@metamask-previews/seedless-onboarding-controller 2.5.0-preview-3f5f144a → 2.5.0-preview-b8352c78

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -84,10 +84,6 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
-    vaultEncryptionSalt: {
-        persist: false,
-        anonymous: true,
-    },
     authPubKey: {
         persist: true,
         anonymous: true,
@@ -123,6 +119,18 @@ const seedlessOnboardingMetadata = {
         persist: true,
         anonymous: true,
     },
+    toprfEncryptionKey: {
+        persist: false,
+        anonymous: true,
+    },
+    toprfPwEncryptionKey: {
+        persist: false,
+        anonymous: true,
+    },
+    toprfAuthKeyPair: {
+        persist: false,
+        anonymous: true,
+    },
 };
 class SeedlessOnboardingController extends base_controller_1.BaseController {
     /**
@@ -296,7 +304,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 // to have an account but with no associated data.
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistOprfKey).call(this, oprfKey, authKeyPair.pk);
                 // create a new vault with the resulting authentication data
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                     password,
                     rawToprfEncryptionKey: encKey,
                     rawToprfPwEncryptionKey: pwEncKey,
@@ -317,20 +325,22 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async addNewSecretData(data, type, options) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            // assert that the controller is unlocked before adding new secret data
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+            // get the TOPRF encryption key and authentication key pair from the state
+            const { toprfEncryptionKey, toprfAuthKeyPair } = this.state;
+            // assert that the password is in sync with the encryption key
             await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
                 skipCache: true,
                 skipLock: true, // skip lock since we already have the lock
             });
             const performBackup = async () => {
-                // verify the password and unlock the vault
-                const { toprfEncryptionKey, toprfAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
                 // encrypt and store the secret data
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSecretData).call(this, {
                     data,
                     type,
-                    encKey: toprfEncryptionKey,
-                    authKeyPair: toprfAuthKeyPair,
+                    encKey: (0, utils_1.base64ToBytes)(toprfEncryptionKey),
+                    authKeyPair: (0, utils_3.deserializAuthKeyPair)(toprfAuthKeyPair),
                     options,
                 });
             };
@@ -359,18 +369,17 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 authKeyPair = recoverEncKeyResult.authKeyPair;
             }
             else {
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
-                // verify the password and unlock the vault
-                const keysFromVault = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
-                encKey = keysFromVault.toprfEncryptionKey;
-                pwEncKey = keysFromVault.toprfPwEncryptionKey;
-                authKeyPair = keysFromVault.toprfAuthKeyPair;
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+                const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = this.state;
+                encKey = (0, utils_1.base64ToBytes)(toprfEncryptionKey);
+                pwEncKey = (0, utils_1.base64ToBytes)(toprfPwEncryptionKey);
+                authKeyPair = (0, utils_3.deserializAuthKeyPair)(toprfAuthKeyPair);
             }
             const performFetch = async () => {
                 const secrets = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore).call(this, encKey, authKeyPair);
                 if (password) {
                     // if password is provided, we need to create a new vault with the auth data. (supposedly the user is trying to rehydrate the wallet)
-                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                         password,
                         rawToprfEncryptionKey: encKey,
                         rawToprfPwEncryptionKey: pwEncKey,
@@ -393,7 +402,8 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async changePassword(newPassword, oldPassword) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            // assert that the controller is unlocked before changing the password
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
             // verify the old password of the encrypted vault
             await this.verifyVaultPassword(oldPassword, {
                 skipLock: true, // skip lock since we already have the lock
@@ -415,7 +425,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     latestKeyIndex,
                 });
                 // update and encrypt the vault with new password
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                     password: newPassword,
                     rawToprfEncryptionKey: newEncKey,
                     rawToprfPwEncryptionKey: newPwEncKey,
@@ -444,7 +454,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param secretData.data - The secret data to update the backup metadata state.
