@metamask-previews/seedless-onboarding-controller 0.0.0-preview-ddbcf048

package/dist/SeedlessOnboardingController.mjs

@@ -0,0 +1,573 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup, _SeedlessOnboardingController_unlockVaultWithPassword, _SeedlessOnboardingController_withPersistedSeedPhraseBackupsState, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsValidVaultData;
+import { keccak256AndHexify } from "@metamask/auth-network-utils";
+import { BaseController } from "@metamask/base-controller";
+import { encrypt, decrypt } from "@metamask/browser-passworder";
+import { ToprfSecureBackup } from "@metamask/toprf-secure-backup";
+import { base64ToBytes, bytesToBase64, stringToBytes, remove0x, bigIntToHex } from "@metamask/utils";
+import { Mutex } from "async-mutex";
+import { controllerName, SeedlessOnboardingControllerError, Web3AuthNetwork } from "./constants.mjs";
+import { RecoveryError } from "./errors.mjs";
+import { projectLogger, createModuleLogger } from "./logger.mjs";
+import { SeedPhraseMetadata } from "./SeedPhraseMetadata.mjs";
+const log = createModuleLogger(projectLogger, controllerName);
+/**
+ * Get the default state for the Seedless Onboarding Controller.
+ *
+ * @returns The default state for the Seedless Onboarding Controller.
+ */
+export function getDefaultSeedlessOnboardingControllerState() {
+    return {
+        backupHashes: [],
+    };
+}
+/**
+ * Seedless Onboarding Controller State Metadata.
+ *
+ * This allows us to choose if fields of the state should be persisted or not
+ * using the `persist` flag; and if they can be sent to Sentry or not, using
+ * the `anonymous` flag.
+ */
+const seedlessOnboardingMetadata = {
+    vault: {
+        persist: true,
+        anonymous: false,
+    },
+    backupHashes: {
+        persist: true,
+        anonymous: true,
+    },
+    nodeAuthTokens: {
+        persist: false,
+        anonymous: true,
+    },
+    authConnectionId: {
+        persist: true,
+        anonymous: true,
+    },
+    groupedAuthConnectionId: {
+        persist: true,
+        anonymous: true,
+    },
+    userId: {
+        persist: true,
+        anonymous: true,
+    },
+};
+export class SeedlessOnboardingController extends BaseController {
+    /**
+     * Creates a new SeedlessOnboardingController instance.
+     *
+     * @param options - The options for the SeedlessOnboardingController.
+     * @param options.messenger - A restricted messenger.
+     * @param options.state - Initial state to set on this controller.
+     * @param options.encryptor - An optional encryptor to use for encrypting and decrypting seedless onboarding vault.
+     * @param options.network - The network to be used for the Seedless Onboarding flow.
+     */
+    constructor({ messenger, state, encryptor = { encrypt, decrypt }, // default to `encrypt` and `decrypt` from `@metamask/browser-passworder`
+    network = Web3AuthNetwork.Mainnet, }) {
+        super({
+            name: controllerName,
+            metadata: seedlessOnboardingMetadata,
+            state: {
+                ...getDefaultSeedlessOnboardingControllerState(),
+                ...state,
+            },
+            messenger,
+        });
+        _SeedlessOnboardingController_instances.add(this);
+        _SeedlessOnboardingController_vaultEncryptor.set(this, void 0);
+        _SeedlessOnboardingController_vaultOperationMutex.set(this, new Mutex());
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
+        this.toprfClient = new ToprfSecureBackup({
+            network,
+        });
+    }
+    /**
+     * Authenticate OAuth user using the seedless onboarding flow
+     * and determine if the user is already registered or not.
+     *
+     * @param params - The parameters for authenticate OAuth user.
+     * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.
+     * @param params.authConnectionId - OAuth authConnectionId from dashboard
+     * @param params.userId - user email or id from Social login
+     * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.
+     * You can pass this to use aggregate multiple OAuth connections. Useful when you want user to have same account while using different OAuth connections.
