@metamask-previews/seedless-onboarding-controller 12.0.0-preview-c3ccf7def → 12.0.0-preview-270326558

package/CHANGELOG.md

@@ -10,6 +10,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Add support for Node.js 26 ([#10981](https://github.com/MetaMask/core/pull/10981))
+- Add `authenticateForRecovery` and the `SeedlessOnboardingController:authenticateForRecovery` messenger action ([#11220](https://github.com/MetaMask/core/pull/11220))
+  - `authenticateForRecovery` takes `authConnectionId` and `groupedAuthConnectionId`, and uses the aal2 token as the id token and its `sub` as the user ID.
+- Add non-persisted `recoverySession` state and the `RecoverySession` type. The session holds recovery-node tokens, expiry, profile ID, verifier IDs, and whether the nodes hold a recovery share, and is cleared on lock and `clearState` ([#11220](https://github.com/MetaMask/core/pull/11220))
+- Add `migrateToEnvelope` and the `SeedlessOnboardingController:migrateToEnvelope` messenger action, which make the current vault keys the stable vault key set of the account ([#11220](https://github.com/MetaMask/core/pull/11220))
+  - Takes the 32-byte `recoverySecret` and no password. It requires an unlocked vault that is in sync with the global password, an aal2 session from `authenticateForRecovery`, and `migrationVersion` `V1` or later.
+  - Registers the Recovery Secret on the recovery verifier if the nodes hold no share for it yet.
+  - Writes the vault keys sealed for the Recovery Secret, plus a control record, as `KeyEnvelope` and `EnvelopeControl` data items in their own metadata partitions, under the vault's metadata lock. Secret data items and the vault are not changed.
+  - No envelope is written for the password, because the current password still derives the vault keys. The first `changePassword` after migration writes it.
+  - The sealed envelope is checkpointed before the first write, so a failed call can be retried with the same arguments. Does nothing if the vault is already envelope-managed, including when another device migrated it.
+- Add `recoverWithRecoverySecret` and the `SeedlessOnboardingController:recoverWithRecoverySecret` messenger action, which restore an envelope-managed vault with the Recovery Secret instead of the password ([#11220](https://github.com/MetaMask/core/pull/11220))
+  - Takes the 32-byte `recoverySecret` and the `password` of the new local vault, and requires the social login session and an aal2 session from `authenticateForRecovery`.
+  - Opens the vault keys sealed for the Recovery Secret, fetches the secret data with them, creates the local vault under `password`, and returns the secret data.
+  - Discards any pending `pendingEnvelopeMigration` checkpoint, since the local vault it belongs to is replaced.
+  - The local password counts as outdated until it is synced with `syncLatestGlobalPassword` or set as the global password with `resetPasswordWithVaultKeys`.
+- Add `resetPasswordWithVaultKeys` and the `SeedlessOnboardingController:resetPasswordWithVaultKeys` messenger action, which set a new global password on an unlocked, envelope-managed vault without the old password after `recoverWithRecoverySecret` ([#11220](https://github.com/MetaMask/core/pull/11220))
+  - Only allowed while `EnvelopeState.passwordAuthPubKey` is unset and with a valid aal2 session from `authenticateForRecovery`; otherwise it throws `PasswordResetRequiresRecovery` or `Aal2Required`. Once the local password is synced or reset, use `changePassword`.
+  - The password OPRF key swap is signed with the auth key stored in the vault's control record. The vault keys and secret data are not changed, and the local vault is re-encrypted under `newPassword`.
+- Add persisted `envelope` state and the `EnvelopeState` type, set once the vault is envelope-managed, and persisted, encrypted `pendingEnvelopeMigration` state for the migration checkpoint ([#11220](https://github.com/MetaMask/core/pull/11220))
+  - `EnvelopeState.passwordAuthPubKey` is unset after `recoverWithRecoverySecret`, until the local password is synced or reset.
+- Add `Aal2Required`, `RecoveryKeyShareConflict`, `InvalidEnvelope`, `EnvelopeControlRecordNotFound`, `EnvelopeMigrationRequiresDataTypes`, `RecoveryEnvelopeNotFound`, and `PasswordResetRequiresRecovery` error messages ([#11220](https://github.com/MetaMask/core/pull/11220))
 
 ### Changed
 
@@ -18,6 +38,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Bump `@metamask/base-controller` from `^10.0.0` to `^10.1.0` ([#10864](https://github.com/MetaMask/core/pull/10864))
 - Bump `@metamask/analytics-controller` from `^4.0.0` to `^4.3.0` ([#11072](https://github.com/MetaMask/core/pull/11072), [#11323](https://github.com/MetaMask/core/pull/11323), [#11391](https://github.com/MetaMask/core/pull/11391))
 - Bump `@metamask/utils` from `^12.0.0` to `^12.0.1` ([#11107](https://github.com/MetaMask/core/pull/11107))
+- `changePassword` on an envelope-managed vault keeps the vault keys: it seals them for the new password, appends a control record, and then swaps the password OPRF key, under the vault's metadata lock. Vaults that another device migrated are detected through their control record ([#11220](https://github.com/MetaMask/core/pull/11220))
+- `syncLatestGlobalPassword` and `submitGlobalPassword` open the envelope sealed for the global password first, and fall back to the existing key chain if there is none. A failed envelope fetch is reported as an error, not treated as a missing envelope ([#11220](https://github.com/MetaMask/core/pull/11220))
+  - When `syncLatestGlobalPassword` falls back, it keeps `envelope` state if the password's key set has a control record, and clears it otherwise.
+- `fetchAllSecretData` with a password opens the envelope sealed for that password first, and restores the vault with the sealed vault keys and sets `envelope` state if there is one ([#11220](https://github.com/MetaMask/core/pull/11220))
+  - If the password has no envelope but its key set has a control record, it restores with the password's keys and sets `envelope` state.
+- `checkIsPasswordOutdated` compares the global password key with `envelope.passwordAuthPubKey` on an envelope-managed vault, and reports the password as outdated while `envelope.passwordAuthPubKey` is unset ([#11220](https://github.com/MetaMask/core/pull/11220))
+- Bump `@metamask/auth-network-utils` from `^0.3.0` to `^0.4.0` ([#11220](https://github.com/MetaMask/core/pull/11220))
 
 ## [12.0.0]
 

package/dist/SeedlessOnboardingController-method-action-types.d.ts

@@ -95,6 +95,9 @@ export type SeedlessOnboardingControllerFetchAllSecretDataAction = {
  * Update the password of the seedless onboarding flow.
  *
  * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.
+ * If the vault is envelope-managed, only the password envelope and the
+ * password OPRF key change; the vault keys and the backend vault stay as
+ * they are.
  *
  * @param newPassword - The new password to update.
  * @param oldPassword - The old password to verify.
@@ -275,6 +278,107 @@ export type SeedlessOnboardingControllerRefreshAuthTokensAction = {
     type: `SeedlessOnboardingController:refreshAuthTokens`;
     handler: SeedlessOnboardingController['refreshAuthTokens'];
 };
+/**
+ * Authenticate on the recovery verifier with the aal2 token and store the
+ * issued node auth tokens, the token's `exp` and `sub` (profile ID), the
+ * verifier IDs, and whether a share already exists, as `recoverySession`.
+ * The aal1 `nodeAuthTokens`, `accessToken` and `metadataAccessToken` are
+ * left as they are.
+ *
+ * @param params - The function parameters.
+ * @param params.aal2Token - The aal2 token minted by the authentication API.
+ * Its `exp` caps the lifetime of the aal2 node auth tokens.
+ * @param params.authConnectionId - The recovery sub-verifier ID.
+ * @param params.groupedAuthConnectionId - The recovery aggregate verifier ID.
+ * @returns A promise that resolves once the aal2 set is stored.
+ * @throws `MissingAuthUserInfo` if either verifier ID is empty or not a string.
+ */
+export type SeedlessOnboardingControllerAuthenticateForRecoveryAction = {
+    type: `SeedlessOnboardingController:authenticateForRecovery`;
+    handler: SeedlessOnboardingController['authenticateForRecovery'];
+};
+/**
+ * Migrate the vault to envelope encryption, adopting its current key set
+ * as the vault key set `K_v`.
+ *
+ * Writes `rbek` (sealed for the Recovery Secret) and the control record
+ * into their own partitions. No secret data item is moved, and no password
+ * is needed: the current password still derives `K_v` directly, so the
+ * first `pbek` is written by the first password change. The sealed
+ * envelope is checkpointed before the first remote write, so a failed call
+ * can be retried with the same arguments. Does nothing if the vault is
+ * already envelope-managed.
