@metamask-previews/seedless-onboarding-controller 12.0.0-preview-717f20d → 12.0.0-preview-64cf2e401

package/CHANGELOG.md

@@ -7,12 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add the `seedlessOperationLifecycle` state field to persist the generic non-sensitive lifecycle record defined by the Seedless Onboarding state-machine ADR ([#10148](https://github.com/MetaMask/core/pull/10148))
+  - `operation` identifies the Seedless Onboarding workflow, such as
+    `PASSWORD_CHANGE` or `PASSWORD_SYNC`.
+  - `phase` identifies the recoverable boundary within that workflow.
+- Add `PasswordSyncInstruction` enum, returned by `resolvePasswordSyncState` and `reconcilePassword` to tell clients which step to run next after either an interrupted local password change or a password change on another device ([#10148](https://github.com/MetaMask/core/pull/10148))
+  - `PasswordOutdated` covers remote password changes and committed password-change recovery for the regular recovery checkpoints.
+  - `KEY_SYNC_PENDING` with an outdated remote password returns `WalletResetRequired` because the local Keyring and Seedless encryption keys cannot be reconciled.
+  - Errors are thrown when the password state cannot be established; no unknown instruction is returned.
+- Add `resolvePasswordSyncState({ skipCache })` and `SeedlessOnboardingControllerResolvePasswordSyncStateAction` to resolve remote password state at unlock without consuming a password, replacing the removed `checkIsPasswordOutdated` read ([#10148](https://github.com/MetaMask/core/pull/10148))
+- Add `reconcilePassword` and `SeedlessOnboardingControllerReconcilePasswordAction` to bring local Seedless state up to date with the remote password after either an interrupted local password change or a password change made on another device. It accepts an optional `maxKeyChainLength` parameter ([#10148](https://github.com/MetaMask/core/pull/10148))
+  - For an outdated password with no checkpoint, `REMOTE_PASSWORD_PENDING`, or `LOCAL_STATE_PENDING`, it performs the password-chain unlock and local vault rewrite internally, re-encrypts `encryptedKeyringEncryptionKey` under the new wrapping key so `loadKeyringEncryptionKey` keeps working, and advances the lifecycle to `LOCAL_PASSWORD_PENDING` so the client reconciles the local Keyring before unlocking normally.
+  - For `LOCAL_PASSWORD_PENDING` or `KEY_SYNC_PENDING` with a current remote password, it unlocks the already-rewritten local vault with the supplied password so `loadKeyringEncryptionKey` and `storeKeyringEncryptionKey` work after a restart, without repeating remote TOPRF recovery. A newer `accessToken` from `refreshAuthTokens` is kept instead of being overwritten by the vault copy.
+  - For `KEY_SYNC_PENDING` with an outdated remote password, it returns `WalletResetRequired` instead of attempting password reconciliation.
+- Add `completePasswordChange` and `markPasswordChangeKeySyncPending` lifecycle-advance methods, along with `SeedlessOnboardingControllerCompletePasswordChangeAction` and `SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction`. `completePasswordChange` clears an active password-recovery lifecycle after key synchronization and local persistence are verified. Password-sync methods also clear stale lifecycle state when the password state is already in sync ([#10148](https://github.com/MetaMask/core/pull/10148))
+- Add `SeedlessOnboardingControllerErrorMessage.PasswordChangeInProgress`, thrown when a password change is started while another one is unresolved ([#10148](https://github.com/MetaMask/core/pull/10148))
+- Add `SeedlessOnboardingControllerErrorMessage.OperationInProgress` and
+  `InvalidPasswordSyncCheckpoint` for lifecycle conflicts and invalid recovery
+  checkpoints ([#10148](https://github.com/MetaMask/core/pull/10148))
+
 ### Changed
 
+- **BREAKING:** `changePassword` is now lifecycle-aware: it writes `seedlessOperationLifecycle` with the shared `REMOTE_PASSWORD_PENDING`, `LOCAL_STATE_PENDING`, and `LOCAL_PASSWORD_PENDING` phases and rejects a concurrent change with `PasswordChangeInProgress` ([#10148](https://github.com/MetaMask/core/pull/10148))
+  - Clients must not start a second password change while a lifecycle is unfinished, and must drive the lifecycle to completion by calling `completePasswordChange`. See the [password sync flow](./docs/0002-seedless-password-sync-flow.md).
+- **BREAKING:** `addNewSecretData` and `runMigrations` now reject while `seedlessOperationLifecycle` is set, including the `LOCAL_PASSWORD_PENDING` state left after a successful password change. They throw `PasswordChangeInProgress` for a pending password change and `OperationInProgress` for another password-recovery operation; clients must complete recovery first ([#10148](https://github.com/MetaMask/core/pull/10148))
+- `storeKeyringEncryptionKey` and `loadKeyringEncryptionKey` now acquire the controller lock, so they wait for any in-flight controller operation before reading or writing the Keyring encryption key ([#10148](https://github.com/MetaMask/core/pull/10148))
+- **BREAKING:** `clearState` now returns a promise and waits for in-flight controller operations before clearing state. It also clears the in-memory decrypted vault data to prevent a completed operation from restoring cleared state ([#10148](https://github.com/MetaMask/core/pull/10148))
 - Replace JS AES implementation with `@metamask/cryptography` ([#10659](https://github.com/MetaMask/core/pull/10659))
 - Bump `@metamask/keyring-controller` from `^28.1.0` to `^28.2.0` ([#10851](https://github.com/MetaMask/core/pull/10851))
 - Bump `@metamask/base-controller` from `^10.0.0` to `^10.1.0` ([#10864](https://github.com/MetaMask/core/pull/10864))
 
+### Removed
+
+- **BREAKING:** Remove the `checkIsPasswordOutdated` method and `SeedlessOnboardingControllerCheckIsPasswordOutdatedAction` ([#10148](https://github.com/MetaMask/core/pull/10148))
+  - Call `resolvePasswordSyncState({ skipCache })` instead. It performs the same remote check and additionally returns the required recovery step, so a boolean `true` result now corresponds to `PasswordSyncInstruction.PasswordOutdated` for regular checkpoints or `PasswordSyncInstruction.WalletResetRequired` for `KEY_SYNC_PENDING`.
+- **BREAKING:** Remove the `submitGlobalPassword` and `syncLatestGlobalPassword` methods, along with `SeedlessOnboardingControllerSubmitGlobalPasswordAction` and `SeedlessOnboardingControllerSyncLatestGlobalPasswordAction` ([#10148](https://github.com/MetaMask/core/pull/10148))
+  - Call `reconcilePassword({ globalPassword })` instead. When password synchronization is required, it runs both steps internally in the correct order, re-wraps the stored Keyring encryption key, and records the lifecycle phase, none of which happened when the two methods were called directly. For `KEY_SYNC_PENDING` with an outdated remote password, it returns `WalletResetRequired` instead.
+
 ## [12.0.0]
 
 ### Added

package/dist/SeedlessOnboardingController-method-action-types.d.ts

@@ -180,45 +180,6 @@ export type SeedlessOnboardingControllerSetLockedAction = {
     type: `SeedlessOnboardingController:setLocked`;
     handler: SeedlessOnboardingController['setLocked'];
 };
-/**
- * Sync the latest global password to the controller.
- * reset vault with latest globalPassword,
- * persist the latest global password authPubKey
- *
- * @param params - The parameters for syncing the latest global password.
- * @param params.globalPassword - The latest global password.
- * @returns A promise that resolves to the success of the operation.
- */
-export type SeedlessOnboardingControllerSyncLatestGlobalPasswordAction = {
-    type: `SeedlessOnboardingController:syncLatestGlobalPassword`;
-    handler: SeedlessOnboardingController['syncLatestGlobalPassword'];
-};
-/**
- * @description Unlock the controller with the latest global password.
- *
- * @param params - The parameters for unlocking the controller.
- * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.
- * @param params.globalPassword - The latest global password.
- * @returns A promise that resolves to the success of the operation.
- */
-export type SeedlessOnboardingControllerSubmitGlobalPasswordAction = {
-    type: `SeedlessOnboardingController:submitGlobalPassword`;
-    handler: SeedlessOnboardingController['submitGlobalPassword'];
-};
-/**
- * @description Check if the current password is outdated compare to the global password.
