@metamask-previews/seedless-onboarding-controller 2.4.0-preview-bd86fa14 → 2.5.0-preview-3f5f144a

package/dist/SeedlessOnboardingController.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"SeedlessOnboardingController.d.mts","sourceRoot":"","sources":["../src/SeedlessOnboardingController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAM3D,OAAO,EACL,iBAAiB,EAGlB,sCAAsC;AASvC,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAoB;AAClD,OAAO,EACL,cAAc,EAEd,UAAU,EAGX,wBAAoB;AAGrB,OAAO,EAAE,cAAc,EAAE,6BAAyB;AAClD,OAAO,KAAK,EAEV,qCAAqC,EACrC,mCAAmC,EACnC,iCAAiC,EAEjC,qBAAqB,EAKtB,oBAAgB;AAKjB;;;;GAIG;AACH,wBAAgB,2CAA2C,IAAI,iCAAiC,CAI/F;AAwFD,qBAAa,4BAA4B,CAAC,aAAa,CAAE,SAAQ,cAAc,CAC7E,OAAO,cAAc,EACrB,iCAAiC,EACjC,qCAAqC,CACtC;;IAOC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAaxC;;;;;;;;;;;OAWG;gBACS,EACV,SAAS,EACT,KAAK,EACL,SAAS,EACT,eAAe,EACf,OAAiC,EACjC,eAAe,EACf,kBAAkB,GACnB,EAAE,mCAAmC,CAAC,aAAa,CAAC;IA8B/C,wBAAwB,IAAI,OAAO,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;IAyBF;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB;IA0DD;;;;;;;OAOG;IACG,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA4ChB;;;;;;;;OAQG;IACG,gBAAgB,CACpB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;OAOG;IACG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAiDtE;;;;;;;;OAQG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IA2D7D;;;;;;OAMG;IACH,yBAAyB,CACvB,UAAU,EACN,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,GAC5D,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE;IAOpE;;;;;;;;OAQG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;;;;OAQG;IACH,wBAAwB,CACtB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAgC,GACrC,qBAAqB,GAAG,SAAS;IAOpC;;;;;;;;;;OAUG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBrD;;;;OAIG;IACH,SAAS;IAWT;;;;;;;;OAQG;IACG,wBAAwB,CAAC,EAC7B,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;KACxB;IAwBD;;;;;;;OAOG;IACG,oBAAoB,CAAC,EACzB,cAAc,EACd,iBAAqB,GACtB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IAiFjB;;;;;;;OAOG;IACG,uBAAuB,CAAC,OAAO,CAAC,EAAE;QACtC,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC;IAwFpB;;OAEG;IACH,UAAU;IAmDV;;;;;OAKG;IACG,yBAAyB,CAAC,oBAAoB,EAAE,MAAM;IAM5D;;;;;OAKG;IACG,wBAAwB;IAivB9B;;;;;;;OAOG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwJxC;;;;OAIG;IACI,yBAAyB,IAAI,OAAO;IAY3C;;;;OAIG;IACI,+BAA+B,IAAI,OAAO;IAYjD;;;;;OAKG;IACI,uBAAuB,IAAI,OAAO;CAa1C"}
+{"version":3,"file":"SeedlessOnboardingController.d.mts","sourceRoot":"","sources":["../src/SeedlessOnboardingController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EAGV,oBAAoB,EACrB,sCAAsC;AACvC,OAAO,EACL,iBAAiB,EAGlB,sCAAsC;AAYvC,OAAO,KAAK,EAAE,cAAc,EAAE,wBAAoB;AAClD,OAAO,EACL,cAAc,EAEd,UAAU,EAGX,wBAAoB;AAGrB,OAAO,EAAE,cAAc,EAAE,6BAAyB;AAClD,OAAO,KAAK,EAEV,qCAAqC,EACrC,mCAAmC,EACnC,iCAAiC,EAEjC,qBAAqB,EAKtB,oBAAgB;AAKjB;;;;GAIG;AACH,wBAAgB,2CAA2C,IAAI,iCAAiC,CAI/F;AAwFD,qBAAa,4BAA4B,CAAC,aAAa,CAAE,SAAQ,cAAc,CAC7E,OAAO,cAAc,EACrB,iCAAiC,EACjC,qCAAqC,CACtC;;IAOC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAkBxC;;;;;;;;;;;;OAYG;gBACS,EACV,SAAS,EACT,KAAK,EACL,SAAS,EACT,eAAe,EACf,OAAiC,EACjC,eAAe,EACf,kBAAkB,EAClB,wBAAyD,GAC1D,EAAE,mCAAmC,CAAC,aAAa,CAAC;IAkC/C,wBAAwB,IAAI,OAAO,CAAC;QACxC,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;IAyBF;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,cAAc,CAAC;QAC/B,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB;IA0DD;;;;;;;OAOG;IACG,iCAAiC,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA4ChB;;;;;;;;OAQG;IACG,gBAAgB,CACpB