      */
     updateBackupMetadataState(secretData) {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata).call(this, secretData);
     }
     /**
@@ -493,7 +503,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password });
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
@@ -505,7 +515,9 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     setLocked() {
         this.update((state) => {
             delete state.vaultEncryptionKey;
-            delete state.vaultEncryptionSalt;
+            delete state.toprfEncryptionKey;
+            delete state.toprfPwEncryptionKey;
+            delete state.toprfAuthKeyPair;
             delete state.revokeToken;
             delete state.accessToken;
         });
@@ -522,12 +534,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async syncLatestGlobalPassword({ globalPassword, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
             const doSyncPassword = async () => {
                 // update vault with latest globalPassword
                 const { encKey, pwEncKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
                 // update and encrypt the vault with new password
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                     password: globalPassword,
                     rawToprfEncryptionKey: encKey,
                     rawToprfPwEncryptionKey: pwEncKey,
@@ -628,7 +640,9 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param keyringEncryptionKey - The keyring encryption key.
      */
     async storeKeyringEncryptionKey(keyringEncryptionKey) {
-        const { toprfPwEncryptionKey: encKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+        const { toprfPwEncryptionKey } = this.state;
+        const encKey = (0, utils_1.base64ToBytes)(toprfPwEncryptionKey);
         await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_storeKeyringEncryptionKey).call(this, encKey, keyringEncryptionKey);
     }
     /**
@@ -638,7 +652,9 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @returns The keyring encryption key.
      */
     async loadKeyringEncryptionKey() {
-        const { toprfPwEncryptionKey: encKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+        const { toprfPwEncryptionKey } = this.state;
+        const encKey = (0, utils_1.base64ToBytes)(toprfPwEncryptionKey);
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, encKey);
     }
     /**
@@ -687,7 +703,10 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+                password,
+                encryptionKey: vaultEncryptionKey,
+            });
             if (!revokeToken) {
                 throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
@@ -701,7 +720,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 // set new refresh token to persist in state
                 state.refreshToken = newRefreshToken;
             });
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
                 password,
                 rawToprfEncryptionKey,
                 rawToprfPwEncryptionKey,
@@ -789,7 +808,9 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+            encryptionKey: vaultKey,
+        });
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     }
     catch (error) {
@@ -821,7 +842,10 @@ async function _SeedlessOnboardingController_getAccessToken(password) {
     if (!vault) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
-    const { accessToken: accessTokenFromVault } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
+    const { accessToken: accessTokenFromVault } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+        password,
+        skipVaultMutexLock: true,
+    });
     return accessTokenFromVault;
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
@@ -940,7 +964,6 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
         });
     }
     catch (error) {
-        log('Error fetching secret data', error);
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
             throw error;
         }
@@ -983,11 +1006,12 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
         } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword));
     }
     else {
-        ({
-            toprfEncryptionKey: encKey,
-            toprfPwEncryptionKey: pwEncKey,
-            toprfAuthKeyPair: authKeyPair,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
+        // get the TOPRF encryption key and authentication key pair from the state
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = this.state;
+        encKey = (0, utils_1.base64ToBytes)(toprfEncryptionKey);
+        pwEncKey = (0, utils_1.base64ToBytes)(toprfPwEncryptionKey);
+        authKeyPair = (0, utils_3.deserializAuthKeyPair)(toprfAuthKeyPair);
     }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
@@ -1056,8 +1080,10 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
- * @param password - The optional password to unlock the vault.
- * @param encryptionKey - The optional encryption key to unlock the vault.
+ * @param params - The parameters for unlocking the vault.
+ * @param params.password - The optional password to unlock the vault.
+ * @param params.encryptionKey - The optional encryption key to unlock the vault.
+ * @param params.skipVaultMutexLock - Whether to skip the vault mutex lock.
  * @returns A promise that resolves to an object containing:
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
@@ -1069,44 +1095,40 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password, encryptionKey) {
-    return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
+async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params) {
+    const doUnlockVaultAndGetVaultData = async () => {
         let { vaultEncryptionKey } = this.state;
-        const { vault: encryptedVault, vaultEncryptionSalt } = this.state;
+        const { vault: encryptedVault } = this.state;
         if (!encryptedVault) {
             throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultError);
         }
-        if (encryptionKey) {
-            vaultEncryptionKey = encryptionKey;
+        if (params?.encryptionKey) {
+            vaultEncryptionKey = params.encryptionKey;
         }
         let decryptedVaultData;
         const updatedState = {};
-        if (password) {
-            assertIsValidPassword(password);
+        if (params?.password) {
+            assertIsValidPassword(params.password);
             // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
             // from the password using an intentionally slow key derivation function.
