@metamask-previews/seedless-onboarding-controller 3.0.0-preview-e821953d → 3.0.0-preview-e43ca14

package/dist/SeedlessOnboardingController.mjs

@@ -9,11 +9,11 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_serializeKeyData, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
+var _SeedlessOnboardingController_instances, _SeedlessOnboardingController_vaultEncryptor, _SeedlessOnboardingController_controllerOperationMutex, _SeedlessOnboardingController_vaultOperationMutex, _SeedlessOnboardingController_refreshJWTToken, _SeedlessOnboardingController_revokeRefreshToken, _SeedlessOnboardingController_passwordOutdatedCacheTTL, _SeedlessOnboardingController_isUnlocked, _SeedlessOnboardingController_cachedDecryptedVaultData, _SeedlessOnboardingController_submitGlobalPassword, _SeedlessOnboardingController_getAccessToken, _SeedlessOnboardingController_setUnlocked, _SeedlessOnboardingController_persistOprfKey, _SeedlessOnboardingController_persistAuthPubKey, _SeedlessOnboardingController_storeKeyringEncryptionKey, _SeedlessOnboardingController_loadKeyringEncryptionKey, _SeedlessOnboardingController_loadSeedlessEncryptionKey, _SeedlessOnboardingController_recoverAuthPubKey, _SeedlessOnboardingController_recoverEncKey, _SeedlessOnboardingController_fetchAllSecretDataFromMetadataStore, _SeedlessOnboardingController_changeEncryptionKey, _SeedlessOnboardingController_encryptAndStoreSecretData, _SeedlessOnboardingController_unlockVaultAndGetVaultData, _SeedlessOnboardingController_decryptAndParseVaultData, _SeedlessOnboardingController_withPersistedSecretMetadataBackupsState, _SeedlessOnboardingController_filterDupesAndUpdateSocialBackupsMetadata, _SeedlessOnboardingController_createNewVaultWithAuthData, _SeedlessOnboardingController_updateVault, _SeedlessOnboardingController_withControllerLock, _SeedlessOnboardingController_withVaultLock, _SeedlessOnboardingController_parseVaultData, _SeedlessOnboardingController_assertIsUnlocked, _SeedlessOnboardingController_assertIsAuthenticatedUser, _SeedlessOnboardingController_assertIsSRPBackedUpUser, _SeedlessOnboardingController_assertPasswordInSync, _SeedlessOnboardingController_resetPasswordOutdatedCache, _SeedlessOnboardingController_isTokenExpiredError, _SeedlessOnboardingController_isMaxKeyChainLengthError, _SeedlessOnboardingController_executeWithTokenRefresh;
 import { keccak256AndHexify } from "@metamask/auth-network-utils";
 import { BaseController } from "@metamask/base-controller";
 import { ToprfSecureBackup, TOPRFErrorCode, TOPRFError } from "@metamask/toprf-secure-backup";
-import { base64ToBytes, bytesToBase64, bigIntToHex } from "@metamask/utils";
+import { base64ToBytes, bytesToBase64 } from "@metamask/utils";
 import { gcm } from "@noble/ciphers/aes";
 import { bytesToUtf8, utf8ToBytes } from "@noble/ciphers/utils";
 import { managedNonce } from "@noble/ciphers/webcrypto";
@@ -24,7 +24,7 @@ import { controllerName, PASSWORD_OUTDATED_CACHE_TTL_MS, SecretType, SeedlessOnb
 import { PasswordSyncError, RecoveryError } from "./errors.mjs";
 import { projectLogger, createModuleLogger } from "./logger.mjs";
 import { SecretMetadata } from "./SecretMetadata.mjs";
-import { decodeJWTToken, decodeNodeAuthToken } from "./utils.mjs";
+import { decodeJWTToken, decodeNodeAuthToken, deserializeVaultData, serializeVaultData } from "./utils.mjs";
 const log = createModuleLogger(projectLogger, controllerName);
 /**
  * Get the initial state for the Seedless Onboarding Controller with defaults.
@@ -163,6 +163,10 @@ export class SeedlessOnboardingController extends BaseController {
         _SeedlessOnboardingController_vaultOperationMutex.set(this, new Mutex());
         _SeedlessOnboardingController_refreshJWTToken.set(this, void 0);
         _SeedlessOnboardingController_revokeRefreshToken.set(this, void 0);
+        /**
+         * The TTL of the password outdated cache in milliseconds.
+         */
+        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
         /**
          * Controller lock state.
