@metamask-previews/seedless-onboarding-controller 2.5.0-preview-3f5f144a → 2.5.0-preview-848c8e7d

package/dist/SeedlessOnboardingController.mjs

@@ -9,11 +9,11 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 import { keccak256AndHexify } from "@metamask/auth-network-utils";
 import { BaseController } from "@metamask/base-controller";
 import { ToprfSecureBackup, TOPRFErrorCode, TOPRFError } from "@metamask/toprf-secure-backup";
-import { base64ToBytes, bytesToBase64, bigIntToHex } from "@metamask/utils";
+import { base64ToBytes, bytesToBase64 } from "@metamask/utils";
 import { gcm } from "@noble/ciphers/aes";
 import { bytesToUtf8, utf8ToBytes } from "@noble/ciphers/utils";
 import { managedNonce } from "@noble/ciphers/webcrypto";
@@ -24,7 +24,7 @@ import { controllerName, PASSWORD_OUTDATED_CACHE_TTL_MS, SecretType, SeedlessOnb
 import { PasswordSyncError, RecoveryError } from "./errors.mjs";
 import { projectLogger, createModuleLogger } from "./logger.mjs";
 import { SecretMetadata } from "./SecretMetadata.mjs";
-import { decodeJWTToken, decodeNodeAuthToken } from "./utils.mjs";
+import { decodeJWTToken, decodeNodeAuthToken, deserializAuthKeyPair, serializeAuthKeyPair } from "./utils.mjs";
 const log = createModuleLogger(projectLogger, controllerName);
 /**
  * Get the default state for the Seedless Onboarding Controller.
@@ -80,10 +80,6 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
-    vaultEncryptionSalt: {
-        persist: false,
-        anonymous: true,
-    },
     authPubKey: {
         persist: true,
         anonymous: true,
@@ -119,6 +115,18 @@ const seedlessOnboardingMetadata = {
         persist: true,
         anonymous: true,
     },
+    toprfEncryptionKey: {
+        persist: false,
+        anonymous: true,
+    },
+    toprfPwEncryptionKey: {
+        persist: false,
+        anonymous: true,
+    },
+    toprfAuthKeyPair: {
+        persist: false,
+        anonymous: true,
+    },
 };
 export class SeedlessOnboardingController extends BaseController {
     /**
@@ -292,7 +300,7 @@ export class SeedlessOnboardingController extends BaseController {
                 // to have an account but with no associated data.
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistOprfKey).call(this, oprfKey, authKeyPair.pk);
                 // create a new vault with the resulting authentication data
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                     password,
                     rawToprfEncryptionKey: encKey,
                     rawToprfPwEncryptionKey: pwEncKey,
@@ -313,20 +321,22 @@ export class SeedlessOnboardingController extends BaseController {
      */
     async addNewSecretData(data, type, options) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            // assert that the controller is unlocked before adding new secret data
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+            // get the TOPRF encryption key and authentication key pair from the state
+            const { toprfEncryptionKey, toprfAuthKeyPair } = this.state;
+            // assert that the password is in sync with the encryption key
             await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
                 skipCache: true,
                 skipLock: true, // skip lock since we already have the lock
             });
             const performBackup = async () => {
-                // verify the password and unlock the vault
-                const { toprfEncryptionKey, toprfAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
                 // encrypt and store the secret data
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSecretData).call(this, {
                     data,
                     type,
-                    encKey: toprfEncryptionKey,
-                    authKeyPair: toprfAuthKeyPair,
+                    encKey: base64ToBytes(toprfEncryptionKey),
+                    authKeyPair: deserializAuthKeyPair(toprfAuthKeyPair),
                     options,
                 });
             };
@@ -355,18 +365,17 @@ export class SeedlessOnboardingController extends BaseController {
                 authKeyPair = recoverEncKeyResult.authKeyPair;
             }
             else {
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
-                // verify the password and unlock the vault
-                const keysFromVault = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
-                encKey = keysFromVault.toprfEncryptionKey;
-                pwEncKey = keysFromVault.toprfPwEncryptionKey;
-                authKeyPair = keysFromVault.toprfAuthKeyPair;
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+                const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = this.state;
+                encKey = base64ToBytes(toprfEncryptionKey);
+                pwEncKey = base64ToBytes(toprfPwEncryptionKey);
+                authKeyPair = deserializAuthKeyPair(toprfAuthKeyPair);
             }
             const performFetch = async () => {
                 const secrets = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore).call(this, encKey, authKeyPair);
                 if (password) {
                     // if password is provided, we need to create a new vault with the auth data. (supposedly the user is trying to rehydrate the wallet)
-                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                         password,
                         rawToprfEncryptionKey: encKey,
                         rawToprfPwEncryptionKey: pwEncKey,
@@ -389,7 +398,8 @@ export class SeedlessOnboardingController extends BaseController {
      */
     async changePassword(newPassword, oldPassword) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            // assert that the controller is unlocked before changing the password
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
             // verify the old password of the encrypted vault
             await this.verifyVaultPassword(oldPassword, {
                 skipLock: true, // skip lock since we already have the lock
@@ -411,7 +421,7 @@ export class SeedlessOnboardingController extends BaseController {
                     latestKeyIndex,
                 });
                 // update and encrypt the vault with new password
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                     password: newPassword,
                     rawToprfEncryptionKey: newEncKey,
                     rawToprfPwEncryptionKey: newPwEncKey,
@@ -440,7 +450,7 @@ export class SeedlessOnboardingController extends BaseController {
      * @param secretData.data - The secret data to update the backup metadata state.