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;OAOG;IACG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAiDtE;;;;;;;;OAQG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IA6D7D;;;;;;OAMG;IACH,yBAAyB,CACvB,UAAU,EACN,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,GAC5D,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE;IAOpE;;;;;;;;OAQG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GACA,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;;;;OAQG;IACH,wBAAwB,CACtB,IAAI,EAAE,UAAU,EAChB,IAAI,GAAE,UAAgC,GACrC,qBAAqB,GAAG,SAAS;IAOpC;;;;;;;;;;OAUG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD;;;;OAIG;IACH,SAAS;IAWT;;;;;;;;OAQG;IACG,wBAAwB,CAAC,EAC7B,cAAc,GACf,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;KACxB;IAwBD;;;;;;;OAOG;IACG,oBAAoB,CAAC,EACzB,cAAc,EACd,iBAAqB,GACtB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC;IAgEjB;;;;;;;;;OASG;IACG,uBAAuB,CAAC,OAAO,CAAC,EAAE;QACtC,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;KACzC,GAAG,OAAO,CAAC,OAAO,CAAC;IAkGpB;;OAEG;IACH,UAAU;IAmDV;;;;;OAKG;IACG,yBAAyB,CAAC,oBAAoB,EAAE,MAAM;IAM5D;;;;;OAKG;IACG,wBAAwB;IAgyB9B;;;;;;;OAOG;IACG,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BxC;;;;;;;OAOG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM;IAwIzC;;;;OAIG;IACI,yBAAyB,IAAI,OAAO;IAY3C;;;;OAIG;IACI,+BAA+B,IAAI,OAAO;IAYjD;;;;;OAKG;IACI,uBAAuB,IAAI,OAAO;CAa1C"}

package/dist/SeedlessOnboardingController.mjs

@@ -9,7 +9,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 import { keccak256AndHexify } from "@metamask/auth-network-utils";
 import { BaseController } from "@metamask/base-controller";
 import { ToprfSecureBackup, TOPRFErrorCode, TOPRFError } from "@metamask/toprf-secure-backup";
@@ -19,7 +19,7 @@ import { bytesToUtf8, utf8ToBytes } from "@noble/ciphers/utils";
 import { managedNonce } from "@noble/ciphers/webcrypto";
 import { secp256k1 } from "@noble/curves/secp256k1";
 import { Mutex } from "async-mutex";
-import { assertIsValidVaultData } from "./assertions.mjs";
+import { assertIsPasswordOutdatedCacheValid, assertIsValidVaultData } from "./assertions.mjs";
 import { controllerName, PASSWORD_OUTDATED_CACHE_TTL_MS, SecretType, SeedlessOnboardingControllerErrorMessage, Web3AuthNetwork } from "./constants.mjs";
 import { PasswordSyncError, RecoveryError } from "./errors.mjs";
 import { projectLogger, createModuleLogger } from "./logger.mjs";
@@ -132,8 +132,9 @@ export class SeedlessOnboardingController extends BaseController {
      * @param options.network - The network to be used for the Seedless Onboarding flow.
      * @param options.refreshJWTToken - A function to get a new jwt token using refresh token.
      * @param options.revokeRefreshToken - A function to revoke the refresh token.
+     * @param options.passwordOutdatedCacheTTL - The TTL of the password outdated cache in milliseconds.,
      */
-    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, }) {
+    constructor({ messenger, state, encryptor, toprfKeyDeriver, network = Web3AuthNetwork.Mainnet, refreshJWTToken, revokeRefreshToken, passwordOutdatedCacheTTL = PASSWORD_OUTDATED_CACHE_TTL_MS, }) {
         super({
             name: controllerName,
             metadata: seedlessOnboardingMetadata,
@@ -155,6 +156,12 @@ export class SeedlessOnboardingController extends BaseController {
          * The controller lock is synchronized with the keyring lock.
          */
         _SeedlessOnboardingController_isUnlocked.set(this, false);
+        /**
+         * The TTL of the password outdated cache in milliseconds.
