@metamask-previews/seedless-onboarding-controller 3.0.0-preview-0b2bfc8a → 3.0.0-preview-e821953d

package/dist/SeedlessOnboardingController.mjs

@@ -9,11 +9,11 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 import { keccak256AndHexify } from "@metamask/auth-network-utils";
 import { BaseController } from "@metamask/base-controller";
 import { ToprfSecureBackup, TOPRFErrorCode, TOPRFError } from "@metamask/toprf-secure-backup";
-import { base64ToBytes, bytesToBase64 } from "@metamask/utils";
+import { base64ToBytes, bytesToBase64, bigIntToHex } from "@metamask/utils";
 import { gcm } from "@noble/ciphers/aes";
 import { bytesToUtf8, utf8ToBytes } from "@noble/ciphers/utils";
 import { managedNonce } from "@noble/ciphers/webcrypto";
@@ -24,7 +24,7 @@ import { controllerName, PASSWORD_OUTDATED_CACHE_TTL_MS, SecretType, SeedlessOnb
 import { PasswordSyncError, RecoveryError } from "./errors.mjs";
 import { projectLogger, createModuleLogger } from "./logger.mjs";
 import { SecretMetadata } from "./SecretMetadata.mjs";
-import { decodeJWTToken, decodeNodeAuthToken, deserializeVaultData, serializeVaultData } from "./utils.mjs";
+import { decodeJWTToken, decodeNodeAuthToken } from "./utils.mjs";
 const log = createModuleLogger(projectLogger, controllerName);
 /**
  * Get the initial state for the Seedless Onboarding Controller with defaults.
@@ -163,10 +163,6 @@ export class SeedlessOnboardingController extends BaseController {
         _SeedlessOnboardingController_vaultOperationMutex.set(this, new Mutex());
         _SeedlessOnboardingController_refreshJWTToken.set(this, void 0);
         _SeedlessOnboardingController_revokeRefreshToken.set(this, void 0);
-        /**
-         * The TTL of the password outdated cache in milliseconds.
-         */
-        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         /**
          * Controller lock state.
          *
@@ -174,11 +170,9 @@ export class SeedlessOnboardingController extends BaseController {
          */
         _SeedlessOnboardingController_isUnlocked.set(this, false);
         /**
-         * Cached decrypted vault data.
-         *
-         * This is used to cache the decrypted vault data to avoid decrypting the vault data multiple times.
+         * The TTL of the password outdated cache in milliseconds.
          */
-        _SeedlessOnboardingController_cachedDecryptedVaultData.set(this, void 0);
+        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         assertIsPasswordOutdatedCacheValid(passwordOutdatedCacheTTL);
         __classPrivateFieldSet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, passwordOutdatedCacheTTL, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
@@ -508,7 +502,7 @@ export class SeedlessOnboardingController extends BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password });
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
@@ -524,7 +518,6 @@ export class SeedlessOnboardingController extends BaseController {
             delete state.revokeToken;
             delete state.accessToken;
         });
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, undefined, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
     /**
@@ -703,10 +696,7 @@ export class SeedlessOnboardingController extends BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-                password,
-                encryptionKey: vaultEncryptionKey,
-            });
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
             if (!revokeToken) {
                 throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
@@ -783,7 +773,7 @@ export class SeedlessOnboardingController extends BaseController {
         }
     }
 }
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_cachedDecryptedVaultData = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -809,9 +799,7 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
-            encryptionKey: vaultKey,
-        });
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     }
     catch (error) {
@@ -843,10 +831,8 @@ async function _SeedlessOnboardingController_getAccessToken(password) {
     if (!vault) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
-    const { vaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, {
-        password,
-    });
-    return vaultData.accessToken;
+    const { parsedVaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password);
+    return parsedVaultData.accessToken;
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
 }, _SeedlessOnboardingController_persistOprfKey = 
@@ -1011,7 +997,7 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
             toprfEncryptionKey: encKey,
             toprfPwEncryptionKey: pwEncKey,
             toprfAuthKeyPair: authKeyPair,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password: oldPassword }));
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
     }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
@@ -1080,9 +1066,8 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
- * @param params - The parameters for unlocking the vault.
