@metamask-previews/seedless-onboarding-controller 10.1.1-preview-abca9bcea → 10.1.1-preview-8bfa290fb

package/CHANGELOG.md

@@ -7,30 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Added
-
-- Add `SeedlessPasswordChangePhase` enum and an optional `passwordChangePhase` state field that persists a non-sensitive password-change lifecycle phase used as a recovery signal. An unset/`undefined` phase means no password change is in progress ([#10148](https://github.com/MetaMask/core/pull/10148))
-- Add `PasswordChangeRecoveryStatus` enum, returned by `resolvePasswordSyncState` and `reconcilePassword` to tell clients which recovery step to run next ([#10148](https://github.com/MetaMask/core/pull/10148))
-- Add `resolvePasswordSyncState({ skipCache })` and `SeedlessOnboardingControllerResolvePasswordSyncStateAction` to resolve remote password state at unlock without consuming a password, replacing the removed `checkIsPasswordOutdated` read ([#10148](https://github.com/MetaMask/core/pull/10148))
-- Add `reconcilePassword({ globalPassword })` and `SeedlessOnboardingControllerReconcilePasswordAction` to bring local Seedless state up to date with the remote password after either an interrupted local password change or a password change made on another device ([#10148](https://github.com/MetaMask/core/pull/10148))
-  - It performs the password-chain unlock and local vault rewrite internally, re-encrypts `encryptedKeyringEncryptionKey` under the new wrapping key so `loadKeyringEncryptionKey` keeps working, and advances the lifecycle to `LOCAL_KEYRING_PENDING` so the client reconciles the local Keyring before unlocking normally.
-- Add `clearPasswordChangePhase` and `markPasswordChangeKeySyncPending` lifecycle-advance methods, along with `SeedlessOnboardingControllerClearPasswordChangePhaseAction` and `SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction`. `clearPasswordChangePhase` is the only way back to "no change in progress" and must be called once key synchronization and local persistence are verified ([#10148](https://github.com/MetaMask/core/pull/10148))
-- Add `SeedlessOnboardingControllerErrorMessage.PasswordChangeInProgress`, thrown when a password change is started while another one is unresolved ([#10148](https://github.com/MetaMask/core/pull/10148))
-
 ### Changed
 
-- **BREAKING:** `changePassword` is now lifecycle-aware: it writes the `SEEDLESS_CHANGE_PENDING`, `SEEDLESS_COMMITTED`, and `LOCAL_KEYRING_PENDING` phases and rejects a concurrent change with `PasswordChangeInProgress` ([#10148](https://github.com/MetaMask/core/pull/10148))
-  - Clients must not start a second password change while a lifecycle is unfinished, and must drive the lifecycle to completion by calling `clearPasswordChangePhase`. See [0002](./docs/0002-password-change-recovery-flow.md) for the client integration guide.
 - Bump `@metamask/keyring-controller` from `^27.1.0` to `^27.1.1` ([#9791](https://github.com/MetaMask/core/pull/9791))
 - Bump `@metamask/utils` from `^11.11.0` to `^11.12.0` ([#10076](https://github.com/MetaMask/core/pull/10076))
 
-### Removed
-
-- **BREAKING:** Remove the `checkIsPasswordOutdated` method and `SeedlessOnboardingControllerCheckIsPasswordOutdatedAction` ([#10148](https://github.com/MetaMask/core/pull/10148))
-  - Call `resolvePasswordSyncState({ skipCache })` instead. It performs the same remote check and additionally returns the required recovery step, so a boolean `true` result now corresponds to `PasswordChangeRecoveryStatus.PasswordOutdated`.
-- **BREAKING:** Remove the `submitGlobalPassword` and `syncLatestGlobalPassword` methods, along with `SeedlessOnboardingControllerSubmitGlobalPasswordAction` and `SeedlessOnboardingControllerSyncLatestGlobalPasswordAction` ([#10148](https://github.com/MetaMask/core/pull/10148))
-  - Call `reconcilePassword({ globalPassword })` instead. It runs both steps internally in the correct order, re-wraps the stored Keyring encryption key, and records the lifecycle phase, none of which happened when the two methods were called directly.
-
 ## [10.1.1]
 
 ### Added

package/dist/SeedlessOnboardingController-method-action-types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController-method-action-types.cjs","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { SeedlessOnboardingController } from './SeedlessOnboardingController.js';\n\nexport type SeedlessOnboardingControllerFetchMetadataAccessCredsAction = {\n  type: `SeedlessOnboardingController:fetchMetadataAccessCreds`;\n  handler: SeedlessOnboardingController['fetchMetadataAccessCreds'];\n};\n\n/**\n * Gets the node details for the TOPRF operations.\n * This function can be called to get the node endpoints, indexes and pubkeys and cache them locally.\n */\nexport type SeedlessOnboardingControllerPreloadToprfNodeDetailsAction = {\n  type: `SeedlessOnboardingController:preloadToprfNodeDetails`;\n  handler: SeedlessOnboardingController['preloadToprfNodeDetails'];\n};\n\n/**\n * Authenticate OAuth user using the seedless onboarding flow\n * and determine if the user is already registered or not.\n *\n * @param params - The parameters for authenticate OAuth user.\n * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.\n * @param params.authConnection - The social login provider.\n * @param params.authConnectionId - OAuth authConnectionId from dashboard\n * @param params.userId - user email or id from Social login\n * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.\n * @param params.socialLoginEmail - The user email from Social login.\n * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.\n * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.\n * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.\n * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.\n * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the authentication result.\n */\nexport type SeedlessOnboardingControllerAuthenticateAction = {\n  type: `SeedlessOnboardingController:authenticate`;\n  handler: SeedlessOnboardingController['authenticate'];\n};\n\n/**\n * Create a new TOPRF encryption key using given password and backups the provided seed phrase.\n *\n * @param password - The password used to create new wallet and seedphrase\n * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.\n * @param keyringId - The keyring id of the backup seed phrase\n * @returns A promise that resolves to the encrypted seed phrase and the encryption key.\n */\nexport type SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction =\n  {\n    type: `SeedlessOnboardingController:createToprfKeyAndBackupSeedPhrase`;\n    handler: SeedlessOnboardingController['createToprfKeyAndBackupSeedPhrase'];\n  };\n\n/**\n * Encrypt and add a new secret data to the metadata store.\n *\n * @param data - The data to add.\n * @param dataType - The data type classification for the secret data.\n * @param options - Optional options object, which includes optional data to be added to the metadata store.\n * @param options.keyringId - The keyring id of the backup keyring (SRP).\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerAddNewSecretDataAction = {\n  type: `SeedlessOnboardingController:addNewSecretData`;\n  handler: SeedlessOnboardingController['addNewSecretData'];\n};\n\n/**\n * Run any pending seedless onboarding migrations.\n *\n * This method should be called by clients after the controller is unlocked\n * to ensure legacy data is migrated to the latest format.\n *\n * Migrations are idempotent - running this multiple times is safe.\n * The migration version is tracked in state to prevent re-running migrations.\n *\n * @returns A promise that resolves to `true` if data was actually migrated\n * (items were updated on the server), `false` otherwise.\n * @throws If the password is outdated (changed on another device).\n */\nexport type SeedlessOnboardingControllerRunMigrationsAction = {\n  type: `SeedlessOnboardingController:runMigrations`;\n  handler: SeedlessOnboardingController['runMigrations'];\n};\n\n/**\n * Fetches all secret data items from the metadata store.\n *\n * Decrypts the secret data and returns the decrypted secret data using the recovered encryption key from the password.\n *\n * @param password - The optional password used to create new wallet. If not provided, `cached Encryption Key` will be used.\n * @returns A promise that resolves to the secret metadata items.\n */\nexport type SeedlessOnboardingControllerFetchAllSecretDataAction = {\n  type: `SeedlessOnboardingController:fetchAllSecretData`;\n  handler: SeedlessOnboardingController['fetchAllSecretData'];\n};\n\n/**\n * Update the password of the seedless onboarding flow.\n *\n * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.\n *\n * @param newPassword - The new password to update.\n * @param oldPassword - The old password to verify.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerChangePasswordAction = {\n  type: `SeedlessOnboardingController:changePassword`;\n  handler: SeedlessOnboardingController['changePassword'];\n};\n\n/**\n * Update the backup metadata state for the given secret data.\n *\n * @param secretData - The data to backup, can be a single backup or array of backups.\n * @param secretData.keyringId - The keyring id associated with the backup secret data.\n * @param secretData.data - The secret data to update the backup metadata state.\n */\nexport type SeedlessOnboardingControllerUpdateBackupMetadataStateAction = {\n  type: `SeedlessOnboardingController:updateBackupMetadataState`;\n  handler: SeedlessOnboardingController['updateBackupMetadataState'];\n};\n\n/**\n * Verify the password validity by decrypting the vault.\n *\n * @param password - The password to verify.\n * @param options - Optional options object.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the success of the operation.\n * @throws {Error} If the password is invalid or the vault is not initialized.\n */\nexport type SeedlessOnboardingControllerVerifyVaultPasswordAction = {\n  type: `SeedlessOnboardingController:verifyVaultPassword`;\n  handler: SeedlessOnboardingController['verifyVaultPassword'];\n};\n\n/**\n * Get backup state of the given secret data, from the controller state.\n *\n * If the given secret data is not backed up and not found in the state, it will return `undefined`.\n *\n * @param data - The data to get the backup state of.\n * @param type - The type of the secret data.\n * @returns The backup state of the given secret data.\n */\nexport type SeedlessOnboardingControllerGetSecretDataBackupStateAction = {\n  type: `SeedlessOnboardingController:getSecretDataBackupState`;\n  handler: SeedlessOnboardingController['getSecretDataBackupState'];\n};\n\n/**\n * Submit the password to the controller, verify the password validity and unlock the controller.\n *\n * This method will be used especially when user unlock the wallet.\n * The provided password will be verified against the encrypted vault, encryption key will be derived and saved in the controller state.\n *\n * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup\n *\n * @param password - The password to submit.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitPasswordAction = {\n  type: `SeedlessOnboardingController:submitPassword`;\n  handler: SeedlessOnboardingController['submitPassword'];\n};\n\n/**\n * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).\n *\n * When the controller is locked, the user will not be able to perform any operations on the controller/vault.\n *\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSetLockedAction = {\n  type: `SeedlessOnboardingController:setLocked`;\n  handler: SeedlessOnboardingController['setLocked'];\n};\n\n/**\n * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.\n *\n * This method will check the `accessToken` and `revokeToken` in the state, besides the social login authentication details.\n * If both are present, the user is authenticated.\n * If either is missing, the user is not authenticated.\n *\n * This method is useful when we want to check if the state has valid authenticated user details to perform vault creations.\n *\n * @returns True if the user is authenticated, false otherwise.\n */\nexport type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {\n  type: `SeedlessOnboardingController:getIsUserAuthenticated`;\n  handler: SeedlessOnboardingController['getIsUserAuthenticated'];\n};\n\n/**\n * Clears the current state of the SeedlessOnboardingController.