      */
     updateBackupMetadataState(secretData) {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata).call(this, secretData);
     }
     /**
@@ -489,7 +499,7 @@ export class SeedlessOnboardingController extends BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password });
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
@@ -501,7 +511,9 @@ export class SeedlessOnboardingController extends BaseController {
     setLocked() {
         this.update((state) => {
             delete state.vaultEncryptionKey;
-            delete state.vaultEncryptionSalt;
+            delete state.toprfEncryptionKey;
+            delete state.toprfPwEncryptionKey;
+            delete state.toprfAuthKeyPair;
             delete state.revokeToken;
             delete state.accessToken;
         });
@@ -518,12 +530,12 @@ export class SeedlessOnboardingController extends BaseController {
      */
     async syncLatestGlobalPassword({ globalPassword, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
             const doSyncPassword = async () => {
                 // update vault with latest globalPassword
                 const { encKey, pwEncKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
                 // update and encrypt the vault with new password
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                     password: globalPassword,
                     rawToprfEncryptionKey: encKey,
                     rawToprfPwEncryptionKey: pwEncKey,
@@ -624,7 +636,9 @@ export class SeedlessOnboardingController extends BaseController {
      * @param keyringEncryptionKey - The keyring encryption key.
      */
     async storeKeyringEncryptionKey(keyringEncryptionKey) {
-        const { toprfPwEncryptionKey: encKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+        const { toprfPwEncryptionKey } = this.state;
+        const encKey = base64ToBytes(toprfPwEncryptionKey);
         await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_storeKeyringEncryptionKey).call(this, encKey, keyringEncryptionKey);
     }
     /**
@@ -634,7 +648,9 @@ export class SeedlessOnboardingController extends BaseController {
      * @returns The keyring encryption key.
      */
     async loadKeyringEncryptionKey() {
-        const { toprfPwEncryptionKey: encKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+        const { toprfPwEncryptionKey } = this.state;
+        const encKey = base64ToBytes(toprfPwEncryptionKey);
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, encKey);
     }
     /**
@@ -683,7 +699,10 @@ export class SeedlessOnboardingController extends BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+                password,
+                encryptionKey: vaultEncryptionKey,
+            });
             if (!revokeToken) {
                 throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
@@ -697,7 +716,7 @@ export class SeedlessOnboardingController extends BaseController {
                 // set new refresh token to persist in state
                 state.refreshToken = newRefreshToken;
             });
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                 password,
                 rawToprfEncryptionKey,
                 rawToprfPwEncryptionKey,
@@ -784,7 +803,9 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+            encryptionKey: vaultKey,
+        });
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     }
     catch (error) {
@@ -816,7 +837,10 @@ async function _SeedlessOnboardingController_getAccessToken(password) {
     if (!vault) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
-    const { accessToken: accessTokenFromVault } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
+    const { accessToken: accessTokenFromVault } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+        password,
+        skipVaultMutexLock: true,
+    });
     return accessTokenFromVault;
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
@@ -935,7 +959,6 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
         });
     }
     catch (error) {
-        log('Error fetching secret data', error);
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
             throw error;
         }
@@ -978,11 +1001,12 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
         } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword));
     }
     else {
-        ({
-            toprfEncryptionKey: encKey,
-            toprfPwEncryptionKey: pwEncKey,
-            toprfAuthKeyPair: authKeyPair,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
+        // get the TOPRF encryption key and authentication key pair from the state
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = this.state;
+        encKey = base64ToBytes(toprfEncryptionKey);
+        pwEncKey = base64ToBytes(toprfPwEncryptionKey);
+        authKeyPair = deserializAuthKeyPair(toprfAuthKeyPair);
     }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
@@ -1048,11 +1072,15 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
     }
 }, _SeedlessOnboardingController_unlockVaultAndGetVaultData = 
 /**
- * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
+ * Unlocks the encrypted vault using the provided password or encryption key and returns the decrypted vault data.
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
- * @param password - The optional password to unlock the vault.
- * @param encryptionKey - The optional encryption key to unlock the vault.
