(string()),\n timeout: optional(integer()),\n extensions: optional(ExtensionsStruct),\n});\n\nexport const PasskeyCreateDataStruct = type({\n publicKey: PublicKeyCredentialCreationOptionsJSONStruct,\n});\n\nexport const PasskeyRequestDataStruct = type({\n publicKey: PublicKeyCredentialRequestOptionsJSONStruct,\n});\n\nexport const RegistrationResponseJSONStruct = sensitive(\n type({\n id: string(),\n rawId: string(),\n type: literal('public-key'),\n response: type({\n attestationObject: string(),\n clientDataJSON: string(),\n transports: optional(array(string())),\n publicKeyAlgorithm: optional(integer()),\n publicKey: optional(string()),\n authenticatorData: optional(string()),\n }),\n authenticatorAttachment: optional(nullable(string())),\n clientExtensionResults: optional(ExtensionsStruct),\n }),\n);\n\nexport const AuthenticationResponseJSONStruct = sensitive(\n type({\n id: string(),\n rawId: string(),\n type: literal('public-key'),\n response: type({\n authenticatorData: string(),\n clientDataJSON: string(),\n signature: string(),\n userHandle: optional(nullable(string())),\n }),\n authenticatorAttachment: optional(nullable(string())),\n clientExtensionResults: optional(ExtensionsStruct),\n }),\n);\n\n/*\n Only the assertion JWT is consumed from the verification response; the\n * profile fields on the wire duplicate what the login flow already resolved.\n /\nexport const MfaVerifyCompleteResponseStruct = type({\n token: sensitive(string()),\n\n expires_in: integer(),\n});\n\n/* Base32 secret for an authenticator app, as `totp_secret` sends it. /\nconst TotpSecretStruct = sensitive(pattern(string(), /^[A-Z2-7]+=$/u));\n\n/*\n QR code for an authenticator app, as `totp_qr` sends it: a PNG data URL that\n * clients can render as-is. It encodes the secret, so it is just as sensitive.\n /\nconst TotpQrCodeStruct = sensitive(\n pattern(string(), /^data:image\\/png;base64,[A-Za-z0-9+/]+=$/u),\n);\n\nexport const MfaEnrollResponseStruct = type({\n flow_id: string(),\n\n expires_at: string(),\n\n passkey_create_data: optional(sensitive(string())),\n\n totp_secret: optional(TotpSecretStruct),\n\n totp_qr: optional(TotpQrCodeStruct),\n});\n\n/*\n Enrollment returns the same assertion as verification, proving the\n * credential just enrolled.\n /\nexport const MfaEnrollCompleteResponseStruct = MfaVerifyCompleteResponseStruct;\n\nexport const MfaVerifyResponseStruct = type({\n flow_id: string(),\n\n expires_at: string(),\n\n passkey_request_data: optional(sensitive(string())),\n});\n\nexport const MfaPasskeyDetailStruct = type({\n display_name: optional(sensitive(string())),\n\n added_at: optional(string()),\n});\n\nexport const MfaEmailDetailStruct = type({\n address: optional(sensitive(string())),\n verified: optional(boolean()),\n});\n\nexport const MfaCredentialStruct = type({\n // Intentionally accepts strings so future server credential types and\n // statuses can be ignored without making the complete response invalid.\n\n credential_type: string(),\n status: string(),\n\n enrolled_at: optional(string()),\n last_used_at: optional(string()),\n passkey: optional(MfaPasskeyDetailStruct),\n email: optional(MfaEmailDetailStruct),\n});\n\nexport const MfaCredentialsResponseStruct = type({\n credentials: array(MfaCredentialStruct),\n});\n\nexport const MfaErrorResponseStruct = type({\n code: optional(string()),\n message: string(),\n retry_after_seconds: optional(integer()),\n});\n\nexport const TokenReasonStruct = object({\n operation: pattern(string(), /^[A-Za-z0-9_.:-]{1,64}$/u),\n});\n\nexport const BeginEnrollmentRequestStruct = refine(\n object({\n type: MfaCredentialTypeStruct,\n email: optional(sensitive(size(string(), 3, 254))),\n reason: TokenReasonStruct,\n maxSessionAgeMs: optional(min(integer(), 0)),\n }),\n 'BeginEnrollmentRequest',\n (value) => {\n if (value.type === 'email_otp' && value.email === undefined) {\n return 'email is required for email_otp enrollment';\n }\n if (value.type !== 'email_otp' && value.email !