\n */\nexport type SeedlessOnboardingControllerClearStateAction = {\n  type: `SeedlessOnboardingController:clearState`;\n  handler: SeedlessOnboardingController['clearState'];\n};\n\n/**\n * Store the keyring encryption key in state, encrypted under the current\n * encryption key.\n *\n * Remains lifecycle-neutral: the client calls this during recovery without\n * advancing the lifecycle phase.\n *\n * @param keyringEncryptionKey - The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:storeKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['storeKeyringEncryptionKey'];\n};\n\n/**\n * Load the keyring encryption key from state, decrypted under the current\n * encryption key.\n *\n * @returns The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];\n};\n\n/**\n * Clear the password-change lifecycle.\n *\n * Used after a definitive remote failure (server did not commit) or once\n * Keyring encryption-key synchronization is verified and all required local\n * writes have succeeded. The controller clears the phase so the next unlock\n * is normal.\n *\n * @returns A promise that resolves once the lifecycle has been cleared.\n */\nexport type SeedlessOnboardingControllerClearPasswordChangePhaseAction = {\n  type: `SeedlessOnboardingController:clearPasswordChangePhase`;\n  handler: SeedlessOnboardingController['clearPasswordChangePhase'];\n};\n\n/**\n * Mark the password-change lifecycle as `KEY_SYNC_PENDING`.\n *\n * Called by the client coordinator before it synchronizes the current\n * Keyring encryption key to Seedless. The controller only records the\n * boundary; it does not perform or verify synchronization.\n *\n * @returns A promise that resolves once the phase has been persisted.\n */\nexport type SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction =\n  {\n    type: `SeedlessOnboardingController:markPasswordChangeKeySyncPending`;\n    handler: SeedlessOnboardingController['markPasswordChangeKeySyncPending'];\n  };\n\n/**\n * Resolve the current password-sync state without consuming a password.\n *\n * Merges the legacy `checkIsPasswordOutdated` read with password-change\n * recovery routing, so the client makes a single call at unlock (both on\n * page render and on password submit) and routes UI from the returned status.\n *\n * Phase handling:\n * - No phase (`undefined`): run the authoritative outdated check. `skipCache`\n * is honored, so the client can read from cache on render and force a remote\n * call on submit. Returns `InSync` or `PasswordOutdated` (another device\n * changed the remote password).\n * - `SEEDLESS_CHANGE_PENDING`: the remote outcome is ambiguous, so `skipCache`\n * is ignored and a remote check is forced. Clears the phase (remote did not\n * commit) or advances to `SEEDLESS_COMMITTED` (remote committed). Returns\n * `InSync` or `EnterNewPassword`.\n * - Other phases: return the next recovery step without mutating state.\n *\n * This method does not consume a password; the client prompts for the\n * correct password and then calls `reconcilePassword`.\n *\n * @param options - The options.\n * @param options.skipCache - Whether to bypass the outdated cache. Ignored\n * for `SEEDLESS_CHANGE_PENDING`, which always forces a remote check.\n * @returns The sync/recovery resolution. On any failure the last known phase\n * is preserved and `PasswordChangeRecoveryStatus.Unknown` is returned.\n */\nexport type SeedlessOnboardingControllerResolvePasswordSyncStateAction = {\n  type: `SeedlessOnboardingController:resolvePasswordSyncState`;\n  handler: SeedlessOnboardingController['resolvePasswordSyncState'];\n};\n\n/**\n * Reconcile the local Seedless password with the remote password.\n *\n * For `SEEDLESS_COMMITTED` or `LOCAL_KEYRING_PENDING` it re-runs the existing\n * password-sync flow (chain unlock + local vault rewrite)\n * with the new password and advances the phase to `LOCAL_KEYRING_PENDING`.\n * These operations are idempotent, so re-running them is safe whether or not\n * the local Seedless vault was already rewritten. The controller is left\n * unlocked.\n *\n * For no phase (`undefined`) it re-checks whether the remote password is\n * outdated. If it is, it runs the same password-sync flow, advances to\n * `LOCAL_KEYRING_PENDING`, and returns `ReconcileKeyring` so the client can\n * reconcile the local Keyring (e.g. after another device changed the remote\n * password). If the remote password is not outdated it is a no-op.\n *\n * The client remains responsible for the Keyring side (classifying the local\n * Keyring via `KeyringController:verifyPassword` and running the old-Keyring\n * or new-Keyring branch), because this controller does not depend on\n * `KeyringController`. See\n * [0003](./docs/0003-controller-owned-password-change-recovery-plan.md).\n *\n * @param params - The reconciliation parameters.\n * @param params.globalPassword - The current global password.\n * @returns The reconciliation result. On any failure the last known phase is\n * preserved and `PasswordChangeRecoveryStatus.Unknown` is returned.\n */\nexport type SeedlessOnboardingControllerReconcilePasswordAction = {\n  type: `SeedlessOnboardingController:reconcilePassword`;\n  handler: SeedlessOnboardingController['reconcilePassword'];\n};\n\n/**\n * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using\n * the stored refresh token.\n *\n * Concurrent callers share a single in-flight HTTP request — if a refresh is\n * already in-progress the returned promise resolves when that request settles\n * rather than firing a duplicate request with the same token.\n *\n * @returns A promise that resolves when the tokens have been refreshed.\n */\nexport type SeedlessOnboardingControllerRefreshAuthTokensAction = {\n  type: `SeedlessOnboardingController:refreshAuthTokens`;\n  handler: SeedlessOnboardingController['refreshAuthTokens'];\n};\n\n/**\n * Rotate the refresh token — fetch a new refresh/revoke token pair from the\n * auth service and persist the new revoke token in the vault.\n *\n * This method should be called after a successful JWT refresh.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRotateRefreshTokenAction = {\n  type: `SeedlessOnboardingController:rotateRefreshToken`;\n  handler: SeedlessOnboardingController['rotateRefreshToken'];\n};\n\n/**\n * Revoke all pending refresh tokens.\n *\n * This method is to be called after user is authenticated.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRevokePendingRefreshTokensAction = {\n  type: `SeedlessOnboardingController:revokePendingRefreshTokens`;\n  handler: SeedlessOnboardingController['revokePendingRefreshTokens'];\n};\n\n/**\n * Get the access token from the state.\n *\n * If the tokens are expired, the method will refresh them and return the new access token.\n *\n * @returns The access token.\n */\nexport type SeedlessOnboardingControllerGetAccessTokenAction = {\n  type: `SeedlessOnboardingController:getAccessToken`;\n  handler: SeedlessOnboardingController['getAccessToken'];\n};\n\n/**\n * Check if the current node auth token is expired.\n *\n * @returns True if the current node auth token is expired, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkNodeAuthTokenExpired`;\n  handler: SeedlessOnboardingController['checkNodeAuthTokenExpired'];\n};\n\n/**\n * Check if the current metadata access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n *\n * @returns True if the metadata access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction =\n  {\n    type: `SeedlessOnboardingController:checkMetadataAccessTokenExpired`;\n    handler: SeedlessOnboardingController['checkMetadataAccessTokenExpired'];\n  };\n\n/**\n * Check if the current access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n * When the vault is locked, the access token is not accessible, so we return false.\n *\n * @returns True if the access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkAccessTokenExpired`;\n  handler: SeedlessOnboardingController['checkAccessTokenExpired'];\n};\n\n/**\n * Union of all SeedlessOnboardingController action types.\n */\nexport type SeedlessOnboardingControllerMethodActions =\n  | SeedlessOnboardingControllerFetchMetadataAccessCredsAction\n  | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction\n  | SeedlessOnboardingControllerAuthenticateAction\n  | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction\n  | SeedlessOnboardingControllerAddNewSecretDataAction\n  | SeedlessOnboardingControllerRunMigrationsAction\n  | SeedlessOnboardingControllerFetchAllSecretDataAction\n  | SeedlessOnboardingControllerChangePasswordAction\n  | SeedlessOnboardingControllerUpdateBackupMetadataStateAction\n  | SeedlessOnboardingControllerVerifyVaultPasswordAction\n  | SeedlessOnboardingControllerGetSecretDataBackupStateAction\n  | SeedlessOnboardingControllerSubmitPasswordAction\n  | SeedlessOnboardingControllerSetLockedAction\n  | SeedlessOnboardingControllerGetIsUserAuthenticatedAction\n  | SeedlessOnboardingControllerClearStateAction\n  | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerClearPasswordChangePhaseAction\n  | SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction\n  | SeedlessOnboardingControllerResolvePasswordSyncStateAction\n  | SeedlessOnboardingControllerReconcilePasswordAction\n  | SeedlessOnboardingControllerRefreshAuthTokensAction\n  | SeedlessOnboardingControllerRotateRefreshTokenAction\n  | SeedlessOnboardingControllerRevokePendingRefreshTokensAction\n  | SeedlessOnboardingControllerGetAccessTokenAction\n  | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction\n  | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction\n  | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;\n"]}
+{"version":3,"file":"SeedlessOnboardingController-method-action-types.cjs","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { SeedlessOnboardingController } from './SeedlessOnboardingController.js';\n\nexport type SeedlessOnboardingControllerFetchMetadataAccessCredsAction = {\n  type: `SeedlessOnboardingController:fetchMetadataAccessCreds`;\n  handler: SeedlessOnboardingController['fetchMetadataAccessCreds'];\n};\n\n/**\n * Gets the node details for the TOPRF operations.\n * This function can be called to get the node endpoints, indexes and pubkeys and cache them locally.\n */\nexport type SeedlessOnboardingControllerPreloadToprfNodeDetailsAction = {\n  type: `SeedlessOnboardingController:preloadToprfNodeDetails`;\n  handler: SeedlessOnboardingController['preloadToprfNodeDetails'];\n};\n\n/**\n * Authenticate OAuth user using the seedless onboarding flow\n * and determine if the user is already registered or not.\n *\n * @param params - The parameters for authenticate OAuth user.\n * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.\n * @param params.authConnection - The social login provider.\n * @param params.authConnectionId - OAuth authConnectionId from dashboard\n * @param params.userId - user email or id from Social login\n * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.\n * @param params.socialLoginEmail - The user email from Social login.\n * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.\n * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.\n * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.\n * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.\n * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the authentication result.\n */\nexport type SeedlessOnboardingControllerAuthenticateAction = {\n  type: `SeedlessOnboardingController:authenticate`;\n  handler: SeedlessOnboardingController['authenticate'];\n};\n\n/**\n * Create a new TOPRF encryption key using given password and backups the provided seed phrase.\n *\n * @param password - The password used to create new wallet and seedphrase\n * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.\n * @param keyringId - The keyring id of the backup seed phrase\n * @returns A promise that resolves to the encrypted seed phrase and the encryption key.\n */\nexport type SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction =\n  {\n    type: `SeedlessOnboardingController:createToprfKeyAndBackupSeedPhrase`;\n    handler: SeedlessOnboardingController['createToprfKeyAndBackupSeedPhrase'];\n  };\n\n/**\n * Encrypt and add a new secret data to the metadata store.\n *\n * @param data - The data to add.\n * @param dataType - The data type classification for the secret data.