+         */
+        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
+        assertIsPasswordOutdatedCacheValid(passwordOutdatedCacheTTL);
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, passwordOutdatedCacheTTL, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
         this.toprfClient = new ToprfSecureBackup({
             network,
@@ -387,7 +394,7 @@ export class SeedlessOnboardingController extends BaseController {
             await this.verifyVaultPassword(oldPassword, {
                 skipLock: true, // skip lock since we already have the lock
             });
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
+            const { latestKeyIndex } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
                 skipCache: true,
                 skipLock: true, // skip lock since we already have the lock
             });
@@ -401,6 +408,7 @@ export class SeedlessOnboardingController extends BaseController {
                 const { encKey: newEncKey, pwEncKey: newPwEncKey, authKeyPair: newAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_changeEncryptionKey).call(this, {
                     oldPassword,
                     newPassword,
+                    latestKeyIndex,
                 });
                 // update and encrypt the vault with new password
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
@@ -481,18 +489,8 @@ export class SeedlessOnboardingController extends BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-            if (revokeToken) {
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
-                // re-creating vault to persist the new revoke token
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                    password,
-                    rawToprfEncryptionKey: toprfEncryptionKey,
-                    rawToprfPwEncryptionKey: toprfPwEncryptionKey,
-                    rawToprfAuthKeyPair: toprfAuthKeyPair,
-                });
-            }
         });
     }
     /**
@@ -560,6 +558,8 @@ export class SeedlessOnboardingController extends BaseController {
      * @description Check if the current password is outdated compare to the global password.
      *
      * @param options - Optional options object.
+     * @param options.globalAuthPubKey - The global auth public key to compare with the current auth public key.
+     * If not provided, the global auth public key will be fetched from the backend.
      * @param options.skipCache - If true, bypass the cache and force a fresh check.
      * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)
      * @returns A promise that resolves to true if the password is outdated, false otherwise.
@@ -574,19 +574,28 @@ export class SeedlessOnboardingController extends BaseController {
                 const now = Date.now();
                 const isCacheValid = passwordOutdatedCache &&
                     now - passwordOutdatedCache.timestamp <
-                        PASSWORD_OUTDATED_CACHE_TTL_MS;
+                        __classPrivateFieldGet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, "f");
                 if (isCacheValid) {
                     return passwordOutdatedCache.isExpiredPwd;
                 }
             }
             const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
             const currentDeviceAuthPubKey = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverAuthPubKey).call(this);
-            const { authPubKey: globalAuthPubKey } = await this.toprfClient.fetchAuthPubKey({
-                nodeAuthTokens,
-                authConnectionId,
-                groupedAuthConnectionId,
-                userId,
-            });
+            let globalAuthPubKey = options?.globalAuthPubKey;
+            if (!globalAuthPubKey) {
+                const { authPubKey } = await this.toprfClient
+                    .fetchAuthPubKey({
+                    nodeAuthTokens,
+                    authConnectionId,
+                    groupedAuthConnectionId,
+                    userId,
+                })
+                    .catch((error) => {
+                    log('Error fetching auth pub key', error);
+                    throw new Error(SeedlessOnboardingControllerErrorMessage.FailedToFetchAuthPubKey);
+                });
+                globalAuthPubKey = authPubKey;
+            }
             // use noble lib to deserialize and compare curve point
             const isExpiredPwd = !secp256k1.ProjectivePoint.fromHex(currentDeviceAuthPubKey).equals(secp256k1.ProjectivePoint.fromHex(globalAuthPubKey));
             // Cache the result in state
@@ -662,6 +671,40 @@ export class SeedlessOnboardingController extends BaseController {
             throw new Error(SeedlessOnboardingControllerErrorMessage.AuthenticationError);
         }
     }
+    /**
+     * Revoke the refresh token and get new refresh token and new revoke token
+     * and also updates the vault with the new revoke token.
+     * This method is to be called after user is authenticated.
+     *
+     * @param password - The password to encrypt the vault.
+     * @returns A Promise that resolves to void.
+     */
+    async revokeRefreshToken(password) {
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+            const { vaultEncryptionKey } = this.state;
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
+            if (!revokeToken) {
+                throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
+            }
+            const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
+                connection: this.state.authConnection,
+                revokeToken,
+            });
+            this.update((state) => {
+                // set new revoke token in state temporarily for persisting in vault
+                state.revokeToken = newRevokeToken;
+                // set new refresh token to persist in state
+                state.refreshToken = newRefreshToken;
+            });
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                password,
+                rawToprfEncryptionKey,
+                rawToprfPwEncryptionKey,
+                rawToprfAuthKeyPair,
+            });
+        });
+    }
     /**
      * Check if the current node auth token is expired.