- *
- * @param options - Optional options object.
- * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.
- * If not provided, the global auth public key will be fetched from the backend.
- * @param options.skipCache - If true, bypass the cache and force a fresh check.
- * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)
- * @returns A promise that resolves to true if the password is outdated, false otherwise.
- */
-export type SeedlessOnboardingControllerCheckIsPasswordOutdatedAction = {
-    type: `SeedlessOnboardingController:checkIsPasswordOutdated`;
-    handler: SeedlessOnboardingController['checkIsPasswordOutdated'];
-};
 /**
  * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.
  *
@@ -236,6 +197,11 @@ export type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {
 };
 /**
  * Clears the current state of the SeedlessOnboardingController.
+ *
+ * Waits for any in-flight controller operation before clearing state and
+ * releases the in-memory decrypted vault data.
+ *
+ * @returns A promise that resolves once the state has been cleared.
  */
 export type SeedlessOnboardingControllerClearStateAction = {
     type: `SeedlessOnboardingController:clearState`;
@@ -245,6 +211,9 @@ export type SeedlessOnboardingControllerClearStateAction = {
  * Store the keyring encryption key in state, encrypted under the current
  * encryption key.
  *
+ * Remains lifecycle-neutral: the client calls this during recovery without
+ * advancing the lifecycle checkpoint.
+ *
  * @param keyringEncryptionKey - The keyring encryption key.
  */
 export type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {
@@ -261,6 +230,89 @@ export type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {
     type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;
     handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];
 };
+/**
+ * Complete password-change recovery.
+ *
+ * Call this after the current Keyring encryption key has been synchronized
+ * and all required local writes have succeeded. The controller clears the
+ * lifecycle so the next unlock is normal.
+ *
+ * @returns A promise that resolves once recovery has been completed.
+ */
+export type SeedlessOnboardingControllerCompletePasswordChangeAction = {
+    type: `SeedlessOnboardingController:completePasswordChange`;
+    handler: SeedlessOnboardingController['completePasswordChange'];
+};
+/**
+ * Mark the password-change lifecycle as `KEY_SYNC_PENDING`.
+ *
+ * Called by the client coordinator before it synchronizes the current
+ * Keyring encryption key to Seedless. The controller only records the
+ * boundary; it does not perform or verify synchronization.
+ *
+ * @returns A promise that resolves once the checkpoint has been persisted.
+ */
+export type SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction = {
+    type: `SeedlessOnboardingController:markPasswordChangeKeySyncPending`;
+    handler: SeedlessOnboardingController['markPasswordChangeKeySyncPending'];
+};
+/**
+ * Resolve the password-sync instruction without consuming a password.
+ *
+ * Checks the remote password before routing recovery for every valid
+ * password-sync checkpoint. The checkpoint then determines the next local
+ * recovery instruction when the passwords are in sync.
+ *
+ * @param options - The options.
+ * @param options.skipCache - Whether to bypass the outdated cache. Recovery
+ * checkpoints always bypass the cache.
+ * @returns The sync/recovery instruction.
+ * @throws If another operation is active or the password state cannot be
+ * established.
+ */
+export type SeedlessOnboardingControllerResolvePasswordSyncStateAction = {
+    type: `SeedlessOnboardingController:resolvePasswordSyncState`;
+    handler: SeedlessOnboardingController['resolvePasswordSyncState'];
+};
+/**
+ * Reconcile the local Seedless password with the remote password.
+ *
+ * For `LOCAL_STATE_PENDING` it re-runs the existing password-sync flow
+ * (chain unlock + local vault rewrite) with the new password and advances
+ * the checkpoint to `LOCAL_PASSWORD_PENDING`. These operations are
+ * idempotent, so re-running them is safe whether or not the local Seedless
+ * vault was already rewritten. The controller is left unlocked.
+ *
+ * For `LOCAL_PASSWORD_PENDING` or `KEY_SYNC_PENDING` the local Seedless vault
+ * is already rewritten. The method unlocks it with the supplied password so
+ * `loadKeyringEncryptionKey` and `storeKeyringEncryptionKey` work after a
+ * restart, without repeating remote TOPRF recovery or a vault rewrite. A
+ * newer `accessToken` from `refreshAuthTokens` is kept instead of being
+ * overwritten by the vault copy.
+ *
+ * It always re-checks whether the remote password is outdated, including when
+ * the local Seedless vault was already rewritten. If it is, it runs the same
+ * password-sync flow, advances to `LOCAL_PASSWORD_PENDING`, and returns
+ * `ReconcileKeyring` so the client can reconcile the local Keyring. If the
+ * remote password is current, the checkpoint determines whether the client
+ * must reconcile the Keyring, sync its key, or do nothing.
+ *
+ * The client remains responsible for the Keyring side (classifying the local
+ * Keyring via `KeyringController:verifyPassword` and running the old-Keyring
+ * or new-Keyring branch), because this controller does not depend on
+ * `KeyringController`. See
+ * [0003](./docs/0003-controller-owned-password-change-recovery-plan.md).
+ *
+ * @param params - The reconciliation parameters.
+ * @param params.globalPassword - The current global password.
+ * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys. @default 5
+ * @returns The reconciliation instruction.
+ * @throws If recovery cannot establish the current password state.
+ */
+export type SeedlessOnboardingControllerReconcilePasswordAction = {
+    type: `SeedlessOnboardingController:reconcilePassword`;
+    handler: SeedlessOnboardingController['reconcilePassword'];
+};
 /**
  * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using
  * the stored refresh token.
@@ -344,5 +396,5 @@ export type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {
 /**
  * Union of all SeedlessOnboardingController action types.
  */
-export type SeedlessOnboardingControllerMethodActions = SeedlessOnboardingControllerFetchMetadataAccessCredsAction | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction | SeedlessOnboardingControllerAuthenticateAction | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction | SeedlessOnboardingControllerAddNewSecretDataAction | SeedlessOnboardingControllerRunMigrationsAction | SeedlessOnboardingControllerFetchAllSecretDataAction | SeedlessOnboardingControllerChangePasswordAction | SeedlessOnboardingControllerUpdateBackupMetadataStateAction | SeedlessOnboardingControllerVerifyVaultPasswordAction | SeedlessOnboardingControllerGetSecretDataBackupStateAction | SeedlessOnboardingControllerSubmitPasswordAction | SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction | SeedlessOnboardingControllerSetLockedAction | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction | SeedlessOnboardingControllerSubmitGlobalPasswordAction | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction | SeedlessOnboardingControllerGetIsUserAuthenticatedAction | SeedlessOnboardingControllerClearStateAction | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction | SeedlessOnboardingControllerRefreshAuthTokensAction | SeedlessOnboardingControllerRotateRefreshTokenAction | SeedlessOnboardingControllerRevokePendingRefreshTokensAction | SeedlessOnboardingControllerGetAccessTokenAction | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;
+export type SeedlessOnboardingControllerMethodActions = SeedlessOnboardingControllerFetchMetadataAccessCredsAction | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction | SeedlessOnboardingControllerAuthenticateAction | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction | SeedlessOnboardingControllerAddNewSecretDataAction | SeedlessOnboardingControllerRunMigrationsAction | SeedlessOnboardingControllerFetchAllSecretDataAction | SeedlessOnboardingControllerChangePasswordAction | SeedlessOnboardingControllerUpdateBackupMetadataStateAction | SeedlessOnboardingControllerVerifyVaultPasswordAction | SeedlessOnboardingControllerGetSecretDataBackupStateAction | SeedlessOnboardingControllerSubmitPasswordAction | SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction | SeedlessOnboardingControllerSetLockedAction | SeedlessOnboardingControllerGetIsUserAuthenticatedAction | SeedlessOnboardingControllerClearStateAction | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction | SeedlessOnboardingControllerCompletePasswordChangeAction | SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction | SeedlessOnboardingControllerResolvePasswordSyncStateAction | SeedlessOnboardingControllerReconcilePasswordAction | SeedlessOnboardingControllerRefreshAuthTokensAction | SeedlessOnboardingControllerRotateRefreshTokenAction | SeedlessOnboardingControllerRevokePendingRefreshTokensAction | SeedlessOnboardingControllerGetAccessTokenAction | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;
 //# sourceMappingURL=SeedlessOnboardingController-method-action-types.d.ts.map