+ * Successfully unlocking the vault will update the controller state with the decrypted vault data.
+ *
+ * @param params - The parameters for unlocking the vault.
+ * @param params.password - The optional password to unlock the vault.
+ * @param params.encryptionKey - The optional encryption key to unlock the vault.
+ * @param params.skipVaultMutexLock - Whether to skip the vault mutex lock.
  * @returns A promise that resolves to an object containing:
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
@@ -1064,44 +1092,40 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password, encryptionKey) {
-    return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
+async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params) {
+    const doUnlockVaultAndGetVaultData = async () => {
         let { vaultEncryptionKey } = this.state;
-        const { vault: encryptedVault, vaultEncryptionSalt } = this.state;
+        const { vault: encryptedVault } = this.state;
         if (!encryptedVault) {
             throw new Error(SeedlessOnboardingControllerErrorMessage.VaultError);
         }
-        if (encryptionKey) {
-            vaultEncryptionKey = encryptionKey;
+        if (params?.encryptionKey) {
+            vaultEncryptionKey = params.encryptionKey;
         }
         let decryptedVaultData;
         const updatedState = {};
-        if (password) {
-            assertIsValidPassword(password);
+        if (params?.password) {
+            assertIsValidPassword(params.password);
             // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
             // from the password using an intentionally slow key derivation function.
             // We should make sure that we only call it very intentionally.
-            const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(password, encryptedVault);
+            const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(params.password, encryptedVault);
             decryptedVaultData = result.vault;
             updatedState.vaultEncryptionKey = result.exportedKeyString;
-            updatedState.vaultEncryptionSalt = result.salt;
         }
         else {
             assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
             const parsedEncryptedVault = JSON.parse(encryptedVault);
-            if (vaultEncryptionSalt &&
-                vaultEncryptionSalt !== parsedEncryptedVault.salt) {
-                throw new Error(SeedlessOnboardingControllerErrorMessage.ExpiredCredentials);
-            }
             const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
             decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
             updatedState.vaultEncryptionKey = vaultEncryptionKey;
-            updatedState.vaultEncryptionSalt = vaultEncryptionSalt;
         }
         const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
         this.update((state) => {
             state.vaultEncryptionKey = updatedState.vaultEncryptionKey;
-            state.vaultEncryptionSalt = updatedState.vaultEncryptionSalt;
+            state.toprfEncryptionKey = bytesToBase64(toprfEncryptionKey);
+            state.toprfPwEncryptionKey = bytesToBase64(toprfPwEncryptionKey);
+            state.toprfAuthKeyPair = serializeAuthKeyPair(toprfAuthKeyPair);
             state.revokeToken = revokeToken;
             state.accessToken = accessToken;
         });
@@ -1112,7 +1136,10 @@ async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password
             revokeToken,
             accessToken,
         };
-    });
+    };
+    return params?.skipVaultMutexLock
+        ? doUnlockVaultAndGetVaultData()
+        : __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, doUnlockVaultAndGetVaultData);
 }, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState = 
 /**
  * Executes a callback function that creates or restores secret data and persists their hashes in the controller state.
@@ -1169,65 +1196,54 @@ async function _SeedlessOnboardingController_withPersistedSecretMetadataBackupsS
             ];
         });
     }
-}, _SeedlessOnboardingController_createNewVaultWithAuthData = 
-/**
- * Create a new vault with the given authentication data.
- *
- * Serialize the authentication and key data which will be stored in the vault.
- *
- * @param params - The parameters for creating a new vault.
- * @param params.password - The password to encrypt the vault.
- * @param params.rawToprfEncryptionKey - The encryption key to encrypt the vault.
- * @param params.rawToprfPwEncryptionKey - The encryption key to encrypt the password.
- * @param params.rawToprfAuthKeyPair - The authentication key pair to encrypt the vault.
- */
-async function _SeedlessOnboardingController_createNewVaultWithAuthData({ password, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair, }) {
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-    const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-    const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
-    const serializedVaultData = JSON.stringify({
-        toprfEncryptionKey,
-        toprfPwEncryptionKey,
-        toprfAuthKeyPair,
-        revokeToken: this.state.revokeToken,
-        accessToken,
-    });
-    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
-        password,
-        serializedVaultData,
-        pwEncKey: rawToprfPwEncryptionKey,
-    });
-    // update the authPubKey in the state
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
-        authPubKey: rawToprfAuthKeyPair.pk,
-    });
 }, _SeedlessOnboardingController_updateVault = 
 /**
  * Encrypt and update the vault with the given authentication data.
  *
  * @param params - The parameters for updating the vault.
  * @param params.password - The password to encrypt the vault.
- * @param params.serializedVaultData - The serialized authentication data to update the vault with.
- * @param params.pwEncKey - The global password encryption key.
