@metamask/profile-sync-controller 0.0.0 → 0.1.0

package/CHANGELOG.md

@@ -7,4 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-[Unreleased]: https://github.com/MetaMask/core/
+## [0.1.0]
+
+### Added
+
+- Initial release
+
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@0.1.0...HEAD
+[0.1.0]: https://github.com/MetaMask/core/releases/tag/@metamask/profile-sync-controller@0.1.0

package/dist/chunk-26CCETCM.mjs

@@ -0,0 +1,70 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __accessCheck = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateGet = (obj, member, getter) => {
+  __accessCheck(obj, member, "read from private field");
+  return getter ? getter.call(obj) : member.get(obj);
+};
+var __privateAdd = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateSet = (obj, member, value, setter) => {
+  __accessCheck(obj, member, "write to private field");
+  setter ? setter.call(obj, value) : member.set(obj, value);
+  return value;
+};
+var __privateMethod = (obj, member, method) => {
+  __accessCheck(obj, member, "access private method");
+  return method;
+};
+
+export {
+  __require,
+  __commonJS,
+  __export,
+  __toESM,
+  __privateGet,
+  __privateAdd,
+  __privateSet,
+  __privateMethod
+};
+//# sourceMappingURL=chunk-26CCETCM.mjs.map

package/dist/chunk-2MVOZPBN.js

@@ -0,0 +1,98 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _chunk4OMJ7A6Ajs = require('./chunk-4OMJ7A6A.js');
+
+// src/controllers/authentication/services.ts
+var ENV_URLS = _chunk4OMJ7A6Ajs.getEnvUrls.call(void 0, "prd" /* PRD */);
+var AUTH_ENDPOINT = ENV_URLS.authApiUrl;
+var AUTH_NONCE_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/nonce`;
+var AUTH_LOGIN_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/srp/login`;
+var OIDC_ENDPOINT = ENV_URLS.oidcApiUrl || "";
+var OIDC_TOKENS_ENDPOINT = `${OIDC_ENDPOINT}/oauth2/token`;
+var OIDC_CLIENT_ID = _chunk4OMJ7A6Ajs.getOidcClientId.call(void 0, "prd" /* PRD */, "extension" /* EXTENSION */);
+var OIDC_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+async function getNonce(publicKey) {
+  const nonceUrl = new URL(AUTH_NONCE_ENDPOINT);
+  nonceUrl.searchParams.set("identifier", publicKey);
+  try {
+    const nonceResponse = await fetch(nonceUrl.toString());
+    if (!nonceResponse.ok) {
+      return null;
+    }
+    const nonceJson = await nonceResponse.json();
+    return nonceJson?.nonce ?? null;
+  } catch (e) {
+    console.error("authentication-controller/services: unable to get nonce", e);
+    return null;
+  }
+}
+async function login(rawMessage, signature, clientMetaMetrics) {
+  try {
+    const response = await fetch(AUTH_LOGIN_ENDPOINT, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        signature,
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        raw_message: rawMessage,
+        metametrics: {
+          // eslint-disable-next-line @typescript-eslint/naming-convention
+          metametrics_id: clientMetaMetrics.metametricsId,
+          agent: clientMetaMetrics.agent
+        }
+      })
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const loginResponse = await response.json();
+    return loginResponse ?? null;
+  } catch (e) {
+    console.error("authentication-controller/services: unable to login", e);
+    return null;
+  }
+}
+async function getAccessToken(jwtToken) {
+  const headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded"
+  });
+  const urlEncodedBody = new URLSearchParams();
+  urlEncodedBody.append("grant_type", OIDC_GRANT_TYPE);
+  urlEncodedBody.append("client_id", OIDC_CLIENT_ID);
+  urlEncodedBody.append("assertion", jwtToken);
+  try {
+    const response = await fetch(OIDC_TOKENS_ENDPOINT, {
+      method: "POST",
+      headers,
+      body: urlEncodedBody.toString()
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const accessTokenResponse = await response.json();
+    return accessTokenResponse?.access_token ?? null;
+  } catch (e) {
+    console.error(
+      "authentication-controller/services: unable to get access token",
+      e
+    );
+    return null;
+  }
+}
+function createLoginRawMessage(nonce, publicKey) {
+  return `metamask:${nonce}:${publicKey}`;
+}
+
+
+
+
+
+
+
+
+
+exports.AUTH_NONCE_ENDPOINT = AUTH_NONCE_ENDPOINT; exports.AUTH_LOGIN_ENDPOINT = AUTH_LOGIN_ENDPOINT; exports.OIDC_TOKENS_ENDPOINT = OIDC_TOKENS_ENDPOINT; exports.getNonce = getNonce; exports.login = login; exports.getAccessToken = getAccessToken; exports.createLoginRawMessage = createLoginRawMessage;
+//# sourceMappingURL=chunk-2MVOZPBN.js.map