             // We should make sure that we only call it very intentionally.
-            const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(password, encryptedVault);
+            const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(params.password, encryptedVault);
             decryptedVaultData = result.vault;
             updatedState.vaultEncryptionKey = result.exportedKeyString;
-            updatedState.vaultEncryptionSalt = result.salt;
         }
         else {
             assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
             const parsedEncryptedVault = JSON.parse(encryptedVault);
-            if (vaultEncryptionSalt &&
-                vaultEncryptionSalt !== parsedEncryptedVault.salt) {
-                throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ExpiredCredentials);
-            }
             const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
             decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
             updatedState.vaultEncryptionKey = vaultEncryptionKey;
-            updatedState.vaultEncryptionSalt = vaultEncryptionSalt;
         }
         const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
         this.update((state) => {
             state.vaultEncryptionKey = updatedState.vaultEncryptionKey;
-            state.vaultEncryptionSalt = updatedState.vaultEncryptionSalt;
+            state.toprfEncryptionKey = (0, utils_1.bytesToBase64)(toprfEncryptionKey);
+            state.toprfPwEncryptionKey = (0, utils_1.bytesToBase64)(toprfPwEncryptionKey);
+            state.toprfAuthKeyPair = (0, utils_3.serializeAuthKeyPair)(toprfAuthKeyPair);
             state.revokeToken = revokeToken;
             state.accessToken = accessToken;
         });
@@ -1117,7 +1139,10 @@ async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password
             revokeToken,
             accessToken,
         };
-    });
+    };
+    return params?.skipVaultMutexLock
+        ? doUnlockVaultAndGetVaultData()
+        : __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, doUnlockVaultAndGetVaultData);
 }, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState = 
 /**
  * Executes a callback function that creates or restores secret data and persists their hashes in the controller state.
@@ -1174,65 +1199,54 @@ async function _SeedlessOnboardingController_withPersistedSecretMetadataBackupsS
             ];
         });
     }
-}, _SeedlessOnboardingController_createNewVaultWithAuthData = 
-/**
- * Create a new vault with the given authentication data.
- *
- * Serialize the authentication and key data which will be stored in the vault.
- *
- * @param params - The parameters for creating a new vault.
- * @param params.password - The password to encrypt the vault.
- * @param params.rawToprfEncryptionKey - The encryption key to encrypt the vault.
- * @param params.rawToprfPwEncryptionKey - The encryption key to encrypt the password.
- * @param params.rawToprfAuthKeyPair - The authentication key pair to encrypt the vault.
- */
-async function _SeedlessOnboardingController_createNewVaultWithAuthData({ password, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair, }) {
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
-    const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-    const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
-    const serializedVaultData = JSON.stringify({
-        toprfEncryptionKey,
-        toprfPwEncryptionKey,
-        toprfAuthKeyPair,
-        revokeToken: this.state.revokeToken,
-        accessToken,
-    });
-    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
-        password,
-        serializedVaultData,
-        pwEncKey: rawToprfPwEncryptionKey,
-    });
-    // update the authPubKey in the state
-    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
-        authPubKey: rawToprfAuthKeyPair.pk,
-    });
 }, _SeedlessOnboardingController_updateVault = 
 /**
  * Encrypt and update the vault with the given authentication data.
  *
  * @param params - The parameters for updating the vault.
  * @param params.password - The password to encrypt the vault.
- * @param params.serializedVaultData - The serialized authentication data to update the vault with.
- * @param params.pwEncKey - The global password encryption key.
+ * @param params.rawToprfEncryptionKey - The TOPRF encryption key.
+ * @param params.rawToprfPwEncryptionKey - The TOPRF password encryption key.
+ * @param params.rawToprfAuthKeyPair - The TOPRF authentication key pair.
  * @returns A promise that resolves to the updated vault.
