@metamask-previews/seedless-onboarding-controller 2.5.0-preview-848c8e7d → 2.5.0-preview-0910ff0

package/dist/SeedlessOnboardingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedlessOnboardingController = exports.getDefaultSeedlessOnboardingControllerState = void 0;
 const auth_network_utils_1 = require("@metamask/auth-network-utils");
@@ -84,6 +84,10 @@ const seedlessOnboardingMetadata = {
         persist: false,
         anonymous: true,
     },
+    vaultEncryptionSalt: {
+        persist: false,
+        anonymous: true,
+    },
     authPubKey: {
         persist: true,
         anonymous: true,
@@ -119,18 +123,6 @@ const seedlessOnboardingMetadata = {
         persist: true,
         anonymous: true,
     },
-    toprfEncryptionKey: {
-        persist: false,
-        anonymous: true,
-    },
-    toprfPwEncryptionKey: {
-        persist: false,
-        anonymous: true,
-    },
-    toprfAuthKeyPair: {
-        persist: false,
-        anonymous: true,
-    },
 };
 class SeedlessOnboardingController extends base_controller_1.BaseController {
     /**
@@ -304,7 +296,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 // to have an account but with no associated data.
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistOprfKey).call(this, oprfKey, authKeyPair.pk);
                 // create a new vault with the resulting authentication data
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                     password,
                     rawToprfEncryptionKey: encKey,
                     rawToprfPwEncryptionKey: pwEncKey,
@@ -325,22 +317,20 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async addNewSecretData(data, type, options) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            // assert that the controller is unlocked before adding new secret data
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
-            // get the TOPRF encryption key and authentication key pair from the state
-            const { toprfEncryptionKey, toprfAuthKeyPair } = this.state;
-            // assert that the password is in sync with the encryption key
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
             await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertPasswordInSync).call(this, {
                 skipCache: true,
                 skipLock: true, // skip lock since we already have the lock
             });
             const performBackup = async () => {
+                // verify the password and unlock the vault
+                const { toprfEncryptionKey, toprfAuthKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
                 // encrypt and store the secret data
                 await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_encryptAndStoreSecretData).call(this, {
                     data,
                     type,
-                    encKey: (0, utils_1.base64ToBytes)(toprfEncryptionKey),
-                    authKeyPair: (0, utils_3.deserializAuthKeyPair)(toprfAuthKeyPair),
+                    encKey: toprfEncryptionKey,
+                    authKeyPair: toprfAuthKeyPair,
                     options,
                 });
             };
@@ -369,17 +359,18 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 authKeyPair = recoverEncKeyResult.authKeyPair;
             }
             else {
-                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
-                const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = this.state;
-                encKey = (0, utils_1.base64ToBytes)(toprfEncryptionKey);
-                pwEncKey = (0, utils_1.base64ToBytes)(toprfPwEncryptionKey);
-                authKeyPair = (0, utils_3.deserializAuthKeyPair)(toprfAuthKeyPair);
+                __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
+                // verify the password and unlock the vault
+                const keysFromVault = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
+                encKey = keysFromVault.toprfEncryptionKey;
+                pwEncKey = keysFromVault.toprfPwEncryptionKey;
+                authKeyPair = keysFromVault.toprfAuthKeyPair;
             }
             const performFetch = async () => {
                 const secrets = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore).call(this, encKey, authKeyPair);
                 if (password) {
                     // if password is provided, we need to create a new vault with the auth data. (supposedly the user is trying to rehydrate the wallet)
-                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+                    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                         password,
                         rawToprfEncryptionKey: encKey,
                         rawToprfPwEncryptionKey: pwEncKey,
@@ -402,8 +393,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async changePassword(newPassword, oldPassword) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            // assert that the controller is unlocked before changing the password
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
             // verify the old password of the encrypted vault
             await this.verifyVaultPassword(oldPassword, {
                 skipLock: true, // skip lock since we already have the lock
@@ -425,7 +415,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                     latestKeyIndex,
                 });
                 // update and encrypt the vault with new password
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                     password: newPassword,
                     rawToprfEncryptionKey: newEncKey,
                     rawToprfPwEncryptionKey: newPwEncKey,
@@ -454,7 +444,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param secretData.data - The secret data to update the backup metadata state.