+ *
+ * The vault must be unlocked and in sync with the global password. Register
+ * the Recovery Secret at the escrows first, then call
+ * {@link authenticateForRecovery}.
+ *
+ * @param params - The function parameters.
+ * @param params.recoverySecret - The 32-byte Recovery Secret held in escrow.
+ * @returns A promise that resolves once the vault is envelope-managed.
+ * @throws `OutdatedPassword` if the vault is not in sync with the global
+ * password.
+ */
+export type SeedlessOnboardingControllerMigrateToEnvelopeAction = {
+    type: `SeedlessOnboardingController:migrateToEnvelope`;
+    handler: SeedlessOnboardingController['migrateToEnvelope'];
+};
+/**
+ * Recover an envelope-managed vault with the Recovery Secret instead of the
+ * password: open `rbek` to get the vault key set `K_v`, fetch the secret
+ * data with it, and create the local vault under `password`.
+ *
+ * `password` only encrypts the local vault. Until the user syncs it with
+ * the global password ({@link syncLatestGlobalPassword}) or sets it as the
+ * global password ({@link resetPasswordWithVaultKeys}), the password counts
+ * as outdated.
+ *
+ * Any pending envelope migration checkpoint is discarded, since it belongs
+ * to the vault this call replaces.
+ *
+ * Authenticate with social login and call {@link authenticateForRecovery}
+ * first.
+ *
+ * @param params - The function parameters.
+ * @param params.recoverySecret - The 32-byte Recovery Secret from escrow.
+ * @param params.password - The password of the new local vault.
+ * @returns The secret data of the vault.
+ * @throws `RecoveryEnvelopeNotFound` if no vault keys are sealed for the
+ * Recovery Secret, `RecoveryKeyShareConflict` if the nodes hold the key of
+ * another Recovery Secret, or `Aal2Required` without a valid aal2 session.
+ */
+export type SeedlessOnboardingControllerRecoverWithRecoverySecretAction = {
+    type: `SeedlessOnboardingController:recoverWithRecoverySecret`;
+    handler: SeedlessOnboardingController['recoverWithRecoverySecret'];
+};
+/**
+ * Set a new global password on an envelope-managed vault without the old
+ * one, after {@link recoverWithRecoverySecret}.
+ *
+ * Only allowed while the local password is not yet synced with the global
+ * password, which is the state {@link recoverWithRecoverySecret} leaves the
+ * vault in, and with a valid aal2 session from
+ * {@link authenticateForRecovery}. Once the reset or a sync succeeds, use
+ * {@link changePassword} instead.
+ *
+ * The password OPRF key swap is signed with the auth key stored in the
+ * vault's control record, so the old password is not needed. The vault
+ * keys and the backend vault stay as they are, and the local vault is
+ * re-encrypted under the new password.
+ *
+ * @param params - The function parameters.
+ * @param params.newPassword - The new global password.
+ * @returns A promise that resolves once the new password is global.
+ * @throws `PasswordResetRequiresRecovery` if the vault is not
+ * envelope-managed or its local password is already synced,
+ * `Aal2Required` without a valid aal2 session, or
+ * `EnvelopeControlRecordNotFound` if no control record matches the live
+ * password OPRF key.
+ */
+export type SeedlessOnboardingControllerResetPasswordWithVaultKeysAction = {
+    type: `SeedlessOnboardingController:resetPasswordWithVaultKeys`;
+    handler: SeedlessOnboardingController['resetPasswordWithVaultKeys'];
+};
 /**
  * Rotate the refresh token — fetch a new refresh/revoke token pair from the
  * auth service and persist the new revoke token in the vault.
@@ -344,5 +448,5 @@ export type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {
 /**
  * Union of all SeedlessOnboardingController action types.
  */
-export type SeedlessOnboardingControllerMethodActions = SeedlessOnboardingControllerFetchMetadataAccessCredsAction | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction | SeedlessOnboardingControllerAuthenticateAction | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction | SeedlessOnboardingControllerAddNewSecretDataAction | SeedlessOnboardingControllerRunMigrationsAction | SeedlessOnboardingControllerFetchAllSecretDataAction | SeedlessOnboardingControllerChangePasswordAction | SeedlessOnboardingControllerUpdateBackupMetadataStateAction | SeedlessOnboardingControllerVerifyVaultPasswordAction | SeedlessOnboardingControllerGetSecretDataBackupStateAction | SeedlessOnboardingControllerSubmitPasswordAction | SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction | SeedlessOnboardingControllerSetLockedAction | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction | SeedlessOnboardingControllerSubmitGlobalPasswordAction | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction | SeedlessOnboardingControllerGetIsUserAuthenticatedAction | SeedlessOnboardingControllerClearStateAction | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction | SeedlessOnboardingControllerRefreshAuthTokensAction | SeedlessOnboardingControllerRotateRefreshTokenAction | SeedlessOnboardingControllerRevokePendingRefreshTokensAction | SeedlessOnboardingControllerGetAccessTokenAction | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;
+export type SeedlessOnboardingControllerMethodActions = SeedlessOnboardingControllerFetchMetadataAccessCredsAction | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction | SeedlessOnboardingControllerAuthenticateAction | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction | SeedlessOnboardingControllerAddNewSecretDataAction | SeedlessOnboardingControllerRunMigrationsAction | SeedlessOnboardingControllerFetchAllSecretDataAction | SeedlessOnboardingControllerChangePasswordAction | SeedlessOnboardingControllerUpdateBackupMetadataStateAction | SeedlessOnboardingControllerVerifyVaultPasswordAction | SeedlessOnboardingControllerGetSecretDataBackupStateAction | SeedlessOnboardingControllerSubmitPasswordAction | SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction | SeedlessOnboardingControllerSetLockedAction | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction | SeedlessOnboardingControllerSubmitGlobalPasswordAction | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction | SeedlessOnboardingControllerGetIsUserAuthenticatedAction | SeedlessOnboardingControllerClearStateAction | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction | SeedlessOnboardingControllerRefreshAuthTokensAction | SeedlessOnboardingControllerAuthenticateForRecoveryAction | SeedlessOnboardingControllerMigrateToEnvelopeAction | SeedlessOnboardingControllerRecoverWithRecoverySecretAction | SeedlessOnboardingControllerResetPasswordWithVaultKeysAction | SeedlessOnboardingControllerRotateRefreshTokenAction | SeedlessOnboardingControllerRevokePendingRefreshTokensAction | SeedlessOnboardingControllerGetAccessTokenAction | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;
 //# sourceMappingURL=SeedlessOnboardingController-method-action-types.d.ts.map

package/dist/SeedlessOnboardingController-method-action-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController-method-action-types.d.ts","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEtF,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mEAAmE,GAC7E;IACE,IAAI,EAAE,gEAAgE,CAAC;IACvE,OAAO,EAAE,4BAA4B,CAAC,mCAAmC,CAAC,CAAC;CAC5E,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,4BAA4B,CAAC,kBAAkB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,4BAA4B,CAAC,eAAe,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kEAAkE,GAC5E;IACE,IAAI,EAAE,+DAA+D,CAAC;IACtE,OAAO,EAAE,4BAA4B,CAAC,kCAAkC,CAAC,CAAC;CAC3E,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;CAC/D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iEAAiE,GAC3E;IACE,IAAI,EAAE,8DAA8D,CAAC;IACrE,OAAO,EAAE,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;CAC1E,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yCAAyC,GACjD,0DAA0D,GAC1D,yDAAyD,GACzD,8CAA8C,GAC9C,mEAAmE,GACnE,kDAAkD,GAClD,+CAA+C,GAC/C,oDAAoD,GACpD,gDAAgD,GAChD,2DAA2D,GAC3D,qDAAqD,GACrD,0DAA0D,GAC1D,gDAAgD,GAChD,kEAAkE,GAClE,2CAA2C,GAC3C,0DAA0D,GAC1D,sDAAsD,GACtD,yDAAyD,GACzD,wDAAwD,GACxD,4CAA4C,GAC5C,2DAA2D,GAC3D,0DAA0D,GAC1D,mDAAmD,GACnD,oDAAoD,GACpD,4DAA4D,GAC5D,gDAAgD,GAChD,2DAA2D,GAC3D,iEAAiE,GACjE,yDAAyD,CAAC"}