package/dist/chunk-2MVOZPBN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/authentication/services.ts"],"names":[],"mappings":";;;;;;AAEA,IAAM,WAAW,0BAAkB;AAEnC,IAAM,gBAAwB,SAAS;AAChC,IAAM,sBAAsB,GAAG,aAAa;AAC5C,IAAM,sBAAsB,GAAG,aAAa;AAEnD,IAAM,gBAAwB,SAAS,cAAc;AAC9C,IAAM,uBAAuB,GAAG,aAAa;AACpD,IAAM,iBAAiB,4DAA2C;AAClE,IAAM,kBAAkB;AAYxB,eAAsB,SAAS,WAA2C;AACxE,QAAM,WAAW,IAAI,IAAI,mBAAmB;AAC5C,WAAS,aAAa,IAAI,cAAc,SAAS;AAEjD,MAAI;AACF,UAAM,gBAAgB,MAAM,MAAM,SAAS,SAAS,CAAC;AACrD,QAAI,CAAC,cAAc,IAAI;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,YAA2B,MAAM,cAAc,KAAK;AAC1D,WAAO,WAAW,SAAS;AAAA,EAC7B,SAAS,GAAG;AACV,YAAQ,MAAM,2DAA2D,CAAC;AAC1E,WAAO;AAAA,EACT;AACF;AAqCA,eAAsB,MACpB,YACA,WACA,mBAC+B;AAC/B,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,qBAAqB;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB;AAAA;AAAA,QAEA,aAAa;AAAA,QACb,aAAa;AAAA;AAAA,UAEX,gBAAgB,kBAAkB;AAAA,UAClC,OAAO,kBAAkB;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,gBAA+B,MAAM,SAAS,KAAK;AACzD,WAAO,iBAAiB;AAAA,EAC1B,SAAS,GAAG;AACV,YAAQ,MAAM,uDAAuD,CAAC;AACtE,WAAO;AAAA,EACT;AACF;AAmBA,eAAsB,eAAe,UAA0C;AAC7E,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,gBAAgB;AAAA,EAClB,CAAC;AAED,QAAM,iBAAiB,IAAI,gBAAgB;AAC3C,iBAAe,OAAO,cAAc,eAAe;AACnD,iBAAe,OAAO,aAAa,cAAc;AACjD,iBAAe,OAAO,aAAa,QAAQ;AAE3C,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,sBAAsB;AAAA,MACjD,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,eAAe,SAAS;AAAA,IAChC,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,sBAA0C,MAAM,SAAS,KAAK;AACpE,WAAO,qBAAqB,gBAAgB;AAAA,EAC9C,SAAS,GAAG;AACV,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AASO,SAAS,sBACd,OACA,WACgC;AAChC,SAAO,YAAY,KAAK,IAAI,SAAS;AACvC","sourcesContent":["import { Env, Platform, getEnvUrls, getOidcClientId } from '../../sdk';\n\nconst ENV_URLS = getEnvUrls(Env.PRD);\n\nconst AUTH_ENDPOINT: string = ENV_URLS.authApiUrl;\nexport const AUTH_NONCE_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/nonce`;\nexport const AUTH_LOGIN_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/srp/login`;\n\nconst OIDC_ENDPOINT: string = ENV_URLS.oidcApiUrl || '';\nexport const OIDC_TOKENS_ENDPOINT = `${OIDC_ENDPOINT}/oauth2/token`;\nconst OIDC_CLIENT_ID = getOidcClientId(Env.PRD, Platform.EXTENSION);\nconst OIDC_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n\nexport type NonceResponse = {\n  nonce: string;\n};\n\n/**\n * Auth Service - Get Nonce. Used for the initial JWTBearer flow\n *\n * @param publicKey - public key to associate a nonce with\n * @returns the nonce or null if failed\n */\nexport async function getNonce(publicKey: string): Promise<string | null> {\n  const nonceUrl = new URL(AUTH_NONCE_ENDPOINT);\n  nonceUrl.searchParams.set('identifier', publicKey);\n\n  try {\n    const nonceResponse = await fetch(nonceUrl.toString());\n    if (!nonceResponse.ok) {\n      return null;\n    }\n\n    const nonceJson: NonceResponse = await nonceResponse.json();\n    return nonceJson?.nonce ?? null;\n  } catch (e) {\n    console.error('authentication-controller/services: unable to get nonce', e);\n    return null;\n  }\n}\n\n/**\n * The Login API Server Response Shape\n */\nexport type LoginResponse = {\n  token: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: string;\n  /**\n   * Contains anonymous information about the logged in profile.\n   *\n   * @property identifier_id - a deterministic unique identifier on the method used to sign in\n   * @property profile_id - a unique id for a given profile\n   * @property metametrics_id - an anonymous server id\n   */\n  profile: {\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    identifier_id: string;\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    profile_id: string;\n  };\n};\n\ntype ClientMetaMetrics = {\n  metametricsId: string;\n  agent: 'extension' | 'mobile';\n};\n\n/**\n * Auth Service - Login. Will perform login with a given signature and will return a single use JWT Token.\n *\n * @param rawMessage - the original message before signing\n * @param signature - the signed message\n * @param clientMetaMetrics - optional client metametrics id (to associate on backend)\n * @returns The Login Response\n */\nexport async function login(\n  rawMessage: string,\n  signature: string,\n  clientMetaMetrics: ClientMetaMetrics,\n): Promise<LoginResponse | null> {\n  try {\n    const response = await fetch(AUTH_LOGIN_ENDPOINT, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        signature,\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        raw_message: rawMessage,\n        metametrics: {\n          // eslint-disable-next-line @typescript-eslint/naming-convention\n          metametrics_id: clientMetaMetrics.metametricsId,\n          agent: clientMetaMetrics.agent,\n        },\n      }),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const loginResponse: LoginResponse = await response.json();\n    return loginResponse ?? null;\n  } catch (e) {\n    console.error('authentication-controller/services: unable to login', e);\n    return null;\n  }\n}\n\n/**\n * The Auth API Token Response Shape\n */\nexport type OAuthTokenResponse = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  access_token: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: number;\n};\n\n/**\n * OIDC Service - Access Token. Trades the Auth Token for an access token (to be used for other authenticated endpoints)\n * NOTE - the access token is short lived, which means it is best practice to validate session before calling authenticated endpoints\n *\n * @param jwtToken - the JWT Auth Token, received from `/login`\n * @returns JWT Access token to store and use on authorized endpoints.\n */\nexport async function getAccessToken(jwtToken: string): Promise<string | null> {\n  const headers = new Headers({\n    'Content-Type': 'application/x-www-form-urlencoded',\n  });\n\n  const urlEncodedBody = new URLSearchParams();\n  urlEncodedBody.append('grant_type', OIDC_GRANT_TYPE);\n  urlEncodedBody.append('client_id', OIDC_CLIENT_ID);\n  urlEncodedBody.append('assertion', jwtToken);\n\n  try {\n    const response = await fetch(OIDC_TOKENS_ENDPOINT, {\n      method: 'POST',\n      headers,\n      body: urlEncodedBody.toString(),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const accessTokenResponse: OAuthTokenResponse = await response.json();\n    return accessTokenResponse?.access_token ?? null;\n  } catch (e) {\n    console.error(\n      'authentication-controller/services: unable to get access token',\n      e,\n    );\n    return null;\n  }\n}\n\n/**\n * Utility to create the raw login message for the JWT bearer flow (via SRP)\n *\n * @param nonce - nonce received from `/nonce` endpoint\n * @param publicKey - public key used to retrieve nonce and for message signing\n * @returns Raw Message which will be used for signing & logging in.\n */\nexport function createLoginRawMessage(\n  nonce: string,\n  publicKey: string,\n): `metamask:${string}:${string}` {\n  return `metamask:${nonce}:${publicKey}` as const;\n}\n"]}

