@metamask/profile-sync-controller 0.0.0 → 0.1.0

package/dist/chunk-QE2F5AZL.mjs

@@ -0,0 +1,158 @@
+import {
+  getAnyCachedKey,
+  getCachedKeyBySalt,
+  setCachedKey
+} from "./chunk-H25EBXG5.mjs";
+import {
+  base64ToByteArray,
+  byteArrayToBase64,
+  bytesToUtf8
+} from "./chunk-76VRE4BI.mjs";
+import {
+  __privateAdd,
+  __privateMethod
+} from "./chunk-26CCETCM.mjs";
+
+// src/controllers/user-storage/encryption/encryption.ts
+import { gcm } from "@noble/ciphers/aes";
+import { randomBytes } from "@noble/ciphers/webcrypto";
+import { scrypt } from "@noble/hashes/scrypt";
+import { sha256 } from "@noble/hashes/sha256";
+import { utf8ToBytes, concatBytes, bytesToHex } from "@noble/hashes/utils";
+var ALGORITHM_NONCE_SIZE = 12;
+var ALGORITHM_KEY_SIZE = 16;
+var SCRYPT_SALT_SIZE = 16;
+var SCRYPT_N = 2 ** 17;
+var SCRYPT_r = 8;
+var SCRYPT_p = 1;
+var _encryptStringV1, encryptStringV1_fn, _decryptStringV1, decryptStringV1_fn, _encrypt, encrypt_fn, _decrypt, decrypt_fn, _getOrGenerateScryptKey, getOrGenerateScryptKey_fn;
+var EncryptorDecryptor = class {
+  constructor() {
+    __privateAdd(this, _encryptStringV1);
+    __privateAdd(this, _decryptStringV1);
+    __privateAdd(this, _encrypt);
+    __privateAdd(this, _decrypt);
+    __privateAdd(this, _getOrGenerateScryptKey);
+  }
+  encryptString(plaintext, password) {
+    try {
+      return __privateMethod(this, _encryptStringV1, encryptStringV1_fn).call(this, plaintext, password);
+    } catch (e) {
+      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);
+      throw new Error(`Unable to encrypt string - ${errorMessage}`);
+    }
+  }
+  decryptString(encryptedDataStr, password) {
+    try {
+      const encryptedData = JSON.parse(encryptedDataStr);
+      if (encryptedData.v === "1") {
+        if (encryptedData.t === "scrypt") {
+          return __privateMethod(this, _decryptStringV1, decryptStringV1_fn).call(this, encryptedData, password);
+        }
+      }
+      throw new Error(
+        `Unsupported encrypted data payload - ${encryptedDataStr}`
+      );
+    } catch (e) {
+      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);
+      throw new Error(`Unable to decrypt string - ${errorMessage}`);
+    }
+  }
+};
+_encryptStringV1 = new WeakSet();
+encryptStringV1_fn = function(plaintext, password) {
+  const { key, salt } = __privateMethod(this, _getOrGenerateScryptKey, getOrGenerateScryptKey_fn).call(this, password, {
+    N: SCRYPT_N,
+    r: SCRYPT_r,
+    p: SCRYPT_p,
+    dkLen: ALGORITHM_KEY_SIZE
+  });
+  const plaintextRaw = utf8ToBytes(plaintext);
+  const ciphertextAndNonceAndSalt = concatBytes(
+    salt,
+    __privateMethod(this, _encrypt, encrypt_fn).call(this, plaintextRaw, key)
+  );
+  const encryptedData = byteArrayToBase64(ciphertextAndNonceAndSalt);
+  const encryptedPayload = {
+    v: "1",
+    t: "scrypt",
+    d: encryptedData,
+    o: {
+      N: SCRYPT_N,
+      r: SCRYPT_r,
+      p: SCRYPT_p,
+      dkLen: ALGORITHM_KEY_SIZE
+    },
+    saltLen: SCRYPT_SALT_SIZE
+  };
+  return JSON.stringify(encryptedPayload);
+};
+_decryptStringV1 = new WeakSet();
+decryptStringV1_fn = function(data, password) {
+  const { o, d: base64CiphertextAndNonceAndSalt, saltLen } = data;
+  const ciphertextAndNonceAndSalt = base64ToByteArray(