\n * @param options - Optional options object, which includes optional data to be added to the metadata store.\n * @param options.keyringId - The keyring id of the backup keyring (SRP).\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerAddNewSecretDataAction = {\n  type: `SeedlessOnboardingController:addNewSecretData`;\n  handler: SeedlessOnboardingController['addNewSecretData'];\n};\n\n/**\n * Run any pending seedless onboarding migrations.\n *\n * This method should be called by clients after the controller is unlocked\n * to ensure legacy data is migrated to the latest format.\n *\n * Migrations are idempotent - running this multiple times is safe.\n * The migration version is tracked in state to prevent re-running migrations.\n *\n * @returns A promise that resolves to `true` if data was actually migrated\n * (items were updated on the server), `false` otherwise.\n * @throws If the password is outdated (changed on another device).\n */\nexport type SeedlessOnboardingControllerRunMigrationsAction = {\n  type: `SeedlessOnboardingController:runMigrations`;\n  handler: SeedlessOnboardingController['runMigrations'];\n};\n\n/**\n * Fetches all secret data items from the metadata store.\n *\n * Decrypts the secret data and returns the decrypted secret data using the recovered encryption key from the password.\n *\n * @param password - The optional password used to create new wallet. If not provided, `cached Encryption Key` will be used.\n * @returns A promise that resolves to the secret metadata items.\n */\nexport type SeedlessOnboardingControllerFetchAllSecretDataAction = {\n  type: `SeedlessOnboardingController:fetchAllSecretData`;\n  handler: SeedlessOnboardingController['fetchAllSecretData'];\n};\n\n/**\n * Update the password of the seedless onboarding flow.\n *\n * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.\n *\n * @param newPassword - The new password to update.\n * @param oldPassword - The old password to verify.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerChangePasswordAction = {\n  type: `SeedlessOnboardingController:changePassword`;\n  handler: SeedlessOnboardingController['changePassword'];\n};\n\n/**\n * Update the backup metadata state for the given secret data.\n *\n * @param secretData - The data to backup, can be a single backup or array of backups.\n * @param secretData.keyringId - The keyring id associated with the backup secret data.\n * @param secretData.data - The secret data to update the backup metadata state.\n */\nexport type SeedlessOnboardingControllerUpdateBackupMetadataStateAction = {\n  type: `SeedlessOnboardingController:updateBackupMetadataState`;\n  handler: SeedlessOnboardingController['updateBackupMetadataState'];\n};\n\n/**\n * Verify the password validity by decrypting the vault.\n *\n * @param password - The password to verify.\n * @param options - Optional options object.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the success of the operation.\n * @throws {Error} If the password is invalid or the vault is not initialized.\n */\nexport type SeedlessOnboardingControllerVerifyVaultPasswordAction = {\n  type: `SeedlessOnboardingController:verifyVaultPassword`;\n  handler: SeedlessOnboardingController['verifyVaultPassword'];\n};\n\n/**\n * Get backup state of the given secret data, from the controller state.\n *\n * If the given secret data is not backed up and not found in the state, it will return `undefined`.\n *\n * @param data - The data to get the backup state of.\n * @param type - The type of the secret data.\n * @returns The backup state of the given secret data.\n */\nexport type SeedlessOnboardingControllerGetSecretDataBackupStateAction = {\n  type: `SeedlessOnboardingController:getSecretDataBackupState`;\n  handler: SeedlessOnboardingController['getSecretDataBackupState'];\n};\n\n/**\n * Submit the password to the controller, verify the password validity and unlock the controller.\n *\n * This method will be used especially when user unlock the wallet.\n * The provided password will be verified against the encrypted vault, encryption key will be derived and saved in the controller state.\n *\n * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup\n *\n * @param password - The password to submit.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitPasswordAction = {\n  type: `SeedlessOnboardingController:submitPassword`;\n  handler: SeedlessOnboardingController['submitPassword'];\n};\n\n/**\n * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).\n *\n * When the controller is locked, the user will not be able to perform any operations on the controller/vault.\n *\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSetLockedAction = {\n  type: `SeedlessOnboardingController:setLocked`;\n  handler: SeedlessOnboardingController['setLocked'];\n};\n\n/**\n * Sync the latest global password to the controller.\n * reset vault with latest globalPassword,\n * persist the latest global password authPubKey\n *\n * @param params - The parameters for syncing the latest global password.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSyncLatestGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:syncLatestGlobalPassword`;\n  handler: SeedlessOnboardingController['syncLatestGlobalPassword'];\n};\n\n/**\n * @description Unlock the controller with the latest global password.\n *\n * @param params - The parameters for unlocking the controller.\n * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:submitGlobalPassword`;\n  handler: SeedlessOnboardingController['submitGlobalPassword'];\n};\n\n/**\n * @description Check if the current password is outdated compare to the global password.\n *\n * @param options - Optional options object.\n * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.\n * If not provided, the global auth public key will be fetched from the backend.\n * @param options.skipCache - If true, bypass the cache and force a fresh check.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to true if the password is outdated, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckIsPasswordOutdatedAction = {\n  type: `SeedlessOnboardingController:checkIsPasswordOutdated`;\n  handler: SeedlessOnboardingController['checkIsPasswordOutdated'];\n};\n\n/**\n * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.\n *\n * This method will check the `accessToken` and `revokeToken` in the state, besides the social login authentication details.\n * If both are present, the user is authenticated.\n * If either is missing, the user is not authenticated.\n *\n * This method is useful when we want to check if the state has valid authenticated user details to perform vault creations.\n *\n * @returns True if the user is authenticated, false otherwise.\n */\nexport type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {\n  type: `SeedlessOnboardingController:getIsUserAuthenticated`;\n  handler: SeedlessOnboardingController['getIsUserAuthenticated'];\n};\n\n/**\n * Clears the current state of the SeedlessOnboardingController.\n */\nexport type SeedlessOnboardingControllerClearStateAction = {\n  type: `SeedlessOnboardingController:clearState`;\n  handler: SeedlessOnboardingController['clearState'];\n};\n\n/**\n * Store the keyring encryption key in state, encrypted under the current\n * encryption key.\n *\n * @param keyringEncryptionKey - The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:storeKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['storeKeyringEncryptionKey'];\n};\n\n/**\n * Load the keyring encryption key from state, decrypted under the current\n * encryption key.\n *\n * @returns The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];\n};\n\n/**\n * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using\n * the stored refresh token.\n *\n * Concurrent callers share a single in-flight HTTP request — if a refresh is\n * already in-progress the returned promise resolves when that request settles\n * rather than firing a duplicate request with the same token.\n *\n * @returns A promise that resolves when the tokens have been refreshed.\n */\nexport type SeedlessOnboardingControllerRefreshAuthTokensAction = {\n  type: `SeedlessOnboardingController:refreshAuthTokens`;\n  handler: SeedlessOnboardingController['refreshAuthTokens'];\n};\n\n/**\n * Rotate the refresh token — fetch a new refresh/revoke token pair from the\n * auth service and persist the new revoke token in the vault.\n *\n * This method should be called after a successful JWT refresh.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRotateRefreshTokenAction = {\n  type: `SeedlessOnboardingController:rotateRefreshToken`;\n  handler: SeedlessOnboardingController['rotateRefreshToken'];\n};\n\n/**\n * Revoke all pending refresh tokens.\n *\n * This method is to be called after user is authenticated.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRevokePendingRefreshTokensAction = {\n  type: `SeedlessOnboardingController:revokePendingRefreshTokens`;\n  handler: SeedlessOnboardingController['revokePendingRefreshTokens'];\n};\n\n/**\n * Get the access token from the state.\n *\n * If the tokens are expired, the method will refresh them and return the new access token.\n *\n * @returns The access token.\n */\nexport type SeedlessOnboardingControllerGetAccessTokenAction = {\n  type: `SeedlessOnboardingController:getAccessToken`;\n  handler: SeedlessOnboardingController['getAccessToken'];\n};\n\n/**\n * Check if the current node auth token is expired.\n *\n * @returns True if the current node auth token is expired, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkNodeAuthTokenExpired`;\n  handler: SeedlessOnboardingController['checkNodeAuthTokenExpired'];\n};\n\n/**\n * Check if the current metadata access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n *\n * @returns True if the metadata access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction =\n  {\n    type: `SeedlessOnboardingController:checkMetadataAccessTokenExpired`;\n    handler: SeedlessOnboardingController['checkMetadataAccessTokenExpired'];\n  };\n\n/**\n * Check if the current access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n * When the vault is locked, the access token is not accessible, so we return false.\n *\n * @returns True if the access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkAccessTokenExpired`;\n  handler: SeedlessOnboardingController['checkAccessTokenExpired'];\n};\n\n/**\n * Union of all SeedlessOnboardingController action types.\n */\nexport type SeedlessOnboardingControllerMethodActions =\n  | SeedlessOnboardingControllerFetchMetadataAccessCredsAction\n  | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction\n  | SeedlessOnboardingControllerAuthenticateAction\n  | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction\n  | SeedlessOnboardingControllerAddNewSecretDataAction\n  | SeedlessOnboardingControllerRunMigrationsAction\n  | SeedlessOnboardingControllerFetchAllSecretDataAction\n  | SeedlessOnboardingControllerChangePasswordAction\n  | SeedlessOnboardingControllerUpdateBackupMetadataStateAction\n  | SeedlessOnboardingControllerVerifyVaultPasswordAction\n  | SeedlessOnboardingControllerGetSecretDataBackupStateAction\n  | SeedlessOnboardingControllerSubmitPasswordAction\n  | SeedlessOnboardingControllerSetLockedAction\n  | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction\n  | SeedlessOnboardingControllerSubmitGlobalPasswordAction\n  | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction\n  | SeedlessOnboardingControllerGetIsUserAuthenticatedAction\n  | SeedlessOnboardingControllerClearStateAction\n  | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerRefreshAuthTokensAction\n  | SeedlessOnboardingControllerRotateRefreshTokenAction\n  | SeedlessOnboardingControllerRevokePendingRefreshTokensAction\n  | SeedlessOnboardingControllerGetAccessTokenAction\n  | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction\n  | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction\n  | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;\n"]}

package/dist/SeedlessOnboardingController-method-action-types.d.cts

@@ -167,6 +167,45 @@ export type SeedlessOnboardingControllerSetLockedAction = {
     type: `SeedlessOnboardingController:setLocked`;
     handler: SeedlessOnboardingController['setLocked'];
 };
+/**
+ * Sync the latest global password to the controller.