package/dist/chunk-3FJQHCCQ.mjs

@@ -0,0 +1,106 @@
+import {
+  SIWEJwtBearerAuth
+} from "./chunk-UWRKMJBI.mjs";
+import {
+  SRPJwtBearerAuth
+} from "./chunk-LN2BY2QF.mjs";
+import {
+  getNonce,
+  pairIdentifiers
+} from "./chunk-7VMXBDXN.mjs";
+import {
+  PairError,
+  UnsupportedAuthTypeError
+} from "./chunk-TFFQFIJV.mjs";
+import {
+  __privateAdd,
+  __privateGet,
+  __privateMethod,
+  __privateSet
+} from "./chunk-26CCETCM.mjs";
+
+// src/sdk/authentication.ts
+var _type, _env, _sdk, _assertSIWE, assertSIWE_fn;
+var JwtBearerAuth = class {
+  constructor(...args) {
+    __privateAdd(this, _assertSIWE);
+    __privateAdd(this, _type, void 0);
+    __privateAdd(this, _env, void 0);
+    __privateAdd(this, _sdk, void 0);
+    __privateSet(this, _type, args[0].type);
+    __privateSet(this, _env, args[0].env);
+    if (args[0].type === "SRP" /* SRP */) {
+      __privateSet(this, _sdk, new SRPJwtBearerAuth(args[0], args[1]));
+      return;
+    }
+    if (args[0].type === "SiWE" /* SiWE */) {
+      __privateSet(this, _sdk, new SIWEJwtBearerAuth(args[0], args[1]));
+      return;
+    }
+    throw new UnsupportedAuthTypeError("unsupported auth type");
+  }
+  async getAccessToken() {
+    return await __privateGet(this, _sdk).getAccessToken();
+  }
+  async getUserProfile() {
+    return await __privateGet(this, _sdk).getUserProfile();
+  }
+  async getIdentifier() {
+    return await __privateGet(this, _sdk).getIdentifier();
+  }
+  async signMessage(message) {
+    return await __privateGet(this, _sdk).signMessage(message);
+  }
+  async pairIdentifiers(pairing) {
+    const profile = await this.getUserProfile();
+    const n = await getNonce(profile.profileId, __privateGet(this, _env));
+    const logins = await Promise.all(
+      pairing.map(async (p) => {
+        try {
+          const raw = `metamask:${n.nonce}:${p.identifier}`;
+          const sig = await p.signMessage(raw);
+          return {
+            signature: sig,
+            // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            raw_message: raw,
+            // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            encrypted_storage_key: p.encryptedStorageKey,
+            // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            identifier_type: p.identifierType
+          };
+        } catch (e) {
+          const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? "");
+          throw new PairError(
+            `failed to sign pairing message: ${errorMessage}`
+          );
+        }
+      })
+    );
+    const accessToken = await this.getAccessToken();
+    await pairIdentifiers(n.nonce, logins, accessToken, __privateGet(this, _env));
+  }
+  prepare(signer) {
+    __privateMethod(this, _assertSIWE, assertSIWE_fn).call(this, __privateGet(this, _type), __privateGet(this, _sdk));
+    __privateGet(this, _sdk).prepare(signer);
+  }
+};
+_type = new WeakMap();
+_env = new WeakMap();
+_sdk = new WeakMap();
+_assertSIWE = new WeakSet();
+assertSIWE_fn = function(type, sdk) {
+  if (type === "SiWE" /* SiWE */) {
+    return;
+  }
+  throw new UnsupportedAuthTypeError(
+    "This method is only available via SIWE auth type"
+  );
+};
+
+export {
+  JwtBearerAuth
+};
+//# sourceMappingURL=chunk-3FJQHCCQ.mjs.map