+{"version":3,"file":"SeedlessOnboardingController-method-action-types.d.ts","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEtF,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,8CAA8C,GAAG;IAC3D,IAAI,EAAE,2CAA2C,CAAC;IAClD,OAAO,EAAE,4BAA4B,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mEAAmE,GAC7E;IACE,IAAI,EAAE,gEAAgE,CAAC;IACvE,OAAO,EAAE,4BAA4B,CAAC,mCAAmC,CAAC,CAAC;CAC5E,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,4BAA4B,CAAC,kBAAkB,CAAC,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,4BAA4B,CAAC,eAAe,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,4BAA4B,CAAC,qBAAqB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kEAAkE,GAC5E;IACE,IAAI,EAAE,+DAA+D,CAAC;IACtE,OAAO,EAAE,4BAA4B,CAAC,kCAAkC,CAAC,CAAC;CAC3E,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,4BAA4B,CAAC,WAAW,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,4BAA4B,CAAC,sBAAsB,CAAC,CAAC;CAC/D,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,wBAAwB,CAAC,CAAC;CACjE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,4BAA4B,CAAC,YAAY,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,oDAAoD,GAAG;IACjE,IAAI,EAAE,iDAAiD,CAAC;IACxD,OAAO,EAAE,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;CAC7D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,4BAA4B,CAAC,4BAA4B,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,4BAA4B,CAAC,gBAAgB,CAAC,CAAC;CACzD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,2DAA2D,GAAG;IACxE,IAAI,EAAE,wDAAwD,CAAC;IAC/D,OAAO,EAAE,4BAA4B,CAAC,2BAA2B,CAAC,CAAC;CACpE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iEAAiE,GAC3E;IACE,IAAI,EAAE,8DAA8D,CAAC;IACrE,OAAO,EAAE,4BAA4B,CAAC,iCAAiC,CAAC,CAAC;CAC1E,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,4BAA4B,CAAC,yBAAyB,CAAC,CAAC;CAClE,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yCAAyC,GACjD,0DAA0D,GAC1D,yDAAyD,GACzD,8CAA8C,GAC9C,mEAAmE,GACnE,kDAAkD,GAClD,+CAA+C,GAC/C,oDAAoD,GACpD,gDAAgD,GAChD,2DAA2D,GAC3D,qDAAqD,GACrD,0DAA0D,GAC1D,gDAAgD,GAChD,kEAAkE,GAClE,2CAA2C,GAC3C,0DAA0D,GAC1D,sDAAsD,GACtD,yDAAyD,GACzD,wDAAwD,GACxD,4CAA4C,GAC5C,2DAA2D,GAC3D,0DAA0D,GAC1D,mDAAmD,GACnD,yDAAyD,GACzD,mDAAmD,GACnD,2DAA2D,GAC3D,4DAA4D,GAC5D,oDAAoD,GACpD,4DAA4D,GAC5D,gDAAgD,GAChD,2DAA2D,GAC3D,iEAAiE,GACjE,yDAAyD,CAAC"}

package/dist/SeedlessOnboardingController-method-action-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController-method-action-types.js","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { SeedlessOnboardingController } from './SeedlessOnboardingController.js';\n\nexport type SeedlessOnboardingControllerFetchMetadataAccessCredsAction = {\n  type: `SeedlessOnboardingController:fetchMetadataAccessCreds`;\n  handler: SeedlessOnboardingController['fetchMetadataAccessCreds'];\n};\n\n/**\n * Gets the node details for the TOPRF operations.\n * This function can be called to get the node endpoints, indexes and pubkeys and cache them locally.\n */\nexport type SeedlessOnboardingControllerPreloadToprfNodeDetailsAction = {\n  type: `SeedlessOnboardingController:preloadToprfNodeDetails`;\n  handler: SeedlessOnboardingController['preloadToprfNodeDetails'];\n};\n\n/**\n * Authenticate OAuth user using the seedless onboarding flow\n * and determine if the user is already registered or not.\n *\n * @param params - The parameters for authenticate OAuth user.\n * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.\n * @param params.authConnection - The social login provider.\n * @param params.authConnectionId - OAuth authConnectionId from dashboard\n * @param params.userId - user email or id from Social login\n * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.\n * @param params.socialLoginEmail - The user email from Social login.\n * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.\n * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.\n * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.\n * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.\n * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the authentication result.\n */\nexport type SeedlessOnboardingControllerAuthenticateAction = {\n  type: `SeedlessOnboardingController:authenticate`;\n  handler: SeedlessOnboardingController['authenticate'];\n};\n\n/**\n * Create a new TOPRF encryption key using given password and backups the provided seed phrase.\n *\n * @param password - The password used to create new wallet and seedphrase\n * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.\n * @param keyringId - The keyring id of the backup seed phrase\n * @returns A promise that resolves to the encrypted seed phrase and the encryption key.\n */\nexport type SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction =\n  {\n    type: `SeedlessOnboardingController:createToprfKeyAndBackupSeedPhrase`;\n    handler: SeedlessOnboardingController['createToprfKeyAndBackupSeedPhrase'];\n  };\n\n/**\n * Encrypt and add a new secret data to the metadata store.\n *\n * @param data - The data to add.\n * @param dataType - The data type classification for the secret data.\n * @param options - Optional options object, which includes optional data to be added to the metadata store.\n * @param options.keyringId - The keyring id of the backup keyring (SRP).\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerAddNewSecretDataAction = {\n  type: `SeedlessOnboardingController:addNewSecretData`;\n  handler: SeedlessOnboardingController['addNewSecretData'];\n};\n\n/**\n * Run any pending seedless onboarding migrations.\n *\n * This method should be called by clients after the controller is unlocked\n * to ensure legacy data is migrated to the latest format.\n *\n * Migrations are idempotent - running this multiple times is safe.\n * The migration version is tracked in state to prevent re-running migrations.\n *\n * @returns A promise that resolves to `true` if data was actually migrated\n * (items were updated on the server), `false` otherwise.\n * @throws If the password is outdated (changed on another device).\n */\nexport type SeedlessOnboardingControllerRunMigrationsAction = {\n  type: `SeedlessOnboardingController:runMigrations`;\n  handler: SeedlessOnboardingController['runMigrations'];\n};\n\n/**\n * Fetches all secret data items from the metadata store.\n *\n * Decrypts the secret data and returns the decrypted secret data using the recovered encryption key from the password.\n *\n * @param password - The optional password used to create new wallet. If not provided, `cached Encryption Key` will be used.\n * @returns A promise that resolves to the secret metadata items.\n */\nexport type SeedlessOnboardingControllerFetchAllSecretDataAction = {\n  type: `SeedlessOnboardingController:fetchAllSecretData`;\n  handler: SeedlessOnboardingController['fetchAllSecretData'];\n};\n\n/**\n * Update the password of the seedless onboarding flow.\n *\n * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.\n *\n * @param newPassword - The new password to update.\n * @param oldPassword - The old password to verify.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerChangePasswordAction = {\n  type: `SeedlessOnboardingController:changePassword`;\n  handler: SeedlessOnboardingController['changePassword'];\n};\n\n/**\n * Update the backup metadata state for the given secret data.\n *\n * @param secretData - The data to backup, can be a single backup or array of backups.\n * @param secretData.keyringId - The keyring id associated with the backup secret data.\n * @param secretData.data - The secret data to update the backup metadata state.\n */\nexport type SeedlessOnboardingControllerUpdateBackupMetadataStateAction = {\n  type: `SeedlessOnboardingController:updateBackupMetadataState`;\n  handler: SeedlessOnboardingController['updateBackupMetadataState'];\n};\n\n/**\n * Verify the password validity by decrypting the vault.\n *\n * @param password - The password to verify.\n * @param options - Optional options object.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the success of the operation.\n * @throws {Error} If the password is invalid or the vault is not initialized.\n */\nexport type SeedlessOnboardingControllerVerifyVaultPasswordAction = {\n  type: `SeedlessOnboardingController:verifyVaultPassword`;\n  handler: SeedlessOnboardingController['verifyVaultPassword'];\n};\n\n/**\n * Get backup state of the given secret data, from the controller state.\n *\n * If the given secret data is not backed up and not found in the state, it will return `undefined`.\n *\n * @param data - The data to get the backup state of.\n * @param type - The type of the secret data.\n * @returns The backup state of the given secret data.\n */\nexport type SeedlessOnboardingControllerGetSecretDataBackupStateAction = {\n  type: `SeedlessOnboardingController:getSecretDataBackupState`;\n  handler: SeedlessOnboardingController['getSecretDataBackupState'];\n};\n\n/**\n * Submit the password to the controller, verify the password validity and unlock the controller.\n *\n * This method will be used especially when user unlock the wallet.\n * The provided password will be verified against the encrypted vault, encryption key will be derived and saved in the controller state.\n *\n * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup\n *\n * @param password - The password to submit.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitPasswordAction = {\n  type: `SeedlessOnboardingController:submitPassword`;\n  handler: SeedlessOnboardingController['submitPassword'];\n};\n\n/**\n * Identify an incomplete or mismatched primary SRP backup.\n *\n * This method must only be called after the controller has been unlocked.\n *\n * @param password - The password used to export the local primary SRP.\n * @returns A promise that resolves after identification and telemetry have\n * completed.\n */\nexport type SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction =\n  {\n    type: `SeedlessOnboardingController:identifyIncompleteMetadataBackup`;\n    handler: SeedlessOnboardingController['identifyIncompleteMetadataBackup'];\n  };\n\n/**\n * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).