package/dist/SeedlessOnboardingController-method-action-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController-method-action-types.d.ts","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEtF,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mEAAmE,GAC7E;IACE,IAAI,EAAE,gEAAgE,CAAC;IACvE,OAAO,EAAE,4BAA4B,CAAC,mCAAmC,CAAC,CAAC;CAC5E,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,4BAA4B,CAAC,kBAAkB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,4BAA4B,CAAC,eAAe,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kEAAkE,GAC5E;IACE,IAAI,EAAE,+DAA+D,CAAC;IACtE,OAAO,EAAE,4BAA4B,CAAC,kCAAkC,CAAC,CAAC;CAC3E,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;CAC/D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iEAAiE,GAC3E;IACE,IAAI,EAAE,8DAA8D,CAAC;IACrE,OAAO,EAAE,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;CAC1E,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yCAAyC,GACjD,0DAA0D,GAC1D,yDAAyD,GACzD,8CAA8C,GAC9C,mEAAmE,GACnE,kDAAkD,GAClD,+CAA+C,GAC/C,oDAAoD,GACpD,gDAAgD,GAChD,2DAA2D,GAC3D,qDAAqD,GACrD,0DAA0D,GAC1D,gDAAgD,GAChD,kEAAkE,GAClE,2CAA2C,GAC3C,0DAA0D,GAC1D,sDAAsD,GACtD,yDAAyD,GACzD,wDAAwD,GACxD,4CAA4C,GAC5C,2DAA2D,GAC3D,0DAA0D,GAC1D,mDAAmD,GACnD,oDAAoD,GACpD,4DAA4D,GAC5D,gDAAgD,GAChD,2DAA2D,GAC3D,iEAAiE,GACjE,yDAAyD,CAAC"}
+{"version":3,"file":"SeedlessOnboardingController-method-action-types.d.ts","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEtF,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mEAAmE,GAC7E;IACE,IAAI,EAAE,gEAAgE,CAAC;IACvE,OAAO,EAAE,4BAA4B,CAAC,mCAAmC,CAAC,CAAC;CAC5E,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,4BAA4B,CAAC,kBAAkB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,4BAA4B,CAAC,eAAe,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kEAAkE,GAC5E;IACE,IAAI,EAAE,+DAA+D,CAAC;IACtE,OAAO,EAAE,4BAA4B,CAAC,kCAAkC,CAAC,CAAC;CAC3E,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kEAAkE,GAC5E;IACE,IAAI,EAAE,+DAA+D,CAAC;IACtE,OAAO,EAAE,4BAA4B,CAAC,kCAAkC,CAAC,CAAC;CAC3E,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iEAAiE,GAC3E;IACE,IAAI,EAAE,8DAA8D,CAAC;IACrE,OAAO,EAAE,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;CAC1E,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yCAAyC,GACjD,0DAA0D,GAC1D,yDAAyD,GACzD,8CAA8C,GAC9C,mEAAmE,GACnE,kDAAkD,GAClD,+CAA+C,GAC/C,oDAAoD,GACpD,gDAAgD,GAChD,2DAA2D,GAC3D,qDAAqD,GACrD,0DAA0D,GAC1D,gDAAgD,GAChD,kEAAkE,GAClE,2CAA2C,GAC3C,wDAAwD,GACxD,4CAA4C,GAC5C,2DAA2D,GAC3D,0DAA0D,GAC1D,wDAAwD,GACxD,kEAAkE,GAClE,0DAA0D,GAC1D,mDAAmD,GACnD,mDAAmD,GACnD,oDAAoD,GACpD,4DAA4D,GAC5D,gDAAgD,GAChD,2DAA2D,GAC3D,iEAAiE,GACjE,yDAAyD,CAAC"}

package/dist/SeedlessOnboardingController-method-action-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController-method-action-types.js","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { SeedlessOnboardingController } from './SeedlessOnboardingController.js';\n\nexport type SeedlessOnboardingControllerFetchMetadataAccessCredsAction = {\n  type: `SeedlessOnboardingController:fetchMetadataAccessCreds`;\n  handler: SeedlessOnboardingController['fetchMetadataAccessCreds'];\n};\n\n/**\n * Gets the node details for the TOPRF operations.\n * This function can be called to get the node endpoints, indexes and pubkeys and cache them locally.\n */\nexport type SeedlessOnboardingControllerPreloadToprfNodeDetailsAction = {\n  type: `SeedlessOnboardingController:preloadToprfNodeDetails`;\n  handler: SeedlessOnboardingController['preloadToprfNodeDetails'];\n};\n\n/**\n * Authenticate OAuth user using the seedless onboarding flow\n * and determine if the user is already registered or not.\n *\n * @param params - The parameters for authenticate OAuth user.\n * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.\n * @param params.authConnection - The social login provider.\n * @param params.authConnectionId - OAuth authConnectionId from dashboard\n * @param params.userId - user email or id from Social login\n * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.\n * @param params.socialLoginEmail - The user email from Social login.\n * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.\n * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.\n * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.\n * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.\n * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the authentication result.\n */\nexport type SeedlessOnboardingControllerAuthenticateAction = {\n  type: `SeedlessOnboardingController:authenticate`;\n  handler: SeedlessOnboardingController['authenticate'];\n};\n\n/**\n * Create a new TOPRF encryption key using given password and backups the provided seed phrase.\n *\n * @param password - The password used to create new wallet and seedphrase\n * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.\n * @param keyringId - The keyring id of the backup seed phrase\n * @returns A promise that resolves to the encrypted seed phrase and the encryption key.\n */\nexport type SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction =\n  {\n    type: `SeedlessOnboardingController:createToprfKeyAndBackupSeedPhrase`;\n    handler: SeedlessOnboardingController['createToprfKeyAndBackupSeedPhrase'];\n  };\n\n/**\n * Encrypt and add a new secret data to the metadata store.\n *\n * @param data - The data to add.\n * @param dataType - The data type classification for the secret data.\n * @param options - Optional options object, which includes optional data to be added to the metadata store.\n * @param options.keyringId - The keyring id of the backup keyring (SRP).\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerAddNewSecretDataAction = {\n  type: `SeedlessOnboardingController:addNewSecretData`;\n  handler: SeedlessOnboardingController['addNewSecretData'];\n};\n\n/**\n * Run any pending seedless onboarding migrations.\n *\n * This method should be called by clients after the controller is unlocked\n * to ensure legacy data is migrated to the latest format.\n *\n * Migrations are idempotent - running this multiple times is safe.\n * The migration version is tracked in state to prevent re-running migrations.\n *\n * @returns A promise that resolves to `true` if data was actually migrated\n * (items were updated on the server), `false` otherwise.\n * @throws If the password is outdated (changed on another device).\n */\nexport type SeedlessOnboardingControllerRunMigrationsAction = {\n  type: `SeedlessOnboardingController:runMigrations`;\n  handler: SeedlessOnboardingController['runMigrations'];\n};\n\n/**\n * Fetches all secret data items from the metadata store.\n *\n * Decrypts the secret data and returns the decrypted secret data using the recovered encryption key from the password.\n *\n * @param password - The optional password used to create new wallet. If not provided, `cached Encryption Key` will be used.\n * @returns A promise that resolves to the secret metadata items.\n */\nexport type SeedlessOnboardingControllerFetchAllSecretDataAction = {\n  type: `SeedlessOnboardingController:fetchAllSecretData`;\n  handler: SeedlessOnboardingController['fetchAllSecretData'];\n};\n\n/**\n * Update the password of the seedless onboarding flow.\n *\n * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.\n *\n * @param newPassword - The new password to update.\n * @param oldPassword - The old password to verify.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerChangePasswordAction = {\n  type: `SeedlessOnboardingController:changePassword`;\n  handler: SeedlessOnboardingController['changePassword'];\n};\n\n/**\n * Update the backup metadata state for the given secret data.\n *\n * @param secretData - The data to backup, can be a single backup or array of backups.\n * @param secretData.keyringId - The keyring id associated with the backup secret data.\n * @param secretData.data - The secret data to update the backup metadata state.\n */\nexport type SeedlessOnboardingControllerUpdateBackupMetadataStateAction = {\n  type: `SeedlessOnboardingController:updateBackupMetadataState`;\n  handler: SeedlessOnboardingController['updateBackupMetadataState'];\n};\n\n/**\n * Verify the password validity by decrypting the vault.\n *\n * @param password - The password to verify.\n * @param options - Optional options object.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the success of the operation.\n * @throws {Error} If the password is invalid or the vault is not initialized.\n */\nexport type SeedlessOnboardingControllerVerifyVaultPasswordAction = {\n  type: `SeedlessOnboardingController:verifyVaultPassword`;\n  handler: SeedlessOnboardingController['verifyVaultPassword'];\n};\n\n/**\n * Get backup state of the given secret data, from the controller state.\n *\n * If the given secret data is not backed up and not found in the state, it will return `undefined`.\n *\n * @param data - The data to get the backup state of.\n * @param type - The type of the secret data.\n * @returns The backup state of the given secret data.\n */\nexport type SeedlessOnboardingControllerGetSecretDataBackupStateAction = {\n  type: `SeedlessOnboardingController:getSecretDataBackupState`;\n  handler: SeedlessOnboardingController['getSecretDataBackupState'];\n};\n\n/**\n * Submit the password to the controller, verify the password validity and unlock the controller.\n *\n * This method will be used especially when user unlock the wallet.\n * The provided password will be verified against the encrypted vault, encryption key will be derived and saved in the controller state.\n *\n * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup\n *\n * @param password - The password to submit.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitPasswordAction = {\n  type: `SeedlessOnboardingController:submitPassword`;\n  handler: SeedlessOnboardingController['submitPassword'];\n};\n\n/**\n * Identify an incomplete or mismatched primary SRP backup.