+ * reset vault with latest globalPassword,
+ * persist the latest global password authPubKey
+ *
+ * @param params - The parameters for syncing the latest global password.
+ * @param params.globalPassword - The latest global password.
+ * @returns A promise that resolves to the success of the operation.
+ */
+export type SeedlessOnboardingControllerSyncLatestGlobalPasswordAction = {
+    type: `SeedlessOnboardingController:syncLatestGlobalPassword`;
+    handler: SeedlessOnboardingController['syncLatestGlobalPassword'];
+};
+/**
+ * @description Unlock the controller with the latest global password.
+ *
+ * @param params - The parameters for unlocking the controller.
+ * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.
+ * @param params.globalPassword - The latest global password.
+ * @returns A promise that resolves to the success of the operation.
+ */
+export type SeedlessOnboardingControllerSubmitGlobalPasswordAction = {
+    type: `SeedlessOnboardingController:submitGlobalPassword`;
+    handler: SeedlessOnboardingController['submitGlobalPassword'];
+};
+/**
+ * @description Check if the current password is outdated compare to the global password.
+ *
+ * @param options - Optional options object.
+ * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.
+ * If not provided, the global auth public key will be fetched from the backend.
+ * @param options.skipCache - If true, bypass the cache and force a fresh check.
+ * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)
+ * @returns A promise that resolves to true if the password is outdated, false otherwise.
+ */
+export type SeedlessOnboardingControllerCheckIsPasswordOutdatedAction = {
+    type: `SeedlessOnboardingController:checkIsPasswordOutdated`;
+    handler: SeedlessOnboardingController['checkIsPasswordOutdated'];
+};
 /**
  * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.
  *
@@ -193,9 +232,6 @@ export type SeedlessOnboardingControllerClearStateAction = {
  * Store the keyring encryption key in state, encrypted under the current
  * encryption key.
  *
- * Remains lifecycle-neutral: the client calls this during recovery without
- * advancing the lifecycle phase.
- *
  * @param keyringEncryptionKey - The keyring encryption key.
  */
 export type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {
@@ -212,95 +248,6 @@ export type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {
     type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;
     handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];
 };
-/**
- * Clear the password-change lifecycle.
- *
- * Used after a definitive remote failure (server did not commit) or once
- * Keyring encryption-key synchronization is verified and all required local
- * writes have succeeded. The controller clears the phase so the next unlock
- * is normal.
- *
- * @returns A promise that resolves once the lifecycle has been cleared.
- */
-export type SeedlessOnboardingControllerClearPasswordChangePhaseAction = {
-    type: `SeedlessOnboardingController:clearPasswordChangePhase`;
-    handler: SeedlessOnboardingController['clearPasswordChangePhase'];
-};
-/**
- * Mark the password-change lifecycle as `KEY_SYNC_PENDING`.
- *
- * Called by the client coordinator before it synchronizes the current
- * Keyring encryption key to Seedless. The controller only records the
- * boundary; it does not perform or verify synchronization.
- *
- * @returns A promise that resolves once the phase has been persisted.
- */
-export type SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction = {
-    type: `SeedlessOnboardingController:markPasswordChangeKeySyncPending`;
-    handler: SeedlessOnboardingController['markPasswordChangeKeySyncPending'];
-};
-/**
- * Resolve the current password-sync state without consuming a password.
- *
- * Merges the legacy `checkIsPasswordOutdated` read with password-change
- * recovery routing, so the client makes a single call at unlock (both on
- * page render and on password submit) and routes UI from the returned status.
- *
- * Phase handling:
- * - No phase (`undefined`): run the authoritative outdated check. `skipCache`
- * is honored, so the client can read from cache on render and force a remote
- * call on submit. Returns `InSync` or `PasswordOutdated` (another device
- * changed the remote password).
- * - `SEEDLESS_CHANGE_PENDING`: the remote outcome is ambiguous, so `skipCache`
- * is ignored and a remote check is forced. Clears the phase (remote did not
- * commit) or advances to `SEEDLESS_COMMITTED` (remote committed). Returns
- * `InSync` or `EnterNewPassword`.
- * - Other phases: return the next recovery step without mutating state.
- *
- * This method does not consume a password; the client prompts for the
- * correct password and then calls `reconcilePassword`.
- *
- * @param options - The options.
- * @param options.skipCache - Whether to bypass the outdated cache. Ignored
- * for `SEEDLESS_CHANGE_PENDING`, which always forces a remote check.
- * @returns The sync/recovery resolution. On any failure the last known phase
- * is preserved and `PasswordChangeRecoveryStatus.Unknown` is returned.
- */
-export type SeedlessOnboardingControllerResolvePasswordSyncStateAction = {
-    type: `SeedlessOnboardingController:resolvePasswordSyncState`;
-    handler: SeedlessOnboardingController['resolvePasswordSyncState'];
-};
-/**
- * Reconcile the local Seedless password with the remote password.
- *
- * For `SEEDLESS_COMMITTED` or `LOCAL_KEYRING_PENDING` it re-runs the existing
- * password-sync flow (chain unlock + local vault rewrite)
- * with the new password and advances the phase to `LOCAL_KEYRING_PENDING`.
- * These operations are idempotent, so re-running them is safe whether or not
- * the local Seedless vault was already rewritten. The controller is left
- * unlocked.
- *
- * For no phase (`undefined`) it re-checks whether the remote password is
- * outdated. If it is, it runs the same password-sync flow, advances to
- * `LOCAL_KEYRING_PENDING`, and returns `ReconcileKeyring` so the client can
- * reconcile the local Keyring (e.g. after another device changed the remote
- * password). If the remote password is not outdated it is a no-op.
- *
- * The client remains responsible for the Keyring side (classifying the local
- * Keyring via `KeyringController:verifyPassword` and running the old-Keyring
- * or new-Keyring branch), because this controller does not depend on
- * `KeyringController`. See
- * [0003](./docs/0003-controller-owned-password-change-recovery-plan.md).
- *
- * @param params - The reconciliation parameters.
- * @param params.globalPassword - The current global password.
- * @returns The reconciliation result. On any failure the last known phase is
- * preserved and `PasswordChangeRecoveryStatus.Unknown` is returned.
- */
-export type SeedlessOnboardingControllerReconcilePasswordAction = {
-    type: `SeedlessOnboardingController:reconcilePassword`;
-    handler: SeedlessOnboardingController['reconcilePassword'];
-};
 /**
  * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using
  * the stored refresh token.
@@ -384,5 +331,5 @@ export type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {
 /**
  * Union of all SeedlessOnboardingController action types.
  */
-export type SeedlessOnboardingControllerMethodActions = SeedlessOnboardingControllerFetchMetadataAccessCredsAction | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction | SeedlessOnboardingControllerAuthenticateAction | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction | SeedlessOnboardingControllerAddNewSecretDataAction | SeedlessOnboardingControllerRunMigrationsAction | SeedlessOnboardingControllerFetchAllSecretDataAction | SeedlessOnboardingControllerChangePasswordAction | SeedlessOnboardingControllerUpdateBackupMetadataStateAction | SeedlessOnboardingControllerVerifyVaultPasswordAction | SeedlessOnboardingControllerGetSecretDataBackupStateAction | SeedlessOnboardingControllerSubmitPasswordAction | SeedlessOnboardingControllerSetLockedAction | SeedlessOnboardingControllerGetIsUserAuthenticatedAction | SeedlessOnboardingControllerClearStateAction | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction | SeedlessOnboardingControllerClearPasswordChangePhaseAction | SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction | SeedlessOnboardingControllerResolvePasswordSyncStateAction | SeedlessOnboardingControllerReconcilePasswordAction | SeedlessOnboardingControllerRefreshAuthTokensAction | SeedlessOnboardingControllerRotateRefreshTokenAction | SeedlessOnboardingControllerRevokePendingRefreshTokensAction | SeedlessOnboardingControllerGetAccessTokenAction | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;
+export type SeedlessOnboardingControllerMethodActions = SeedlessOnboardingControllerFetchMetadataAccessCredsAction | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction | SeedlessOnboardingControllerAuthenticateAction | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction | SeedlessOnboardingControllerAddNewSecretDataAction | SeedlessOnboardingControllerRunMigrationsAction | SeedlessOnboardingControllerFetchAllSecretDataAction | SeedlessOnboardingControllerChangePasswordAction | SeedlessOnboardingControllerUpdateBackupMetadataStateAction | SeedlessOnboardingControllerVerifyVaultPasswordAction | SeedlessOnboardingControllerGetSecretDataBackupStateAction | SeedlessOnboardingControllerSubmitPasswordAction | SeedlessOnboardingControllerSetLockedAction | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction | SeedlessOnboardingControllerSubmitGlobalPasswordAction | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction | SeedlessOnboardingControllerGetIsUserAuthenticatedAction | SeedlessOnboardingControllerClearStateAction | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction | SeedlessOnboardingControllerRefreshAuthTokensAction | SeedlessOnboardingControllerRotateRefreshTokenAction | SeedlessOnboardingControllerRevokePendingRefreshTokensAction | SeedlessOnboardingControllerGetAccessTokenAction | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;
 //# sourceMappingURL=SeedlessOnboardingController-method-action-types.d.cts.map

package/dist/SeedlessOnboardingController-method-action-types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController-method-action-types.d.cts","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,2CAA0C;AAEtF,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mEAAmE,GAC7E;IACE,IAAI,EAAE,gEAAgE,CAAC;IACvE,OAAO,EAAE,4BAA4B,CAAC,mCAAmC,CAAC,CAAC;CAC5E,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,4BAA4B,CAAC,kBAAkB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,4BAA4B,CAAC,eAAe,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kEAAkE,GAC5E;IACE,IAAI,EAAE,+DAA+D,CAAC;IACtE,OAAO,EAAE,4BAA4B,CAAC,kCAAkC,CAAC,CAAC;CAC3E,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iEAAiE,GAC3E;IACE,IAAI,EAAE,8DAA8D,CAAC;IACrE,OAAO,EAAE,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;CAC1E,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yCAAyC,GACjD,0DAA0D,GAC1D,yDAAyD,GACzD,8CAA8C,GAC9C,mEAAmE,GACnE,kDAAkD,GAClD,+CAA+C,GAC/C,oDAAoD,GACpD,gDAAgD,GAChD,2DAA2D,GAC3D,qDAAqD,GACrD,0DAA0D,GAC1D,gDAAgD,GAChD,2CAA2C,GAC3C,wDAAwD,GACxD,4CAA4C,GAC5C,2DAA2D,GAC3D,0DAA0D,GAC1D,0DAA0D,GAC1D,kEAAkE,GAClE,0DAA0D,GAC1D,mDAAmD,GACnD,mDAAmD,GACnD,oDAAoD,GACpD,4DAA4D,GAC5D,gDAAgD,GAChD,2DAA2D,GAC3D,iEAAiE,GACjE,yDAAyD,CAAC"}
+{"version":3,"file":"SeedlessOnboardingController-method-action-types.d.cts","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,2CAA0C;AAEtF,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mEAAmE,GAC7E;IACE,IAAI,EAAE,gEAAgE,CAAC;IACvE,OAAO,EAAE,4BAA4B,CAAC,mCAAmC,CAAC,CAAC;CAC5E,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,4BAA4B,CAAC,kBAAkB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,4BAA4B,CAAC,eAAe,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;CAC/D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iEAAiE,GAC3E;IACE,IAAI,EAAE,8DAA8D,CAAC;IACrE,OAAO,EAAE,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;CAC1E,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yCAAyC,GACjD,0DAA0D,GAC1D,yDAAyD,GACzD,8CAA8C,GAC9C,mEAAmE,GACnE,kDAAkD,GAClD,+CAA+C,GAC/C,oDAAoD,GACpD,gDAAgD,GAChD,2DAA2D,GAC3D,qDAAqD,GACrD,0DAA0D,GAC1D,gDAAgD,GAChD,2CAA2C,GAC3C,0DAA0D,GAC1D,sDAAsD,GACtD,yDAAyD,GACzD,wDAAwD,GACxD,4CAA4C,GAC5C,2DAA2D,GAC3D,0DAA0D,GAC1D,mDAAmD,GACnD,oDAAoD,GACpD,4DAA4D,GAC5D,gDAAgD,GAChD,2DAA2D,GAC3D,iEAAiE,GACjE,yDAAyD,CAAC"}

package/dist/SeedlessOnboardingController-method-action-types.d.mts

@@ -167,6 +167,45 @@ export type SeedlessOnboardingControllerSetLockedAction = {
     type: `SeedlessOnboardingController:setLocked`;
     handler: SeedlessOnboardingController['setLocked'];
 };
+/**
+ * Sync the latest global password to the controller.