+     * @returns A promise that resolves to the authentication result.
+     */
+    async authenticate(params) {
+        try {
+            const { idTokens, authConnectionId, groupedAuthConnectionId, userId } = params;
+            const hashedIdTokenHexes = idTokens.map((idToken) => {
+                return remove0x(keccak256AndHexify(stringToBytes(idToken)));
+            });
+            const authenticationResult = await this.toprfClient.authenticate({
+                verifier: groupedAuthConnectionId || authConnectionId,
+                verifierId: userId,
+                idTokens: hashedIdTokenHexes,
+                singleIdVerifierParams: {
+                    subVerifier: authConnectionId,
+                    subVerifierIdTokens: idTokens,
+                },
+            });
+            // update the state with the authenticated user info
+            this.update((state) => {
+                state.nodeAuthTokens = authenticationResult.nodeAuthTokens;
+                state.authConnectionId = authConnectionId;
+                state.groupedAuthConnectionId = groupedAuthConnectionId;
+                state.userId = userId;
+            });
+            return authenticationResult;
+        }
+        catch (error) {
+            log('Error authenticating user', error);
+            throw new Error(SeedlessOnboardingControllerError.AuthenticationError);
+        }
+    }
+    /**
+     * Create a new TOPRF encryption key using given password and backups the provided seed phrase.
+     *
+     * @param password - The password used to create new wallet and seedphrase
+     * @param seedPhrase - The seed phrase to backup
+     * @returns A promise that resolves to the encrypted seed phrase and the encryption key.
+     */
+    async createToprfKeyAndBackupSeedPhrase(password, seedPhrase) {
+        // to make sure that fail fast,
+        // assert that the user is authenticated before creating the TOPRF key and backing up the seed phrase
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+        // locally evaluate the encryption key from the password
+        const { encKey, authKeyPair, oprfKey } = this.toprfClient.createLocalKey({
+            password,
+        });
+        // encrypt and store the seed phrase backup
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup).call(this, seedPhrase, encKey, authKeyPair);
+        // store/persist the encryption key shares
+        // We store the seed phrase metadata in the metadata store first. If this operation fails,
+        // we avoid persisting the encryption key shares to prevent a situation where a user appears
+        // to have an account but with no associated data.
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistOprfKey).call(this, oprfKey, authKeyPair.pk);
+        // create a new vault with the resulting authentication data
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+            password,
+            rawToprfEncryptionKey: encKey,
+            rawToprfAuthKeyPair: authKeyPair,
+        });
+    }
+    /**
+     * Add a new seed phrase backup to the metadata store.
+     *
+     * @param seedPhrase - The seed phrase to backup.
+     * @param password - The password used to create new wallet and seedphrase
+     * @returns A promise that resolves to the success of the operation.
+     */
+    async addNewSeedPhraseBackup(seedPhrase, password) {
+        // verify the password and unlock the vault
+        const { toprfEncryptionKey, toprfAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultWithPassword).call(this, password);
+        // encrypt and store the seed phrase backup
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup).call(this, seedPhrase, toprfEncryptionKey, toprfAuthKeyPair);
+    }
+    /**
+     * Fetches all encrypted seed phrases and metadata for user's account from the metadata store.
+     *
+     * Decrypts the seed phrases and returns the decrypted seed phrases using the recovered encryption key from the password.
+     *
+     * @param password - The password used to create new wallet and seedphrase
+     * @returns A promise that resolves to the seed phrase metadata.