\n *\n * This method must only be called after the controller has been unlocked.\n *\n * @param password - The password used to export the local primary SRP.\n * @returns A promise that resolves after identification and telemetry have\n * completed.\n */\nexport type SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction =\n  {\n    type: `SeedlessOnboardingController:identifyIncompleteMetadataBackup`;\n    handler: SeedlessOnboardingController['identifyIncompleteMetadataBackup'];\n  };\n\n/**\n * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).\n *\n * When the controller is locked, the user will not be able to perform any operations on the controller/vault.\n *\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSetLockedAction = {\n  type: `SeedlessOnboardingController:setLocked`;\n  handler: SeedlessOnboardingController['setLocked'];\n};\n\n/**\n * Sync the latest global password to the controller.\n * reset vault with latest globalPassword,\n * persist the latest global password authPubKey\n *\n * @param params - The parameters for syncing the latest global password.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSyncLatestGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:syncLatestGlobalPassword`;\n  handler: SeedlessOnboardingController['syncLatestGlobalPassword'];\n};\n\n/**\n * @description Unlock the controller with the latest global password.\n *\n * @param params - The parameters for unlocking the controller.\n * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:submitGlobalPassword`;\n  handler: SeedlessOnboardingController['submitGlobalPassword'];\n};\n\n/**\n * @description Check if the current password is outdated compare to the global password.\n *\n * @param options - Optional options object.\n * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.\n * If not provided, the global auth public key will be fetched from the backend.\n * @param options.skipCache - If true, bypass the cache and force a fresh check.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to true if the password is outdated, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckIsPasswordOutdatedAction = {\n  type: `SeedlessOnboardingController:checkIsPasswordOutdated`;\n  handler: SeedlessOnboardingController['checkIsPasswordOutdated'];\n};\n\n/**\n * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.\n *\n * This method will check the `accessToken` and `revokeToken` in the state, besides the social login authentication details.\n * If both are present, the user is authenticated.\n * If either is missing, the user is not authenticated.\n *\n * This method is useful when we want to check if the state has valid authenticated user details to perform vault creations.\n *\n * @returns True if the user is authenticated, false otherwise.\n */\nexport type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {\n  type: `SeedlessOnboardingController:getIsUserAuthenticated`;\n  handler: SeedlessOnboardingController['getIsUserAuthenticated'];\n};\n\n/**\n * Clears the current state of the SeedlessOnboardingController.\n */\nexport type SeedlessOnboardingControllerClearStateAction = {\n  type: `SeedlessOnboardingController:clearState`;\n  handler: SeedlessOnboardingController['clearState'];\n};\n\n/**\n * Store the keyring encryption key in state, encrypted under the current\n * encryption key.\n *\n * @param keyringEncryptionKey - The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:storeKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['storeKeyringEncryptionKey'];\n};\n\n/**\n * Load the keyring encryption key from state, decrypted under the current\n * encryption key.\n *\n * @returns The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];\n};\n\n/**\n * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using\n * the stored refresh token.\n *\n * Concurrent callers share a single in-flight HTTP request — if a refresh is\n * already in-progress the returned promise resolves when that request settles\n * rather than firing a duplicate request with the same token.\n *\n * @returns A promise that resolves when the tokens have been refreshed.\n */\nexport type SeedlessOnboardingControllerRefreshAuthTokensAction = {\n  type: `SeedlessOnboardingController:refreshAuthTokens`;\n  handler: SeedlessOnboardingController['refreshAuthTokens'];\n};\n\n/**\n * Rotate the refresh token — fetch a new refresh/revoke token pair from the\n * auth service and persist the new revoke token in the vault.\n *\n * This method should be called after a successful JWT refresh.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRotateRefreshTokenAction = {\n  type: `SeedlessOnboardingController:rotateRefreshToken`;\n  handler: SeedlessOnboardingController['rotateRefreshToken'];\n};\n\n/**\n * Revoke all pending refresh tokens.\n *\n * This method is to be called after user is authenticated.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRevokePendingRefreshTokensAction = {\n  type: `SeedlessOnboardingController:revokePendingRefreshTokens`;\n  handler: SeedlessOnboardingController['revokePendingRefreshTokens'];\n};\n\n/**\n * Get the access token from the state.\n *\n * If the tokens are expired, the method will refresh them and return the new access token.\n *\n * @returns The access token.\n */\nexport type SeedlessOnboardingControllerGetAccessTokenAction = {\n  type: `SeedlessOnboardingController:getAccessToken`;\n  handler: SeedlessOnboardingController['getAccessToken'];\n};\n\n/**\n * Check if the current node auth token is expired.\n *\n * @returns True if the current node auth token is expired, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkNodeAuthTokenExpired`;\n  handler: SeedlessOnboardingController['checkNodeAuthTokenExpired'];\n};\n\n/**\n * Check if the current metadata access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n *\n * @returns True if the metadata access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction =\n  {\n    type: `SeedlessOnboardingController:checkMetadataAccessTokenExpired`;\n    handler: SeedlessOnboardingController['checkMetadataAccessTokenExpired'];\n  };\n\n/**\n * Check if the current access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n * When the vault is locked, the access token is not accessible, so we return false.\n *\n * @returns True if the access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkAccessTokenExpired`;\n  handler: SeedlessOnboardingController['checkAccessTokenExpired'];\n};\n\n/**\n * Union of all SeedlessOnboardingController action types.\n */\nexport type SeedlessOnboardingControllerMethodActions =\n  | SeedlessOnboardingControllerFetchMetadataAccessCredsAction\n  | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction\n  | SeedlessOnboardingControllerAuthenticateAction\n  | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction\n  | SeedlessOnboardingControllerAddNewSecretDataAction\n  | SeedlessOnboardingControllerRunMigrationsAction\n  | SeedlessOnboardingControllerFetchAllSecretDataAction\n  | SeedlessOnboardingControllerChangePasswordAction\n  | SeedlessOnboardingControllerUpdateBackupMetadataStateAction\n  | SeedlessOnboardingControllerVerifyVaultPasswordAction\n  | SeedlessOnboardingControllerGetSecretDataBackupStateAction\n  | SeedlessOnboardingControllerSubmitPasswordAction\n  | SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction\n  | SeedlessOnboardingControllerSetLockedAction\n  | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction\n  | SeedlessOnboardingControllerSubmitGlobalPasswordAction\n  | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction\n  | SeedlessOnboardingControllerGetIsUserAuthenticatedAction\n  | SeedlessOnboardingControllerClearStateAction\n  | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerRefreshAuthTokensAction\n  | SeedlessOnboardingControllerRotateRefreshTokenAction\n  | SeedlessOnboardingControllerRevokePendingRefreshTokensAction\n  | SeedlessOnboardingControllerGetAccessTokenAction\n  | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction\n  | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction\n  | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;\n"]}