      */
     updateBackupMetadataState(secretData) {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata).call(this, secretData);
     }
     /**
@@ -503,7 +493,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password });
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
@@ -515,9 +505,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
     setLocked() {
         this.update((state) => {
             delete state.vaultEncryptionKey;
-            delete state.toprfEncryptionKey;
-            delete state.toprfPwEncryptionKey;
-            delete state.toprfAuthKeyPair;
+            delete state.vaultEncryptionSalt;
             delete state.revokeToken;
             delete state.accessToken;
         });
@@ -534,12 +522,12 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      */
     async syncLatestGlobalPassword({ globalPassword, }) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
+            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this);
             const doSyncPassword = async () => {
                 // update vault with latest globalPassword
                 const { encKey, pwEncKey, authKeyPair } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, globalPassword);
                 // update and encrypt the vault with new password
-                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+                await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                     password: globalPassword,
                     rawToprfEncryptionKey: encKey,
                     rawToprfPwEncryptionKey: pwEncKey,
@@ -640,9 +628,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @param keyringEncryptionKey - The keyring encryption key.
      */
     async storeKeyringEncryptionKey(keyringEncryptionKey) {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
-        const { toprfPwEncryptionKey } = this.state;
-        const encKey = (0, utils_1.base64ToBytes)(toprfPwEncryptionKey);
+        const { toprfPwEncryptionKey: encKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
         await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_storeKeyringEncryptionKey).call(this, encKey, keyringEncryptionKey);
     }
     /**
@@ -652,9 +638,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
      * @returns The keyring encryption key.
      */
     async loadKeyringEncryptionKey() {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
-        const { toprfPwEncryptionKey } = this.state;
-        const encKey = (0, utils_1.base64ToBytes)(toprfPwEncryptionKey);
+        const { toprfPwEncryptionKey: encKey } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this);
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadKeyringEncryptionKey).call(this, encKey);
     }
     /**
@@ -703,10 +687,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-                password,
-                encryptionKey: vaultEncryptionKey,
-            });
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
             if (!revokeToken) {
                 throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
@@ -720,7 +701,7 @@ class SeedlessOnboardingController extends base_controller_1.BaseController {
                 // set new refresh token to persist in state
                 state.refreshToken = newRefreshToken;
             });
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_createNewVaultWithAuthData).call(this, {
                 password,
                 rawToprfEncryptionKey,
                 rawToprfPwEncryptionKey,
@@ -808,9 +789,7 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-            encryptionKey: vaultKey,
-        });
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     }
     catch (error) {
@@ -842,10 +821,7 @@ async function _SeedlessOnboardingController_getAccessToken(password) {
     if (!vault) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
-    const { accessToken: accessTokenFromVault } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-        password,
-        skipVaultMutexLock: true,
-    });
+    const { accessToken: accessTokenFromVault } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
     return accessTokenFromVault;
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
@@ -964,6 +940,7 @@ async function _SeedlessOnboardingController_recoverEncKey(password) {
         });
     }
     catch (error) {
+        log('Error fetching secret data', error);
         if (__classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_isTokenExpiredError).call(this, error)) {
             throw error;
         }
@@ -1006,12 +983,11 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
         } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_recoverEncKey).call(this, oldPassword));
     }
     else {
-        // get the TOPRF encryption key and authentication key pair from the state
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsUnlocked).call(this, this.state);
-        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = this.state;
-        encKey = (0, utils_1.base64ToBytes)(toprfEncryptionKey);
-        pwEncKey = (0, utils_1.base64ToBytes)(toprfPwEncryptionKey);
-        authKeyPair = (0, utils_3.deserializAuthKeyPair)(toprfAuthKeyPair);
+        ({
+            toprfEncryptionKey: encKey,
+            toprfPwEncryptionKey: pwEncKey,
+            toprfAuthKeyPair: authKeyPair,
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
     }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
@@ -1077,15 +1053,11 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
     }
 }, _SeedlessOnboardingController_unlockVaultAndGetVaultData = 
 /**
- * Unlocks the encrypted vault using the provided password or encryption key and returns the decrypted vault data.
+ * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
- * Successfully unlocking the vault will update the controller state with the decrypted vault data.
- *
- * @param params - The parameters for unlocking the vault.
- * @param params.password - The optional password to unlock the vault.
- * @param params.encryptionKey - The optional encryption key to unlock the vault.
- * @param params.skipVaultMutexLock - Whether to skip the vault mutex lock.
+ * @param password - The optional password to unlock the vault.