== undefined) {\n return `email is not accepted for ${value.type} enrollment`;\n }\n return true;\n },\n);\n\n/* A 6-digit code, from an email or an authenticator app. /\nconst OtpCodeStruct = sensitive(pattern(string(), /^\\d{6}$/u));\n\nconst EnrollmentProofStruct = union([\n object({\n type: literal('passkey'),\n attestation: RegistrationResponseJSONStruct,\n }),\n object({\n type: enums(['email_otp', 'totp']),\n code: OtpCodeStruct,\n }),\n]);\n\nexport const CompleteEnrollmentRequestStruct = object({\n flowId: string(),\n proof: EnrollmentProofStruct,\n reason: TokenReasonStruct,\n});\n\nexport const BeginVerificationRequestStruct = object({\n type: MfaCredentialTypeStruct,\n reason: TokenReasonStruct,\n});\n\nconst VerificationProofStruct = union([\n object({\n type: literal('passkey'),\n assertion: AuthenticationResponseJSONStruct,\n }),\n object({\n type: enums(['email_otp', 'totp']),\n code: OtpCodeStruct,\n }),\n]);\n\nexport const CompleteVerificationRequestStruct = object({\n flowId: string(),\n proof: VerificationProofStruct,\n reason: TokenReasonStruct,\n});\n\nexport const GetVerificationTokenRequestStruct = object({\n maxSessionAgeMs: optional(min(integer(), 0)),\n});\n\n// No `aal` check: the assurance level a verification yields is the server's\n// policy, and the services receiving the token enforce it themselves.\nexport const VerificationTokenClaimsStruct = sensitive(\n type({\n sub: string(),\n exp: integer(),\n // Any method name: the server may verify with methods this client cannot\n // enroll, and an unknown name must not invalidate the token.\n amr: union([string(), array(string())]),\n }),\n);\n\nfunction formatStructError(error: StructError): string {\n return error\n .failures()\n .map(({ path, message }) => `[${path.join('.')}] ${message}`)\n .join(', ');\n}\n\n/\n Validates data received from the authentication service.\n \n @param value - Untrusted response data.\n * @param struct - Expected response structure.\n * @throws MfaError if the response does not match the structure.\n /\nexport function assertValidMfaResponse<Value>(\n value: unknown,\n struct: Struct<Value>,\n): asserts value is Value {\n try {\n assert(value, struct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new MfaError('invalid_response', formatStructError(error));\n }\n / istanbul ignore next /\n throw error;\n }\n}\n\n/\n Validates data received from an untyped controller boundary.\n \n @param value - Untrusted request data.\n * @param struct - Expected request structure.\n * @throws MfaError if the request does not match the structure.\n /\nexport function assertValidMfaRequest<Value>(\n value: unknown,\n struct: Struct<Value>,\n): asserts value is Value {\n try {\n assert(value, struct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new MfaError('invalid_request', formatStructError(error));\n }\n / istanbul ignore next /\n throw error;\n }\n}\n\n/\n Validates and normalizes claims from a verification access token.\n \n Hydra places hook-supplied claims under `ext` unless they are promoted to\n * the top level, so `amr` is read from either location.\n \n @param payload - Decoded JWT payload.\n * @returns Validated claims with `amr` represented as an array.\n * @throws VerificationTokenInvalidError if claims are missing or invalid.\n /\nexport function parseVerificationTokenClaims(payload: unknown): {\n sub: string;\n exp: number;\n amr: string[];\n} {\n const record = asRecord(payload);\n const ext = asRecord(record?.ext);\n const value: unknown = {\n sub: record?.sub,\n exp: record?.exp,\n amr: record?.amr ?? ext?.amr,\n };\n\n try {\n assert(value, VerificationTokenClaimsStruct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new VerificationTokenInvalidError(formatStructError(error));\n }\n / istanbul ignore next */\n throw error;\n }\n\n return {\n sub: value.sub,\n exp: value.exp,\n amr: Array.isArray(value.amr) ? value.amr : [value.amr],\n };\n}\n"]}