+{"version":3,"file":"SeedlessOnboardingController-method-action-types.js","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { SeedlessOnboardingController } from './SeedlessOnboardingController.js';\n\nexport type SeedlessOnboardingControllerFetchMetadataAccessCredsAction = {\n  type: `SeedlessOnboardingController:fetchMetadataAccessCreds`;\n  handler: SeedlessOnboardingController['fetchMetadataAccessCreds'];\n};\n\n/**\n * Gets the node details for the TOPRF operations.\n * This function can be called to get the node endpoints, indexes and pubkeys and cache them locally.\n */\nexport type SeedlessOnboardingControllerPreloadToprfNodeDetailsAction = {\n  type: `SeedlessOnboardingController:preloadToprfNodeDetails`;\n  handler: SeedlessOnboardingController['preloadToprfNodeDetails'];\n};\n\n/**\n * Authenticate OAuth user using the seedless onboarding flow\n * and determine if the user is already registered or not.\n *\n * @param params - The parameters for authenticate OAuth user.\n * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.\n * @param params.authConnection - The social login provider.\n * @param params.authConnectionId - OAuth authConnectionId from dashboard\n * @param params.userId - user email or id from Social login\n * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.\n * @param params.socialLoginEmail - The user email from Social login.\n * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.\n * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.\n * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.\n * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.\n * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the authentication result.\n */\nexport type SeedlessOnboardingControllerAuthenticateAction = {\n  type: `SeedlessOnboardingController:authenticate`;\n  handler: SeedlessOnboardingController['authenticate'];\n};\n\n/**\n * Create a new TOPRF encryption key using given password and backups the provided seed phrase.\n *\n * @param password - The password used to create new wallet and seedphrase\n * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.\n * @param keyringId - The keyring id of the backup seed phrase\n * @returns A promise that resolves to the encrypted seed phrase and the encryption key.\n */\nexport type SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction =\n  {\n    type: `SeedlessOnboardingController:createToprfKeyAndBackupSeedPhrase`;\n    handler: SeedlessOnboardingController['createToprfKeyAndBackupSeedPhrase'];\n  };\n\n/**\n * Encrypt and add a new secret data to the metadata store.\n *\n * @param data - The data to add.\n * @param dataType - The data type classification for the secret data.\n * @param options - Optional options object, which includes optional data to be added to the metadata store.\n * @param options.keyringId - The keyring id of the backup keyring (SRP).\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerAddNewSecretDataAction = {\n  type: `SeedlessOnboardingController:addNewSecretData`;\n  handler: SeedlessOnboardingController['addNewSecretData'];\n};\n\n/**\n * Run any pending seedless onboarding migrations.\n *\n * This method should be called by clients after the controller is unlocked\n * to ensure legacy data is migrated to the latest format.\n *\n * Migrations are idempotent - running this multiple times is safe.\n * The migration version is tracked in state to prevent re-running migrations.\n *\n * @returns A promise that resolves to `true` if data was actually migrated\n * (items were updated on the server), `false` otherwise.\n * @throws If the password is outdated (changed on another device).\n */\nexport type SeedlessOnboardingControllerRunMigrationsAction = {\n  type: `SeedlessOnboardingController:runMigrations`;\n  handler: SeedlessOnboardingController['runMigrations'];\n};\n\n/**\n * Fetches all secret data items from the metadata store.\n *\n * Decrypts the secret data and returns the decrypted secret data using the recovered encryption key from the password.\n *\n * @param password - The optional password used to create new wallet. If not provided, `cached Encryption Key` will be used.\n * @returns A promise that resolves to the secret metadata items.\n */\nexport type SeedlessOnboardingControllerFetchAllSecretDataAction = {\n  type: `SeedlessOnboardingController:fetchAllSecretData`;\n  handler: SeedlessOnboardingController['fetchAllSecretData'];\n};\n\n/**\n * Update the password of the seedless onboarding flow.\n *\n * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.\n *\n * @param newPassword - The new password to update.\n * @param oldPassword - The old password to verify.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerChangePasswordAction = {\n  type: `SeedlessOnboardingController:changePassword`;\n  handler: SeedlessOnboardingController['changePassword'];\n};\n\n/**\n * Update the backup metadata state for the given secret data.\n *\n * @param secretData - The data to backup, can be a single backup or array of backups.\n * @param secretData.keyringId - The keyring id associated with the backup secret data.\n * @param secretData.data - The secret data to update the backup metadata state.\n */\nexport type SeedlessOnboardingControllerUpdateBackupMetadataStateAction = {\n  type: `SeedlessOnboardingController:updateBackupMetadataState`;\n  handler: SeedlessOnboardingController['updateBackupMetadataState'];\n};\n\n/**\n * Verify the password validity by decrypting the vault.\n *\n * @param password - The password to verify.\n * @param options - Optional options object.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the success of the operation.\n * @throws {Error} If the password is invalid or the vault is not initialized.\n */\nexport type SeedlessOnboardingControllerVerifyVaultPasswordAction = {\n  type: `SeedlessOnboardingController:verifyVaultPassword`;\n  handler: SeedlessOnboardingController['verifyVaultPassword'];\n};\n\n/**\n * Get backup state of the given secret data, from the controller state.\n *\n * If the given secret data is not backed up and not found in the state, it will return `undefined`.\n *\n * @param data - The data to get the backup state of.\n * @param type - The type of the secret data.\n * @returns The backup state of the given secret data.\n */\nexport type SeedlessOnboardingControllerGetSecretDataBackupStateAction = {\n  type: `SeedlessOnboardingController:getSecretDataBackupState`;\n  handler: SeedlessOnboardingController['getSecretDataBackupState'];\n};\n\n/**\n * Submit the password to the controller, verify the password validity and unlock the controller.\n *\n * This method will be used especially when user unlock the wallet.\n * The provided password will be verified against the encrypted vault, encryption key will be derived and saved in the controller state.\n *\n * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup\n *\n * @param password - The password to submit.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitPasswordAction = {\n  type: `SeedlessOnboardingController:submitPassword`;\n  handler: SeedlessOnboardingController['submitPassword'];\n};\n\n/**\n * Identify an incomplete or mismatched primary SRP backup.\n *\n * This method must only be called after the controller has been unlocked.\n *\n * @param password - The password used to export the local primary SRP.\n * @returns A promise that resolves after identification and telemetry have\n * completed.\n */\nexport type SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction =\n  {\n    type: `SeedlessOnboardingController:identifyIncompleteMetadataBackup`;\n    handler: SeedlessOnboardingController['identifyIncompleteMetadataBackup'];\n  };\n\n/**\n * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).\n *\n * When the controller is locked, the user will not be able to perform any operations on the controller/vault.\n *\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSetLockedAction = {\n  type: `SeedlessOnboardingController:setLocked`;\n  handler: SeedlessOnboardingController['setLocked'];\n};\n\n/**\n * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.\n *\n * This method will check the `accessToken` and `revokeToken` in the state, besides the social login authentication details.\n * If both are present, the user is authenticated.\n * If either is missing, the user is not authenticated.\n *\n * This method is useful when we want to check if the state has valid authenticated user details to perform vault creations.\n *\n * @returns True if the user is authenticated, false otherwise.\n */\nexport type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {\n  type: `SeedlessOnboardingController:getIsUserAuthenticated`;\n  handler: SeedlessOnboardingController['getIsUserAuthenticated'];\n};\n\n/**\n * Clears the current state of the SeedlessOnboardingController.\n *\n * Waits for any in-flight controller operation before clearing state and\n * releases the in-memory decrypted vault data.\n *\n * @returns A promise that resolves once the state has been cleared.\n */\nexport type SeedlessOnboardingControllerClearStateAction = {\n  type: `SeedlessOnboardingController:clearState`;\n  handler: SeedlessOnboardingController['clearState'];\n};\n\n/**\n * Store the keyring encryption key in state, encrypted under the current\n * encryption key.\n *\n * Remains lifecycle-neutral: the client calls this during recovery without\n * advancing the lifecycle checkpoint.\n *\n * @param keyringEncryptionKey - The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:storeKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['storeKeyringEncryptionKey'];\n};\n\n/**\n * Load the keyring encryption key from state, decrypted under the current\n * encryption key.\n *\n * @returns The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];\n};\n\n/**\n * Complete password-change recovery.\n *\n * Call this after the current Keyring encryption key has been synchronized\n * and all required local writes have succeeded. The controller clears the\n * lifecycle so the next unlock is normal.\n *\n * @returns A promise that resolves once recovery has been completed.\n */\nexport type SeedlessOnboardingControllerCompletePasswordChangeAction = {\n  type: `SeedlessOnboardingController:completePasswordChange`;\n  handler: SeedlessOnboardingController['completePasswordChange'];\n};\n\n/**\n * Mark the password-change lifecycle as `KEY_SYNC_PENDING`.\n *\n * Called by the client coordinator before it synchronizes the current\n * Keyring encryption key to Seedless. The controller only records the\n * boundary; it does not perform or verify synchronization.\n *\n * @returns A promise that resolves once the checkpoint has been persisted.