          *
@@ -170,9 +174,11 @@ export class SeedlessOnboardingController extends BaseController {
          */
         _SeedlessOnboardingController_isUnlocked.set(this, false);
         /**
-         * The TTL of the password outdated cache in milliseconds.
+         * Cached decrypted vault data.
+         *
+         * This is used to cache the decrypted vault data to avoid decrypting the vault data multiple times.
          */
-        _SeedlessOnboardingController_passwordOutdatedCacheTTL.set(this, void 0);
+        _SeedlessOnboardingController_cachedDecryptedVaultData.set(this, void 0);
         assertIsPasswordOutdatedCacheValid(passwordOutdatedCacheTTL);
         __classPrivateFieldSet(this, _SeedlessOnboardingController_passwordOutdatedCacheTTL, passwordOutdatedCacheTTL, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_vaultEncryptor, encryptor, "f");
@@ -183,14 +189,6 @@ export class SeedlessOnboardingController extends BaseController {
         });
         __classPrivateFieldSet(this, _SeedlessOnboardingController_refreshJWTToken, refreshJWTToken, "f");
         __classPrivateFieldSet(this, _SeedlessOnboardingController_revokeRefreshToken, revokeRefreshToken, "f");
-        // setup subscriptions to the keyring lock event
-        // when the keyring is locked (wallet is locked), the controller will be cleared of its credentials
-        this.messagingSystem.subscribe('KeyringController:lock', () => {
-            this.setLocked();
-        });
-        this.messagingSystem.subscribe('KeyringController:unlock', () => {
-            __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
-        });
     }
     async fetchMetadataAccessCreds() {
         const { metadataAccessToken } = this.state;
@@ -502,7 +500,7 @@ export class SeedlessOnboardingController extends BaseController {
      */
     async submitPassword(password) {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
-            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password);
+            await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password });
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
         });
     }
@@ -510,15 +508,20 @@ export class SeedlessOnboardingController extends BaseController {
      * Set the controller to locked state, and deallocate the secrets (vault encryption key and salt).
      *
      * When the controller is locked, the user will not be able to perform any operations on the controller/vault.
+     *
+     * @returns A promise that resolves to the success of the operation.
      */
-    setLocked() {
-        this.update((state) => {
-            delete state.vaultEncryptionKey;
-            delete state.vaultEncryptionSalt;
-            delete state.revokeToken;
-            delete state.accessToken;
+    async setLocked() {
+        return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
+            this.update((state) => {
+                delete state.vaultEncryptionKey;
+                delete state.vaultEncryptionSalt;
+                delete state.revokeToken;
+                delete state.accessToken;
+            });
+            __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, undefined, "f");
+            __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
         });
-        __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, false, "f");
     }
     /**
      * Sync the latest global password to the controller.
@@ -696,7 +699,10 @@ export class SeedlessOnboardingController extends BaseController {
         return await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withControllerLock).call(this, async () => {
             __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
             const { vaultEncryptionKey } = this.state;
-            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, password, vaultEncryptionKey);
+            const { toprfEncryptionKey: rawToprfEncryptionKey, toprfPwEncryptionKey: rawToprfPwEncryptionKey, toprfAuthKeyPair: rawToprfAuthKeyPair, revokeToken, } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+                password,
+                encryptionKey: vaultEncryptionKey,
+            });
             if (!revokeToken) {
                 throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidRevokeToken);
             }
@@ -773,7 +779,7 @@ export class SeedlessOnboardingController extends BaseController {
         }
     }
 }
-_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
+_SeedlessOnboardingController_vaultEncryptor = new WeakMap(), _SeedlessOnboardingController_controllerOperationMutex = new WeakMap(), _SeedlessOnboardingController_vaultOperationMutex = new WeakMap(), _SeedlessOnboardingController_refreshJWTToken = new WeakMap(), _SeedlessOnboardingController_revokeRefreshToken = new WeakMap(), _SeedlessOnboardingController_passwordOutdatedCacheTTL = new WeakMap(), _SeedlessOnboardingController_isUnlocked = new WeakMap(), _SeedlessOnboardingController_cachedDecryptedVaultData = new WeakMap(), _SeedlessOnboardingController_instances = new WeakSet(), _SeedlessOnboardingController_submitGlobalPassword = 
 /**
  * @description Submit the global password to the controller, verify the
  * password validity and unlock the controller.