package/dist/chunk-3FJQHCCQ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication.ts"],"sourcesContent":["import { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe';\nimport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp';\nimport {\n  getNonce,\n  pairIdentifiers,\n} from './authentication-jwt-bearer/services';\nimport type { UserProfile, Pair } from './authentication-jwt-bearer/types';\nimport { AuthType } from './authentication-jwt-bearer/types';\nimport type { Env } from './env';\nimport { PairError, UnsupportedAuthTypeError } from './errors';\n\n// Computing the Classes, so we only get back the public methods for the interface.\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype Compute<T> = T extends infer U ? { [K in keyof U]: U[K] } : never;\ntype SIWEInterface = Compute<SIWEJwtBearerAuth>;\ntype SRPInterface = Compute<SRPJwtBearerAuth>;\n\ntype SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;\ntype SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;\ntype JwtBearerAuthParams = SiweParams | SRPParams;\n\nexport class JwtBearerAuth implements SIWEInterface, SRPInterface {\n  #type: AuthType;\n\n  #env: Env;\n\n  #sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth;\n\n  constructor(...args: JwtBearerAuthParams) {\n    this.#type = args[0].type;\n    this.#env = args[0].env;\n\n    if (args[0].type === AuthType.SRP) {\n      this.#sdk = new SRPJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    if (args[0].type === AuthType.SiWE) {\n      this.#sdk = new SIWEJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError('unsupported auth type');\n  }\n\n  async getAccessToken(): Promise<string> {\n    return await this.#sdk.getAccessToken();\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    return await this.#sdk.getUserProfile();\n  }\n\n  async getIdentifier(): Promise<string> {\n    return await this.#sdk.getIdentifier();\n  }\n\n  async signMessage(message: string): Promise<string> {\n    return await this.#sdk.signMessage(message);\n  }\n\n  async pairIdentifiers(pairing: Pair[]): Promise<void> {\n    const profile = await this.getUserProfile();\n    const n = await getNonce(profile.profileId, this.#env);\n\n    const logins = await Promise.all(\n      pairing.map(async (p) => {\n        try {\n          const raw = `metamask:${n.nonce}:${p.identifier}`;\n          const sig = await p.signMessage(raw);\n          return {\n            signature: sig,\n            // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n            // eslint-disable-next-line @typescript-eslint/naming-convention\n            raw_message: raw,\n            // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n            // eslint-disable-next-line @typescript-eslint/naming-convention\n            encrypted_storage_key: p.encryptedStorageKey,\n            // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n            // eslint-disable-next-line @typescript-eslint/naming-convention\n            identifier_type: p.identifierType,\n          };\n        } catch (e) {\n          /* istanbul ignore next */\n          const errorMessage =\n            e instanceof Error ? e.message : JSON.stringify(e ?? '');\n          throw new PairError(\n            `failed to sign pairing message: ${errorMessage}`,\n          );\n        }\n      }),\n    );\n\n    const accessToken = await this.getAccessToken();\n    await pairIdentifiers(n.nonce, logins, accessToken, this.#env);\n  }\n\n  prepare(signer: {\n    address: string;\n    chainId: number;\n    signMessage: (message: string) => Promise<string>;\n    domain: string;\n  }): void {\n    this.#assertSIWE(this.#type, this.#sdk);\n    this.#sdk.prepare(signer);\n  }\n\n  #assertSIWE(\n    type: AuthType,\n    sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts sdk is SIWEJwtBearerAuth {\n    if (type === AuthType.SiWE) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SIWE auth type',\n    );\n  }\n}\n\nexport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe';\nexport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp';\nexport * from './authentication-jwt-bearer/types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAsBO,IAAM,gBAAN,MAA2D;AAAA,EAOhE,eAAe,MAA2B;AA+E1C;AArFA;AAEA;AAEA;AAGE,uBAAK,OAAQ,KAAK,CAAC,EAAE;AACrB,uBAAK,MAAO,KAAK,CAAC,EAAE;AAEpB,QAAI,KAAK,CAAC,EAAE,0BAAuB;AACjC,yBAAK,MAAO,IAAI,iBAAiB,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC;AACjD;AAAA,IACF;AAEA,QAAI,KAAK,CAAC,EAAE,4BAAwB;AAClC,yBAAK,MAAO,IAAI,kBAAkB,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC;AAClD;AAAA,IACF;AAEA,UAAM,IAAI,yBAAyB,uBAAuB;AAAA,EAC5D;AAAA,EAEA,MAAM,iBAAkC;AACtC,WAAO,MAAM,mBAAK,MAAK,eAAe;AAAA,EACxC;AAAA,EAEA,MAAM,iBAAuC;AAC3C,WAAO,MAAM,mBAAK,MAAK,eAAe;AAAA,EACxC;AAAA,EAEA,MAAM,gBAAiC;AACrC,WAAO,MAAM,mBAAK,MAAK,cAAc;AAAA,EACvC;AAAA,EAEA,MAAM,YAAY,SAAkC;AAClD,WAAO,MAAM,mBAAK,MAAK,YAAY,OAAO;AAAA,EAC5C;AAAA,EAEA,MAAM,gBAAgB,SAAgC;AACpD,UAAM,UAAU,MAAM,KAAK,eAAe;AAC1C,UAAM,IAAI,MAAM,SAAS,QAAQ,WAAW,mBAAK,KAAI;AAErD,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,QAAQ,IAAI,OAAO,MAAM;AACvB,YAAI;AACF,gBAAM,MAAM,YAAY,EAAE,KAAK,IAAI,EAAE,UAAU;AAC/C,gBAAM,MAAM,MAAM,EAAE,YAAY,GAAG;AACnC,iBAAO;AAAA,YACL,WAAW;AAAA;AAAA;AAAA,YAGX,aAAa;AAAA;AAAA;AAAA,YAGb,uBAAuB,EAAE;AAAA;AAAA;AAAA,YAGzB,iBAAiB,EAAE;AAAA,UACrB;AAAA,QACF,SAAS,GAAG;AAEV,gBAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,gBAAM,IAAI;AAAA,YACR,mCAAmC,YAAY;AAAA,UACjD;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,KAAK,eAAe;AAC9C,UAAM,gBAAgB,EAAE,OAAO,QAAQ,aAAa,mBAAK,KAAI;AAAA,EAC/D;AAAA,EAEA,QAAQ,QAKC;AACP,0BAAK,4BAAL,WAAiB,mBAAK,QAAO,mBAAK;AAClC,uBAAK,MAAK,QAAQ,MAAM;AAAA,EAC1B;AAcF;AAjGE;AAEA;AAEA;AAiFA;AAAA,gBAAW,SACT,MACA,KACkC;AAClC,MAAI,4BAAwB;AAC1B;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-4OMJ7A6A.js

@@ -0,0 +1,77 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/sdk/env.ts
+var Env = /* @__PURE__ */ ((Env2) => {
+  Env2["DEV"] = "dev";
+  Env2["UAT"] = "uat";
+  Env2["PRD"] = "prd";
+  return Env2;
+})(Env || {});
+var Platform = /* @__PURE__ */ ((Platform2) => {
+  Platform2["MOBILE"] = "mobile";
+  Platform2["EXTENSION"] = "extension";
+  Platform2["PORTFOLIO"] = "portfolio";
+  Platform2["INFURA"] = "infura";
+  return Platform2;
+})(Platform || {});
+var ENV_URLS = {
+  dev: {
+    authApiUrl: "https://authentication.dev-api.cx.metamask.io",
+    oidcApiUrl: "https://oidc.dev-api.cx.metamask.io",
+    userStorageApiUrl: "https://user-storage.dev-api.cx.metamask.io"
+  },
+  uat: {
+    authApiUrl: "https://authentication.uat-api.cx.metamask.io",
+    oidcApiUrl: "https://oidc.uat-api.cx.metamask.io",
+    userStorageApiUrl: "https://user-storage.uat-api.cx.metamask.io"
+  },
+  prd: {
+    authApiUrl: "https://authentication.api.cx.metamask.io",
+    oidcApiUrl: "https://oidc.api.cx.metamask.io",
+    userStorageApiUrl: "https://user-storage.api.cx.metamask.io"
+  }
+};
+function getEnvUrls(env) {
+  if (!ENV_URLS[env]) {
+    throw new Error("invalid environment configuration");
+  }
+  return ENV_URLS[env];
+}
+function getOidcClientId(env, platform) {
+  const clientIds = {
+    ["dev" /* DEV */]: {
+      ["portfolio" /* PORTFOLIO */]: "c7ca94a0-5d52-4635-9502-1a50a9c410cc",
+      ["mobile" /* MOBILE */]: "e83c7cc9-267d-4fb4-8fec-f0e3bbe5ae8e",
+      ["extension" /* EXTENSION */]: "f1a963d7-50dc-4cb5-8d81-f1f3654f0df3",
+      ["infura" /* INFURA */]: "bd887006-0d55-481a-a395-5ff9a0dc52c9"
+    },
+    ["uat" /* UAT */]: {
+      ["portfolio" /* PORTFOLIO */]: "8f2dd4ac-db07-4819-9ba5-1ee0ec1b56d1",
+      ["mobile" /* MOBILE */]: "c3cfdcd2-51d6-4fae-ad2c-ff238c8fef53",
+      ["extension" /* EXTENSION */]: "a9de167c-c9a6-43d8-af39-d301fd44c485",
+      ["infura" /* INFURA */]: "01929890-7002-4c97-9913-8f6c09a6d674"
+    },
+    ["prd" /* PRD */]: {
+      ["portfolio" /* PORTFOLIO */]: "35e1cd62-49c5-4be8-8b6e-a5212f2d2cfb",
+      ["mobile" /* MOBILE */]: "75fa62a3-9ca0-4b91-9fe5-76bec86b0257",
+      ["extension" /* EXTENSION */]: "1132f10a-b4e5-4390-a5f2-d9c6022db564",
+      ["infura" /* INFURA */]: ""
+      // unset
+    }
+  };
+  if (!clientIds[env]) {
+    throw new Error(`invalid env ${env}: cannot determine oidc client id`);
+  }
+  if (!clientIds[env][platform]) {
+    throw new Error(
+      `invalid env ${env} and platform ${platform} combination: cannot determine oidc client id`
+    );
+  }
+  return clientIds[env][platform];
+}
+
+
+
+
+
+
+exports.Env = Env; exports.Platform = Platform; exports.getEnvUrls = getEnvUrls; exports.getOidcClientId = getOidcClientId;
+//# sourceMappingURL=chunk-4OMJ7A6A.js.map