\n *\n * When the controller is locked, the user will not be able to perform any operations on the controller/vault.\n *\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSetLockedAction = {\n  type: `SeedlessOnboardingController:setLocked`;\n  handler: SeedlessOnboardingController['setLocked'];\n};\n\n/**\n * Sync the latest global password to the controller.\n * reset vault with latest globalPassword,\n * persist the latest global password authPubKey\n *\n * @param params - The parameters for syncing the latest global password.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSyncLatestGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:syncLatestGlobalPassword`;\n  handler: SeedlessOnboardingController['syncLatestGlobalPassword'];\n};\n\n/**\n * @description Unlock the controller with the latest global password.\n *\n * @param params - The parameters for unlocking the controller.\n * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:submitGlobalPassword`;\n  handler: SeedlessOnboardingController['submitGlobalPassword'];\n};\n\n/**\n * @description Check if the current password is outdated compare to the global password.\n *\n * @param options - Optional options object.\n * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.\n * If not provided, the global auth public key will be fetched from the backend.\n * @param options.skipCache - If true, bypass the cache and force a fresh check.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to true if the password is outdated, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckIsPasswordOutdatedAction = {\n  type: `SeedlessOnboardingController:checkIsPasswordOutdated`;\n  handler: SeedlessOnboardingController['checkIsPasswordOutdated'];\n};\n\n/**\n * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.\n *\n * This method will check the `accessToken` and `revokeToken` in the state, besides the social login authentication details.\n * If both are present, the user is authenticated.\n * If either is missing, the user is not authenticated.\n *\n * This method is useful when we want to check if the state has valid authenticated user details to perform vault creations.\n *\n * @returns True if the user is authenticated, false otherwise.\n */\nexport type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {\n  type: `SeedlessOnboardingController:getIsUserAuthenticated`;\n  handler: SeedlessOnboardingController['getIsUserAuthenticated'];\n};\n\n/**\n * Clears the current state of the SeedlessOnboardingController.\n */\nexport type SeedlessOnboardingControllerClearStateAction = {\n  type: `SeedlessOnboardingController:clearState`;\n  handler: SeedlessOnboardingController['clearState'];\n};\n\n/**\n * Store the keyring encryption key in state, encrypted under the current\n * encryption key.\n *\n * @param keyringEncryptionKey - The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:storeKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['storeKeyringEncryptionKey'];\n};\n\n/**\n * Load the keyring encryption key from state, decrypted under the current\n * encryption key.\n *\n * @returns The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];\n};\n\n/**\n * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using\n * the stored refresh token.\n *\n * Concurrent callers share a single in-flight HTTP request — if a refresh is\n * already in-progress the returned promise resolves when that request settles\n * rather than firing a duplicate request with the same token.\n *\n * @returns A promise that resolves when the tokens have been refreshed.\n */\nexport type SeedlessOnboardingControllerRefreshAuthTokensAction = {\n  type: `SeedlessOnboardingController:refreshAuthTokens`;\n  handler: SeedlessOnboardingController['refreshAuthTokens'];\n};\n\n/**\n * Rotate the refresh token — fetch a new refresh/revoke token pair from the\n * auth service and persist the new revoke token in the vault.\n *\n * This method should be called after a successful JWT refresh.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRotateRefreshTokenAction = {\n  type: `SeedlessOnboardingController:rotateRefreshToken`;\n  handler: SeedlessOnboardingController['rotateRefreshToken'];\n};\n\n/**\n * Revoke all pending refresh tokens.\n *\n * This method is to be called after user is authenticated.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRevokePendingRefreshTokensAction = {\n  type: `SeedlessOnboardingController:revokePendingRefreshTokens`;\n  handler: SeedlessOnboardingController['revokePendingRefreshTokens'];\n};\n\n/**\n * Get the access token from the state.\n *\n * If the tokens are expired, the method will refresh them and return the new access token.\n *\n * @returns The access token.\n */\nexport type SeedlessOnboardingControllerGetAccessTokenAction = {\n  type: `SeedlessOnboardingController:getAccessToken`;\n  handler: SeedlessOnboardingController['getAccessToken'];\n};\n\n/**\n * Check if the current node auth token is expired.\n *\n * @returns True if the current node auth token is expired, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkNodeAuthTokenExpired`;\n  handler: SeedlessOnboardingController['checkNodeAuthTokenExpired'];\n};\n\n/**\n * Check if the current metadata access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n *\n * @returns True if the metadata access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction =\n  {\n    type: `SeedlessOnboardingController:checkMetadataAccessTokenExpired`;\n    handler: SeedlessOnboardingController['checkMetadataAccessTokenExpired'];\n  };\n\n/**\n * Check if the current access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n * When the vault is locked, the access token is not accessible, so we return false.\n *\n * @returns True if the access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkAccessTokenExpired`;\n  handler: SeedlessOnboardingController['checkAccessTokenExpired'];\n};\n\n/**\n * Union of all SeedlessOnboardingController action types.\n */\nexport type SeedlessOnboardingControllerMethodActions =\n  | SeedlessOnboardingControllerFetchMetadataAccessCredsAction\n  | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction\n  | SeedlessOnboardingControllerAuthenticateAction\n  | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction\n  | SeedlessOnboardingControllerAddNewSecretDataAction\n  | SeedlessOnboardingControllerRunMigrationsAction\n  | SeedlessOnboardingControllerFetchAllSecretDataAction\n  | SeedlessOnboardingControllerChangePasswordAction\n  | SeedlessOnboardingControllerUpdateBackupMetadataStateAction\n  | SeedlessOnboardingControllerVerifyVaultPasswordAction\n  | SeedlessOnboardingControllerGetSecretDataBackupStateAction\n  | SeedlessOnboardingControllerSubmitPasswordAction\n  | SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction\n  | SeedlessOnboardingControllerSetLockedAction\n  | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction\n  | SeedlessOnboardingControllerSubmitGlobalPasswordAction\n  | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction\n  | SeedlessOnboardingControllerGetIsUserAuthenticatedAction\n  | SeedlessOnboardingControllerClearStateAction\n  | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerRefreshAuthTokensAction\n  | SeedlessOnboardingControllerRotateRefreshTokenAction\n  | SeedlessOnboardingControllerRevokePendingRefreshTokensAction\n  | SeedlessOnboardingControllerGetAccessTokenAction\n  | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction\n  | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction\n  | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;\n"]}
+{"version":3,"file":"SeedlessOnboardingController-method-action-types.js","sourceRoot":"","sources":["../src/SeedlessOnboardingController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { SeedlessOnboardingController } from './SeedlessOnboardingController.js';\n\nexport type SeedlessOnboardingControllerFetchMetadataAccessCredsAction = {\n  type: `SeedlessOnboardingController:fetchMetadataAccessCreds`;\n  handler: SeedlessOnboardingController['fetchMetadataAccessCreds'];\n};\n\n/**\n * Gets the node details for the TOPRF operations.\n * This function can be called to get the node endpoints, indexes and pubkeys and cache them locally.\n */\nexport type SeedlessOnboardingControllerPreloadToprfNodeDetailsAction = {\n  type: `SeedlessOnboardingController:preloadToprfNodeDetails`;\n  handler: SeedlessOnboardingController['preloadToprfNodeDetails'];\n};\n\n/**\n * Authenticate OAuth user using the seedless onboarding flow\n * and determine if the user is already registered or not.\n *\n * @param params - The parameters for authenticate OAuth user.\n * @param params.idTokens - The ID token(s) issued by OAuth verification service. Currently this array only contains a single idToken which is verified by all the nodes, in future we are considering to issue a unique idToken for each node.\n * @param params.authConnection - The social login provider.