      *
@@ -715,7 +758,7 @@ export class SeedlessOnboardingController extends BaseController {
         }
     }
 }
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -741,19 +784,8 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        const { revokeToken, toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-        if (revokeToken) {
-            // revoke and recyle refresh token after unlock to keep refresh token fresh, avoid malicious use of leaked refresh token
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState).call(this, revokeToken);
-            // re-creating vault to persist the new revoke token
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
-                password: globalPassword,
-                rawToprfEncryptionKey: toprfEncryptionKey,
-                rawToprfPwEncryptionKey: toprfPwEncryptionKey,
-                rawToprfAuthKeyPair: toprfAuthKeyPair,
-            });
-        }
     }
     catch (error) {
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
@@ -927,12 +959,31 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
  * @param params - The function parameters.
  * @param params.oldPassword - The old password to verify.
  * @param params.newPassword - The new password to update.
+ * @param params.latestKeyIndex - The key index of the latest key.
  * @returns A promise that resolves to new encryption key and authentication key pair.
  */
-async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword, newPassword, }) {
+async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword, newPassword, latestKeyIndex, }) {
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { authConnectionId, groupedAuthConnectionId, userId } = this.state;
-    const { encKey, pwEncKey, authKeyPair, keyShareIndex: newKeyShareIndex, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword);
+    let encKey;
+    let pwEncKey;
+    let authKeyPair;
+    let globalKeyIndex = latestKeyIndex;
+    if (!globalKeyIndex) {
+        ({
+            encKey,
+            pwEncKey,
+            authKeyPair,
+            keyShareIndex: globalKeyIndex,
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword));
+    }
+    else {
+        ({
+            toprfEncryptionKey: encKey,
+            toprfPwEncryptionKey: pwEncKey,
+            toprfAuthKeyPair: authKeyPair,
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
+    }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
         authConnectionId,
@@ -941,7 +992,7 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
         oldEncKey: encKey,
         oldPwEncKey: pwEncKey,
         oldAuthKeyPair: authKeyPair,
-        newKeyShareIndex,
+        newKeyShareIndex: globalKeyIndex,
         newPassword,
     });
     return result;
@@ -1283,36 +1334,37 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
  * @param options - The options for asserting the password is in sync.
  * @param options.skipCache - Whether to skip the cache check.
  * @param options.skipLock - Whether to skip the lock acquisition. (to prevent deadlock in case the caller already acquired the lock)
+ * @returns The global auth public key and the latest key index.
  * @throws If the password is outdated.
  */
 async function _SeedlessOnboardingController_assertPasswordInSync(options) {
-    const isPasswordOutdated = await this.checkIsPasswordOutdated(options);
+    const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
+    if (!nodeAuthTokens || !authConnectionId || !userId) {
+        throw new Error(SeedlessOnboardingControllerErrorMessage.MissingAuthUserInfo);
+    }
+    const { authPubKey, keyIndex: latestKeyIndex } = await this.toprfClient
+        .fetchAuthPubKey({
+        nodeAuthTokens,
+        authConnectionId,
+        groupedAuthConnectionId,
+        userId,
+    })
+        .catch((error) => {
+        log('Error fetching auth pub key', error);
+        throw new Error(SeedlessOnboardingControllerErrorMessage.FailedToFetchAuthPubKey);
+    });
+    const isPasswordOutdated = await this.checkIsPasswordOutdated({
+        ...options,
+        globalAuthPubKey: authPubKey,
+    });
     if (isPasswordOutdated) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.OutdatedPassword);
     }
+    return { authPubKey, latestKeyIndex };
 }, _SeedlessOnboardingController_resetPasswordOutdatedCache = function _SeedlessOnboardingController_resetPasswordOutdatedCache() {
     this.update((state) => {
         delete state.passwordOutdatedCache;
     });
-}, _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState = 
-/**
- * Revoke the refresh token and get new refresh token and new revoke token.
- * This method is to be called after user is authenticated.
- *
- * @param revokeToken - The revoke token to use for revoking the refresh token.
- */
-async function _SeedlessOnboardingController_revokeRefreshTokenAndUpdateState(revokeToken) {
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-    const { newRevokeToken, newRefreshToken } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_revokeRefreshToken, "f").call(this, {
-        connection: this.state.authConnection,
-        revokeToken,
-    });
-    this.update((state) => {
-        // set new revoke token in state temporarily for persisting in vault
-        state.revokeToken = newRevokeToken;
-        // set new refresh token to persist in state
-        state.refreshToken = newRefreshToken;
-    });
 }, _SeedlessOnboardingController_isTokenExpiredError = function _SeedlessOnboardingController_isTokenExpiredError(error) {
     if (error instanceof TOPRFError) {
         // eslint-disable-next-line @typescript-eslint/no-unsafe-enum-comparison