+    base64CiphertextAndNonceAndSalt
+  );
+  const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);
+  const ciphertextAndNonce = ciphertextAndNonceAndSalt.slice(
+    saltLen,
+    ciphertextAndNonceAndSalt.length
+  );
+  const { key } = __privateMethod(this, _getOrGenerateScryptKey, getOrGenerateScryptKey_fn).call(this, password, {
+    N: o.N,
+    r: o.r,
+    p: o.p,
+    dkLen: o.dkLen
+  }, salt);
+  return bytesToUtf8(__privateMethod(this, _decrypt, decrypt_fn).call(this, ciphertextAndNonce, key));
+};
+_encrypt = new WeakSet();
+encrypt_fn = function(plaintext, key) {
+  const nonce = randomBytes(ALGORITHM_NONCE_SIZE);
+  const ciphertext = gcm(key, nonce).encrypt(plaintext);
+  return concatBytes(nonce, ciphertext);
+};
+_decrypt = new WeakSet();
+decrypt_fn = function(ciphertextAndNonce, key) {
+  const nonce = ciphertextAndNonce.slice(0, ALGORITHM_NONCE_SIZE);
+  const ciphertext = ciphertextAndNonce.slice(
+    ALGORITHM_NONCE_SIZE,
+    ciphertextAndNonce.length
+  );
+  return gcm(key, nonce).decrypt(ciphertext);
+};
+_getOrGenerateScryptKey = new WeakSet();
+getOrGenerateScryptKey_fn = function(password, o, salt) {
+  const hashedPassword = createSHA256Hash(password);
+  const cachedKey = salt ? getCachedKeyBySalt(hashedPassword, salt) : getAnyCachedKey(hashedPassword);
+  if (cachedKey) {
+    return {
+      key: cachedKey.key,
+      salt: cachedKey.salt
+    };
+  }
+  const newSalt = salt ?? randomBytes(SCRYPT_SALT_SIZE);
+  const newKey = scrypt(password, newSalt, {
+    N: o.N,
+    r: o.r,
+    p: o.p,
+    dkLen: o.dkLen
+  });
+  setCachedKey(hashedPassword, newSalt, newKey);
+  return {
+    key: newKey,
+    salt: newSalt
+  };
+};
+var encryption = new EncryptorDecryptor();
+var encryption_default = encryption;
+function createSHA256Hash(data) {
+  const hashedData = sha256(data);
+  return bytesToHex(hashedData);
+}
+
+export {
+  encryption_default,
+  createSHA256Hash
+};
+//# sourceMappingURL=chunk-QE2F5AZL.mjs.map

package/dist/chunk-QE2F5AZL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/user-storage/encryption/encryption.ts"],"sourcesContent":["import { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { scrypt } from '@noble/hashes/scrypt';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { utf8ToBytes, concatBytes, bytesToHex } from '@noble/hashes/utils';\n\nimport { getAnyCachedKey, getCachedKeyBySalt, setCachedKey } from './cache';\nimport { base64ToByteArray, byteArrayToBase64, bytesToUtf8 } from './utils';\n\nexport type EncryptedPayload = {\n  // version\n  v: '1';\n\n  // key derivation function algorithm - scrypt\n  t: 'scrypt';\n\n  // data\n  d: string;\n\n  // encryption options - scrypt\n  o: {\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    N: number;\n    r: number;\n    p: number;\n    dkLen: number;\n  };\n\n  // Salt options\n  saltLen: number;\n};\n\n// Nonce/Key Sizes\nconst ALGORITHM_NONCE_SIZE = 12; // 12 bytes\nconst ALGORITHM_KEY_SIZE = 16; // 16 bytes\n\n// Scrypt settings\n// see: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#scrypt\nconst SCRYPT_SALT_SIZE = 16; // 16 bytes\nconst SCRYPT_N = 2 ** 17; // CPU/memory cost parameter (must be a power of 2, > 1)\n// eslint-disable-next-line @typescript-eslint/naming-convention\nconst SCRYPT_r = 8; // Block size parameter\n// eslint-disable-next-line @typescript-eslint/naming-convention\nconst SCRYPT_p = 1; // Parallelization parameter\n\nclass EncryptorDecryptor {\n  encryptString(plaintext: string, password: string): string {\n    try {\n      return this.