\n * @param params.authConnectionId - OAuth authConnectionId from dashboard\n * @param params.userId - user email or id from Social login\n * @param params.groupedAuthConnectionId - Optional grouped authConnectionId to be used for the authenticate request.\n * @param params.socialLoginEmail - The user email from Social login.\n * @param params.refreshToken - Refresh token issued during OAuth login. Written to state when provided.\n * @param params.revokeToken - revoke token for revoking refresh token and get new refresh token and new revoke token.\n * @param params.accessToken - Access token for pairing with profile sync auth service and to access other services.\n * @param params.metadataAccessToken - Metadata access token for accessing the metadata service before the vault is created or unlocked.\n * @param params.skipLock - Optional flag to skip acquiring the controller lock. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the authentication result.\n */\nexport type SeedlessOnboardingControllerAuthenticateAction = {\n  type: `SeedlessOnboardingController:authenticate`;\n  handler: SeedlessOnboardingController['authenticate'];\n};\n\n/**\n * Create a new TOPRF encryption key using given password and backups the provided seed phrase.\n *\n * @param password - The password used to create new wallet and seedphrase\n * @param seedPhrase - The initial seed phrase (Mnemonic) created together with the wallet.\n * @param keyringId - The keyring id of the backup seed phrase\n * @returns A promise that resolves to the encrypted seed phrase and the encryption key.\n */\nexport type SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction =\n  {\n    type: `SeedlessOnboardingController:createToprfKeyAndBackupSeedPhrase`;\n    handler: SeedlessOnboardingController['createToprfKeyAndBackupSeedPhrase'];\n  };\n\n/**\n * Encrypt and add a new secret data to the metadata store.\n *\n * @param data - The data to add.\n * @param dataType - The data type classification for the secret data.\n * @param options - Optional options object, which includes optional data to be added to the metadata store.\n * @param options.keyringId - The keyring id of the backup keyring (SRP).\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerAddNewSecretDataAction = {\n  type: `SeedlessOnboardingController:addNewSecretData`;\n  handler: SeedlessOnboardingController['addNewSecretData'];\n};\n\n/**\n * Run any pending seedless onboarding migrations.\n *\n * This method should be called by clients after the controller is unlocked\n * to ensure legacy data is migrated to the latest format.\n *\n * Migrations are idempotent - running this multiple times is safe.\n * The migration version is tracked in state to prevent re-running migrations.\n *\n * @returns A promise that resolves to `true` if data was actually migrated\n * (items were updated on the server), `false` otherwise.\n * @throws If the password is outdated (changed on another device).\n */\nexport type SeedlessOnboardingControllerRunMigrationsAction = {\n  type: `SeedlessOnboardingController:runMigrations`;\n  handler: SeedlessOnboardingController['runMigrations'];\n};\n\n/**\n * Fetches all secret data items from the metadata store.\n *\n * Decrypts the secret data and returns the decrypted secret data using the recovered encryption key from the password.\n *\n * @param password - The optional password used to create new wallet. If not provided, `cached Encryption Key` will be used.\n * @returns A promise that resolves to the secret metadata items.\n */\nexport type SeedlessOnboardingControllerFetchAllSecretDataAction = {\n  type: `SeedlessOnboardingController:fetchAllSecretData`;\n  handler: SeedlessOnboardingController['fetchAllSecretData'];\n};\n\n/**\n * Update the password of the seedless onboarding flow.\n *\n * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.\n * If the vault is envelope-managed, only the password envelope and the\n * password OPRF key change; the vault keys and the backend vault stay as\n * they are.\n *\n * @param newPassword - The new password to update.\n * @param oldPassword - The old password to verify.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerChangePasswordAction = {\n  type: `SeedlessOnboardingController:changePassword`;\n  handler: SeedlessOnboardingController['changePassword'];\n};\n\n/**\n * Update the backup metadata state for the given secret data.\n *\n * @param secretData - The data to backup, can be a single backup or array of backups.\n * @param secretData.keyringId - The keyring id associated with the backup secret data.\n * @param secretData.data - The secret data to update the backup metadata state.\n */\nexport type SeedlessOnboardingControllerUpdateBackupMetadataStateAction = {\n  type: `SeedlessOnboardingController:updateBackupMetadataState`;\n  handler: SeedlessOnboardingController['updateBackupMetadataState'];\n};\n\n/**\n * Verify the password validity by decrypting the vault.\n *\n * @param password - The password to verify.\n * @param options - Optional options object.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to the success of the operation.\n * @throws {Error} If the password is invalid or the vault is not initialized.\n */\nexport type SeedlessOnboardingControllerVerifyVaultPasswordAction = {\n  type: `SeedlessOnboardingController:verifyVaultPassword`;\n  handler: SeedlessOnboardingController['verifyVaultPassword'];\n};\n\n/**\n * Get backup state of the given secret data, from the controller state.\n *\n * If the given secret data is not backed up and not found in the state, it will return `undefined`.\n *\n * @param data - The data to get the backup state of.\n * @param type - The type of the secret data.\n * @returns The backup state of the given secret data.\n */\nexport type SeedlessOnboardingControllerGetSecretDataBackupStateAction = {\n  type: `SeedlessOnboardingController:getSecretDataBackupState`;\n  handler: SeedlessOnboardingController['getSecretDataBackupState'];\n};\n\n/**\n * Submit the password to the controller, verify the password validity and unlock the controller.\n *\n * This method will be used especially when user unlock the wallet.\n * The provided password will be verified against the encrypted vault, encryption key will be derived and saved in the controller state.\n *\n * This operation is useful when user performs some actions that requires the user password/encryption key. e.g. add new srp backup\n *\n * @param password - The password to submit.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitPasswordAction = {\n  type: `SeedlessOnboardingController:submitPassword`;\n  handler: SeedlessOnboardingController['submitPassword'];\n};\n\n/**\n * Identify an incomplete or mismatched primary SRP backup.\n *\n * This method must only be called after the controller has been unlocked.\n *\n * @param password - The password used to export the local primary SRP.\n * @returns A promise that resolves after identification and telemetry have\n * completed.\n */\nexport type SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction =\n  {\n    type: `SeedlessOnboardingController:identifyIncompleteMetadataBackup`;\n    handler: SeedlessOnboardingController['identifyIncompleteMetadataBackup'];\n  };\n\n/**\n * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).\n *\n * When the controller is locked, the user will not be able to perform any operations on the controller/vault.\n *\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSetLockedAction = {\n  type: `SeedlessOnboardingController:setLocked`;\n  handler: SeedlessOnboardingController['setLocked'];\n};\n\n/**\n * Sync the latest global password to the controller.\n * reset vault with latest globalPassword,\n * persist the latest global password authPubKey\n *\n * @param params - The parameters for syncing the latest global password.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSyncLatestGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:syncLatestGlobalPassword`;\n  handler: SeedlessOnboardingController['syncLatestGlobalPassword'];\n};\n\n/**\n * @description Unlock the controller with the latest global password.\n *\n * @param params - The parameters for unlocking the controller.\n * @param params.maxKeyChainLength - The maximum chain length of the pwd encryption keys.\n * @param params.globalPassword - The latest global password.\n * @returns A promise that resolves to the success of the operation.\n */\nexport type SeedlessOnboardingControllerSubmitGlobalPasswordAction = {\n  type: `SeedlessOnboardingController:submitGlobalPassword`;\n  handler: SeedlessOnboardingController['submitGlobalPassword'];\n};\n\n/**\n * @description Check if the current password is outdated compare to the global password.\n *\n * @param options - Optional options object.\n * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.\n * If not provided, the global auth public key will be fetched from the backend.\n * @param options.skipCache - If true, bypass the cache and force a fresh check.