1	+ {"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,KAAK,EACL,OAAO,EACP,OAAO,EACP,GAAG,EACH,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,EACP,MAAM,EACN,SAAS,EACT,IAAI,EACJ,MAAM,EACN,WAAW,EACX,IAAI,EACJ,KAAK,GACN,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,6BAA6B,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAU,CAAC;AAEtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnE,MAAM,0BAA0B,GAAG,IAAI,CAAC;IACtC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,EAAE,EAAE,MAAM,EAAE;IACZ,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAElC,MAAM,CAAC,MAAM,4CAA4C,GAAG,IAAI,CAAC;IAC/D,EAAE,EAAE,IAAI,CAAC;QACP,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,MAAM,EAAE;KACf,CAAC;IACF,IAAI,EAAE,IAAI,CAAC;QACT,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CACrB,IAAI,CAAC;QACH,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;QAC3B,GAAG,EAAE,OAAO,EAAE;KACf,CAAC,CACH;IACD,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC/D,sBAAsB,EAAE,QAAQ,CAC9B,IAAI,CAAC;QACH,uBAAuB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACrC,CAAC,CACH;IACD,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2CAA2C,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,gBAAgB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5B,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,4CAA4C;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3C,SAAS,EAAE,2CAA2C;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CACrD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CACvD,IAAI,CAAC;IACH,EAAE,EAAE,MAAM,EAAE;IACZ,KAAK,EAAE,MAAM,EAAE;IACf,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC;IAC3B,QAAQ,EAAE,IAAI,CAAC;QACb,iBAAiB,EAAE,MAAM,EAAE;QAC3B,cAAc,EAAE,MAAM,EAAE;QACxB,SAAS,EAAE,MAAM,EAAE;QACnB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KACzC,CAAC;IACF,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,sBAAsB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;CACnD,CAAC,CACH,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;IAClD,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAE1B,UAAU,EAAE,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,mBAAmB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,+BAA+B,CAAC;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE;IAEjB,UAAU,EAAE,MAAM,EAAE;IAEpB,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAE3C,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACtC,sEAAsE;IACtE,wEAAwE;IAExE,eAAe,EAAE,MAAM,EAAE;IACzB,MAAM,EAAE,MAAM,EAAE;IAEhB,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IACzC,KAAK,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC/C,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;IACzC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE;IACjB,mBAAmB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAChD,MAAM,CAAC;IACL,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,iBAAiB;IACzB,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;CAC7C,CAAC,EACF,wBAAwB,EACxB,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,4CAA4C,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,8CAA8C,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpE,MAAM,qBAAqB,GAAG,KAAK,CAAC;IAClC,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,WAAW,EAAE,8BAA8B;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,qBAAqB;IAC5B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;IACnD,IAAI,EAAE,uBAAuB;IAC7B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,KAAK,CAAC;IACpC,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;QACxB,SAAS,EAAE,gCAAgC;KAC5C,CAAC;IACF,MAAM,CAAC;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,IAAI,EAAE,kBAAkB;KACzB,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;IACtD,MAAM,EAAE,MAAM,EAAE;IAChB,KAAK,EAAE,uBAAuB;IAC9B,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;IACtD,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAEH,4EAA4E;AAC5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CACpD,IAAI,CAAC;IACH,GAAG,EAAE,MAAM,EAAE;IACb,GAAG,EAAE,OAAO,EAAE;IACd,yEAAyE;IACzE,6DAA6D;IAC7D,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;CACxC,CAAC,CACH,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAkB;IAC3C,OAAO,KAAK;SACT,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAK3D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAY;QACrB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG;KAC7B,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,6BAA6B,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,0BAA0B;QAC1B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;KACxD,CAAC;AACJ,CAAC","sourcesContent":["import {\n array,\n assert,\n boolean,\n enums,\n integer,\n literal,\n min,\n nullable,\n object,\n optional,\n pattern,\n refine,\n sensitive,\n size,\n