#encryptStringV1(plaintext, password);\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to encrypt string - ${errorMessage}`);\n    }\n  }\n\n  decryptString(encryptedDataStr: string, password: string): string {\n    try {\n      const encryptedData: EncryptedPayload = JSON.parse(encryptedDataStr);\n      if (encryptedData.v === '1') {\n        if (encryptedData.t === 'scrypt') {\n          return this.#decryptStringV1(encryptedData, password);\n        }\n      }\n      throw new Error(\n        `Unsupported encrypted data payload - ${encryptedDataStr}`,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to decrypt string - ${errorMessage}`);\n    }\n  }\n\n  #encryptStringV1(plaintext: string, password: string): string {\n    const { key, salt } = this.#getOrGenerateScryptKey(password, {\n      N: SCRYPT_N,\n      r: SCRYPT_r,\n      p: SCRYPT_p,\n      dkLen: ALGORITHM_KEY_SIZE,\n    });\n\n    // Encrypt and prepend salt.\n    const plaintextRaw = utf8ToBytes(plaintext);\n    const ciphertextAndNonceAndSalt = concatBytes(\n      salt,\n      this.#encrypt(plaintextRaw, key),\n    );\n\n    // Convert to Base64\n    const encryptedData = byteArrayToBase64(ciphertextAndNonceAndSalt);\n\n    const encryptedPayload: EncryptedPayload = {\n      v: '1',\n      t: 'scrypt',\n      d: encryptedData,\n      o: {\n        N: SCRYPT_N,\n        r: SCRYPT_r,\n        p: SCRYPT_p,\n        dkLen: ALGORITHM_KEY_SIZE,\n      },\n      saltLen: SCRYPT_SALT_SIZE,\n    };\n\n    return JSON.stringify(encryptedPayload);\n  }\n\n  #decryptStringV1(data: EncryptedPayload, password: string): string {\n    const { o, d: base64CiphertextAndNonceAndSalt, saltLen } = data;\n\n    // Decode the base64.\n    const ciphertextAndNonceAndSalt = base64ToByteArray(\n      base64CiphertextAndNonceAndSalt,\n    );\n\n    // Create buffers of salt and ciphertextAndNonce.\n    const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);\n    const ciphertextAndNonce = ciphertextAndNonceAndSalt.slice(\n      saltLen,\n      ciphertextAndNonceAndSalt.length,\n    );\n\n    // Derive the key.\n    const { key } = this.#getOrGenerateScryptKey(\n      password,\n      {\n        N: o.N,\n        r: o.r,\n        p: o.p,\n        dkLen: o.dkLen,\n      },\n      salt,\n    );\n\n    // Decrypt and return result.\n    return bytesToUtf8(this.#decrypt(ciphertextAndNonce, key));\n  }\n\n  #encrypt(plaintext: Uint8Array, key: Uint8Array): Uint8Array {\n    const nonce = randomBytes(ALGORITHM_NONCE_SIZE);\n\n    // Encrypt and prepend nonce.\n    const ciphertext = gcm(key, nonce).encrypt(plaintext);\n\n    return concatBytes(nonce, ciphertext);\n  }\n\n  #decrypt(ciphertextAndNonce: Uint8Array, key: Uint8Array): Uint8Array {\n    // Create buffers of nonce and ciphertext.\n    const nonce = ciphertextAndNonce.slice(0, ALGORITHM_NONCE_SIZE);\n    const ciphertext = ciphertextAndNonce.slice(\n      ALGORITHM_NONCE_SIZE,\n      ciphertextAndNonce.length,\n    );\n\n    // Decrypt and return result.