@@ -799,7 +805,9 @@ async function _SeedlessOnboardingController_submitGlobalPassword({ targetAuthPu
         const { pwEncKey } = res;
         const vaultKey = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_loadSeedlessEncryptionKey).call(this, pwEncKey);
         // Unlock the controller
-        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, undefined, vaultKey);
+        await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, {
+            encryptionKey: vaultKey,
+        });
         __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_setUnlocked).call(this);
     }
     catch (error) {
@@ -831,8 +839,10 @@ async function _SeedlessOnboardingController_getAccessToken(password) {
     if (!vault) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidAccessToken);
     }
-    const { parsedVaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password);
-    return parsedVaultData.accessToken;
+    const { vaultData } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, {
+        password,
+    });
+    return vaultData.accessToken;
 }, _SeedlessOnboardingController_setUnlocked = function _SeedlessOnboardingController_setUnlocked() {
     __classPrivateFieldSet(this, _SeedlessOnboardingController_isUnlocked, true, "f");
 }, _SeedlessOnboardingController_persistOprfKey = 
@@ -997,7 +1007,7 @@ async function _SeedlessOnboardingController_changeEncryptionKey({ oldPassword,
             toprfEncryptionKey: encKey,
             toprfPwEncryptionKey: pwEncKey,
             toprfAuthKeyPair: authKeyPair,
-        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, oldPassword));
+        } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_unlockVaultAndGetVaultData).call(this, { password: oldPassword }));
     }
     const result = await this.toprfClient.changeEncKey({
         nodeAuthTokens: this.state.nodeAuthTokens,
@@ -1066,8 +1076,9 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * Unlocks the encrypted vault using the provided password and returns the decrypted vault data.
  * This method ensures thread-safety by using a mutex lock when accessing the vault.
  *
- * @param password - The optional password to unlock the vault.
- * @param encryptionKey - The optional encryption key to unlock the vault.
+ * @param params - The parameters for unlocking the vault.
+ * @param params.password - The optional password to unlock the vault.
+ * @param params.encryptionKey - The optional encryption key to unlock the vault.
  * @returns A promise that resolves to an object containing:
  * - toprfEncryptionKey: The decrypted TOPRF encryption key
  * - toprfAuthKeyPair: The decrypted TOPRF authentication key pair
@@ -1079,54 +1090,43 @@ async function _SeedlessOnboardingController_encryptAndStoreSecretData(params) {
  * - The password is incorrect (from encryptor.decrypt)
  * - The decrypted vault data is malformed
  */
-async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(password, encryptionKey) {
+async function _SeedlessOnboardingController_unlockVaultAndGetVaultData(params) {
     return __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
-        const { parsedVaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, password, encryptionKey);
-        const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair, revokeToken, accessToken, } = parsedVaultData;
+        if (__classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f")) {
+            return __classPrivateFieldGet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, "f");
+        }
+        const { vaultData, vaultEncryptionKey, vaultEncryptionSalt } = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_decryptAndParseVaultData).call(this, params);
         this.update((state) => {
             state.vaultEncryptionKey = vaultEncryptionKey;
             state.vaultEncryptionSalt = vaultEncryptionSalt;
-            state.revokeToken = revokeToken;
-            state.accessToken = accessToken;
+            state.revokeToken = vaultData.revokeToken;
+            state.accessToken = vaultData.accessToken;
         });
-        return {
-            toprfEncryptionKey,
-            toprfPwEncryptionKey,
-            toprfAuthKeyPair,
-            revokeToken,
-            accessToken,
-        };
+        const deserializedVaultData = deserializeVaultData(vaultData);
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, deserializedVaultData, "f");
+        return deserializedVaultData;
     });
 }, _SeedlessOnboardingController_decryptAndParseVaultData = 
 /**
  * Decrypts the vault data and parses it into a usable format.
  *
- * @param password - The optional password to decrypt the vault.
- * @param encryptionKey - The optional encryption key to decrypt the vault.
+ * @param params - The parameters for decrypting the vault.
+ * @param params.password - The optional password to decrypt the vault.
+ * @param params.encryptionKey - The optional encryption key to decrypt the vault.
  * @returns A promise that resolves to an object containing:
  */
-async function _SeedlessOnboardingController_decryptAndParseVaultData(password, encryptionKey) {
+async function _SeedlessOnboardingController_decryptAndParseVaultData(params) {
     let { vaultEncryptionKey, vaultEncryptionSalt } = this.state;
     const { vault: encryptedVault } = this.state;
     if (!encryptedVault) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.VaultError);
     }
-    if (encryptionKey) {
-        vaultEncryptionKey = encryptionKey;
+    if (params?.encryptionKey) {
+        vaultEncryptionKey = params.encryptionKey;
     }
     let decryptedVaultData;
-    if (password) {
-        assertIsValidPassword(password);
-        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
-        // from the password using an intentionally slow key derivation function.