string,\n StructError,\n type,\n union,\n} from '@metamask/superstruct';\nimport type { Struct } from '@metamask/superstruct';\n\nimport { VerificationTokenInvalidError, MfaError } from '../../errors.js';\nimport { asRecord } from '../../utils/as-record.js';\n\nexport const MFA_CREDENTIAL_TYPES = ['passkey', 'email_otp'] as const;\n\nexport const MfaCredentialTypeStruct = enums(MFA_CREDENTIAL_TYPES);\n\nconst CredentialDescriptorStruct = type({\n type: literal('public-key'),\n id: string(),\n transports: optional(array(string())),\n});\n\nconst ExtensionsStruct = type({});\n\nexport const PublicKeyCredentialCreationOptionsJSONStruct = type({\n rp: type({\n id: string(),\n name: string(),\n }),\n user: type({\n id: sensitive(string()),\n name: sensitive(string()),\n displayName: sensitive(string()),\n }),\n challenge: sensitive(string()),\n pubKeyCredParams: array(\n type({\n type: literal('public-key'),\n alg: integer(),\n }),\n ),\n excludeCredentials: optional(array(CredentialDescriptorStruct)),\n authenticatorSelection: optional(\n type({\n authenticatorAttachment: optional(string()),\n residentKey: optional(string()),\n requireResidentKey: optional(boolean()),\n userVerification: optional(string()),\n }),\n ),\n attestation: optional(string()),\n timeout: optional(integer()),\n extensions: optional(ExtensionsStruct),\n});\n\nexport const PublicKeyCredentialRequestOptionsJSONStruct = type({\n challenge: sensitive(string()),\n rpId: optional(string()),\n allowCredentials: optional(array(CredentialDescriptorStruct)),\n userVerification: optional(string()),\n timeout: optional(integer()),\n extensions: optional(ExtensionsStruct),\n});\n\nexport const PasskeyCreateDataStruct = type({\n publicKey: PublicKeyCredentialCreationOptionsJSONStruct,\n});\n\nexport const PasskeyRequestDataStruct = type({\n publicKey: PublicKeyCredentialRequestOptionsJSONStruct,\n});\n\nexport const RegistrationResponseJSONStruct = sensitive(\n type({\n id: string(),\n rawId: string(),\n type: literal('public-key'),\n response: type({\n attestationObject: string(),\n clientDataJSON: string(),\n transports: optional(array(string())),\n publicKeyAlgorithm: optional(integer()),\n publicKey: optional(string()),\n authenticatorData: optional(string()),\n }),\n authenticatorAttachment: optional(nullable(string())),\n clientExtensionResults: optional(ExtensionsStruct),\n }),\n);\n\nexport const AuthenticationResponseJSONStruct = sensitive(\n type({\n id: string(),\n rawId: string(),\n type: literal('public-key'),\n response: type({\n authenticatorData: string(),\n clientDataJSON: string(),\n signature: string(),\n userHandle: optional(nullable(string())),\n }),\n authenticatorAttachment: optional(nullable(string())),\n clientExtensionResults: optional(ExtensionsStruct),\n }),\n);\n\n/*\n Only the assertion JWT is consumed from the verification response; the\n * profile fields on the wire duplicate what the login flow already resolved.\n /\nexport const MfaVerifyCompleteResponseStruct = type({\n token: sensitive(string()),\n\n expires_in: integer(),\n});\n\nexport const MfaEnrollResponseStruct = type({\n flow_id: string(),\n\n expires_at: string(),\n\n passkey_create_data: optional(sensitive(string())),\n});\n\n/\n Enrollment returns the same assertion as verification, proving the\n * credential just enrolled.\n /\nexport const MfaEnrollCompleteResponseStruct = MfaVerifyCompleteResponseStruct;\n\nexport const MfaVerifyResponseStruct = type({\n flow_id: string(),\n\n expires_at: string(),\n\n passkey_request_data: optional(sensitive(string())),\n});\n\nexport const MfaPasskeyDetailStruct = type({\n display_name: optional(sensitive(string())),\n\n added_at: optional(string()),\n});\n\nexport const MfaEmailDetailStruct = type({\n address: optional(sensitive(string())),\n verified: optional(boolean()),\n});\n\nexport const MfaCredentialStruct = type({\n // Intentionally accepts strings so future server credential types and\n // statuses can be ignored without making the complete response invalid.