package/dist/chunk-4OMJ7A6A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/env.ts"],"names":["Env","Platform"],"mappings":";AAAO,IAAW,MAAX,kBAAWA,SAAX;AACL,EAAAA,KAAA,SAAM;AACN,EAAAA,KAAA,SAAM;AACN,EAAAA,KAAA,SAAM;AAHU,SAAAA;AAAA,GAAA;AAMX,IAAW,WAAX,kBAAWC,cAAX;AACL,EAAAA,UAAA,YAAS;AACT,EAAAA,UAAA,eAAY;AACZ,EAAAA,UAAA,eAAY;AACZ,EAAAA,UAAA,YAAS;AAJO,SAAAA;AAAA,GAAA;AAalB,IAAM,WAAsC;AAAA,EAC1C,KAAK;AAAA,IACH,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,KAAK;AAAA,IACH,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,KAAK;AAAA,IACH,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AACF;AASO,SAAS,WAAW,KAAwB;AACjD,MAAI,CAAC,SAAS,GAAG,GAAG;AAClB,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,SAAO,SAAS,GAAG;AACrB;AASO,SAAS,gBAAgB,KAAU,UAA4B;AACpE,QAAM,YAAY;AAAA,IAChB,CAAC,eAAO,GAAG;AAAA,MACT,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,MACnB,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,IACrB;AAAA,IACA,CAAC,eAAO,GAAG;AAAA,MACT,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,MACnB,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,IACrB;AAAA,IACA,CAAC,eAAO,GAAG;AAAA,MACT,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,MACnB,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,UAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;AAAA,EACvE;AAEA,MAAI,CAAC,UAAU,GAAG,EAAE,QAAQ,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR,eAAe,GAAG,iBAAiB,QAAQ;AAAA,IAC7C;AAAA,EACF;AAEA,SAAO,UAAU,GAAG,EAAE,QAAQ;AAChC","sourcesContent":["export const enum Env {\n  DEV = 'dev',\n  UAT = 'uat',\n  PRD = 'prd',\n}\n\nexport const enum Platform {\n  MOBILE = 'mobile',\n  EXTENSION = 'extension',\n  PORTFOLIO = 'portfolio',\n  INFURA = 'infura',\n}\n\ntype EnvUrlsEntry = {\n  authApiUrl: string;\n  oidcApiUrl: string;\n  userStorageApiUrl: string;\n};\n\nconst ENV_URLS: Record<Env, EnvUrlsEntry> = {\n  dev: {\n    authApiUrl: 'https://authentication.dev-api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.dev-api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.dev-api.cx.metamask.io',\n  },\n  uat: {\n    authApiUrl: 'https://authentication.uat-api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.uat-api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.uat-api.cx.metamask.io',\n  },\n  prd: {\n    authApiUrl: 'https://authentication.api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.api.cx.metamask.io',\n  },\n};\n\n/**\n * Validates and returns correct environment endpoints\n *\n * @param env - environment field\n * @returns the correct environment url\n * @throws on invalid environment passed\n */\nexport function getEnvUrls(env: Env): EnvUrlsEntry {\n  if (!ENV_URLS[env]) {\n    throw new Error('invalid environment configuration');\n  }\n  return ENV_URLS[env];\n}\n\n/**\n * Returns the valid OIDC Client ID (used during authorization)\n *\n * @param env - environment field\n * @param platform - platform field\n * @returns the OIDC client id for the environment\n */\nexport function getOidcClientId(env: Env, platform: Platform): string {\n  const clientIds = {\n    [Env.DEV]: {\n      [Platform.PORTFOLIO]: 'c7ca94a0-5d52-4635-9502-1a50a9c410cc',\n      [Platform.MOBILE]: 'e83c7cc9-267d-4fb4-8fec-f0e3bbe5ae8e',\n      [Platform.EXTENSION]: 'f1a963d7-50dc-4cb5-8d81-f1f3654f0df3',\n      [Platform.INFURA]: 'bd887006-0d55-481a-a395-5ff9a0dc52c9',\n    },\n    [Env.UAT]: {\n      [Platform.PORTFOLIO]: '8f2dd4ac-db07-4819-9ba5-1ee0ec1b56d1',\n      [Platform.MOBILE]: 'c3cfdcd2-51d6-4fae-ad2c-ff238c8fef53',\n      [Platform.EXTENSION]: 'a9de167c-c9a6-43d8-af39-d301fd44c485',\n      [Platform.INFURA]: '01929890-7002-4c97-9913-8f6c09a6d674',\n    },\n    [Env.PRD]: {\n      [Platform.PORTFOLIO]: '35e1cd62-49c5-4be8-8b6e-a5212f2d2cfb',\n      [Platform.MOBILE]: '75fa62a3-9ca0-4b91-9fe5-76bec86b0257',\n      [Platform.EXTENSION]: '1132f10a-b4e5-4390-a5f2-d9c6022db564',\n      [Platform.INFURA]: '', // unset\n    },\n  };\n\n  if (!clientIds[env]) {\n    throw new Error(`invalid env ${env}: cannot determine oidc client id`);\n  }\n\n  if (!clientIds[env][platform]) {\n    throw new Error(\n      `invalid env ${env} and platform ${platform} combination: cannot determine oidc client id`,\n    );\n  }\n\n  return clientIds[env][platform];\n}\n"]}