-        // We should make sure that we only call it very intentionally.
-        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(password, encryptedVault);
-        decryptedVaultData = result.vault;
-        vaultEncryptionKey = result.exportedKeyString;
-        vaultEncryptionSalt = result.salt;
-    }
-    else {
-        assertIsVaultEncryptionKeyDefined(vaultEncryptionKey);
+    // if the encryption key is available, we will use it to decrypt the vault
+    if (vaultEncryptionKey) {
         const parsedEncryptedVault = JSON.parse(encryptedVault);
         if (vaultEncryptionSalt &&
             vaultEncryptionSalt !== parsedEncryptedVault.salt) {
@@ -1135,9 +1135,20 @@ async function _SeedlessOnboardingController_decryptAndParseVaultData(password,
         const key = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").importKey(vaultEncryptionKey);
         decryptedVaultData = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithKey(key, parsedEncryptedVault);
     }
-    const parsedVaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
+    else {
+        // if the encryption key is not available, we will use the password to decrypt the vault
+        assertIsValidPassword(params?.password);
+        // Note that vault decryption using the password is a very costly operation as it involves deriving the encryption key
+        // from the password using an intentionally slow key derivation function.
+        // We should make sure that we only call it very intentionally.
+        const result = await __classPrivateFieldGet(this, _SeedlessOnboardingController_vaultEncryptor, "f").decryptWithDetail(params.password, encryptedVault);
+        decryptedVaultData = result.vault;
+        vaultEncryptionKey = result.exportedKeyString;
+        vaultEncryptionSalt = result.salt;
+    }
+    const vaultData = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_parseVaultData).call(this, decryptedVaultData);
     return {
-        parsedVaultData,
+        vaultData,
         vaultEncryptionKey,
         vaultEncryptionSalt,
     };
@@ -1213,17 +1224,16 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
     __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { revokeToken } = this.state;
     const accessToken = await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_getAccessToken).call(this, password);
-    const { toprfEncryptionKey, toprfPwEncryptionKey, toprfAuthKeyPair } = __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_serializeKeyData).call(this, rawToprfEncryptionKey, rawToprfPwEncryptionKey, rawToprfAuthKeyPair);
-    const serializedVaultData = JSON.stringify({
-        toprfEncryptionKey,
-        toprfPwEncryptionKey,
-        toprfAuthKeyPair,
+    const vaultData = {
+        toprfAuthKeyPair: rawToprfAuthKeyPair,
+        toprfEncryptionKey: rawToprfEncryptionKey,
+        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
         revokeToken,
         accessToken,
-    });
+    };
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_updateVault).call(this, {
         password,
-        serializedVaultData,
+        vaultData,
         pwEncKey: rawToprfPwEncryptionKey,
     });
     // update the authPubKey in the state
@@ -1237,13 +1247,16 @@ async function _SeedlessOnboardingController_createNewVaultWithAuthData({ passwo
  *
  * @param params - The parameters for updating the vault.
  * @param params.password - The password to encrypt the vault.
- * @param params.serializedVaultData - The serialized authentication data to update the vault with.
+ * @param params.vaultData - The raw vault data to update the vault with.
  * @param params.pwEncKey - The global password encryption key.
  * @returns A promise that resolves to the updated vault.
  */
-async function _SeedlessOnboardingController_updateVault({ password, serializedVaultData, pwEncKey, }) {
+async function _SeedlessOnboardingController_updateVault({ password, vaultData, pwEncKey, }) {
     await __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_withVaultLock).call(this, async () => {
         assertIsValidPassword(password);
+        // cache the vault data to avoid decrypting the vault data multiple times
+        __classPrivateFieldSet(this, _SeedlessOnboardingController_cachedDecryptedVaultData, vaultData, "f");
+        const serializedVaultData = serializeVaultData(vaultData);
         // Note that vault encryption using the password is a very costly operation as it involves deriving the encryption key
         // from the password using an intentionally slow key derivation function.
         // We should make sure that we only call it very intentionally.