+ * reset vault with latest globalPassword,
+ * persist the latest global password authPubKey
+ *
+ * @param params - The parameters for syncing the latest global password.
+ * @param params.globalPassword - The latest global password.
+ * @returns A promise that resolves to the success of the operation.
+ */
+export type SeedlessOnboardingControllerSyncLatestGlobalPasswordAction = {
+    type: `SeedlessOnboardingController:syncLatestGlobalPassword`;
+    handler: SeedlessOnboardingController['syncLatestGlobalPassword'];
+};
+/**
+ * @description Unlock the controller with the latest global password.
+ *
+ * @param params - The parameters for unlocking the controller.
+ * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.
+ * @param params.globalPassword - The latest global password.
+ * @returns A promise that resolves to the success of the operation.
+ */
+export type SeedlessOnboardingControllerSubmitGlobalPasswordAction = {
+    type: `SeedlessOnboardingController:submitGlobalPassword`;
+    handler: SeedlessOnboardingController['submitGlobalPassword'];
+};
+/**
+ * @description Check if the current password is outdated compare to the global password.
+ *
+ * @param options - Optional options object.
+ * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.
+ * If not provided, the global auth public key will be fetched from the backend.
+ * @param options.skipCache - If true, bypass the cache and force a fresh check.
+ * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)
+ * @returns A promise that resolves to true if the password is outdated, false otherwise.
+ */
+export type SeedlessOnboardingControllerCheckIsPasswordOutdatedAction = {
+    type: `SeedlessOnboardingController:checkIsPasswordOutdated`;
+    handler: SeedlessOnboardingController['checkIsPasswordOutdated'];
+};
 /**
  * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.
  *
@@ -193,9 +232,6 @@ export type SeedlessOnboardingControllerClearStateAction = {
  * Store the keyring encryption key in state, encrypted under the current
  * encryption key.
  *
- * Remains lifecycle-neutral: the client calls this during recovery without
- * advancing the lifecycle phase.
- *
  * @param keyringEncryptionKey - The keyring encryption key.
  */
 export type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {
@@ -212,95 +248,6 @@ export type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {
     type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;
     handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];
 };
-/**
- * Clear the password-change lifecycle.
- *
- * Used after a definitive remote failure (server did not commit) or once
- * Keyring encryption-key synchronization is verified and all required local
- * writes have succeeded. The controller clears the phase so the next unlock
- * is normal.
- *
- * @returns A promise that resolves once the lifecycle has been cleared.
- */
-export type SeedlessOnboardingControllerClearPasswordChangePhaseAction = {
-    type: `SeedlessOnboardingController:clearPasswordChangePhase`;
-    handler: SeedlessOnboardingController['clearPasswordChangePhase'];
-};
-/**
- * Mark the password-change lifecycle as `KEY_SYNC_PENDING`.
- *
- * Called by the client coordinator before it synchronizes the current
- * Keyring encryption key to Seedless. The controller only records the
- * boundary; it does not perform or verify synchronization.
- *
- * @returns A promise that resolves once the phase has been persisted.
- */
-export type SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction = {
-    type: `SeedlessOnboardingController:markPasswordChangeKeySyncPending`;
-    handler: SeedlessOnboardingController['markPasswordChangeKeySyncPending'];
-};
-/**
- * Resolve the current password-sync state without consuming a password.
- *
- * Merges the legacy `checkIsPasswordOutdated` read with password-change
- * recovery routing, so the client makes a single call at unlock (both on
- * page render and on password submit) and routes UI from the returned status.
- *
- * Phase handling:
- * - No phase (`undefined`): run the authoritative outdated check. `skipCache`
- * is honored, so the client can read from cache on render and force a remote
- * call on submit. Returns `InSync` or `PasswordOutdated` (another device
- * changed the remote password).
- * - `SEEDLESS_CHANGE_PENDING`: the remote outcome is ambiguous, so `skipCache`
- * is ignored and a remote check is forced. Clears the phase (remote did not
- * commit) or advances to `SEEDLESS_COMMITTED` (remote committed). Returns
- * `InSync` or `EnterNewPassword`.
- * - Other phases: return the next recovery step without mutating state.
- *
- * This method does not consume a password; the client prompts for the
- * correct password and then calls `reconcilePassword`.
- *
- * @param options - The options.
- * @param options.skipCache - Whether to bypass the outdated cache. Ignored
- * for `SEEDLESS_CHANGE_PENDING`, which always forces a remote check.
- * @returns The sync/recovery resolution. On any failure the last known phase
- * is preserved and `PasswordChangeRecoveryStatus.Unknown` is returned.
- */
-export type SeedlessOnboardingControllerResolvePasswordSyncStateAction = {
-    type: `SeedlessOnboardingController:resolvePasswordSyncState`;
-    handler: SeedlessOnboardingController['resolvePasswordSyncState'];
-};
-/**
- * Reconcile the local Seedless password with the remote password.
- *
- * For `SEEDLESS_COMMITTED` or `LOCAL_KEYRING_PENDING` it re-runs the existing
- * password-sync flow (chain unlock + local vault rewrite)
- * with the new password and advances the phase to `LOCAL_KEYRING_PENDING`.
- * These operations are idempotent, so re-running them is safe whether or not
- * the local Seedless vault was already rewritten. The controller is left
- * unlocked.
- *
- * For no phase (`undefined`) it re-checks whether the remote password is
- * outdated. If it is, it runs the same password-sync flow, advances to
- * `LOCAL_KEYRING_PENDING`, and returns `ReconcileKeyring` so the client can
- * reconcile the local Keyring (e.g. after another device changed the remote
- * password). If the remote password is not outdated it is a no-op.
- *
- * The client remains responsible for the Keyring side (classifying the local
- * Keyring via `KeyringController:verifyPassword` and running the old-Keyring
- * or new-Keyring branch), because this controller does not depend on
- * `KeyringController`. See
- * [0003](./docs/0003-controller-owned-password-change-recovery-plan.md).
- *
- * @param params - The reconciliation parameters.
- * @param params.globalPassword - The current global password.
- * @returns The reconciliation result. On any failure the last known phase is
- * preserved and `PasswordChangeRecoveryStatus.Unknown` is returned.
- */
-export type SeedlessOnboardingControllerReconcilePasswordAction = {
-    type: `SeedlessOnboardingController:reconcilePassword`;
-    handler: SeedlessOnboardingController['reconcilePassword'];
-};
 /**
  * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using
  * the stored refresh token.
@@ -384,5 +331,5 @@ export type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {
 /**
  * Union of all SeedlessOnboardingController action types.