\n * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)\n * @returns A promise that resolves to true if the password is outdated, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckIsPasswordOutdatedAction = {\n  type: `SeedlessOnboardingController:checkIsPasswordOutdated`;\n  handler: SeedlessOnboardingController['checkIsPasswordOutdated'];\n};\n\n/**\n * Check if the user is authenticated with the seedless onboarding flow by checking the token values in the state.\n *\n * This method will check the `accessToken` and `revokeToken` in the state, besides the social login authentication details.\n * If both are present, the user is authenticated.\n * If either is missing, the user is not authenticated.\n *\n * This method is useful when we want to check if the state has valid authenticated user details to perform vault creations.\n *\n * @returns True if the user is authenticated, false otherwise.\n */\nexport type SeedlessOnboardingControllerGetIsUserAuthenticatedAction = {\n  type: `SeedlessOnboardingController:getIsUserAuthenticated`;\n  handler: SeedlessOnboardingController['getIsUserAuthenticated'];\n};\n\n/**\n * Clears the current state of the SeedlessOnboardingController.\n */\nexport type SeedlessOnboardingControllerClearStateAction = {\n  type: `SeedlessOnboardingController:clearState`;\n  handler: SeedlessOnboardingController['clearState'];\n};\n\n/**\n * Store the keyring encryption key in state, encrypted under the current\n * encryption key.\n *\n * @param keyringEncryptionKey - The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:storeKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['storeKeyringEncryptionKey'];\n};\n\n/**\n * Load the keyring encryption key from state, decrypted under the current\n * encryption key.\n *\n * @returns The keyring encryption key.\n */\nexport type SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction = {\n  type: `SeedlessOnboardingController:loadKeyringEncryptionKey`;\n  handler: SeedlessOnboardingController['loadKeyringEncryptionKey'];\n};\n\n/**\n * Refresh expired nodeAuthTokens, accessToken, and metadataAccessToken using\n * the stored refresh token.\n *\n * Concurrent callers share a single in-flight HTTP request — if a refresh is\n * already in-progress the returned promise resolves when that request settles\n * rather than firing a duplicate request with the same token.\n *\n * @returns A promise that resolves when the tokens have been refreshed.\n */\nexport type SeedlessOnboardingControllerRefreshAuthTokensAction = {\n  type: `SeedlessOnboardingController:refreshAuthTokens`;\n  handler: SeedlessOnboardingController['refreshAuthTokens'];\n};\n\n/**\n * Authenticate on the recovery verifier with the aal2 token and store the\n * issued node auth tokens, the token's `exp` and `sub` (profile ID), the\n * verifier IDs, and whether a share already exists, as `recoverySession`.\n * The aal1 `nodeAuthTokens`, `accessToken` and `metadataAccessToken` are\n * left as they are.\n *\n * @param params - The function parameters.\n * @param params.aal2Token - The aal2 token minted by the authentication API.\n * Its `exp` caps the lifetime of the aal2 node auth tokens.\n * @param params.authConnectionId - The recovery sub-verifier ID.\n * @param params.groupedAuthConnectionId - The recovery aggregate verifier ID.\n * @returns A promise that resolves once the aal2 set is stored.\n * @throws `MissingAuthUserInfo` if either verifier ID is empty or not a string.\n */\nexport type SeedlessOnboardingControllerAuthenticateForRecoveryAction = {\n  type: `SeedlessOnboardingController:authenticateForRecovery`;\n  handler: SeedlessOnboardingController['authenticateForRecovery'];\n};\n\n/**\n * Migrate the vault to envelope encryption, adopting its current key set\n * as the vault key set `K_v`.\n *\n * Writes `rbek` (sealed for the Recovery Secret) and the control record\n * into their own partitions. No secret data item is moved, and no password\n * is needed: the current password still derives `K_v` directly, so the\n * first `pbek` is written by the first password change. The sealed\n * envelope is checkpointed before the first remote write, so a failed call\n * can be retried with the same arguments. Does nothing if the vault is\n * already envelope-managed.\n *\n * The vault must be unlocked and in sync with the global password. Register\n * the Recovery Secret at the escrows first, then call\n * {@link authenticateForRecovery}.\n *\n * @param params - The function parameters.\n * @param params.recoverySecret - The 32-byte Recovery Secret held in escrow.\n * @returns A promise that resolves once the vault is envelope-managed.\n * @throws `OutdatedPassword` if the vault is not in sync with the global\n * password.\n */\nexport type SeedlessOnboardingControllerMigrateToEnvelopeAction = {\n  type: `SeedlessOnboardingController:migrateToEnvelope`;\n  handler: SeedlessOnboardingController['migrateToEnvelope'];\n};\n\n/**\n * Recover an envelope-managed vault with the Recovery Secret instead of the\n * password: open `rbek` to get the vault key set `K_v`, fetch the secret\n * data with it, and create the local vault under `password`.\n *\n * `password` only encrypts the local vault. Until the user syncs it with\n * the global password ({@link syncLatestGlobalPassword}) or sets it as the\n * global password ({@link resetPasswordWithVaultKeys}), the password counts\n * as outdated.\n *\n * Any pending envelope migration checkpoint is discarded, since it belongs\n * to the vault this call replaces.\n *\n * Authenticate with social login and call {@link authenticateForRecovery}\n * first.\n *\n * @param params - The function parameters.\n * @param params.recoverySecret - The 32-byte Recovery Secret from escrow.\n * @param params.password - The password of the new local vault.\n * @returns The secret data of the vault.\n * @throws `RecoveryEnvelopeNotFound` if no vault keys are sealed for the\n * Recovery Secret, `RecoveryKeyShareConflict` if the nodes hold the key of\n * another Recovery Secret, or `Aal2Required` without a valid aal2 session.\n */\nexport type SeedlessOnboardingControllerRecoverWithRecoverySecretAction = {\n  type: `SeedlessOnboardingController:recoverWithRecoverySecret`;\n  handler: SeedlessOnboardingController['recoverWithRecoverySecret'];\n};\n\n/**\n * Set a new global password on an envelope-managed vault without the old\n * one, after {@link recoverWithRecoverySecret}.\n *\n * Only allowed while the local password is not yet synced with the global\n * password, which is the state {@link recoverWithRecoverySecret} leaves the\n * vault in, and with a valid aal2 session from\n * {@link authenticateForRecovery}. Once the reset or a sync succeeds, use\n * {@link changePassword} instead.\n *\n * The password OPRF key swap is signed with the auth key stored in the\n * vault's control record, so the old password is not needed. The vault\n * keys and the backend vault stay as they are, and the local vault is\n * re-encrypted under the new password.\n *\n * @param params - The function parameters.\n * @param params.newPassword - The new global password.\n * @returns A promise that resolves once the new password is global.\n * @throws `PasswordResetRequiresRecovery` if the vault is not\n * envelope-managed or its local password is already synced,\n * `Aal2Required` without a valid aal2 session, or\n * `EnvelopeControlRecordNotFound` if no control record matches the live\n * password OPRF key.\n */\nexport type SeedlessOnboardingControllerResetPasswordWithVaultKeysAction = {\n  type: `SeedlessOnboardingController:resetPasswordWithVaultKeys`;\n  handler: SeedlessOnboardingController['resetPasswordWithVaultKeys'];\n};\n\n/**\n * Rotate the refresh token — fetch a new refresh/revoke token pair from the\n * auth service and persist the new revoke token in the vault.\n *\n * This method should be called after a successful JWT refresh.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRotateRefreshTokenAction = {\n  type: `SeedlessOnboardingController:rotateRefreshToken`;\n  handler: SeedlessOnboardingController['rotateRefreshToken'];\n};\n\n/**\n * Revoke all pending refresh tokens.\n *\n * This method is to be called after user is authenticated.\n *\n * @returns A Promise that resolves to void.\n */\nexport type SeedlessOnboardingControllerRevokePendingRefreshTokensAction = {\n  type: `SeedlessOnboardingController:revokePendingRefreshTokens`;\n  handler: SeedlessOnboardingController['revokePendingRefreshTokens'];\n};\n\n/**\n * Get the access token from the state.\n *\n * If the tokens are expired, the method will refresh them and return the new access token.\n *\n * @returns The access token.\n */\nexport type SeedlessOnboardingControllerGetAccessTokenAction = {\n  type: `SeedlessOnboardingController:getAccessToken`;\n  handler: SeedlessOnboardingController['getAccessToken'];\n};\n\n/**\n * Check if the current node auth token is expired.