package/dist/chunk-6P6CUKKI.mjs

@@ -0,0 +1,30 @@
+// src/controllers/authentication/auth-snap-requests.ts
+import { HandlerType } from "@metamask/snaps-utils";
+var snapId = "npm:@metamask/message-signing-snap";
+function createSnapPublicKeyRequest() {
+  return {
+    snapId,
+    origin: "",
+    handler: HandlerType.OnRpcRequest,
+    request: {
+      method: "getPublicKey"
+    }
+  };
+}
+function createSnapSignMessageRequest(message) {
+  return {
+    snapId,
+    origin: "",
+    handler: HandlerType.OnRpcRequest,
+    request: {
+      method: "signMessage",
+      params: { message }
+    }
+  };
+}
+
+export {
+  createSnapPublicKeyRequest,
+  createSnapSignMessageRequest
+};
+//# sourceMappingURL=chunk-6P6CUKKI.mjs.map

package/dist/chunk-6P6CUKKI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/authentication/auth-snap-requests.ts"],"sourcesContent":["import type { HandleSnapRequest } from '@metamask/snaps-controllers';\nimport type { SnapId } from '@metamask/snaps-sdk';\nimport { HandlerType } from '@metamask/snaps-utils';\n\ntype SnapRPCRequest = Parameters<HandleSnapRequest['handler']>[0];\n\nconst snapId = 'npm:@metamask/message-signing-snap' as SnapId;\n\n/**\n * Constructs Request to Message Signing Snap to get Public Key\n *\n * @returns Snap Public Key Request\n */\nexport function createSnapPublicKeyRequest(): SnapRPCRequest {\n  return {\n    snapId,\n    origin: '',\n    handler: HandlerType.OnRpcRequest,\n    request: {\n      method: 'getPublicKey',\n    },\n  };\n}\n\n/**\n * Constructs Request to get Message Signing Snap to sign a message.\n *\n * @param message - message to sign\n * @returns Snap Sign Message Request\n */\nexport function createSnapSignMessageRequest(\n  message: `metamask:${string}`,\n): SnapRPCRequest {\n  return {\n    snapId,\n    origin: '',\n    handler: HandlerType.OnRpcRequest,\n    request: {\n      method: 'signMessage',\n      params: { message },\n    },\n  };\n}\n"],"mappings":";AAEA,SAAS,mBAAmB;AAI5B,IAAM,SAAS;AAOR,SAAS,6BAA6C;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,SAAS,YAAY;AAAA,IACrB,SAAS;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAQO,SAAS,6BACd,SACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,SAAS,YAAY;AAAA,IACrB,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ,EAAE,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-OF3TQWGX.js → chunk-6TK7544L.js}

@@ -2,7 +2,7 @@
 
 
 
-var _chunkNRH6O4QZjs = require('./chunk-NRH6O4QZ.js');
+var _chunkXUPRRLBIjs = require('./chunk-XUPRRLBI.js');
 
 
 var _chunkRG4II6WHjs = require('./chunk-RG4II6WH.js');
@@ -11,33 +11,30 @@ var _chunkRG4II6WHjs = require('./chunk-RG4II6WH.js');
 var _chunkPQ5T4GHYjs = require('./chunk-PQ5T4GHY.js');
 
 
-var _chunkGQLHSQGZjs = require('./chunk-GQLHSQGZ.js');
+var _chunkMBTBE4P5js = require('./chunk-MBTBE4P5.js');
 
 
-var _chunkBARZBXO7js = require('./chunk-BARZBXO7.js');
 
 
 
-
-
-var _chunkZ4BLTVTBjs = require('./chunk-Z4BLTVTB.js');
+var _chunkV46WVGWNjs = require('./chunk-V46WVGWN.js');
 