  */
-export type SeedlessOnboardingControllerMethodActions = SeedlessOnboardingControllerFetchMetadataAccessCredsAction | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction | SeedlessOnboardingControllerAuthenticateAction | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction | SeedlessOnboardingControllerAddNewSecretDataAction | SeedlessOnboardingControllerRunMigrationsAction | SeedlessOnboardingControllerFetchAllSecretDataAction | SeedlessOnboardingControllerChangePasswordAction | SeedlessOnboardingControllerUpdateBackupMetadataStateAction | SeedlessOnboardingControllerVerifyVaultPasswordAction | SeedlessOnboardingControllerGetSecretDataBackupStateAction | SeedlessOnboardingControllerSubmitPasswordAction | SeedlessOnboardingControllerSetLockedAction | SeedlessOnboardingControllerGetIsUserAuthenticatedAction | SeedlessOnboardingControllerClearStateAction | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction | SeedlessOnboardingControllerClearPasswordChangePhaseAction | SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction | SeedlessOnboardingControllerResolvePasswordSyncStateAction | SeedlessOnboardingControllerReconcilePasswordAction | SeedlessOnboardingControllerRefreshAuthTokensAction | SeedlessOnboardingControllerRotateRefreshTokenAction | SeedlessOnboardingControllerRevokePendingRefreshTokensAction | SeedlessOnboardingControllerGetAccessTokenAction | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;
+export type SeedlessOnboardingControllerMethodActions = SeedlessOnboardingControllerFetchMetadataAccessCredsAction | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction | SeedlessOnboardingControllerAuthenticateAction | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction | SeedlessOnboardingControllerAddNewSecretDataAction | SeedlessOnboardingControllerRunMigrationsAction | SeedlessOnboardingControllerFetchAllSecretDataAction | SeedlessOnboardingControllerChangePasswordAction | SeedlessOnboardingControllerUpdateBackupMetadataStateAction | SeedlessOnboardingControllerVerifyVaultPasswordAction | SeedlessOnboardingControllerGetSecretDataBackupStateAction | SeedlessOnboardingControllerSubmitPasswordAction | SeedlessOnboardingControllerSetLockedAction | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction | SeedlessOnboardingControllerSubmitGlobalPasswordAction | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction | SeedlessOnboardingControllerGetIsUserAuthenticatedAction | SeedlessOnboardingControllerClearStateAction | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction | SeedlessOnboardingControllerRefreshAuthTokensAction | SeedlessOnboardingControllerRotateRefreshTokenAction | SeedlessOnboardingControllerRevokePendingRefreshTokensAction | SeedlessOnboardingControllerGetAccessTokenAction | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;
 //# sourceMappingURL=SeedlessOnboardingController-method-action-types.d.mts.map

package/dist/SeedlessOnboardingController-method-action-types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController-method-action-types.d.mts","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,2CAA0C;AAEtF,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mEAAmE,GAC7E;IACE,IAAI,EAAE,gEAAgE,CAAC;IACvE,OAAO,EAAE,4BAA4B,CAAC,mCAAmC,CAAC,CAAC;CAC5E,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,4BAA4B,CAAC,kBAAkB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,4BAA4B,CAAC,eAAe,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kEAAkE,GAC5E;IACE,IAAI,EAAE,+DAA+D,CAAC;IACtE,OAAO,EAAE,4BAA4B,CAAC,kCAAkC,CAAC,CAAC;CAC3E,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iEAAiE,GAC3E;IACE,IAAI,EAAE,8DAA8D,CAAC;IACrE,OAAO,EAAE,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;CAC1E,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yCAAyC,GACjD,0DAA0D,GAC1D,yDAAyD,GACzD,8CAA8C,GAC9C,mEAAmE,GACnE,kDAAkD,GAClD,+CAA+C,GAC/C,oDAAoD,GACpD,gDAAgD,GAChD,2DAA2D,GAC3D,qDAAqD,GACrD,0DAA0D,GAC1D,gDAAgD,GAChD,2CAA2C,GAC3C,wDAAwD,GACxD,4CAA4C,GAC5C,2DAA2D,GAC3D,0DAA0D,GAC1D,0DAA0D,GAC1D,kEAAkE,GAClE,0DAA0D,GAC1D,mDAAmD,GACnD,mDAAmD,GACnD,oDAAoD,GACpD,4DAA4D,GAC5D,gDAAgD,GAChD,2DAA2D,GAC3D,iEAAiE,GACjE,yDAAyD,CAAC"}
+{"version":3,"file":"SeedlessOnboardingController-method-action-types.d.mts","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,2CAA0C;AAEtF,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mEAAmE,GAC7E;IACE,IAAI,EAAE,gEAAgE,CAAC;IACvE,OAAO,EAAE,4BAA4B,CAAC,mCAAmC,CAAC,CAAC;CAC5E,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,4BAA4B,CAAC,kBAAkB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,4BAA4B,CAAC,eAAe,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;CAC/D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iEAAiE,GAC3E;IACE,IAAI,EAAE,8DAA8D,CAAC;IACrE,OAAO,EAAE,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;CAC1E,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yCAAyC,GACjD,0DAA0D,GAC1D,yDAAyD,GACzD,8CAA8C,GAC9C,mEAAmE,GACnE,kDAAkD,GAClD,+CAA+C,GAC/C,oDAAoD,GACpD,gDAAgD,GAChD,2DAA2D,GAC3D,qDAAqD,GACrD,0DAA0D,GAC1D,gDAAgD,GAChD,2CAA2C,GAC3C,0DAA0D,GAC1D,sDAAsD,GACtD,yDAAyD,GACzD,wDAAwD,GACxD,4CAA4C,GAC5C,2DAA2D,GAC3D,0DAA0D,GAC1D,mDAAmD,GACnD,oDAAoD,GACpD,4DAA4D,GAC5D,gDAAgD,GAChD,2DAA2D,GAC3D,iEAAiE,GACjE,yDAAyD,CAAC"}

package/dist/SeedlessOnboardingController-method-action-types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController-method-action-types.mjs","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { SeedlessOnboardingController } from './SeedlessOnboardingController.js';\n\nexport type SeedlessOnboardingControllerFetchMetadataAccessCredsAction = {\n  type: `SeedlessOnboardingController:fetchMetadataAccessCreds`;\n  handler: SeedlessOnboardingController['fetchMetadataAccessCreds'];\n};\n\n/**\n * Gets the node details for the TOPRF operations.\n * This function can be called to get the node endpoints, indexes and pubkeys and cache them locally.\n */\nexport type SeedlessOnboardingControllerPreloadToprfNodeDetailsAction = {\n  type: `SeedlessOnboardingController:preloadToprfNodeDetails`;\n  handler: SeedlessOnboardingController['preloadToprfNodeDetails'];\n};\n\n/**\n * Authenticate OAuth user using the seedless onboarding flow\n * and determine if the user is already registered or not.\n *\n * @param params - The parameters for authenticate OAuth user.\n * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.\n * @param params.authConnection - The social login provider.\n * @param params.authConnectionId - OAuth authConnectionId from dashboard\n * @param params.userId - user email or id from Social login\n * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.\n * @param params.socialLoginEmail - The user email from Social login.\n * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.\n * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.\n * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.\n * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.\n * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the authentication result.\n */\nexport type SeedlessOnboardingControllerAuthenticateAction = {\n  type: `SeedlessOnboardingController:authenticate`;\n  handler: SeedlessOnboardingController['authenticate'];\n};\n\n/**\n * Create a new TOPRF encryption key using given password and backups the provided seed phrase.\n *\n * @param password - The password used to create new wallet and seedphrase\n * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.\n * @param keyringId - The keyring id of the backup seed phrase\n * @returns A promise that resolves to the encrypted seed phrase and the encryption key.\n */\nexport type SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction =\n  {\n    type: `SeedlessOnboardingController:createToprfKeyAndBackupSeedPhrase`;\n    handler: SeedlessOnboardingController['createToprfKeyAndBackupSeedPhrase'];\n  };\n\n/**\n * Encrypt and add a new secret data to the metadata store.\n *\n * @param data - The data to add.\n * @param dataType - The data type classification for the secret data.\n * @param options - Optional options object, which includes optional data to be added to the metadata store.\n * @param options.keyringId - The keyring id of the backup keyring (SRP).\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerAddNewSecretDataAction = {\n  type: `SeedlessOnboardingController:addNewSecretData`;\n  handler: SeedlessOnboardingController['addNewSecretData'];\n};\n\n/**\n * Run any pending seedless onboarding migrations.\n *\n * This method should be called by clients after the controller is unlocked\n * to ensure legacy data is migrated to the latest format.\n *\n * Migrations are idempotent - running this multiple times is safe.\n * The migration version is tracked in state to prevent re-running migrations.\n *\n * @returns A promise that resolves to `true` if data was actually migrated\n * (items were updated on the server), `false` otherwise.\n * @throws If the password is outdated (changed on another device).\n */\nexport type SeedlessOnboardingControllerRunMigrationsAction = {\n  type: `SeedlessOnboardingController:runMigrations`;\n  handler: SeedlessOnboardingController['runMigrations'];\n};\n\n/**\n * Fetches all secret data items from the metadata store.\n *\n * Decrypts the secret data and returns the decrypted secret data using the recovered encryption key from the password.\n *\n * @param password - The optional password used to create new wallet. If not provided, `cached Encryption Key` will be used.\n * @returns A promise that resolves to the secret metadata items.\n */\nexport type SeedlessOnboardingControllerFetchAllSecretDataAction = {\n  type: `SeedlessOnboardingController:fetchAllSecretData`;\n  handler: SeedlessOnboardingController['fetchAllSecretData'];\n};\n\n/**\n * Update the password of the seedless onboarding flow.\n *\n * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.\n *\n * @param newPassword - The new password to update.\n * @param oldPassword - The old password to verify.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerChangePasswordAction = {\n  type: `SeedlessOnboardingController:changePassword`;\n  handler: SeedlessOnboardingController['changePassword'];\n};\n\n/**\n * Update the backup metadata state for the given secret data.\n *\n * @param secretData - The data to backup, can be a single backup or array of backups.\n * @param secretData.keyringId - The keyring id associated with the backup secret data.\n * @param secretData.data - The secret data to update the backup metadata state.\n */\nexport type SeedlessOnboardingControllerUpdateBackupMetadataStateAction = {\n  type: `SeedlessOnboardingController:updateBackupMetadataState`;\n  handler: SeedlessOnboardingController['updateBackupMetadataState'];\n};\n\n/**\n * Verify the password validity by decrypting the vault.\n *\n * @param password - The password to verify.\n * @param options - Optional options object.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the success of the operation.\n * @throws {Error} If the password is invalid or the vault is not initialized.\n */\nexport type SeedlessOnboardingControllerVerifyVaultPasswordAction = {\n  type: `SeedlessOnboardingController:verifyVaultPassword`;\n  handler: SeedlessOnboardingController['verifyVaultPassword'];\n};\n\n/**\n * Get backup state of the given secret data, from the controller state.\n *\n * If the given secret data is not backed up and not found in the state, it will return `undefined`.\n *\n * @param data - The data to get the backup state of.\n * @param type - The type of the secret data.\n * @returns The backup state of the given secret data.\n */\nexport type SeedlessOnboardingControllerGetSecretDataBackupStateAction = {\n  type: `SeedlessOnboardingController:getSecretDataBackupState`;\n  handler: SeedlessOnboardingController['getSecretDataBackupState'];\n};\n\n/**\n * Submit the password to the controller, verify the password validity and unlock the controller.\n *\n * This method will be used especially when user unlock the wallet.\n * The provided password will be verified against the encrypted vault, encryption key will be derived and saved in the controller state.\n *\n * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup\n *\n * @param password - The password to submit.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitPasswordAction = {\n  type: `SeedlessOnboardingController:submitPassword`;\n  handler: SeedlessOnboardingController['submitPassword'];\n};\n\n/**\n * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).\n *\n * When the controller is locked, the user will not be able to perform any operations on the controller/vault.