\n */\nexport type SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction =\n  {\n    type: `SeedlessOnboardingController:markPasswordChangeKeySyncPending`;\n    handler: SeedlessOnboardingController['markPasswordChangeKeySyncPending'];\n  };\n\n/**\n * Resolve the password-sync instruction without consuming a password.\n *\n * Checks the remote password before routing recovery for every valid\n * password-sync checkpoint. The checkpoint then determines the next local\n * recovery instruction when the passwords are in sync.\n *\n * @param options - The options.\n * @param options.skipCache - Whether to bypass the outdated cache. Recovery\n * checkpoints always bypass the cache.\n * @returns The sync/recovery instruction.\n * @throws If another operation is active or the password state cannot be\n * established.\n */\nexport type SeedlessOnboardingControllerResolvePasswordSyncStateAction = {\n  type: `SeedlessOnboardingController:resolvePasswordSyncState`;\n  handler: SeedlessOnboardingController['resolvePasswordSyncState'];\n};\n\n/**\n * Reconcile the local Seedless password with the remote password.\n *\n * For `LOCAL_STATE_PENDING` it re-runs the existing password-sync flow\n * (chain unlock + local vault rewrite) with the new password and advances\n * the checkpoint to `LOCAL_PASSWORD_PENDING`. These operations are\n * idempotent, so re-running them is safe whether or not the local Seedless\n * vault was already rewritten. The controller is left unlocked.\n *\n * For `LOCAL_PASSWORD_PENDING` or `KEY_SYNC_PENDING` the local Seedless vault\n * is already rewritten. The method unlocks it with the supplied password so\n * `loadKeyringEncryptionKey` and `storeKeyringEncryptionKey` work after a\n * restart, without repeating remote TOPRF recovery or a vault rewrite. A\n * newer `accessToken` from `refreshAuthTokens` is kept instead of being\n * overwritten by the vault copy.\n *\n * It always re-checks whether the remote password is outdated, including when\n * the local Seedless vault was already rewritten. If it is, it runs the same\n * password-sync flow, advances to `LOCAL_PASSWORD_PENDING`, and returns\n * `ReconcileKeyring` so the client can reconcile the local Keyring. If the\n * remote password is current, the checkpoint determines whether the client\n * must reconcile the Keyring, sync its key, or do nothing.\n *\n * The client remains responsible for the Keyring side (classifying the local\n * Keyring via `KeyringController:verifyPassword` and running the old-Keyring\n * or new-Keyring branch), because this controller does not depend on\n * `KeyringController`. See\n * [0003](./docs/0003-controller-owned-password-change-recovery-plan.md).\n *\n * @param params - The reconciliation parameters.\n * @param params.globalPassword - The current global password.\n * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys. @default 5\n * @returns The reconciliation instruction.\n * @throws If recovery cannot establish the current password state.\n */\nexport type SeedlessOnboardingControllerReconcilePasswordAction = {\n  type: `SeedlessOnboardingController:reconcilePassword`;\n  handler: SeedlessOnboardingController['reconcilePassword'];\n};\n\n/**\n * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using\n * the stored refresh token.\n *\n * Concurrent callers share a single in-flight HTTP request — if a refresh is\n * already in-progress the returned promise resolves when that request settles\n * rather than firing a duplicate request with the same token.\n *\n * @returns A promise that resolves when the tokens have been refreshed.\n */\nexport type SeedlessOnboardingControllerRefreshAuthTokensAction = {\n  type: `SeedlessOnboardingController:refreshAuthTokens`;\n  handler: SeedlessOnboardingController['refreshAuthTokens'];\n};\n\n/**\n * Rotate the refresh token — fetch a new refresh/revoke token pair from the\n * auth service and persist the new revoke token in the vault.\n *\n * This method should be called after a successful JWT refresh.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRotateRefreshTokenAction = {\n  type: `SeedlessOnboardingController:rotateRefreshToken`;\n  handler: SeedlessOnboardingController['rotateRefreshToken'];\n};\n\n/**\n * Revoke all pending refresh tokens.\n *\n * This method is to be called after user is authenticated.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRevokePendingRefreshTokensAction = {\n  type: `SeedlessOnboardingController:revokePendingRefreshTokens`;\n  handler: SeedlessOnboardingController['revokePendingRefreshTokens'];\n};\n\n/**\n * Get the access token from the state.\n *\n * If the tokens are expired, the method will refresh them and return the new access token.\n *\n * @returns The access token.\n */\nexport type SeedlessOnboardingControllerGetAccessTokenAction = {\n  type: `SeedlessOnboardingController:getAccessToken`;\n  handler: SeedlessOnboardingController['getAccessToken'];\n};\n\n/**\n * Check if the current node auth token is expired.\n *\n * @returns True if the current node auth token is expired, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkNodeAuthTokenExpired`;\n  handler: SeedlessOnboardingController['checkNodeAuthTokenExpired'];\n};\n\n/**\n * Check if the current metadata access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n *\n * @returns True if the metadata access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction =\n  {\n    type: `SeedlessOnboardingController:checkMetadataAccessTokenExpired`;\n    handler: SeedlessOnboardingController['checkMetadataAccessTokenExpired'];\n  };\n\n/**\n * Check if the current access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n * When the vault is locked, the access token is not accessible, so we return false.\n *\n * @returns True if the access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkAccessTokenExpired`;\n  handler: SeedlessOnboardingController['checkAccessTokenExpired'];\n};\n\n/**\n * Union of all SeedlessOnboardingController action types.\n */\nexport type SeedlessOnboardingControllerMethodActions =\n  | SeedlessOnboardingControllerFetchMetadataAccessCredsAction\n  | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction\n  | SeedlessOnboardingControllerAuthenticateAction\n  | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction\n  | SeedlessOnboardingControllerAddNewSecretDataAction\n  | SeedlessOnboardingControllerRunMigrationsAction\n  | SeedlessOnboardingControllerFetchAllSecretDataAction\n  | SeedlessOnboardingControllerChangePasswordAction\n  | SeedlessOnboardingControllerUpdateBackupMetadataStateAction\n  | SeedlessOnboardingControllerVerifyVaultPasswordAction\n  | SeedlessOnboardingControllerGetSecretDataBackupStateAction\n  | SeedlessOnboardingControllerSubmitPasswordAction\n  | SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction\n  | SeedlessOnboardingControllerSetLockedAction\n  | SeedlessOnboardingControllerGetIsUserAuthenticatedAction\n  | SeedlessOnboardingControllerClearStateAction\n  | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerCompletePasswordChangeAction\n  | SeedlessOnboardingControllerMarkPasswordChangeKeySyncPendingAction\n  | SeedlessOnboardingControllerResolvePasswordSyncStateAction\n  | SeedlessOnboardingControllerReconcilePasswordAction\n  | SeedlessOnboardingControllerRefreshAuthTokensAction\n  | SeedlessOnboardingControllerRotateRefreshTokenAction\n  | SeedlessOnboardingControllerRevokePendingRefreshTokensAction\n  | SeedlessOnboardingControllerGetAccessTokenAction\n  | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction\n  | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction\n  | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;\n"]}

package/dist/SeedlessOnboardingController.d.ts

@@ -1,12 +1,12 @@
 import { BaseController } from '@metamask/base-controller';
 import type * as encryptionUtils from '@metamask/browser-passworder';
 import type { DefaultEncryptionResult, EncryptionResultConstraint } from '@metamask/keyring-controller';
-import type { AuthenticateResult, SEC1EncodedPublicKey } from '@metamask/toprf-secure-backup';
+import type { AuthenticateResult } from '@metamask/toprf-secure-backup';
 import { ToprfSecureBackup, EncAccountDataType } from '@metamask/toprf-secure-backup';
 import type { AuthConnection } from './constants.js';
-import { controllerName, SecretType, SeedlessOnboardingMigrationVersion } from './constants.js';
+import { controllerName, SecretType, SeedlessOnboardingMigrationVersion, PasswordSyncInstruction } from './constants.js';
 import { SecretMetadata } from './SecretMetadata.js';
-import type { SeedlessOnboardingControllerMessenger, SeedlessOnboardingControllerOptions } from './SeedlessOnboardingController-types.js';
+import { SeedlessOnboardingControllerMessenger, SeedlessOnboardingControllerOptions } from './SeedlessOnboardingController-types.js';
 import type { SeedlessOnboardingControllerState, SocialBackupsMetadata } from './types.js';
 export type { SeedlessOnboardingControllerActions, SeedlessOnboardingControllerEvents, SeedlessOnboardingControllerGetStateAction, SeedlessOnboardingControllerMessenger, SeedlessOnboardingControllerOptions, SeedlessOnboardingControllerStateChangeEvent, } from './SeedlessOnboardingController-types.js';
 export { getInitialSeedlessOnboardingControllerStateWithDefaults } from './state.js';
@@ -194,45 +194,6 @@ export declare class SeedlessOnboardingController<EncryptionKey = encryptionUtil
      * @returns A promise that resolves to the success of the operation.