- * @param params.password - The optional password to unlock the vault.
- * @param params.encryptionKey - The optional encryption key to unlock the vault.
+ * @param password - The optional password to unlock the vault.
+ * @param encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
@@ -1094,43 +1079,54 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params) {
+async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password, encryptionKey) {
     return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
-        if (__classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f")) {
-            return __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f");
-        }
-        const { vaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, params);
+        const { parsedVaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password, encryptionKey);
+        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = parsedVaultData;
         this.update((state) => {
             state.vaultEncryptionKey = vaultEncryptionKey;
             state.vaultEncryptionSalt = vaultEncryptionSalt;
-            state.revokeToken = vaultData.revokeToken;
-            state.accessToken = vaultData.accessToken;
+            state.revokeToken = revokeToken;
+            state.accessToken = accessToken;
         });
-        const deserializedVaultData = deserializeVaultData(vaultData);
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, deserializedVaultData, "f");
-        return deserializedVaultData;
+        return {
+            toprfEncryptionKey,
+            toprfPwEncryptionKey,
+            toprfAuthKeyPair,
+            revokeToken,
+            accessToken,
+        };
     });
 }, _SeedlessOnboardingController_decryptAndParseVaultData = 
 /**
  * Decrypts the vault data and parses it into a usable format.
  *
- * @param params - The parameters for decrypting the vault.
- * @param params.password - The optional password to decrypt the vault.
- * @param params.encryptionKey - The optional encryption key to decrypt the vault.
+ * @param password - The optional password to decrypt the vault.
+ * @param encryptionKey - The optional encryption key to decrypt the vault.
  * @returns A promise that resolves to an object containing:
  */
-async function _SeedlessOnboardingController_decryptAndParseVaultData(params) {
+async function _SeedlessOnboardingController_decryptAndParseVaultData(password, encryptionKey) {
     let { vaultEncryptionKey, vaultEncryptionSalt } = this.state;
     const { vault: encryptedVault } = this.state;
     if (!encryptedVault) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.VaultError);
     }
-    if (params?.encryptionKey) {
-        vaultEncryptionKey = params.encryptionKey;
+    if (encryptionKey) {
+        vaultEncryptionKey = encryptionKey;
     }
     let decryptedVaultData;
-    // if the encryption key is available, we will use it to decrypt the vault
-    if (vaultEncryptionKey) {
+    if (password) {
+        assertIsValidPassword(password);
+        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
+        // from the password using an intentionally slow key derivation function.
+        // We should make sure that we only call it very intentionally.
+        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(password, encryptedVault);
+        decryptedVaultData = result.vault;
+        vaultEncryptionKey = result.exportedKeyString;
+        vaultEncryptionSalt = result.salt;
+    }
+    else {
+        assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
         const parsedEncryptedVault = JSON.parse(encryptedVault);
         if (vaultEncryptionSalt &&
             vaultEncryptionSalt !== parsedEncryptedVault.salt) {
@@ -1139,20 +1135,9 @@ async function _SeedlessOnboardingController_decryptAndParseVaultData(params) {
         const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
         decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
     }
-    else {
-        // if the encryption key is not available, we will use the password to decrypt the vault
-        assertIsValidPassword(params?.password);
-        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
-        // from the password using an intentionally slow key derivation function.
-        // We should make sure that we only call it very intentionally.
-        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(params.password, encryptedVault);
-        decryptedVaultData = result.vault;
-        vaultEncryptionKey = result.exportedKeyString;
-        vaultEncryptionSalt = result.salt;
-    }
-    const vaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
+    const parsedVaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
     return {
-        vaultData,
+        parsedVaultData,
         vaultEncryptionKey,
         vaultEncryptionSalt,
     };
@@ -1228,16 +1213,17 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { revokeToken } = this.state;
     const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
-    const vaultData = {
-        toprfAuthKeyPair: rawToprfAuthKeyPair,
-        toprfEncryptionKey: rawToprfEncryptionKey,
-        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
+    const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
+    const serializedVaultData = JSON.stringify({
+        toprfEncryptionKey,
+        toprfPwEncryptionKey,
+        toprfAuthKeyPair,
         revokeToken,
         accessToken,
-    };
+    });
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
         password,
-        vaultData,
+        serializedVaultData,
         pwEncKey: rawToprfPwEncryptionKey,
     });
     // update the authPubKey in the state
@@ -1251,16 +1237,13 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
  *
  * @param params - The parameters for updating the vault.