\n *\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSetLockedAction = {\n  type: `SeedlessOnboardingController:setLocked`;\n  handler: SeedlessOnboardingController['setLocked'];\n};\n\n/**\n * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.\n *\n * This method will check the `accessToken` and `revokeToken` in the state, besides the social login authentication details.\n * If both are present, the user is authenticated.\n * If either is missing, the user is not authenticated.\n *\n * This method is useful when we want to check if the state has valid authenticated user details to perform vault creations.\n *\n * @returns True if the user is authenticated, false otherwise.\n */\nexport type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {\n  type: `SeedlessOnboardingController:getIsUserAuthenticated`;\n  handler: SeedlessOnboardingController['getIsUserAuthenticated'];\n};\n\n/**\n * Clears the current state of the SeedlessOnboardingController.\n */\nexport type SeedlessOnboardingControllerClearStateAction = {\n  type: `SeedlessOnboardingController:clearState`;\n  handler: SeedlessOnboardingController['clearState'];\n};\n\n/**\n * Store the keyring encryption key in state, encrypted under the current\n * encryption key.\n *\n * Remains lifecycle-neutral: the client calls this during recovery without\n * advancing the lifecycle phase.\n *\n * @param keyringEncryptionKey - The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:storeKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['storeKeyringEncryptionKey'];\n};\n\n/**\n * Load the keyring encryption key from state, decrypted under the current\n * encryption key.\n *\n * @returns The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];\n};\n\n/**\n * Clear the password-change lifecycle.\n *\n * Used after a definitive remote failure (server did not commit) or once\n * Keyring encryption-key synchronization is verified and all required local\n * writes have succeeded. The controller clears the phase so the next unlock\n * is normal.\n *\n * @returns A promise that resolves once the lifecycle has been cleared.\n */\nexport type SeedlessOnboardingControllerClearPasswordChangePhaseAction = {\n  type: `SeedlessOnboardingController:clearPasswordChangePhase`;\n  handler: SeedlessOnboardingController['clearPasswordChangePhase'];\n};\n\n/**\n * Mark the password-change lifecycle as `KEY_SYNC_PENDING`.\n *\n * Called by the client coordinator before it synchronizes the current\n * Keyring encryption key to Seedless. The controller only records the\n * boundary; it does not perform or verify synchronization.\n *\n * @returns A promise that resolves once the phase has been persisted.\n */\nexport type SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction =\n  {\n    type: `SeedlessOnboardingController:markPasswordChangeKeySyncPending`;\n    handler: SeedlessOnboardingController['markPasswordChangeKeySyncPending'];\n  };\n\n/**\n * Resolve the current password-sync state without consuming a password.\n *\n * Merges the legacy `checkIsPasswordOutdated` read with password-change\n * recovery routing, so the client makes a single call at unlock (both on\n * page render and on password submit) and routes UI from the returned status.\n *\n * Phase handling:\n * - No phase (`undefined`): run the authoritative outdated check. `skipCache`\n * is honored, so the client can read from cache on render and force a remote\n * call on submit. Returns `InSync` or `PasswordOutdated` (another device\n * changed the remote password).\n * - `SEEDLESS_CHANGE_PENDING`: the remote outcome is ambiguous, so `skipCache`\n * is ignored and a remote check is forced. Clears the phase (remote did not\n * commit) or advances to `SEEDLESS_COMMITTED` (remote committed). Returns\n * `InSync` or `EnterNewPassword`.\n * - Other phases: return the next recovery step without mutating state.\n *\n * This method does not consume a password; the client prompts for the\n * correct password and then calls `reconcilePassword`.\n *\n * @param options - The options.\n * @param options.skipCache - Whether to bypass the outdated cache. Ignored\n * for `SEEDLESS_CHANGE_PENDING`, which always forces a remote check.\n * @returns The sync/recovery resolution. On any failure the last known phase\n * is preserved and `PasswordChangeRecoveryStatus.Unknown` is returned.\n */\nexport type SeedlessOnboardingControllerResolvePasswordSyncStateAction = {\n  type: `SeedlessOnboardingController:resolvePasswordSyncState`;\n  handler: SeedlessOnboardingController['resolvePasswordSyncState'];\n};\n\n/**\n * Reconcile the local Seedless password with the remote password.\n *\n * For `SEEDLESS_COMMITTED` or `LOCAL_KEYRING_PENDING` it re-runs the existing\n * password-sync flow (chain unlock + local vault rewrite)\n * with the new password and advances the phase to `LOCAL_KEYRING_PENDING`.\n * These operations are idempotent, so re-running them is safe whether or not\n * the local Seedless vault was already rewritten. The controller is left\n * unlocked.\n *\n * For no phase (`undefined`) it re-checks whether the remote password is\n * outdated. If it is, it runs the same password-sync flow, advances to\n * `LOCAL_KEYRING_PENDING`, and returns `ReconcileKeyring` so the client can\n * reconcile the local Keyring (e.g. after another device changed the remote\n * password). If the remote password is not outdated it is a no-op.\n *\n * The client remains responsible for the Keyring side (classifying the local\n * Keyring via `KeyringController:verifyPassword` and running the old-Keyring\n * or new-Keyring branch), because this controller does not depend on\n * `KeyringController`. See\n * [0003](./docs/0003-controller-owned-password-change-recovery-plan.md).\n *\n * @param params - The reconciliation parameters.\n * @param params.globalPassword - The current global password.\n * @returns The reconciliation result. On any failure the last known phase is\n * preserved and `PasswordChangeRecoveryStatus.Unknown` is returned.\n */\nexport type SeedlessOnboardingControllerReconcilePasswordAction = {\n  type: `SeedlessOnboardingController:reconcilePassword`;\n  handler: SeedlessOnboardingController['reconcilePassword'];\n};\n\n/**\n * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using\n * the stored refresh token.\n *\n * Concurrent callers share a single in-flight HTTP request — if a refresh is\n * already in-progress the returned promise resolves when that request settles\n * rather than firing a duplicate request with the same token.\n *\n * @returns A promise that resolves when the tokens have been refreshed.\n */\nexport type SeedlessOnboardingControllerRefreshAuthTokensAction = {\n  type: `SeedlessOnboardingController:refreshAuthTokens`;\n  handler: SeedlessOnboardingController['refreshAuthTokens'];\n};\n\n/**\n * Rotate the refresh token — fetch a new refresh/revoke token pair from the\n * auth service and persist the new revoke token in the vault.\n *\n * This method should be called after a successful JWT refresh.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRotateRefreshTokenAction = {\n  type: `SeedlessOnboardingController:rotateRefreshToken`;\n  handler: SeedlessOnboardingController['rotateRefreshToken'];\n};\n\n/**\n * Revoke all pending refresh tokens.\n *\n * This method is to be called after user is authenticated.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRevokePendingRefreshTokensAction = {\n  type: `SeedlessOnboardingController:revokePendingRefreshTokens`;\n  handler: SeedlessOnboardingController['revokePendingRefreshTokens'];\n};\n\n/**\n * Get the access token from the state.\n *\n * If the tokens are expired, the method will refresh them and return the new access token.\n *\n * @returns The access token.\n */\nexport type SeedlessOnboardingControllerGetAccessTokenAction = {\n  type: `SeedlessOnboardingController:getAccessToken`;\n  handler: SeedlessOnboardingController['getAccessToken'];\n};\n\n/**\n * Check if the current node auth token is expired.\n *\n * @returns True if the current node auth token is expired, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkNodeAuthTokenExpired`;\n  handler: SeedlessOnboardingController['checkNodeAuthTokenExpired'];\n};\n\n/**\n * Check if the current metadata access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n *\n * @returns True if the metadata access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction =\n  {\n    type: `SeedlessOnboardingController:checkMetadataAccessTokenExpired`;\n    handler: SeedlessOnboardingController['checkMetadataAccessTokenExpired'];\n  };\n\n/**\n * Check if the current access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n * When the vault is locked, the access token is not accessible, so we return false.\n *\n * @returns True if the access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkAccessTokenExpired`;\n  handler: SeedlessOnboardingController['checkAccessTokenExpired'];\n};\n\n/**\n * Union of all SeedlessOnboardingController action types.\n */\nexport type SeedlessOnboardingControllerMethodActions =\n  | SeedlessOnboardingControllerFetchMetadataAccessCredsAction\n  | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction\n  | SeedlessOnboardingControllerAuthenticateAction\n  | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction\n  | SeedlessOnboardingControllerAddNewSecretDataAction\n  | SeedlessOnboardingControllerRunMigrationsAction\n  | SeedlessOnboardingControllerFetchAllSecretDataAction\n  | SeedlessOnboardingControllerChangePasswordAction\n  | SeedlessOnboardingControllerUpdateBackupMetadataStateAction\n  | SeedlessOnboardingControllerVerifyVaultPasswordAction\n  | SeedlessOnboardingControllerGetSecretDataBackupStateAction\n  | SeedlessOnboardingControllerSubmitPasswordAction\n  | SeedlessOnboardingControllerSetLockedAction\n  | SeedlessOnboardingControllerGetIsUserAuthenticatedAction\n  | SeedlessOnboardingControllerClearStateAction\n  | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerClearPasswordChangePhaseAction\n  | SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction\n  | SeedlessOnboardingControllerResolvePasswordSyncStateAction\n  | SeedlessOnboardingControllerReconcilePasswordAction\n  | SeedlessOnboardingControllerRefreshAuthTokensAction\n  | SeedlessOnboardingControllerRotateRefreshTokenAction\n  | SeedlessOnboardingControllerRevokePendingRefreshTokensAction\n  | SeedlessOnboardingControllerGetAccessTokenAction\n  | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction\n  | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction\n  | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;\n"]}
+{"version":3,"file":"SeedlessOnboardingController-method-action-types.mjs","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { SeedlessOnboardingController } from './SeedlessOnboardingController.js';\n\nexport type SeedlessOnboardingControllerFetchMetadataAccessCredsAction = {\n  type: `SeedlessOnboardingController:fetchMetadataAccessCreds`;\n  handler: SeedlessOnboardingController['fetchMetadataAccessCreds'];\n};\n\n/**\n * Gets the node details for the TOPRF operations.\n * This function can be called to get the node endpoints, indexes and pubkeys and cache them locally.\n */\nexport type SeedlessOnboardingControllerPreloadToprfNodeDetailsAction = {\n  type: `SeedlessOnboardingController:preloadToprfNodeDetails`;\n  handler: SeedlessOnboardingController['preloadToprfNodeDetails'];\n};\n\n/**\n * Authenticate OAuth user using the seedless onboarding flow\n * and determine if the user is already registered or not.\n *\n * @param params - The parameters for authenticate OAuth user.\n * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.\n * @param params.authConnection - The social login provider.\n * @param params.authConnectionId - OAuth authConnectionId from dashboard\n * @param params.userId - user email or id from Social login\n * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.\n * @param params.socialLoginEmail - The user email from Social login.\n * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.\n * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.\n * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.\n * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.\n * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the authentication result.\n */\nexport type SeedlessOnboardingControllerAuthenticateAction = {\n  type: `SeedlessOnboardingController:authenticate`;\n  handler: SeedlessOnboardingController['authenticate'];\n};\n\n/**\n * Create a new TOPRF encryption key using given password and backups the provided seed phrase.\n *\n * @param password - The password used to create new wallet and seedphrase\n * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.