      */
     setLocked(): Promise<void>;
-    /**
-     * Sync the latest global password to the controller.
-     * reset vault with latest globalPassword,
-     * persist the latest global password authPubKey
-     *
-     * @param params - The parameters for syncing the latest global password.
-     * @param params.globalPassword - The latest global password.
-     * @returns A promise that resolves to the success of the operation.
-     */
-    syncLatestGlobalPassword({ globalPassword, }: {
-        globalPassword: string;
-    }): Promise<void>;
-    /**
-     * @description Unlock the controller with the latest global password.
-     *
-     * @param params - The parameters for unlocking the controller.
-     * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.
-     * @param params.globalPassword - The latest global password.
-     * @returns A promise that resolves to the success of the operation.
-     */
-    submitGlobalPassword({ globalPassword, maxKeyChainLength, }: {
-        globalPassword: string;
-        maxKeyChainLength?: number;
-    }): Promise<void>;
-    /**
-     * @description Check if the current password is outdated compare to the global password.
-     *
-     * @param options - Optional options object.
-     * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.
-     * If not provided, the global auth public key will be fetched from the backend.
-     * @param options.skipCache - If true, bypass the cache and force a fresh check.
-     * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)
-     * @returns A promise that resolves to true if the password is outdated, false otherwise.
-     */
-    checkIsPasswordOutdated(options?: {
-        skipCache?: boolean;
-        skipLock?: boolean;
-        globalAuthPubKey?: SEC1EncodedPublicKey;
-    }): Promise<boolean>;
     /**
      * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.
      *
@@ -247,12 +208,20 @@ export declare class SeedlessOnboardingController<EncryptionKey = encryptionUtil
     getIsUserAuthenticated(): Promise<boolean>;
     /**
      * Clears the current state of the SeedlessOnboardingController.
+     *
+     * Waits for any in-flight controller operation before clearing state and
+     * releases the in-memory decrypted vault data.
+     *
+     * @returns A promise that resolves once the state has been cleared.
      */
-    clearState(): void;
+    clearState(): Promise<void>;
     /**
      * Store the keyring encryption key in state, encrypted under the current
      * encryption key.
      *
+     * Remains lifecycle-neutral: the client calls this during recovery without
+     * advancing the lifecycle checkpoint.
+     *
      * @param keyringEncryptionKey - The keyring encryption key.
      */
     storeKeyringEncryptionKey(keyringEncryptionKey: string): Promise<void>;
@@ -263,6 +232,82 @@ export declare class SeedlessOnboardingController<EncryptionKey = encryptionUtil
      * @returns The keyring encryption key.
      */
     loadKeyringEncryptionKey(): Promise<string>;
+    /**
+     * Complete password-change recovery.
+     *
+     * Call this after the current Keyring encryption key has been synchronized
+     * and all required local writes have succeeded. The controller clears the
+     * lifecycle so the next unlock is normal.
+     *
+     * @returns A promise that resolves once recovery has been completed.
+     */
+    completePasswordChange(): Promise<void>;
+    /**
+     * Mark the password-change lifecycle as `KEY_SYNC_PENDING`.
+     *
+     * Called by the client coordinator before it synchronizes the current
+     * Keyring encryption key to Seedless. The controller only records the
+     * boundary; it does not perform or verify synchronization.
+     *
+     * @returns A promise that resolves once the checkpoint has been persisted.
+     */
+    markPasswordChangeKeySyncPending(): Promise<void>;
+    /**
+     * Resolve the password-sync instruction without consuming a password.
+     *
+     * Checks the remote password before routing recovery for every valid
+     * password-sync checkpoint. The checkpoint then determines the next local
+     * recovery instruction when the passwords are in sync.
+     *
+     * @param options - The options.
+     * @param options.skipCache - Whether to bypass the outdated cache. Recovery
+     * checkpoints always bypass the cache.
+     * @returns The sync/recovery instruction.
+     * @throws If another operation is active or the password state cannot be
+     * established.
+     */
+    resolvePasswordSyncState(options?: {
+        skipCache?: boolean;
+    }): Promise<PasswordSyncInstruction>;
+    /**
+     * Reconcile the local Seedless password with the remote password.
+     *
+     * For `LOCAL_STATE_PENDING` it re-runs the existing password-sync flow
+     * (chain unlock + local vault rewrite) with the new password and advances
+     * the checkpoint to `LOCAL_PASSWORD_PENDING`. These operations are
+     * idempotent, so re-running them is safe whether or not the local Seedless
+     * vault was already rewritten. The controller is left unlocked.
+     *
+     * For `LOCAL_PASSWORD_PENDING` or `KEY_SYNC_PENDING` the local Seedless vault
+     * is already rewritten. The method unlocks it with the supplied password so
+     * `loadKeyringEncryptionKey` and `storeKeyringEncryptionKey` work after a
+     * restart, without repeating remote TOPRF recovery or a vault rewrite. A
+     * newer `accessToken` from `refreshAuthTokens` is kept instead of being
+     * overwritten by the vault copy.
+     *
+     * It always re-checks whether the remote password is outdated, including when
+     * the local Seedless vault was already rewritten. If it is, it runs the same
+     * password-sync flow, advances to `LOCAL_PASSWORD_PENDING`, and returns
+     * `ReconcileKeyring` so the client can reconcile the local Keyring. If the
+     * remote password is current, the checkpoint determines whether the client
+     * must reconcile the Keyring, sync its key, or do nothing.
+     *
+     * The client remains responsible for the Keyring side (classifying the local
+     * Keyring via `KeyringController:verifyPassword` and running the old-Keyring
+     * or new-Keyring branch), because this controller does not depend on
+     * `KeyringController`. See
+     * [0003](./docs/0003-controller-owned-password-change-recovery-plan.md).
+     *
+     * @param params - The reconciliation parameters.