+     */
+    async fetchAllSeedPhrases(password) {
+        // assert that the user is authenticated before fetching the seed phrases
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+        const { encKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, password);
+        try {
+            const secretData = await this.toprfClient.fetchAllSecretDataItems({
+                decKey: encKey,
+                authKeyPair,
+            });
+            if (secretData?.length > 0) {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                    password,
+                    rawToprfEncryptionKey: encKey,
+                    rawToprfAuthKeyPair: authKeyPair,
+                });
+            }
+            return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withPersistedSeedPhraseBackupsState).call(this, () => Promise.resolve(SeedPhraseMetadata.parseSeedPhraseFromMetadataStore(secretData)));
+        }
+        catch (error) {
+            log('Error fetching seed phrase metadata', error);
+            throw new Error(SeedlessOnboardingControllerError.FailedToFetchSeedPhraseMetadata);
+        }
+    }
+    /**
+     * Update the password of the seedless onboarding flow.
+     *
+     * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.
+     *
+     * @param newPassword - The new password to update.
+     * @param oldPassword - The old password to verify.
+     */
+    async changePassword(newPassword, oldPassword) {
+        // verify the old password of the encrypted vault
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultWithPassword).call(this, oldPassword);
+        try {
+            // update the encryption key with new password and update the Metadata Store
+            const { encKey: newEncKey, authKeyPair: newAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, newPassword, oldPassword);
+            // update and encrypt the vault with new password
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                password: newPassword,
+                rawToprfEncryptionKey: newEncKey,
+                rawToprfAuthKeyPair: newAuthKeyPair,
+            });
+        }
+        catch (error) {
+            log('Error changing password', error);
+            throw new Error(SeedlessOnboardingControllerError.FailedToChangePassword);
+        }
+    }
+    /**
+     * Get the hash of the seed phrase backup for the given seed phrase, from the state.
+     *
+     * If the given seed phrase is not backed up and not found in the state, it will return `undefined`.
+     *
+     * @param seedPhrase - The seed phrase to get the hash of.
+     * @returns A promise that resolves to the hash of the seed phrase backup.
+     */
+    getSeedPhraseBackupHash(seedPhrase) {
+        const seedPhraseHash = keccak256AndHexify(seedPhrase);
+        return this.state.backupHashes.find((hash) => hash === seedPhraseHash);
+    }
+}
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_persistOprfKey = 
+/**
+ * Persist the encryption key for the seedless onboarding flow.
+ *
+ * @param oprfKey - The OPRF key to be splited and persisted.
+ * @param authPubKey - The authentication public key.
+ * @returns A promise that resolves to the success of the operation.
+ */
+async function _SeedlessOnboardingController_persistOprfKey(oprfKey, authPubKey) {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    const verifier = this.state.groupedAuthConnectionId || this.state.authConnectionId;
+    try {
+        await this.toprfClient.persistLocalKey({
+            nodeAuthTokens: this.state.nodeAuthTokens,
+            verifier,
+            verifierId: this.state.userId,
+            oprfKey,
+            authPubKey,
+        });
+    }
+    catch (error) {
+        log('Error persisting local encryption key', error);
+        throw new Error(SeedlessOnboardingControllerError.FailedToPersistOprfKey);
+    }
+}, _SeedlessOnboardingController_recoverEncKey = 
+/**
+ * Recover the encryption key from password.
+ *
+ * @param password - The password used to derive/recover the encryption key.
+ * @returns A promise that resolves to the encryption key and authentication key pair.
+ * @throws RecoveryError - If failed to recover the encryption key.
+ */
+async function _SeedlessOnboardingController_recoverEncKey(password) {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    const verifier = this.state.groupedAuthConnectionId || this.state.authConnectionId;
+    try {
+        const recoverEncKeyResult = await this.toprfClient.recoverEncKey({
+            nodeAuthTokens: this.state.nodeAuthTokens,
+            password,
+            verifier,
+            verifierId: this.state.userId,
+        });
+        return recoverEncKeyResult;
+    }
+    catch (error) {
+        throw RecoveryError.getInstance(error);
+    }
+}, _SeedlessOnboardingController_changeEncryptionKey = 
+/**
+ * Update the encryption key with new password and update the Metadata Store with new encryption key.
+ *
+ * @param newPassword - The new password to update.
+ * @param oldPassword - The old password to verify.