\n * @param keyringId - The keyring id of the backup seed phrase\n * @returns A promise that resolves to the encrypted seed phrase and the encryption key.\n */\nexport type SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction =\n  {\n    type: `SeedlessOnboardingController:createToprfKeyAndBackupSeedPhrase`;\n    handler: SeedlessOnboardingController['createToprfKeyAndBackupSeedPhrase'];\n  };\n\n/**\n * Encrypt and add a new secret data to the metadata store.\n *\n * @param data - The data to add.\n * @param dataType - The data type classification for the secret data.\n * @param options - Optional options object, which includes optional data to be added to the metadata store.\n * @param options.keyringId - The keyring id of the backup keyring (SRP).\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerAddNewSecretDataAction = {\n  type: `SeedlessOnboardingController:addNewSecretData`;\n  handler: SeedlessOnboardingController['addNewSecretData'];\n};\n\n/**\n * Run any pending seedless onboarding migrations.\n *\n * This method should be called by clients after the controller is unlocked\n * to ensure legacy data is migrated to the latest format.\n *\n * Migrations are idempotent - running this multiple times is safe.\n * The migration version is tracked in state to prevent re-running migrations.\n *\n * @returns A promise that resolves to `true` if data was actually migrated\n * (items were updated on the server), `false` otherwise.\n * @throws If the password is outdated (changed on another device).\n */\nexport type SeedlessOnboardingControllerRunMigrationsAction = {\n  type: `SeedlessOnboardingController:runMigrations`;\n  handler: SeedlessOnboardingController['runMigrations'];\n};\n\n/**\n * Fetches all secret data items from the metadata store.\n *\n * Decrypts the secret data and returns the decrypted secret data using the recovered encryption key from the password.\n *\n * @param password - The optional password used to create new wallet. If not provided, `cached Encryption Key` will be used.\n * @returns A promise that resolves to the secret metadata items.\n */\nexport type SeedlessOnboardingControllerFetchAllSecretDataAction = {\n  type: `SeedlessOnboardingController:fetchAllSecretData`;\n  handler: SeedlessOnboardingController['fetchAllSecretData'];\n};\n\n/**\n * Update the password of the seedless onboarding flow.\n *\n * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.\n *\n * @param newPassword - The new password to update.\n * @param oldPassword - The old password to verify.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerChangePasswordAction = {\n  type: `SeedlessOnboardingController:changePassword`;\n  handler: SeedlessOnboardingController['changePassword'];\n};\n\n/**\n * Update the backup metadata state for the given secret data.\n *\n * @param secretData - The data to backup, can be a single backup or array of backups.\n * @param secretData.keyringId - The keyring id associated with the backup secret data.\n * @param secretData.data - The secret data to update the backup metadata state.\n */\nexport type SeedlessOnboardingControllerUpdateBackupMetadataStateAction = {\n  type: `SeedlessOnboardingController:updateBackupMetadataState`;\n  handler: SeedlessOnboardingController['updateBackupMetadataState'];\n};\n\n/**\n * Verify the password validity by decrypting the vault.\n *\n * @param password - The password to verify.\n * @param options - Optional options object.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the success of the operation.\n * @throws {Error} If the password is invalid or the vault is not initialized.\n */\nexport type SeedlessOnboardingControllerVerifyVaultPasswordAction = {\n  type: `SeedlessOnboardingController:verifyVaultPassword`;\n  handler: SeedlessOnboardingController['verifyVaultPassword'];\n};\n\n/**\n * Get backup state of the given secret data, from the controller state.\n *\n * If the given secret data is not backed up and not found in the state, it will return `undefined`.\n *\n * @param data - The data to get the backup state of.\n * @param type - The type of the secret data.\n * @returns The backup state of the given secret data.\n */\nexport type SeedlessOnboardingControllerGetSecretDataBackupStateAction = {\n  type: `SeedlessOnboardingController:getSecretDataBackupState`;\n  handler: SeedlessOnboardingController['getSecretDataBackupState'];\n};\n\n/**\n * Submit the password to the controller, verify the password validity and unlock the controller.\n *\n * This method will be used especially when user unlock the wallet.\n * The provided password will be verified against the encrypted vault, encryption key will be derived and saved in the controller state.\n *\n * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup\n *\n * @param password - The password to submit.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitPasswordAction = {\n  type: `SeedlessOnboardingController:submitPassword`;\n  handler: SeedlessOnboardingController['submitPassword'];\n};\n\n/**\n * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).\n *\n * When the controller is locked, the user will not be able to perform any operations on the controller/vault.\n *\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSetLockedAction = {\n  type: `SeedlessOnboardingController:setLocked`;\n  handler: SeedlessOnboardingController['setLocked'];\n};\n\n/**\n * Sync the latest global password to the controller.\n * reset vault with latest globalPassword,\n * persist the latest global password authPubKey\n *\n * @param params - The parameters for syncing the latest global password.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSyncLatestGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:syncLatestGlobalPassword`;\n  handler: SeedlessOnboardingController['syncLatestGlobalPassword'];\n};\n\n/**\n * @description Unlock the controller with the latest global password.\n *\n * @param params - The parameters for unlocking the controller.\n * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:submitGlobalPassword`;\n  handler: SeedlessOnboardingController['submitGlobalPassword'];\n};\n\n/**\n * @description Check if the current password is outdated compare to the global password.\n *\n * @param options - Optional options object.\n * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.\n * If not provided, the global auth public key will be fetched from the backend.\n * @param options.skipCache - If true, bypass the cache and force a fresh check.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to true if the password is outdated, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckIsPasswordOutdatedAction = {\n  type: `SeedlessOnboardingController:checkIsPasswordOutdated`;\n  handler: SeedlessOnboardingController['checkIsPasswordOutdated'];\n};\n\n/**\n * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.\n *\n * This method will check the `accessToken` and `revokeToken` in the state, besides the social login authentication details.\n * If both are present, the user is authenticated.\n * If either is missing, the user is not authenticated.\n *\n * This method is useful when we want to check if the state has valid authenticated user details to perform vault creations.\n *\n * @returns True if the user is authenticated, false otherwise.\n */\nexport type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {\n  type: `SeedlessOnboardingController:getIsUserAuthenticated`;\n  handler: SeedlessOnboardingController['getIsUserAuthenticated'];\n};\n\n/**\n * Clears the current state of the SeedlessOnboardingController.\n */\nexport type SeedlessOnboardingControllerClearStateAction = {\n  type: `SeedlessOnboardingController:clearState`;\n  handler: SeedlessOnboardingController['clearState'];\n};\n\n/**\n * Store the keyring encryption key in state, encrypted under the current\n * encryption key.\n *\n * @param keyringEncryptionKey - The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:storeKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['storeKeyringEncryptionKey'];\n};\n\n/**\n * Load the keyring encryption key from state, decrypted under the current\n * encryption key.\n *\n * @returns The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];\n};\n\n/**\n * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using\n * the stored refresh token.\n *\n * Concurrent callers share a single in-flight HTTP request — if a refresh is\n * already in-progress the returned promise resolves when that request settles\n * rather than firing a duplicate request with the same token.\n *\n * @returns A promise that resolves when the tokens have been refreshed.\n */\nexport type SeedlessOnboardingControllerRefreshAuthTokensAction = {\n  type: `SeedlessOnboardingController:refreshAuthTokens`;\n  handler: SeedlessOnboardingController['refreshAuthTokens'];\n};\n\n/**\n * Rotate the refresh token — fetch a new refresh/revoke token pair from the\n * auth service and persist the new revoke token in the vault.\n *\n * This method should be called after a successful JWT refresh.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRotateRefreshTokenAction = {\n  type: `SeedlessOnboardingController:rotateRefreshToken`;\n  handler: SeedlessOnboardingController['rotateRefreshToken'];\n};\n\n/**\n * Revoke all pending refresh tokens.\n *\n * This method is to be called after user is authenticated.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRevokePendingRefreshTokensAction = {\n  type: `SeedlessOnboardingController:revokePendingRefreshTokens`;\n  handler: SeedlessOnboardingController['revokePendingRefreshTokens'];\n};\n\n/**\n * Get the access token from the state.\n *\n * If the tokens are expired, the method will refresh them and return the new access token.\n *\n * @returns The access token.\n */\nexport type SeedlessOnboardingControllerGetAccessTokenAction = {\n  type: `SeedlessOnboardingController:getAccessToken`;\n  handler: SeedlessOnboardingController['getAccessToken'];\n};\n\n/**\n * Check if the current node auth token is expired.\n *\n * @returns True if the current node auth token is expired, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkNodeAuthTokenExpired`;\n  handler: SeedlessOnboardingController['checkNodeAuthTokenExpired'];\n};\n\n/**\n * Check if the current metadata access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n *\n * @returns True if the metadata access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction =\n  {\n    type: `SeedlessOnboardingController:checkMetadataAccessTokenExpired`;\n    handler: SeedlessOnboardingController['checkMetadataAccessTokenExpired'];\n  };\n\n/**\n * Check if the current access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n * When the vault is locked, the access token is not accessible, so we return false.\n *\n * @returns True if the access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkAccessTokenExpired`;\n  handler: SeedlessOnboardingController['checkAccessTokenExpired'];\n};\n\n/**\n * Union of all SeedlessOnboardingController action types.\n */\nexport type SeedlessOnboardingControllerMethodActions =\n  | SeedlessOnboardingControllerFetchMetadataAccessCredsAction\n  | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction\n  | SeedlessOnboardingControllerAuthenticateAction\n  | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction\n  | SeedlessOnboardingControllerAddNewSecretDataAction\n  | SeedlessOnboardingControllerRunMigrationsAction\n  | SeedlessOnboardingControllerFetchAllSecretDataAction\n  | SeedlessOnboardingControllerChangePasswordAction\n  | SeedlessOnboardingControllerUpdateBackupMetadataStateAction\n  | SeedlessOnboardingControllerVerifyVaultPasswordAction\n  | SeedlessOnboardingControllerGetSecretDataBackupStateAction\n  | SeedlessOnboardingControllerSubmitPasswordAction\n  | SeedlessOnboardingControllerSetLockedAction\n  | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction\n  | SeedlessOnboardingControllerSubmitGlobalPasswordAction\n  | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction\n  | SeedlessOnboardingControllerGetIsUserAuthenticatedAction\n  | SeedlessOnboardingControllerClearStateAction\n  | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerRefreshAuthTokensAction\n  | SeedlessOnboardingControllerRotateRefreshTokenAction\n  | SeedlessOnboardingControllerRevokePendingRefreshTokensAction\n  | SeedlessOnboardingControllerGetAccessTokenAction\n  | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction\n  | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction\n  | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;\n"]}