@@ -1287,44 +1300,19 @@ async function _SeedlessOnboardingController_withControllerLock(callback) {
  */
 async function _SeedlessOnboardingController_withVaultLock(callback) {
     return await withLock(__classPrivateFieldGet(this, _SeedlessOnboardingController_vaultOperationMutex, "f"), callback);
-}, _SeedlessOnboardingController_serializeKeyData = function _SeedlessOnboardingController_serializeKeyData(encKey, pwEncKey, authKeyPair) {
-    const b64EncodedEncKey = bytesToBase64(encKey);
-    const b64EncodedPwEncKey = bytesToBase64(pwEncKey);
-    const b64EncodedAuthKeyPair = JSON.stringify({
-        sk: bigIntToHex(authKeyPair.sk),
-        pk: bytesToBase64(authKeyPair.pk),
-    });
-    return {
-        toprfEncryptionKey: b64EncodedEncKey,
-        toprfPwEncryptionKey: b64EncodedPwEncKey,
-        toprfAuthKeyPair: b64EncodedAuthKeyPair,
-    };
 }, _SeedlessOnboardingController_parseVaultData = function _SeedlessOnboardingController_parseVaultData(data) {
     if (typeof data !== 'string') {
-        throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
+        throw new Error(SeedlessOnboardingControllerErrorMessage.VaultDataError);
     }
     let parsedVaultData;
     try {
         parsedVaultData = JSON.parse(data);
     }
     catch {
-        throw new Error(SeedlessOnboardingControllerErrorMessage.InvalidVaultData);
+        throw new Error(SeedlessOnboardingControllerErrorMessage.VaultDataError);
     }
     assertIsValidVaultData(parsedVaultData);
-    const rawToprfEncryptionKey = base64ToBytes(parsedVaultData.toprfEncryptionKey);
-    const rawToprfPwEncryptionKey = base64ToBytes(parsedVaultData.toprfPwEncryptionKey);
-    const parsedToprfAuthKeyPair = JSON.parse(parsedVaultData.toprfAuthKeyPair);
-    const rawToprfAuthKeyPair = {
-        sk: BigInt(parsedToprfAuthKeyPair.sk),
-        pk: base64ToBytes(parsedToprfAuthKeyPair.pk),
-    };
-    return {
-        toprfEncryptionKey: rawToprfEncryptionKey,
-        toprfPwEncryptionKey: rawToprfPwEncryptionKey,
-        toprfAuthKeyPair: rawToprfAuthKeyPair,
-        revokeToken: parsedVaultData.revokeToken,
-        accessToken: parsedVaultData.accessToken,
-    };
+    return parsedVaultData;
 }, _SeedlessOnboardingController_assertIsUnlocked = function _SeedlessOnboardingController_assertIsUnlocked() {
     if (!__classPrivateFieldGet(this, _SeedlessOnboardingController_isUnlocked, "f")) {
         throw new Error(SeedlessOnboardingControllerErrorMessage.ControllerLocked);
@@ -1354,10 +1342,8 @@ async function _SeedlessOnboardingController_withVaultLock(callback) {
  * @throws If the password is outdated.
  */
 async function _SeedlessOnboardingController_assertPasswordInSync(options) {
+    __classPrivateFieldGet(this, _SeedlessOnboardingController_instances, "m", _SeedlessOnboardingController_assertIsAuthenticatedUser).call(this, this.state);
     const { nodeAuthTokens, authConnectionId, groupedAuthConnectionId, userId, } = this.state;
-    if (!nodeAuthTokens || !authConnectionId || !userId) {
-        throw new Error(SeedlessOnboardingControllerErrorMessage.MissingAuthUserInfo);
-    }
     const { authPubKey, keyIndex: latestKeyIndex } = await this.toprfClient
         .fetchAuthPubKey({
         nodeAuthTokens,
@@ -1500,15 +1486,4 @@ function assertIsEncryptedSeedlessEncryptionKeySet(encryptedSeedlessEncryptionKe
         throw new Error(SeedlessOnboardingControllerErrorMessage.EncryptedSeedlessEncryptionKeyNotSet);
     }
 }
-/**
- * Assert that the provided vault encryption key is a valid non-empty string.
- *
- * @param vaultEncryptionKey - The vault encryption key to check.
- * @throws If the vault encryption key is not a valid string.
- */
-function assertIsVaultEncryptionKeyDefined(vaultEncryptionKey) {
-    if (!vaultEncryptionKey) {
-        throw new Error(SeedlessOnboardingControllerErrorMessage.VaultEncryptionKeyUndefined);
-    }
-}
 //# sourceMappingURL=SeedlessOnboardingController.mjs.map