+ * @returns A promise that resolves to new encryption key and authentication key pair.
+ */
+async function _SeedlessOnboardingController_changeEncryptionKey(newPassword, oldPassword) {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    const verifier = this.state.groupedAuthConnectionId || this.state.authConnectionId;
+    const { encKey, authKeyPair, keyShareIndex: newKeyShareIndex, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword);
+    return await this.toprfClient.changeEncKey({
+        nodeAuthTokens: this.state.nodeAuthTokens,
+        verifier,
+        verifierId: this.state.userId,
+        oldEncKey: encKey,
+        oldAuthKeyPair: authKeyPair,
+        newKeyShareIndex,
+        newPassword,
+    });
+}, _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup = 
+/**
+ * Encrypt and store the seed phrase backup in the metadata store.
+ *
+ * @param seedPhrase - The seed phrase to store.
+ * @param encKey - The encryption key to store.
+ * @param authKeyPair - The authentication key pair to store.
+ *
+ * @returns A promise that resolves to the success of the operation.
+ */
+async function _SeedlessOnboardingController_encryptAndStoreSeedPhraseBackup(seedPhrase, encKey, authKeyPair) {
+    try {
+        const seedPhraseMetadata = new SeedPhraseMetadata(seedPhrase);
+        const secretData = seedPhraseMetadata.toBytes();
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withPersistedSeedPhraseBackupsState).call(this, async () => {
+            await this.toprfClient.addSecretDataItem({
+                encKey,
+                secretData,
+                authKeyPair,
+            });
+            return seedPhrase;
+        });
+    }
+    catch (error) {
+        log('Error encrypting and storing seed phrase backup', error);
+        throw new Error(SeedlessOnboardingControllerError.FailedToEncryptAndStoreSeedPhraseBackup);
+    }
+}, _SeedlessOnboardingController_unlockVaultWithPassword = 
+/**
+ * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
+ * This method ensures thread-safety by using a mutex lock when accessing the vault.
+ *
+ * @param password - The password to decrypt the vault.
+ * @returns A promise that resolves to an object containing:
+ * - nodeAuthTokens: Authentication tokens to communicate with the TOPRF service
+ * - toprfEncryptionKey: The decrypted TOPRF encryption key
+ * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
+ * @throws {Error} If:
+ * - The password is invalid or empty
+ * - The vault is not initialized
+ * - The password is incorrect (from encryptor.decrypt)
+ * - The decrypted vault data is malformed
+ */
+async function _SeedlessOnboardingController_unlockVaultWithPassword(password) {
+    return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
+        assertIsValidPassword(password);
+        const encryptedVault = this.state.vault;
+        if (!encryptedVault) {
+            throw new Error(SeedlessOnboardingControllerError.VaultError);
+        }
+        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
+        // from the password using an intentionally slow key derivation function.
+        // We should make sure that we only call it very intentionally.
+        const decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decrypt(password, encryptedVault);
+        const { nodeAuthTokens, toprfEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
+        // update the state with the restored nodeAuthTokens
+        this.update((state) => {
+            state.nodeAuthTokens = nodeAuthTokens;
+        });
+        return { nodeAuthTokens, toprfEncryptionKey, toprfAuthKeyPair };
+    });
+}, _SeedlessOnboardingController_withPersistedSeedPhraseBackupsState = 
+/**
+ * Executes a callback function that creates or restores seed phrases and persists their hashes in the controller state.
+ *
+ * This method:
+ * 1. Executes the provided callback to create/restore seed phrases
+ * 2. Generates keccak256 hashes of the seed phrases
+ * 3. Merges new hashes with existing ones in the state, ensuring uniqueness
+ * 4. Updates the controller state with the combined hashes
+ *
+ * This is a wrapper method that should be used around any operation that creates
+ * or restores seed phrases to ensure their hashes are properly tracked.