+ * @param encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
@@ -1097,40 +1069,44 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params) {
-    const doUnlockVaultAndGetVaultData = async () => {
+async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password, encryptionKey) {
+    return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
         let { vaultEncryptionKey } = this.state;
-        const { vault: encryptedVault } = this.state;
+        const { vault: encryptedVault, vaultEncryptionSalt } = this.state;
         if (!encryptedVault) {
             throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultError);
         }
-        if (params?.encryptionKey) {
-            vaultEncryptionKey = params.encryptionKey;
+        if (encryptionKey) {
+            vaultEncryptionKey = encryptionKey;
         }
         let decryptedVaultData;
         const updatedState = {};
-        if (params?.password) {
-            assertIsValidPassword(params.password);
+        if (password) {
+            assertIsValidPassword(password);
             // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
             // from the password using an intentionally slow key derivation function.
             // We should make sure that we only call it very intentionally.
-            const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(params.password, encryptedVault);
+            const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(password, encryptedVault);
             decryptedVaultData = result.vault;
             updatedState.vaultEncryptionKey = result.exportedKeyString;
+            updatedState.vaultEncryptionSalt = result.salt;
         }
         else {
             assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
             const parsedEncryptedVault = JSON.parse(encryptedVault);
+            if (vaultEncryptionSalt &&
+                vaultEncryptionSalt !== parsedEncryptedVault.salt) {
+                throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ExpiredCredentials);
+            }
             const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
             decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
             updatedState.vaultEncryptionKey = vaultEncryptionKey;
+            updatedState.vaultEncryptionSalt = vaultEncryptionSalt;
         }
         const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
         this.update((state) => {
             state.vaultEncryptionKey = updatedState.vaultEncryptionKey;
-            state.toprfEncryptionKey = (0, utils_1.bytesToBase64)(toprfEncryptionKey);
-            state.toprfPwEncryptionKey = (0, utils_1.bytesToBase64)(toprfPwEncryptionKey);
-            state.toprfAuthKeyPair = (0, utils_3.serializeAuthKeyPair)(toprfAuthKeyPair);
+            state.vaultEncryptionSalt = updatedState.vaultEncryptionSalt;
             state.revokeToken = revokeToken;
             state.accessToken = accessToken;
         });
@@ -1141,10 +1117,7 @@ async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params)
             revokeToken,
             accessToken,
         };
-    };
-    return params?.skipVaultMutexLock
-        ? doUnlockVaultAndGetVaultData()
-        : __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, doUnlockVaultAndGetVaultData);
+    });
 }, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState = 
 /**
  * Executes a callback function that creates or restores secret data and persists their hashes in the controller state.
@@ -1201,54 +1174,65 @@ async function _SeedlessOnboardingController_withPersistedSecretMetadataBackupsS
             ];
         });
     }
+}, _SeedlessOnboardingController_createNewVaultWithAuthData = 
+/**
+ * Create a new vault with the given authentication data.
+ *
+ * Serialize the authentication and key data which will be stored in the vault.
+ *
+ * @param params - The parameters for creating a new vault.
+ * @param params.password - The password to encrypt the vault.
+ * @param params.rawToprfEncryptionKey - The encryption key to encrypt the vault.
+ * @param params.rawToprfPwEncryptionKey - The encryption key to encrypt the password.
+ * @param params.rawToprfAuthKeyPair - The authentication key pair to encrypt the vault.
+ */
+async function _SeedlessOnboardingController_createNewVaultWithAuthData({ password, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair, }) {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
+    const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
+    const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
+    const serializedVaultData = JSON.stringify({
+        toprfEncryptionKey,
+        toprfPwEncryptionKey,
+        toprfAuthKeyPair,
+        revokeToken: this.state.revokeToken,
+        accessToken,
+    });
+    await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
+        password,
+        serializedVaultData,
+        pwEncKey: rawToprfPwEncryptionKey,
+    });
+    // update the authPubKey in the state
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
+        authPubKey: rawToprfAuthKeyPair.pk,
+    });
 }, _SeedlessOnboardingController_updateVault = 
 /**
  * Encrypt and update the vault with the given authentication data.
  *
  * @param params - The parameters for updating the vault.
  * @param params.password - The password to encrypt the vault.
- * @param params.rawToprfEncryptionKey - The TOPRF encryption key.
- * @param params.rawToprfPwEncryptionKey - The TOPRF password encryption key.
- * @param params.rawToprfAuthKeyPair - The TOPRF authentication key pair.
+ * @param params.serializedVaultData - The serialized authentication data to update the vault with.
+ * @param params.pwEncKey - The global password encryption key.
  * @returns A promise that resolves to the updated vault.