+     * @param params.globalPassword - The current global password.
+     * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys. @default 5
+     * @returns The reconciliation instruction.
+     * @throws If recovery cannot establish the current password state.
+     */
+    reconcilePassword({ globalPassword, maxKeyChainLength, }: {
+        globalPassword: string;
+        maxKeyChainLength?: number;
+    }): Promise<PasswordSyncInstruction>;
     /**
      * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using
      * the stored refresh token.

package/dist/SeedlessOnboardingController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController.d.ts","sourceRoot":"","sources":["../src/SeedlessOnboardingController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,kBAAkB,EAIlB,oBAAoB,EAErB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAWvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EACL,cAAc,EAEd,UAAU,EAEV,kCAAkC,EAEnC,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,qCAAqC,EACrC,mCAAmC,EACpC,MAAM,yCAAyC,CAAC;AAKjD,OAAO,KAAK,EAEV,iCAAiC,EAEjC,qBAAqB,EAMtB,MAAM,YAAY,CAAC;AAuBpB,YAAY,EACV,mCAAmC,EACnC,kCAAkC,EAClC,0CAA0C,EAC1C,qCAAqC,EACrC,mCAAmC,EACnC,4CAA4C,GAC7C,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uDAAuD,EAAE,MAAM,YAAY,CAAC;AAmCrF,qBAAa,4BAA4B,CACvC,aAAa,GAAG,eAAe,CAAC,aAAa,EAC7C,6BAA6B,GAAG,eAAe,CAAC,oBAAoB,EACpE,gBAAgB,SACd,0BAA0B,CAAC,6BAA6B,CAAC,GACzD,uBAAuB,CAAC,6BAA6B,CAAC,CACxD,SAAQ,cAAc,CACtB,OAAO,cAAc,EACrB,iCAAiC,EACjC,qCAAqC,CACtC;;IAkBC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IA2BxC;;;;;;;;;;;;;OAaG;IACH,YAAY,EACV,SAAS,EACT,KAAK,EACL,SAAS,EACT,eAAe,EACf,OAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,wBAAyD,GAC1D,EAAE,mCAAmC,CACpC,aAAa,EACb,6BAA6B,EAC7B,gBAAgB,CACjB,EA0BA;IAEK,wBAAwB,IAAI,OAAO,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC,CAwBD;IAED;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM7C;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0D9B;IAED;;;;;;;OAOG;IACG,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CA4Df;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAgCf;IAED;;;;;;;;;;;;OAYG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CActC;IAED;;;;;;;OAOG;IACH,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,IAAI,CAErE;IA6ED;;;;;;;OAOG;IACG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA0CrE;IAED;;;;;;;;OAQG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Df;IAED;;;;;;OAMG;IACH,yBAAyB,CACvB,UAAU,EACN,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,GAC5D,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE,GACjE,IAAI,CAIN;IAED;;;;;;;;OAQG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAUf;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAgC,GACrC,qBAAqB,GAAG,SAAS,CAKnC;IAED;;;;;;;;;;OAUG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCpD;IAED;;;;;;;;OAQG;IACG,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;IAED;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAY/B;IAED;;;;;;;;OAQG;IACG,wBAAwB,CAAC,EAC7B,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB;IAED;;;;;;;OAOG;IACG,oBAAoB,CAAC,EACzB,cAAc,EACd,iBAAqB,GACtB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;IAoED;;;;;;;;;OASG;IACG,uBAAuB,CAAC,OAAO,CAAC,EAAE;QACtC,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;KACzC,GAAG,OAAO,CAAC,OAAO,CAAC,CAkEnB;IAED;;;;;;;;;;OAUG;IACG,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/C;IAuCD;;OAEG;IACH,UAAU,IAAI,IAAI,CAMjB;IAoDD;;;;;OAKG;IACG,yBAAyB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;IAED;;;;;OAKG;IACG,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAIhD;IA8xBD;;;;;;;;;OASG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBvC;IAqJD;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA2CxC;IAED;;;;;;OAMG;IACG,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAqChD;IAED;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQlD;IAgGD;;;;OAIG;IACI,yBAAyB,IAAI,OAAO,CAU1C;IAED;;;;;;OAMG;IACI,+BAA+B,IAAI,OAAO,CAUhD;IAED;;;;;;;OAOG;IACI,uBAAuB,IAAI,OAAO,CAYxC;CAqBF"}
+{"version":3,"file":"SeedlessOnboardingController.d.ts","sourceRoot":"","sources":["../src/SeedlessOnboardingController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,kBAAkB,EAMnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAYvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EACL,cAAc,EAGd,UAAU,EAEV,kCAAkC,EAGlC,uBAAuB,EAExB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,qCAAqC,EACrC,mCAAmC,EACpC,MAAM,yCAAyC,CAAC;AAKjD,OAAO,KAAK,EAEV,iCAAiC,EAEjC,qBAAqB,EAMtB,MAAM,YAAY,CAAC;AAwBpB,YAAY,EACV,mCAAmC,EACnC,kCAAkC,EAClC,0CAA0C,EAC1C,qCAAqC,EACrC,mCAAmC,EACnC,4CAA4C,GAC7C,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uDAAuD,EAAE,MAAM,YAAY,CAAC;AA4CrF,qBAAa,4BAA4B,CACvC,aAAa,GAAG,eAAe,CAAC,aAAa,EAC7C,6BAA6B,GAAG,eAAe,CAAC,oBAAoB,EACpE,gBAAgB,SACd,0BAA0B,CAAC,6BAA6B,CAAC,GACzD,uBAAuB,CAAC,6BAA6B,CAAC,CACxD,SAAQ,cAAc,CACtB,OAAO,cAAc,EACrB,iCAAiC,EACjC,qCAAqC,CACtC;;IAkBC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IA2BxC;;;;;;;;;;;;;OAaG;IACH,YAAY,EACV,SAAS,EACT,KAAK,EACL,SAAS,EACT,eAAe,EACf,OAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,wBAAyD,GAC1D,EAAE,mCAAmC,CACpC,aAAa,EACb,6BAA6B,EAC7B,gBAAgB,CACjB,EA0BA;IAEK,wBAAwB,IAAI,OAAO,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC,CAwBD;IAED;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM7C;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0D9B;IAED;;;;;;;OAOG;IACG,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CA4Df;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CA+Bf;IAED;;;;;;;;;;;;OAYG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAatC;IAED;;;;;;;OAOG;IACH,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,IAAI,CAErE;IA6ED;;;;;;;OAOG;IACG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA0CrE;IAED;;;;;;;;OAQG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAgEf;IAED;;;;;;OAMG;IACH,yBAAyB,CACvB,UAAU,EACN,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,GAC5D,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE,GACjE,IAAI,CAIN;IAED;;;;;;;;OAQG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAUf;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAgC,GACrC,qBAAqB,GAAG,SAAS,CAKnC;IAED;;;;;;;;;;OAUG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpD;IAED;;;;;;;;OAQG;IACG,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;IAED;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAY/B;IAmLD;;;;;;;;;;OAUG;IACG,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/C;IA8ED;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAUhC;IAoDD;;;;;;;;OAQG;IACG,yBAAyB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;IAoBD;;;;;OAKG;IACG,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAIhD;IAs2BD;;;;;;;;OAQG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAW5C;IAED;;;;;;;;OAQG;IACG,gCAAgC,IAAI,OAAO,CAAC,IAAI,CAAC,CAoBtD;IAED;;;;;;;;;;;;;OAaG;IACG,wBAAwB,CAAC,OAAO,CAAC,EAAE;QACvC,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA6BnC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,iBAAiB,CAAC,EACtB,cAAc,EACd,iBAAqB,GACtB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkDnC;IAkJD;;;;;;;;;OASG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBvC;IAqJD;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA2CxC;IAED;;;;;;OAMG;IACG,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAqChD;IAED;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQlD;IAgGD;;;;OAIG;IACI,yBAAyB,IAAI,OAAO,CAU1C;IAED;;;;;;OAMG;IACI,+BAA+B,IAAI,OAAO,CAUhD;IAED;;;;;;;OAOG;IACI,uBAAuB,IAAI,OAAO,CAYxC;CAqBF"}