 // src/sdk/authentication-jwt-bearer/flow-srp.ts
 var defaultEIP6963SigningOptions = {
   getIdentifier: async () => {
     const provider = await _chunkRG4II6WHjs.getMetaMaskProviderEIP6963.call(void 0, );
     if (!provider) {
-      throw new (0, _chunkGQLHSQGZjs.ValidationError)("No MetaMask wallet connected");
+      throw new (0, _chunkMBTBE4P5js.ValidationError)("No MetaMask wallet connected");
     }
     return await _chunkPQ5T4GHYjs.MESSAGE_SIGNING_SNAP.getPublicKey(provider);
   },
   signMessage: async (message) => {
     const provider = await _chunkRG4II6WHjs.getMetaMaskProviderEIP6963.call(void 0, );
     if (!provider) {
-      throw new (0, _chunkGQLHSQGZjs.ValidationError)("No MetaMask wallet connected");
+      throw new (0, _chunkMBTBE4P5js.ValidationError)("No MetaMask wallet connected");
     }
     if (!message.startsWith("metamask:")) {
-      throw new (0, _chunkGQLHSQGZjs.ValidationError)('message must start with "metamask:"');
+      throw new (0, _chunkMBTBE4P5js.ValidationError)('message must start with "metamask:"');
     }
     const formattedMessage = message;
     return await _chunkPQ5T4GHYjs.MESSAGE_SIGNING_SNAP.signMessage(provider, formattedMessage);
@@ -46,51 +43,53 @@ var defaultEIP6963SigningOptions = {
 var _config, _options, _getAuthSession, getAuthSession_fn, _login, login_fn, _createSrpLoginRawMessage, createSrpLoginRawMessage_fn;
 var SRPJwtBearerAuth = class {
   constructor(config, options) {
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _getAuthSession);
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _login);
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _createSrpLoginRawMessage);
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _config, void 0);
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _options, void 0);
-    _chunkZ4BLTVTBjs.__privateSet.call(void 0, this, _config, config);
-    _chunkZ4BLTVTBjs.__privateSet.call(void 0, this, _options, {
+    // convert expiresIn from seconds to milliseconds and use 90% of expiresIn
+    _chunkV46WVGWNjs.__privateAdd.call(void 0, this, _getAuthSession);
+    _chunkV46WVGWNjs.__privateAdd.call(void 0, this, _login);
+    _chunkV46WVGWNjs.__privateAdd.call(void 0, this, _createSrpLoginRawMessage);
+    _chunkV46WVGWNjs.__privateAdd.call(void 0, this, _config, void 0);
+    _chunkV46WVGWNjs.__privateAdd.call(void 0, this, _options, void 0);
+    _chunkV46WVGWNjs.__privateSet.call(void 0, this, _config, config);
+    _chunkV46WVGWNjs.__privateSet.call(void 0, this, _options, {
       storage: options.storage,
       signing: options.signing ?? defaultEIP6963SigningOptions
     });
   }
   async getAccessToken() {
-    const session = await _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _getAuthSession, getAuthSession_fn).call(this);
+    const session = await _chunkV46WVGWNjs.__privateMethod.call(void 0, this, _getAuthSession, getAuthSession_fn).call(this);
     if (session) {
       return session.token.accessToken;
     }
-    const loginResponse = await _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _login, login_fn).call(this);
+    const loginResponse = await _chunkV46WVGWNjs.__privateMethod.call(void 0, this, _login, login_fn).call(this);
     return loginResponse.token.accessToken;
   }
   async getUserProfile() {
-    const session = await _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _getAuthSession, getAuthSession_fn).call(this);
+    const session = await _chunkV46WVGWNjs.__privateMethod.call(void 0, this, _getAuthSession, getAuthSession_fn).call(this);
     if (session) {
       return session.profile;
     }
-    const loginResponse = await _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _login, login_fn).call(this);
+    const loginResponse = await _chunkV46WVGWNjs.__privateMethod.call(void 0, this, _login, login_fn).call(this);
     return loginResponse.profile;
   }
   async getIdentifier() {
-    return await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).signing.getIdentifier();
+    return await _chunkV46WVGWNjs.__privateGet.call(void 0, this, _options).signing.getIdentifier();
   }
   async signMessage(message) {
-    return await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).signing.signMessage(message);
+    return await _chunkV46WVGWNjs.__privateGet.call(void 0, this, _options).signing.signMessage(message);
   }
 };
 _config = new WeakMap();
 _options = new WeakMap();
 _getAuthSession = new WeakSet();
 getAuthSession_fn = async function() {
-  const auth = await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).storage.getLoginResponse();
+  const auth = await _chunkV46WVGWNjs.__privateGet.call(void 0, this, _options).storage.getLoginResponse();
   if (!auth) {
     return null;
   }
   const currentTime = Date.now();
   const sessionAge = currentTime - auth.token.obtainedAt;
-  if (sessionAge < _chunkBARZBXO7js.SESSION_LIFETIME_MS) {
+  const refreshThreshold = auth.token.expiresIn * 1e3 * 0.9;
+  if (sessionAge < refreshThreshold) {
     return auth;
   }
   return null;
@@ -98,25 +97,26 @@ getAuthSession_fn = async function() {
 _login = new WeakSet();
 login_fn = async function() {
   const address = await this.getIdentifier();
-  const nonceRes = await _chunkNRH6O4QZjs.getNonce.call(void 0, address, _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _config).env);
-  const publicKey = await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).signing.getIdentifier();
-  const rawMessage = _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _createSrpLoginRawMessage, createSrpLoginRawMessage_fn).call(this, nonceRes.nonce, publicKey);
+  const nonceRes = await _chunkXUPRRLBIjs.getNonce.call(void 0, address, _chunkV46WVGWNjs.__privateGet.call(void 0, this, _config).env);
+  const publicKey = await _chunkV46WVGWNjs.__privateGet.call(void 0, this, _options).signing.getIdentifier();
+  const rawMessage = _chunkV46WVGWNjs.__privateMethod.call(void 0, this, _createSrpLoginRawMessage, createSrpLoginRawMessage_fn).call(this, nonceRes.nonce, publicKey);
   const signature = await this.signMessage(rawMessage);
-  const authResponse = await _chunkNRH6O4QZjs.authenticate.call(void 0, 
+  const authResponse = await _chunkXUPRRLBIjs.authenticate.call(void 0, 
     rawMessage,
     signature,
-    _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _config).type,
-    _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _config).env
+    _chunkV46WVGWNjs.__privateGet.call(void 0, this, _config).type,
+    _chunkV46WVGWNjs.__privateGet.call(void 0, this, _config).env
   );
-  const tokenResponse = await _chunkNRH6O4QZjs.authorizeOIDC.call(void 0, 
+  const tokenResponse = await _chunkXUPRRLBIjs.authorizeOIDC.call(void 0, 
     authResponse.token,
-    _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _config).env
+    _chunkV46WVGWNjs.__privateGet.call(void 0, this, _config).env,
+    _chunkV46WVGWNjs.__privateGet.call(void 0, this, _config).platform
   );
   const result = {
     profile: authResponse.profile,
     token: tokenResponse
   };
-  await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).storage.setLoginResponse(result);
+  await _chunkV46WVGWNjs.__privateGet.call(void 0, this, _options).storage.setLoginResponse(result);
   return result;
 };
 _createSrpLoginRawMessage = new WeakSet();
@@ -127,4 +127,4 @@ createSrpLoginRawMessage_fn = function(nonce, publicKey) {
 
 
 exports.SRPJwtBearerAuth = SRPJwtBearerAuth;
-//# sourceMappingURL=chunk-OF3TQWGX.js.map
+//# sourceMappingURL=chunk-6TK7544L.js.map