  */
-async function _SeedlessOnboardingController_updateVault({ password, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair, }) {
+async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, pwEncKey, }) {
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
         assertIsValidPassword(password);
-        const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
-        const toprfEncryptionKey = (0, utils_1.bytesToBase64)(rawToprfEncryptionKey);
-        const toprfPwEncryptionKey = (0, utils_1.bytesToBase64)(rawToprfPwEncryptionKey);
-        const toprfAuthKeyPair = (0, utils_3.serializeAuthKeyPair)(rawToprfAuthKeyPair);
-        const serializedVaultData = JSON.stringify({
-            toprfEncryptionKey,
-            toprfPwEncryptionKey,
-            toprfAuthKeyPair,
-            revokeToken: this.state.revokeToken,
-            accessToken,
-        });
         // Note that vault encryption using the password is a very costly operation as it involves deriving the encryption key
         // from the password using an intentionally slow key derivation function.
         // We should make sure that we only call it very intentionally.
         const { vault, exportedKeyString } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").encryptWithDetail(password, serializedVaultData);
         // Encrypt vault key.
-        const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(rawToprfPwEncryptionKey);
+        const aes = (0, webcrypto_1.managedNonce)(aes_1.gcm)(pwEncKey);
         const encryptedKey = aes.encrypt((0, utils_2.utf8ToBytes)(exportedKeyString));
-        // update the controller state after updating the vault
         this.update((state) => {
             state.vault = vault;
             state.vaultEncryptionKey = exportedKeyString;
+            state.vaultEncryptionSalt = JSON.parse(vault).salt;
             state.encryptedSeedlessEncryptionKey = (0, utils_1.bytesToBase64)(encryptedKey);
-            state.toprfEncryptionKey = toprfEncryptionKey;
-            state.toprfPwEncryptionKey = toprfPwEncryptionKey;
-            state.toprfAuthKeyPair = toprfAuthKeyPair;
-        });
-        // update the authPubKey in the state
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_persistAuthPubKey).call(this, {
-            authPubKey: rawToprfAuthKeyPair.pk,
         });
-        // unlock the controller
-        __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     });
 }, _SeedlessOnboardingController_withControllerLock = 
 /**
@@ -1279,6 +1263,18 @@ async function _SeedlessOnboardingController_withControllerLock(callback) {
  */
 async function _SeedlessOnboardingController_withVaultLock(callback) {
     return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
+}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, pwEncKey, authKeyPair) {
+    const b64EncodedEncKey = (0, utils_1.bytesToBase64)(encKey);
+    const b64EncodedPwEncKey = (0, utils_1.bytesToBase64)(pwEncKey);
+    const b64EncodedAuthKeyPair = JSON.stringify({
+        sk: (0, utils_1.bigIntToHex)(authKeyPair.sk),
+        pk: (0, utils_1.bytesToBase64)(authKeyPair.pk),
+    });
+    return {
+        toprfEncryptionKey: b64EncodedEncKey,
+        toprfPwEncryptionKey: b64EncodedPwEncKey,
+        toprfAuthKeyPair: b64EncodedAuthKeyPair,
+    };
 }, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
     if (typeof data !== 'string') {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
@@ -1293,7 +1289,11 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
     (0, assertions_1.assertIsValidVaultData)(parsedVaultData);
     const rawToprfEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfEncryptionKey);
     const rawToprfPwEncryptionKey = (0, utils_1.base64ToBytes)(parsedVaultData.toprfPwEncryptionKey);
-    const rawToprfAuthKeyPair = (0, utils_3.deserializAuthKeyPair)(parsedVaultData.toprfAuthKeyPair);
+    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
+    const rawToprfAuthKeyPair = {
+        sk: BigInt(parsedToprfAuthKeyPair.sk),
+        pk: (0, utils_1.base64ToBytes)(parsedToprfAuthKeyPair.pk),
+    };
     return {
         toprfEncryptionKey: rawToprfEncryptionKey,
         toprfPwEncryptionKey: rawToprfPwEncryptionKey,
@@ -1301,17 +1301,10 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
         revokeToken: parsedVaultData.revokeToken,
         accessToken: parsedVaultData.accessToken,
     };
-}, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked(value) {
+}, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
         throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.ControllerLocked);
     }
-    if (!value ||
-        typeof value !== 'object' ||
-        !('toprfEncryptionKey' in value) ||
-        !('toprfPwEncryptionKey' in value) ||
-        !('toprfAuthKeyPair' in value)) {
-        throw new Error(constants_1.SeedlessOnboardingControllerErrorMessage.VaultLocked);
-    }
 }, _SeedlessOnboardingController_assertIsAuthenticatedUser = function _SeedlessOnboardingController_assertIsAuthenticatedUser(value) {
     if (!value ||
         typeof value !== 'object' ||