+ *
+ * @param createOrRestoreSeedPhraseBackupCallback - function that returns either a single seed phrase
+ * or an array of seed phrases as Uint8Array(s)
+ * @returns The original seed phrase(s) returned by the callback
+ * @throws Rethrows any errors from the callback with additional logging
+ */
+async function _SeedlessOnboardingController_withPersistedSeedPhraseBackupsState(createOrRestoreSeedPhraseBackupCallback) {
+    try {
+        const backedUpSeedPhrases = await createOrRestoreSeedPhraseBackupCallback();
+        let backedUpHashB64Strings = [];
+        if (Array.isArray(backedUpSeedPhrases)) {
+            backedUpHashB64Strings = backedUpSeedPhrases.map((seedPhrase) => keccak256AndHexify(seedPhrase));
+        }
+        else {
+            backedUpHashB64Strings = [keccak256AndHexify(backedUpSeedPhrases)];
+        }
+        const existingBackedUpHashes = this.state.backupHashes;
+        const uniqueHashesSet = new Set([
+            ...existingBackedUpHashes,
+            ...backedUpHashB64Strings,
+        ]);
+        this.update((state) => {
+            state.backupHashes = Array.from(uniqueHashesSet);
+        });
+        return backedUpSeedPhrases;
+    }
+    catch (error) {
+        log('Error persisting seed phrase backups', error);
+        throw error;
+    }
+}, _SeedlessOnboardingController_createNewVaultWithAuthData = 
+/**
+ * Create a new vault with the given authentication data.
+ *
+ * Serialize the authentication and key data which will be stored in the vault.
+ *
+ * @param params - The parameters for creating a new vault.
+ * @param params.password - The password to encrypt the vault.
+ * @param params.rawToprfEncryptionKey - The encryption key to encrypt the vault.
+ * @param params.rawToprfAuthKeyPair - The authentication key pair to encrypt the vault.
+ */
+async function _SeedlessOnboardingController_createNewVaultWithAuthData({ password, rawToprfEncryptionKey, rawToprfAuthKeyPair, }) {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    const { toprfEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfAuthKeyPair);
+    const serializedVaultData = JSON.stringify({
+        authTokens: this.state.nodeAuthTokens,
+        toprfEncryptionKey,
+        toprfAuthKeyPair,
+    });
+    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+        password,
+        serializedVaultData,
+    });
+}, _SeedlessOnboardingController_updateVault = 
+/**
+ * Encrypt and update the vault with the given authentication data.
+ *
+ * @param params - The parameters for updating the vault.
+ * @param params.password - The password to encrypt the vault.
+ * @param params.serializedVaultData - The serialized authentication data to update the vault with.
+ * @returns A promise that resolves to the updated vault.
+ */
+async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, }) {
+    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
+        assertIsValidPassword(password);
+        const updatedState = {};
+        // Note that vault encryption using the password is a very costly operation as it involves deriving the encryption key
+        // from the password using an intentionally slow key derivation function.
+        // We should make sure that we only call it very intentionally.
+        updatedState.vault = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").encrypt(password, serializedVaultData);
+        this.update((state) => {
+            state.vault = updatedState.vault;
+        });
+    });
+}, _SeedlessOnboardingController_withVaultLock = 
+/**
+ * Lock the vault mutex before executing the given function,
+ * and release it after the function is resolved or after an
+ * error is thrown.
+ *
+ * This ensures that each operation that interacts with the vault
+ * is executed in a mutually exclusive way.
+ *
+ * @param callback - The function to execute while the vault mutex is locked.
+ * @returns The result of the function.