+ * @param params.rawToprfEncryptionKey - The TOPRF encryption key.
+ * @param params.rawToprfPwEncryptionKey - The TOPRF password encryption key.
+ * @param params.rawToprfAuthKeyPair - The TOPRF authentication key pair.
  * @returns A promise that resolves to the updated vault.
  */
-async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, pwEncKey, }) {
+async function _SeedlessOnboardingController_updateVault({ password, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair, }) {
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
         assertIsValidPassword(password);
+        const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
+        const toprfEncryptionKey = bytesToBase64(rawToprfEncryptionKey);
+        const toprfPwEncryptionKey = bytesToBase64(rawToprfPwEncryptionKey);
+        const toprfAuthKeyPair = serializeAuthKeyPair(rawToprfAuthKeyPair);
+        const serializedVaultData = JSON.stringify({
+            toprfEncryptionKey,
+            toprfPwEncryptionKey,
+            toprfAuthKeyPair,
+            revokeToken: this.state.revokeToken,
+            accessToken,
+        });
         // Note that vault encryption using the password is a very costly operation as it involves deriving the encryption key
         // from the password using an intentionally slow key derivation function.
         // We should make sure that we only call it very intentionally.
         const { vault, exportedKeyString } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").encryptWithDetail(password, serializedVaultData);
         // Encrypt vault key.
-        const aes = managedNonce(gcm)(pwEncKey);
+        const aes = managedNonce(gcm)(rawToprfPwEncryptionKey);
         const encryptedKey = aes.encrypt(utf8ToBytes(exportedKeyString));
+        // update the controller state after updating the vault
         this.update((state) => {
             state.vault = vault;
             state.vaultEncryptionKey = exportedKeyString;
-            state.vaultEncryptionSalt = JSON.parse(vault).salt;
             state.encryptedSeedlessEncryptionKey = bytesToBase64(encryptedKey);
+            state.toprfEncryptionKey = toprfEncryptionKey;
+            state.toprfPwEncryptionKey = toprfPwEncryptionKey;
+            state.toprfAuthKeyPair = toprfAuthKeyPair;
+        });
+        // update the authPubKey in the state
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
+            authPubKey: rawToprfAuthKeyPair.pk,
         });
+        // unlock the controller
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     });
 }, _SeedlessOnboardingController_withControllerLock = 
 /**
@@ -1258,18 +1274,6 @@ async function _SeedlessOnboardingController_withControllerLock(callback) {
  */
 async function _SeedlessOnboardingController_withVaultLock(callback) {
     return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
-}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, pwEncKey, authKeyPair) {
-    const b64EncodedEncKey = bytesToBase64(encKey);
-    const b64EncodedPwEncKey = bytesToBase64(pwEncKey);
-    const b64EncodedAuthKeyPair = JSON.stringify({
-        sk: bigIntToHex(authKeyPair.sk),
-        pk: bytesToBase64(authKeyPair.pk),
-    });
-    return {
-        toprfEncryptionKey: b64EncodedEncKey,
-        toprfPwEncryptionKey: b64EncodedPwEncKey,
-        toprfAuthKeyPair: b64EncodedAuthKeyPair,
-    };
 }, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
     if (typeof data !== 'string') {
         throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
@@ -1284,11 +1288,7 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
     assertIsValidVaultData(parsedVaultData);
     const rawToprfEncryptionKey = base64ToBytes(parsedVaultData.toprfEncryptionKey);
     const rawToprfPwEncryptionKey = base64ToBytes(parsedVaultData.toprfPwEncryptionKey);
-    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
-    const rawToprfAuthKeyPair = {
-        sk: BigInt(parsedToprfAuthKeyPair.sk),
-        pk: base64ToBytes(parsedToprfAuthKeyPair.pk),
-    };
+    const rawToprfAuthKeyPair = deserializAuthKeyPair(parsedVaultData.toprfAuthKeyPair);
     return {
         toprfEncryptionKey: rawToprfEncryptionKey,
         toprfPwEncryptionKey: rawToprfPwEncryptionKey,
@@ -1296,10 +1296,17 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         revokeToken: parsedVaultData.revokeToken,
         accessToken: parsedVaultData.accessToken,
     };
-}, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
+}, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked(value) {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.ControllerLocked);
     }
+    if (!value ||
+        typeof value !== 'object' ||
+        !('toprfEncryptionKey' in value) ||
+        !('toprfPwEncryptionKey' in value) ||
+        !('toprfAuthKeyPair' in value)) {
+        throw new Error(SeedlessOnboardingControllerErrorMessage.VaultLocked);
+    }
 }, _SeedlessOnboardingController_assertIsAuthenticatedUser = function _SeedlessOnboardingController_assertIsAuthenticatedUser(value) {
     if (!value ||
         typeof value !== 'object' ||