\n *\n * @returns True if the current node auth token is expired, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkNodeAuthTokenExpired`;\n  handler: SeedlessOnboardingController['checkNodeAuthTokenExpired'];\n};\n\n/**\n * Check if the current metadata access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n *\n * @returns True if the metadata access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction =\n  {\n    type: `SeedlessOnboardingController:checkMetadataAccessTokenExpired`;\n    handler: SeedlessOnboardingController['checkMetadataAccessTokenExpired'];\n  };\n\n/**\n * Check if the current access token should be refreshed.\n * Returns true when the token is expired or when less than 10% of its\n * lifetime remains (proactive refresh).\n * When the vault is locked, the access token is not accessible, so we return false.\n *\n * @returns True if the access token should be refreshed, false otherwise.\n */\nexport type SeedlessOnboardingControllerCheckAccessTokenExpiredAction = {\n  type: `SeedlessOnboardingController:checkAccessTokenExpired`;\n  handler: SeedlessOnboardingController['checkAccessTokenExpired'];\n};\n\n/**\n * Union of all SeedlessOnboardingController action types.\n */\nexport type SeedlessOnboardingControllerMethodActions =\n  | SeedlessOnboardingControllerFetchMetadataAccessCredsAction\n  | SeedlessOnboardingControllerPreloadToprfNodeDetailsAction\n  | SeedlessOnboardingControllerAuthenticateAction\n  | SeedlessOnboardingControllerCreateToprfKeyAndBackupSeedPhraseAction\n  | SeedlessOnboardingControllerAddNewSecretDataAction\n  | SeedlessOnboardingControllerRunMigrationsAction\n  | SeedlessOnboardingControllerFetchAllSecretDataAction\n  | SeedlessOnboardingControllerChangePasswordAction\n  | SeedlessOnboardingControllerUpdateBackupMetadataStateAction\n  | SeedlessOnboardingControllerVerifyVaultPasswordAction\n  | SeedlessOnboardingControllerGetSecretDataBackupStateAction\n  | SeedlessOnboardingControllerSubmitPasswordAction\n  | SeedlessOnboardingControllerIdentifyIncompleteMetadataBackupAction\n  | SeedlessOnboardingControllerSetLockedAction\n  | SeedlessOnboardingControllerSyncLatestGlobalPasswordAction\n  | SeedlessOnboardingControllerSubmitGlobalPasswordAction\n  | SeedlessOnboardingControllerCheckIsPasswordOutdatedAction\n  | SeedlessOnboardingControllerGetIsUserAuthenticatedAction\n  | SeedlessOnboardingControllerClearStateAction\n  | SeedlessOnboardingControllerStoreKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerLoadKeyringEncryptionKeyAction\n  | SeedlessOnboardingControllerRefreshAuthTokensAction\n  | SeedlessOnboardingControllerAuthenticateForRecoveryAction\n  | SeedlessOnboardingControllerMigrateToEnvelopeAction\n  | SeedlessOnboardingControllerRecoverWithRecoverySecretAction\n  | SeedlessOnboardingControllerResetPasswordWithVaultKeysAction\n  | SeedlessOnboardingControllerRotateRefreshTokenAction\n  | SeedlessOnboardingControllerRevokePendingRefreshTokensAction\n  | SeedlessOnboardingControllerGetAccessTokenAction\n  | SeedlessOnboardingControllerCheckNodeAuthTokenExpiredAction\n  | SeedlessOnboardingControllerCheckMetadataAccessTokenExpiredAction\n  | SeedlessOnboardingControllerCheckAccessTokenExpiredAction;\n"]}

package/dist/SeedlessOnboardingController.d.ts

@@ -124,6 +124,9 @@ export declare class SeedlessOnboardingController<EncryptionKey = encryptionUtil
      * Update the password of the seedless onboarding flow.
      *
      * Changing password will also update the encryption key, metadata store and the vault with new encrypted values.
+     * If the vault is envelope-managed, only the password envelope and the
+     * password OPRF key change; the vault keys and the backend vault stay as
+     * they are.
      *
      * @param newPassword - The new password to update.
      * @param oldPassword - The old password to verify.
@@ -274,6 +277,106 @@ export declare class SeedlessOnboardingController<EncryptionKey = encryptionUtil
      * @returns A promise that resolves when the tokens have been refreshed.
      */
     refreshAuthTokens(): Promise<void>;
+    /**
+     * Authenticate on the recovery verifier with the aal2 token and store the
+     * issued node auth tokens, the token's `exp` and `sub` (profile ID), the
+     * verifier IDs, and whether a share already exists, as `recoverySession`.
+     * The aal1 `nodeAuthTokens`, `accessToken` and `metadataAccessToken` are
+     * left as they are.
+     *
+     * @param params - The function parameters.
+     * @param params.aal2Token - The aal2 token minted by the authentication API.
+     * Its `exp` caps the lifetime of the aal2 node auth tokens.
+     * @param params.authConnectionId - The recovery sub-verifier ID.
+     * @param params.groupedAuthConnectionId - The recovery aggregate verifier ID.
+     * @returns A promise that resolves once the aal2 set is stored.
+     * @throws `MissingAuthUserInfo` if either verifier ID is empty or not a string.
+     */
+    authenticateForRecovery({ aal2Token, authConnectionId, groupedAuthConnectionId, }: {
+        aal2Token: string;
+        authConnectionId: string;
+        groupedAuthConnectionId: string;
+    }): Promise<void>;
+    /**
+     * Migrate the vault to envelope encryption, adopting its current key set
+     * as the vault key set `K_v`.
+     *
+     * Writes `rbek` (sealed for the Recovery Secret) and the control record
+     * into their own partitions. No secret data item is moved, and no password
+     * is needed: the current password still derives `K_v` directly, so the
+     * first `pbek` is written by the first password change. The sealed
+     * envelope is checkpointed before the first remote write, so a failed call
+     * can be retried with the same arguments. Does nothing if the vault is
+     * already envelope-managed.
+     *
+     * The vault must be unlocked and in sync with the global password. Register
+     * the Recovery Secret at the escrows first, then call
+     * {@link authenticateForRecovery}.
+     *
+     * @param params - The function parameters.
+     * @param params.recoverySecret - The 32-byte Recovery Secret held in escrow.
+     * @returns A promise that resolves once the vault is envelope-managed.
+     * @throws `OutdatedPassword` if the vault is not in sync with the global
+     * password.
+     */
+    migrateToEnvelope({ recoverySecret, }: {
+        recoverySecret: Uint8Array;
+    }): Promise<void>;
+    /**
+     * Recover an envelope-managed vault with the Recovery Secret instead of the
+     * password: open `rbek` to get the vault key set `K_v`, fetch the secret
+     * data with it, and create the local vault under `password`.
+     *
+     * `password` only encrypts the local vault. Until the user syncs it with
+     * the global password ({@link syncLatestGlobalPassword}) or sets it as the
+     * global password ({@link resetPasswordWithVaultKeys}), the password counts
+     * as outdated.
+     *
+     * Any pending envelope migration checkpoint is discarded, since it belongs
+     * to the vault this call replaces.
+     *
+     * Authenticate with social login and call {@link authenticateForRecovery}
+     * first.
+     *
+     * @param params - The function parameters.
+     * @param params.recoverySecret - The 32-byte Recovery Secret from escrow.
+     * @param params.password - The password of the new local vault.
+     * @returns The secret data of the vault.
+     * @throws `RecoveryEnvelopeNotFound` if no vault keys are sealed for the
+     * Recovery Secret, `RecoveryKeyShareConflict` if the nodes hold the key of
+     * another Recovery Secret, or `Aal2Required` without a valid aal2 session.
+     */
+    recoverWithRecoverySecret({ recoverySecret, password, }: {
+        recoverySecret: Uint8Array;
+        password: string;
+    }): Promise<SecretMetadata[]>;
+    /**
+     * Set a new global password on an envelope-managed vault without the old
+     * one, after {@link recoverWithRecoverySecret}.
+     *
+     * Only allowed while the local password is not yet synced with the global
+     * password, which is the state {@link recoverWithRecoverySecret} leaves the
+     * vault in, and with a valid aal2 session from
+     * {@link authenticateForRecovery}. Once the reset or a sync succeeds, use
+     * {@link changePassword} instead.
+     *
+     * The password OPRF key swap is signed with the auth key stored in the
+     * vault's control record, so the old password is not needed. The vault
+     * keys and the backend vault stay as they are, and the local vault is
+     * re-encrypted under the new password.
+     *
+     * @param params - The function parameters.
+     * @param params.newPassword - The new global password.
+     * @returns A promise that resolves once the new password is global.
+     * @throws `PasswordResetRequiresRecovery` if the vault is not
+     * envelope-managed or its local password is already synced,
+     * `Aal2Required` without a valid aal2 session, or
+     * `EnvelopeControlRecordNotFound` if no control record matches the live
+     * password OPRF key.
+     */
+    resetPasswordWithVaultKeys({ newPassword, }: {
+        newPassword: string;
+    }): Promise<void>;
     /**
      * Rotate the refresh token — fetch a new refresh/revoke token pair from the
      * auth service and persist the new revoke token in the vault.