package/dist/chunk-6TK7544L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqBA,IAAM,+BAAmD;AAAA,EACvD,eAAe,YAA6B;AAC1C,UAAM,WAAW,MAAM,2BAA2B;AAClD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,8BAA8B;AAAA,IAC1D;AACA,WAAO,MAAM,qBAAqB,aAAa,QAAQ;AAAA,EACzD;AAAA,EACA,aAAa,OAAO,YAAqC;AACvD,UAAM,WAAW,MAAM,2BAA2B;AAClD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,8BAA8B;AAAA,IAC1D;AACA,QAAI,CAAC,QAAQ,WAAW,WAAW,GAAG;AACpC,YAAM,IAAI,gBAAgB,qCAAqC;AAAA,IACjE;AACA,UAAM,mBAAmB;AACzB,WAAO,MAAM,qBAAqB,YAAY,UAAU,gBAAgB;AAAA,EAC1E;AACF;AAxCA;AA0CO,IAAM,mBAAN,MAA4C;AAAA,EAKjD,YACE,QACA,SACA;AAqCF;AAAA,uBAAM;AAgBN,uBAAM;AAqCN;AAjGA;AAEA;AAME,uBAAK,SAAU;AACf,uBAAK,UAAW;AAAA,MACd,SAAS,QAAQ;AAAA,MACjB,SAAS,QAAQ,WAAW;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,UAAU,MAAM,sBAAK,oCAAL;AACtB,QAAI,SAAS;AACX,aAAO,QAAQ,MAAM;AAAA,IACvB;AAEA,UAAM,gBAAgB,MAAM,sBAAK,kBAAL;AAC5B,WAAO,cAAc,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAM,iBAAuC;AAC3C,UAAM,UAAU,MAAM,sBAAK,oCAAL;AACtB,QAAI,SAAS;AACX,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,gBAAgB,MAAM,sBAAK,kBAAL;AAC5B,WAAO,cAAc;AAAA,EACvB;AAAA,EAEA,MAAM,gBAAiC;AACrC,WAAO,MAAM,mBAAK,UAAS,QAAQ,cAAc;AAAA,EACnD;AAAA,EAEA,MAAM,YAAY,SAAkC;AAClD,WAAO,MAAM,mBAAK,UAAS,QAAQ,YAAY,OAAO;AAAA,EACxD;AA8DF;AAvGE;AAEA;AA0CM;AAAA,oBAAe,iBAAkC;AACrD,QAAM,OAAO,MAAM,mBAAK,UAAS,QAAQ,iBAAiB;AAC1D,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK,IAAI;AAC7B,QAAM,aAAa,cAAc,KAAK,MAAM;AAC5C,QAAM,mBAAmB,KAAK,MAAM,YAAY,MAAO;AAEvD,MAAI,aAAa,kBAAkB;AACjC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEM;AAAA,WAAM,iBAA2B;AAErC,QAAM,UAAU,MAAM,KAAK,cAAc;AACzC,QAAM,WAAW,MAAM,SAAS,SAAS,mBAAK,SAAQ,GAAG;AACzD,QAAM,YAAY,MAAM,mBAAK,UAAS,QAAQ,cAAc;AAC5D,QAAM,aAAa,sBAAK,wDAAL,WACjB,SAAS,OACT;AAEF,QAAM,YAAY,MAAM,KAAK,YAAY,UAAU;AAGnD,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,mBAAK,SAAQ;AAAA,IACb,mBAAK,SAAQ;AAAA,EACf;AAGA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,aAAa;AAAA,IACb,mBAAK,SAAQ;AAAA,IACb,mBAAK,SAAQ;AAAA,EACf;AAGA,QAAM,SAAwB;AAAA,IAC5B,SAAS,aAAa;AAAA,IACtB,OAAO;AAAA,EACT;AAEA,QAAM,mBAAK,UAAS,QAAQ,iBAAiB,MAAM;AAEnD,SAAO;AACT;AAEA;AAAA,8BAAyB,SACvB,OACA,WACgC;AAChC,SAAO,YAAY,KAAK,IAAI,SAAS;AACvC","sourcesContent":["import { ValidationError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport { MESSAGE_SIGNING_SNAP } from '../utils/messaging-signing-snap-requests';\nimport { authenticate, authorizeOIDC, getNonce } from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n} from './types';\n\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n};\n\nconst defaultEIP6963SigningOptions: AuthSigningOptions = {\n  getIdentifier: async (): Promise<string> => {\n    const provider = await getMetaMaskProviderEIP6963();\n    if (!provider) {\n      throw new ValidationError('No MetaMask wallet connected');\n    }\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider);\n  },\n  signMessage: async (message: string): Promise<string> => {\n    const provider = await getMetaMaskProviderEIP6963();\n    if (!provider) {\n      throw new ValidationError('No MetaMask wallet connected');\n    }\n    if (!message.startsWith('metamask:')) {\n      throw new ValidationError('message must start with \"metamask:\"');\n    }\n    const formattedMessage = message as `metamask:${string}`;\n    return await MESSAGE_SIGNING_SNAP.signMessage(provider, formattedMessage);\n  },\n};\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  #config: AuthConfig;\n\n  #options: Required<JwtBearerAuth_SRP_Options>;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options,\n  ) {\n    this.#config = config;\n    this.#options = {\n      storage: options.storage,\n      signing: options.signing ?? defaultEIP6963SigningOptions,\n    };\n  }\n\n  async getAccessToken(): Promise<string> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(): Promise<string> {\n    return await this.#options.signing.getIdentifier();\n  }\n\n  async signMessage(message: string): Promise<string> {\n    return await this.#options.signing.signMessage(message);\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse();\n    if (!auth) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(): Promise<LoginResponse> {\n    // Nonce\n    const address = await this.getIdentifier();\n    const nonceRes = await getNonce(address, this.#config.env);\n    const publicKey = await this.#options.signing.getIdentifier();\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result);\n\n    return result;\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}

package/dist/chunk-76VRE4BI.mjs

@@ -0,0 +1,18 @@
+// src/controllers/user-storage/encryption/utils.ts
+var byteArrayToBase64 = (byteArray) => {
+  return Buffer.from(byteArray).toString("base64");
+};
+var base64ToByteArray = (base64) => {
+  return new Uint8Array(Buffer.from(base64, "base64"));
+};
+var bytesToUtf8 = (byteArray) => {
+  const decoder = new TextDecoder("utf-8");
+  return decoder.decode(byteArray);
+};
+
+export {
+  byteArrayToBase64,
+  base64ToByteArray,
+  bytesToUtf8
+};
+//# sourceMappingURL=chunk-76VRE4BI.mjs.map

package/dist/chunk-76VRE4BI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/user-storage/encryption/utils.ts"],"sourcesContent":["export const byteArrayToBase64 = (byteArray: Uint8Array) => {\n  return Buffer.from(byteArray).toString('base64');\n};\n\nexport const base64ToByteArray = (base64: string) => {\n  return new Uint8Array(Buffer.from(base64, 'base64'));\n};\n\nexport const bytesToUtf8 = (byteArray: Uint8Array) => {\n  const decoder = new TextDecoder('utf-8');\n  return decoder.decode(byteArray);\n};\n"],"mappings":";AAAO,IAAM,oBAAoB,CAAC,cAA0B;AAC1D,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,QAAQ;AACjD;AAEO,IAAM,oBAAoB,CAAC,WAAmB;AACnD,SAAO,IAAI,WAAW,OAAO,KAAK,QAAQ,QAAQ,CAAC;AACrD;AAEO,IAAM,cAAc,CAAC,cAA0B;AACpD,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,QAAQ,OAAO,SAAS;AACjC;","names":[]}