\n\n credential_type: string(),\n status: string(),\n\n enrolled_at: optional(string()),\n passkey: optional(MfaPasskeyDetailStruct),\n email: optional(MfaEmailDetailStruct),\n});\n\nexport const MfaCredentialsResponseStruct = type({\n credentials: array(MfaCredentialStruct),\n});\n\nexport const MfaErrorResponseStruct = type({\n code: optional(string()),\n message: string(),\n retry_after_seconds: optional(integer()),\n});\n\nexport const TokenReasonStruct = object({\n operation: pattern(string(), /^[A-Za-z0-9_.:-]{1,64}$/u),\n});\n\nexport const BeginEnrollmentRequestStruct = refine(\n object({\n type: MfaCredentialTypeStruct,\n email: optional(sensitive(size(string(), 3, 254))),\n reason: TokenReasonStruct,\n maxSessionAgeMs: optional(min(integer(), 0)),\n }),\n 'BeginEnrollmentRequest',\n (value) => {\n if (value.type === 'email_otp' && value.email === undefined) {\n return 'email is required for email_otp enrollment';\n }\n if (value.type === 'passkey' && value.email !== undefined) {\n return 'email is not accepted for passkey enrollment';\n }\n return true;\n },\n);\n\nconst EmailOtpCodeStruct = sensitive(pattern(string(), /^\\d{6}$/u));\n\nconst EnrollmentProofStruct = union([\n object({\n type: literal('passkey'),\n attestation: RegistrationResponseJSONStruct,\n }),\n object({\n type: literal('email_otp'),\n code: EmailOtpCodeStruct,\n }),\n]);\n\nexport const CompleteEnrollmentRequestStruct = object({\n flowId: string(),\n proof: EnrollmentProofStruct,\n reason: TokenReasonStruct,\n});\n\nexport const BeginVerificationRequestStruct = object({\n type: MfaCredentialTypeStruct,\n reason: TokenReasonStruct,\n});\n\nconst VerificationProofStruct = union([\n object({\n type: literal('passkey'),\n assertion: AuthenticationResponseJSONStruct,\n }),\n object({\n type: literal('email_otp'),\n code: EmailOtpCodeStruct,\n }),\n]);\n\nexport const CompleteVerificationRequestStruct = object({\n flowId: string(),\n proof: VerificationProofStruct,\n reason: TokenReasonStruct,\n});\n\nexport const GetVerificationTokenRequestStruct = object({\n maxSessionAgeMs: optional(min(integer(), 0)),\n});\n\n// No `aal` check: the assurance level a verification yields is the server's\n// policy, and the services receiving the token enforce it themselves.\nexport const VerificationTokenClaimsStruct = sensitive(\n type({\n sub: string(),\n exp: integer(),\n // Any method name: the server may verify with methods this client cannot\n // enroll, and an unknown name must not invalidate the token.\n amr: union([string(), array(string())]),\n }),\n);\n\nfunction formatStructError(error: StructError): string {\n return error\n .failures()\n .map(({ path, message }) => `[${path.join('.')}] ${message}`)\n .join(', ');\n}\n\n/\n Validates data received from the authentication service.\n \n @param value - Untrusted response data.\n * @param struct - Expected response structure.\n * @throws MfaError if the response does not match the structure.\n /\nexport function assertValidMfaResponse<Value>(\n value: unknown,\n struct: Struct<Value>,\n): asserts value is Value {\n try {\n assert(value, struct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new MfaError('invalid_response', formatStructError(error));\n }\n / istanbul ignore next /\n throw error;\n }\n}\n\n/\n Validates data received from an untyped controller boundary.\n \n @param value - Untrusted request data.\n * @param struct - Expected request structure.\n * @throws MfaError if the request does not match the structure.\n /\nexport function assertValidMfaRequest<Value>(\n value: unknown,\n struct: Struct<Value>,\n): asserts value is Value {\n try {\n assert(value, struct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new MfaError('invalid_request', formatStructError(error));\n }\n / istanbul ignore next /\n throw error;\n }\n}\n\n/\n Validates and normalizes claims from a verification access token.\n \n Hydra places hook-supplied claims under `ext` unless they are promoted to\n * the top level, so `amr` is read from either location.\n \n @param payload - Decoded JWT payload.\n * @returns Validated claims with `amr` represented as an array.\n * @throws VerificationTokenInvalidError if claims are missing or invalid.\n /\nexport function parseVerificationTokenClaims(payload: unknown): {\n sub: string;\n exp: number;\n amr: string[];\n} {\n const record = asRecord(payload);\n const ext = asRecord(record?.ext);\n const value: unknown = {\n sub: record?.sub,\n exp: record?.exp,\n amr: record?.amr ?? ext?.amr,\n };\n\n try {\n assert(value, VerificationTokenClaimsStruct);\n } catch (error) {\n if (error instanceof StructError) {\n throw new VerificationTokenInvalidError(formatStructError(error));\n }\n / istanbul ignore next */\n throw error;\n }\n\n return {\n sub: value.sub,\n exp: value.exp,\n amr: Array.isArray(value.amr) ? value.amr : [value.amr],\n };\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/mfa/services.d.ts CHANGED Viewed