package/dist/SeedlessOnboardingController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController.d.ts","sourceRoot":"","sources":["../src/SeedlessOnboardingController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,kBAAkB,EAIlB,oBAAoB,EAErB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAWvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EACL,cAAc,EAEd,UAAU,EAEV,kCAAkC,EAEnC,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,qCAAqC,EACrC,mCAAmC,EACpC,MAAM,yCAAyC,CAAC;AAKjD,OAAO,KAAK,EAEV,iCAAiC,EAEjC,qBAAqB,EAMtB,MAAM,YAAY,CAAC;AAuBpB,YAAY,EACV,mCAAmC,EACnC,kCAAkC,EAClC,0CAA0C,EAC1C,qCAAqC,EACrC,mCAAmC,EACnC,4CAA4C,GAC7C,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uDAAuD,EAAE,MAAM,YAAY,CAAC;AAmCrF,qBAAa,4BAA4B,CACvC,aAAa,GAAG,eAAe,CAAC,aAAa,EAC7C,6BAA6B,GAAG,eAAe,CAAC,oBAAoB,EACpE,gBAAgB,SACd,0BAA0B,CAAC,6BAA6B,CAAC,GACzD,uBAAuB,CAAC,6BAA6B,CAAC,CACxD,SAAQ,cAAc,CACtB,OAAO,cAAc,EACrB,iCAAiC,EACjC,qCAAqC,CACtC;;IAkBC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IA2BxC;;;;;;;;;;;;;OAaG;IACH,YAAY,EACV,SAAS,EACT,KAAK,EACL,SAAS,EACT,eAAe,EACf,OAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,wBAAyD,GAC1D,EAAE,mCAAmC,CACpC,aAAa,EACb,6BAA6B,EAC7B,gBAAgB,CACjB,EA0BA;IAEK,wBAAwB,IAAI,OAAO,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC,CAwBD;IAED;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM7C;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0D9B;IAED;;;;;;;OAOG;IACG,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CA4Df;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAgCf;IAED;;;;;;;;;;;;OAYG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CActC;IAED;;;;;;;OAOG;IACH,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,IAAI,CAErE;IA6ED;;;;;;;OAOG;IACG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA0CrE;IAED;;;;;;;;OAQG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Df;IAED;;;;;;OAMG;IACH,yBAAyB,CACvB,UAAU,EACN,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,GAC5D,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE,GACjE,IAAI,CAIN;IAED;;;;;;;;OAQG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAUf;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAgC,GACrC,qBAAqB,GAAG,SAAS,CAKnC;IAED;;;;;;;;;;OAUG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCpD;IAED;;;;;;;;OAQG;IACG,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;IAED;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAY/B;IAED;;;;;;;;OAQG;IACG,wBAAwB,CAAC,EAC7B,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB;IAED;;;;;;;OAOG;IACG,oBAAoB,CAAC,EACzB,cAAc,EACd,iBAAqB,GACtB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;IAoED;;;;;;;;;OASG;IACG,uBAAuB,CAAC,OAAO,CAAC,EAAE;QACtC,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;KACzC,GAAG,OAAO,CAAC,OAAO,CAAC,CAkEnB;IAED;;;;;;;;;;OAUG;IACG,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/C;IAuCD;;OAEG;IACH,UAAU,IAAI,IAAI,CAMjB;IAoDD;;;;;OAKG;IACG,yBAAyB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;IAED;;;;;OAKG;IACG,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAIhD;IA8xBD;;;;;;;;;OASG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBvC;IAqJD;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA2CxC;IAED;;;;;;OAMG;IACG,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAqChD;IAED;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQlD;IAgGD;;;;OAIG;IACI,yBAAyB,IAAI,OAAO,CAU1C;IAED;;;;;;OAMG;IACI,+BAA+B,IAAI,OAAO,CAUhD;IAED;;;;;;;OAOG;IACI,uBAAuB,IAAI,OAAO,CAYxC;CAqBF"}
+{"version":3,"file":"SeedlessOnboardingController.d.ts","sourceRoot":"","sources":["../src/SeedlessOnboardingController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EACV,uBAAuB,EACvB,0BAA0B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,kBAAkB,EAKlB,oBAAoB,EAErB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAavC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EACL,cAAc,EAEd,UAAU,EAEV,kCAAkC,EAEnC,MAAM,gBAAgB,CAAC;AAmCxB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,qCAAqC,EACrC,mCAAmC,EACpC,MAAM,yCAAyC,CAAC;AAKjD,OAAO,KAAK,EAEV,iCAAiC,EAEjC,qBAAqB,EAOtB,MAAM,YAAY,CAAC;AAwBpB,YAAY,EACV,mCAAmC,EACnC,kCAAkC,EAClC,0CAA0C,EAC1C,qCAAqC,EACrC,mCAAmC,EACnC,4CAA4C,GAC7C,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uDAAuD,EAAE,MAAM,YAAY,CAAC;AAsErF,qBAAa,4BAA4B,CACvC,aAAa,GAAG,eAAe,CAAC,aAAa,EAC7C,6BAA6B,GAAG,eAAe,CAAC,oBAAoB,EACpE,gBAAgB,SACd,0BAA0B,CAAC,6BAA6B,CAAC,GACzD,uBAAuB,CAAC,6BAA6B,CAAC,CACxD,SAAQ,cAAc,CACtB,OAAO,cAAc,EACrB,iCAAiC,EACjC,qCAAqC,CACtC;;IAkBC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IA6BxC;;;;;;;;;;;;;OAaG;IACH,YAAY,EACV,SAAS,EACT,KAAK,EACL,SAAS,EACT,eAAe,EACf,OAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,wBAAyD,GAC1D,EAAE,mCAAmC,CACpC,aAAa,EACb,6BAA6B,EAC7B,gBAAgB,CACjB,EA6BA;IAEK,wBAAwB,IAAI,OAAO,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC,CAwBD;IAED;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAM7C;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0D9B;IAED;;;;;;;OAOG;IACG,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CA4Df;IAED;;;;;;;;OAQG;IACG,gBAAgB,CACpB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAgCf;IAED;;;;;;;;;;;;OAYG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CActC;IAED;;;;;;;OAOG;IACH,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,IAAI,CAErE;IA6ED;;;;;;;OAOG;IACG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkFrE;IAED;;;;;;;;;;;OAWG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAsFf;IAyFD;;;;;;OAMG;IACH,yBAAyB,CACvB,UAAU,EACN,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,GAC5D,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE,GACjE,IAAI,CAIN;IAED;;;;;;;;OAQG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC,CAUf;IAED;;;;;;;;OAQG;IACH,wBAAwB,CACtB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAgC,GACrC,qBAAqB,GAAG,SAAS,CAKnC;IAED;;;;;;;;;;OAUG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCpD;IAED;;;;;;;;OAQG;IACG,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;IAED;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAa/B;IAED;;;;;;;;OAQG;IACG,wBAAwB,CAAC,EAC7B,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDhB;IAED;;;;;;;OAOG;IACG,oBAAoB,CAAC,EACzB,cAAc,EACd,iBAAqB,GACtB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;IAoFD;;;;;;;;;OASG;IACG,uBAAuB,CAAC,OAAO,CAAC,EAAE;QACtC,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;KACzC,GAAG,OAAO,CAAC,OAAO,CAAC,CA4EnB;IAED;;;;;;;;;;OAUG;IACG,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/C;IAuCD;;OAEG;IACH,UAAU,IAAI,IAAI,CAMjB;IAoDD;;;;;OAKG;IACG,yBAAyB,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;IAED;;;;;OAKG;IACG,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAIhD;IA6yBD;;;;;;;;;OASG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBvC;IAqJD;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,CAAC,EAC5B,SAAS,EACT,gBAAgB,EAChB,uBAAuB,GACxB,EAAE;QACD,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;QACzB,uBAAuB,EAAE,MAAM,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ChB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,iBAAiB,CAAC,EACtB,cAAc,GACf,EAAE;QACD,cAAc,EAAE,UAAU,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDhB;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,yBAAyB,CAAC,EAC9B,cAAc,EACd,QAAQ,GACT,EAAE;QACD,cAAc,EAAE,UAAU,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA4C5B;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,0BAA0B,CAAC,EAC/B,WAAW,GACZ,EAAE;QACD,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;IAkaD;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA2CxC;IAED;;;;;;OAMG;IACG,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAqChD;IAED;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQlD;IAgGD;;;;OAIG;IACI,yBAAyB,IAAI,OAAO,CAU1C;IAED;;;;;;OAMG;IACI,+BAA+B,IAAI,OAAO,CAUhD;IAED;;;;;;;OAOG;IACI,uBAAuB,IAAI,OAAO,CAYxC;CAqBF"}