  * @param params.password - The password to encrypt the vault.
- * @param params.vaultData - The raw vault data to update the vault with.
+ * @param params.serializedVaultData - The serialized authentication data to update the vault with.
  * @param params.pwEncKey - The global password encryption key.
  * @returns A promise that resolves to the updated vault.
  */
-async function _SeedlessOnboardingController_updateVault({ password, vaultData, pwEncKey, }) {
+async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, pwEncKey, }) {
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
         assertIsValidPassword(password);
-        // cache the vault data to avoid decrypting the vault data multiple times
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, vaultData, "f");
-        const serializedVaultData = serializeVaultData(vaultData);
         // Note that vault encryption using the password is a very costly operation as it involves deriving the encryption key
         // from the password using an intentionally slow key derivation function.
         // We should make sure that we only call it very intentionally.
@@ -1304,19 +1287,44 @@ async function _SeedlessOnboardingController_withControllerLock(callback) {
  */
 async function _SeedlessOnboardingController_withVaultLock(callback) {
     return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
+}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, pwEncKey, authKeyPair) {
+    const b64EncodedEncKey = bytesToBase64(encKey);
+    const b64EncodedPwEncKey = bytesToBase64(pwEncKey);
+    const b64EncodedAuthKeyPair = JSON.stringify({
+        sk: bigIntToHex(authKeyPair.sk),
+        pk: bytesToBase64(authKeyPair.pk),
+    });
+    return {
+        toprfEncryptionKey: b64EncodedEncKey,
+        toprfPwEncryptionKey: b64EncodedPwEncKey,
+        toprfAuthKeyPair: b64EncodedAuthKeyPair,
+    };
 }, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
     if (typeof data !== 'string') {
-        throw new Error(SeedlessOnboardingControllerErrorMessage.VaultDataError);
+        throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
     }
     let parsedVaultData;
     try {
         parsedVaultData = JSON.parse(data);
     }
     catch {
-        throw new Error(SeedlessOnboardingControllerErrorMessage.VaultDataError);
+        throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
     }
     assertIsValidVaultData(parsedVaultData);
-    return parsedVaultData;
+    const rawToprfEncryptionKey = base64ToBytes(parsedVaultData.toprfEncryptionKey);
+    const rawToprfPwEncryptionKey = base64ToBytes(parsedVaultData.toprfPwEncryptionKey);
+    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
+    const rawToprfAuthKeyPair = {
+        sk: BigInt(parsedToprfAuthKeyPair.sk),
+        pk: base64ToBytes(parsedToprfAuthKeyPair.pk),
+    };
+    return {
+        toprfEncryptionKey: rawToprfEncryptionKey,
+        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
+        toprfAuthKeyPair: rawToprfAuthKeyPair,
+        revokeToken: parsedVaultData.revokeToken,
+        accessToken: parsedVaultData.accessToken,
+    };
 }, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.ControllerLocked);
@@ -1492,4 +1500,15 @@ function assertIsEncryptedSeedlessEncryptionKeySet(encryptedSeedlessEncryptionKe
         throw new Error(SeedlessOnboardingControllerErrorMessage.EncryptedSeedlessEncryptionKeyNotSet);
     }
 }
+/**
+ * Assert that the provided vault encryption key is a valid non-empty string.
+ *
+ * @param vaultEncryptionKey - The vault encryption key to check.
+ * @throws If the vault encryption key is not a valid string.
+ */
+function assertIsVaultEncryptionKeyDefined(vaultEncryptionKey) {
+    if (!vaultEncryptionKey) {
+        throw new Error(SeedlessOnboardingControllerErrorMessage.VaultEncryptionKeyUndefined);
+    }
+}
 //# sourceMappingURL=SeedlessOnboardingController.mjs.map