@@ -9,26 +9,7 @@ type EnrollmentServiceResult = {
     flowId: string;
     expiresAt: number;
     publicKey?: PasskeyCreationOptions;
-    totp?: {
-        secret: string;
-        qrCode: string;
-        setupUri: string;
-    };
 };
-/**
- * Builds the `otpauth://` link that opens an authenticator app with the
- * account to add, for devices that cannot scan their own screen.
- *
- * It is built here rather than sent by the server because Kratos does not
- * expose it: its settings flow returns only the secret and the QR code image,
- * and keeps the link in internal flow data that its API never returns. The
- * server could only rebuild it the same way, from the same fixed settings, or
- * by decoding its own QR code.
- *
- * @param secret - Base32 secret from the enrollment response.
- * @returns The setup link. It contains the secret: never log or persist it.
- */
-export declare function buildTotpSetupUri(secret: string): string;
 type VerificationServiceResult = {
     flowId: string;
     expiresAt: number;

package/dist/sdk/authentication-jwt-bearer/mfa/services.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAkClD,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAEjB,gBAAgB,EAEhB,gBAAgB,EAChB,sCAAsC,IAAI,sBAAsB,EAChE,qCAAqC,IAAI,qBAAqB,EAC9D,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,KAAK,uBAAuB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;~~IACnC~~,~~IAAI,~~CAAC~~,EAAE~~;~~QAAE~~,~~MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D,CAAC;AAsBF;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED,~~KAAK,yBAAyB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,qBAAqB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAEhC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;CAChD,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAElC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;~~AAkCF~~;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAY5E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAY5E;~~AAyLD~~;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,uBAAuB,CAAC,~~CAuBlC~~;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAuBnC;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,wBAAwB,CAAC,CAuBnC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,GACxB,kBAAkB,GAAG,IAAI,~~CA8C3B~~;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B"}
1	+ {"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../../src/sdk/authentication-jwt-bearer/mfa/services.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAkClD,OAAO,KAAK,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EAEb,iBAAiB,EAEjB,gBAAgB,EAEhB,gBAAgB,EAChB,sCAAsC,IAAI,sBAAsB,EAChE,qCAAqC,IAAI,qBAAqB,EAC9D,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,GAAG,KAAG,MACS,CAAC;AAE7D,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,KAAK,uBAAuB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,qBAAqB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,KAAK,0BAA0B,GAAG;IAEhC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mBAAmB,CAAC,EAAE,wBAAwB,CAAC;CAChD,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAElC,eAAe,EAAE,iBAAiB,CAAC;IAEnC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;CAChD,CAAC;AA8BF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAY5E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAY5E;AAwLD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,uBAAuB,CAAC,CAclC;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAuBnC;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,wBAAwB,CAAC,CAuBnC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,aAAa,GACxB,kBAAkB,GAAG,IAAI,CAqC3B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B"}