  */
-async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, pwEncKey, }) {
+async function _SeedlessOnboardingController_updateVault({ password, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair, }) {
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
         assertIsValidPassword(password);
+        const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
+        const toprfEncryptionKey = (0, utils_1.bytesToBase64)(rawToprfEncryptionKey);
+        const toprfPwEncryptionKey = (0, utils_1.bytesToBase64)(rawToprfPwEncryptionKey);
+        const toprfAuthKeyPair = (0, utils_3.serializeAuthKeyPair)(rawToprfAuthKeyPair);
+        const serializedVaultData = JSON.stringify({
+            toprfEncryptionKey,
+            toprfPwEncryptionKey,
+            toprfAuthKeyPair,
+            revokeToken: this.state.revokeToken,
+            accessToken,
+        });
         // Note that vault encryption using the password is a very costly operation as it involves deriving the encryption key
         // from the password using an intentionally slow key derivation function.
         // We should make sure that we only call it very intentionally.
         const { vault, exportedKeyString } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").encryptWithDetail(password, serializedVaultData);
         // Encrypt vault key.
-        const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(pwEncKey);
+        const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(rawToprfPwEncryptionKey);
         const encryptedKey = aes.encrypt((0, utils_2.utf8ToBytes)(exportedKeyString));
+        // update the controller state after updating the vault
         this.update((state) => {
             state.vault = vault;
             state.vaultEncryptionKey = exportedKeyString;
-            state.vaultEncryptionSalt = JSON.parse(vault).salt;
             state.encryptedSeedlessEncryptionKey = (0, utils_1.bytesToBase64)(encryptedKey);
+            state.toprfEncryptionKey = toprfEncryptionKey;
+            state.toprfPwEncryptionKey = toprfPwEncryptionKey;
+            state.toprfAuthKeyPair = toprfAuthKeyPair;
+        });
+        // update the authPubKey in the state
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
+            authPubKey: rawToprfAuthKeyPair.pk,
         });
+        // unlock the controller
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     });
 }, _SeedlessOnboardingController_withControllerLock = 
 /**
@@ -1263,18 +1277,6 @@ async function _SeedlessOnboardingController_withControllerLock(callback) {
  */
 async function _SeedlessOnboardingController_withVaultLock(callback) {
     return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
-}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, pwEncKey, authKeyPair) {
-    const b64EncodedEncKey = (0, utils_1.bytesToBase64)(encKey);
-    const b64EncodedPwEncKey = (0, utils_1.bytesToBase64)(pwEncKey);
-    const b64EncodedAuthKeyPair = JSON.stringify({
-        sk: (0, utils_1.bigIntToHex)(authKeyPair.sk),
-        pk: (0, utils_1.bytesToBase64)(authKeyPair.pk),
-    });
-    return {
-        toprfEncryptionKey: b64EncodedEncKey,
-        toprfPwEncryptionKey: b64EncodedPwEncKey,
-        toprfAuthKeyPair: b64EncodedAuthKeyPair,
-    };
 }, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
     if (typeof data !== 'string') {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
@@ -1289,11 +1291,7 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
     (0, assertions_1.assertIsValidVaultData)(parsedVaultData);
     const rawToprfEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfEncryptionKey);
     const rawToprfPwEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfPwEncryptionKey);
-    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
-    const rawToprfAuthKeyPair = {
-        sk: BigInt(parsedToprfAuthKeyPair.sk),
-        pk: (0, utils_1.base64ToBytes)(parsedToprfAuthKeyPair.pk),
-    };
+    const rawToprfAuthKeyPair = (0, utils_3.deserializAuthKeyPair)(parsedVaultData.toprfAuthKeyPair);
     return {
         toprfEncryptionKey: rawToprfEncryptionKey,
         toprfPwEncryptionKey: rawToprfPwEncryptionKey,
@@ -1301,10 +1299,17 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         revokeToken: parsedVaultData.revokeToken,
         accessToken: parsedVaultData.accessToken,
     };
-}, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
+}, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked(value) {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ControllerLocked);
     }
+    if (!value ||
+        typeof value !== 'object' ||
+        !('toprfEncryptionKey' in value) ||
+        !('toprfPwEncryptionKey' in value) ||
+        !('toprfAuthKeyPair' in value)) {
+        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultLocked);
+    }
 }, _SeedlessOnboardingController_assertIsAuthenticatedUser = function _SeedlessOnboardingController_assertIsAuthenticatedUser(value) {
     if (!value ||
         typeof value !== 'object' ||