+ */
+async function _SeedlessOnboardingController_withVaultLock(callback) {
+    return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
+}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, authKeyPair) {
+    const b64EncodedEncKey = bytesToBase64(encKey);
+    const b64EncodedAuthKeyPair = JSON.stringify({
+        sk: bigIntToHex(authKeyPair.sk),
+        pk: bytesToBase64(authKeyPair.pk),
+    });
+    return {
+        toprfEncryptionKey: b64EncodedEncKey,
+        toprfAuthKeyPair: b64EncodedAuthKeyPair,
+    };
+}, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
+    if (typeof data !== 'string') {
+        throw new Error(SeedlessOnboardingControllerError.InvalidVaultData);
+    }
+    let parsedVaultData;
+    try {
+        parsedVaultData = JSON.parse(data);
+    }
+    catch {
+        throw new Error(SeedlessOnboardingControllerError.InvalidVaultData);
+    }
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsValidVaultData).call(this, parsedVaultData);
+    const rawToprfEncryptionKey = base64ToBytes(parsedVaultData.toprfEncryptionKey);
+    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
+    const rawToprfAuthKeyPair = {
+        sk: BigInt(parsedToprfAuthKeyPair.sk),
+        pk: base64ToBytes(parsedToprfAuthKeyPair.pk),
+    };
+    return {
+        nodeAuthTokens: parsedVaultData.authTokens,
+        toprfEncryptionKey: rawToprfEncryptionKey,
+        toprfAuthKeyPair: rawToprfAuthKeyPair,
+    };
+}, _SeedlessOnboardingController_assertIsAuthenticatedUser = function _SeedlessOnboardingController_assertIsAuthenticatedUser(value) {
+    if (!value ||
+        typeof value !== 'object' ||
+        !('authConnectionId' in value) ||
+        typeof value.authConnectionId !== 'string' ||
+        !('userId' in value) ||
+        typeof value.userId !== 'string') {
+        throw new Error(SeedlessOnboardingControllerError.MissingAuthUserInfo);
+    }
+    if (!('nodeAuthTokens' in value) ||
+        typeof value.nodeAuthTokens !== 'object' ||
+        !Array.isArray(value.nodeAuthTokens) ||
+        value.nodeAuthTokens.length < 3 // At least 3 auth tokens are required for Threshold OPRF service
+    ) {
+        throw new Error(SeedlessOnboardingControllerError.InsufficientAuthToken);
+    }
+}, _SeedlessOnboardingController_assertIsValidVaultData = function _SeedlessOnboardingController_assertIsValidVaultData(value) {
+    // value is not valid vault data if any of the following conditions are true:
+    if (!value || // value is not defined
+        typeof value !== 'object' || // value is not an object
+        !('authTokens' in value) || // authTokens is not defined
+        typeof value.authTokens !== 'object' || // authTokens is not an object
+        !('toprfEncryptionKey' in value) || // toprfEncryptionKey is not defined
+        typeof value.toprfEncryptionKey !== 'string' || // toprfEncryptionKey is not a string
+        !('toprfAuthKeyPair' in value) || // toprfAuthKeyPair is not defined
+        typeof value.toprfAuthKeyPair !== 'string' // toprfAuthKeyPair is not a string
+    ) {
+        throw new Error(SeedlessOnboardingControllerError.VaultDataError);
+    }
+};
+/**
+ * Assert that the provided password is a valid non-empty string.
+ *
+ * @param password - The password to check.
+ * @throws If the password is not a valid string.
+ */
+function assertIsValidPassword(password) {
+    if (typeof password !== 'string') {
+        throw new Error(SeedlessOnboardingControllerError.WrongPasswordType);
+    }
+    if (!password || !password.length) {
+        throw new Error(SeedlessOnboardingControllerError.InvalidEmptyPassword);
+    }
+}
+/**
+ * Lock the given mutex before executing the given function,
+ * and release it after the function is resolved or after an
+ * error is thrown.
+ *
+ * @param mutex - The mutex to lock.
+ * @param callback - The function to execute while the mutex is locked.
+ * @returns The result of the function.
+ */
+async function withLock(mutex, callback) {
+    const releaseLock = await mutex.acquire();
+    try {
+        return await callback({ releaseLock });
+    }
+    finally {
+        releaseLock();
+    }
+}
+//# sourceMappingURL=SeedlessOnboardingController.mjs.map