\n    return gcm(key, nonce).decrypt(ciphertext);\n  }\n\n  #getOrGenerateScryptKey(\n    password: string,\n    o: EncryptedPayload['o'],\n    salt?: Uint8Array,\n  ) {\n    const hashedPassword = createSHA256Hash(password);\n    const cachedKey = salt\n      ? getCachedKeyBySalt(hashedPassword, salt)\n      : getAnyCachedKey(hashedPassword);\n\n    if (cachedKey) {\n      return {\n        key: cachedKey.key,\n        salt: cachedKey.salt,\n      };\n    }\n\n    const newSalt = salt ?? randomBytes(SCRYPT_SALT_SIZE);\n    const newKey = scrypt(password, newSalt, {\n      N: o.N,\n      r: o.r,\n      p: o.p,\n      dkLen: o.dkLen,\n    });\n    setCachedKey(hashedPassword, newSalt, newKey);\n\n    return {\n      key: newKey,\n      salt: newSalt,\n    };\n  }\n}\n\nconst encryption = new EncryptorDecryptor();\nexport default encryption;\n\n/**\n * Receive a SHA256 hash from a given string\n * @param data - input\n * @returns sha256 hash\n */\nexport function createSHA256Hash(data: string): string {\n  const hashedData = sha256(data);\n  return bytesToHex(hashedData);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,WAAW;AACpB,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,cAAc;AACvB,SAAS,aAAa,aAAa,kBAAkB;AA6BrD,IAAM,uBAAuB;AAC7B,IAAM,qBAAqB;AAI3B,IAAM,mBAAmB;AACzB,IAAM,WAAW,KAAK;AAEtB,IAAM,WAAW;AAEjB,IAAM,WAAW;AA3CjB;AA6CA,IAAM,qBAAN,MAAyB;AAAA,EAAzB;AA2BE;AAkCA;AA+BA;AASA;AAYA;AAAA;AAAA,EAhHA,cAAc,WAAmB,UAA0B;AACzD,QAAI;AACF,aAAO,sBAAK,sCAAL,WAAsB,WAAW;AAAA,IAC1C,SAAS,GAAG;AACV,YAAM,eAAe,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,CAAC;AACtE,YAAM,IAAI,MAAM,8BAA8B,YAAY,EAAE;AAAA,IAC9D;AAAA,EACF;AAAA,EAEA,cAAc,kBAA0B,UAA0B;AAChE,QAAI;AACF,YAAM,gBAAkC,KAAK,MAAM,gBAAgB;AACnE,UAAI,cAAc,MAAM,KAAK;AAC3B,YAAI,cAAc,MAAM,UAAU;AAChC,iBAAO,sBAAK,sCAAL,WAAsB,eAAe;AAAA,QAC9C;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR,wCAAwC,gBAAgB;AAAA,MAC1D;AAAA,IACF,SAAS,GAAG;AACV,YAAM,eAAe,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,CAAC;AACtE,YAAM,IAAI,MAAM,8BAA8B,YAAY,EAAE;AAAA,IAC9D;AAAA,EACF;AAuHF;AArHE;AAAA,qBAAgB,SAAC,WAAmB,UAA0B;AAC5D,QAAM,EAAE,KAAK,KAAK,IAAI,sBAAK,oDAAL,WAA6B,UAAU;AAAA,IAC3D,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,OAAO;AAAA,EACT;AAGA,QAAM,eAAe,YAAY,SAAS;AAC1C,QAAM,4BAA4B;AAAA,IAChC;AAAA,IACA,sBAAK,sBAAL,WAAc,cAAc;AAAA,EAC9B;AAGA,QAAM,gBAAgB,kBAAkB,yBAAyB;AAEjE,QAAM,mBAAqC;AAAA,IACzC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,MACD,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,IACA,SAAS;AAAA,EACX;AAEA,SAAO,KAAK,UAAU,gBAAgB;AACxC;AAEA;AAAA,qBAAgB,SAAC,MAAwB,UAA0B;AACjE,QAAM,EAAE,GAAG,GAAG,iCAAiC,QAAQ,IAAI;AAG3D,QAAM,4BAA4B;AAAA,IAChC;AAAA,EACF;AAGA,QAAM,OAAO,0BAA0B,MAAM,GAAG,OAAO;AACvD,QAAM,qBAAqB,0BAA0B;AAAA,IACnD;AAAA,IACA,0BAA0B;AAAA,EAC5B;AAGA,QAAM,EAAE,IAAI,IAAI,sBAAK,oDAAL,WACd,UACA;AAAA,IACE,GAAG,EAAE;AAAA,IACL,GAAG,EAAE;AAAA,IACL,GAAG,EAAE;AAAA,IACL,OAAO,EAAE;AAAA,EACX,GACA;AAIF,SAAO,YAAY,sBAAK,sBAAL,WAAc,oBAAoB,IAAI;AAC3D;AAEA;AAAA,aAAQ,SAAC,WAAuB,KAA6B;AAC3D,QAAM,QAAQ,YAAY,oBAAoB;AAG9C,QAAM,aAAa,IAAI,KAAK,KAAK,EAAE,QAAQ,SAAS;AAEpD,SAAO,YAAY,OAAO,UAAU;AACtC;AAEA;AAAA,aAAQ,SAAC,oBAAgC,KAA6B;AAEpE,QAAM,QAAQ,mBAAmB,MAAM,GAAG,oBAAoB;AAC9D,QAAM,aAAa,mBAAmB;AAAA,IACpC;AAAA,IACA,mBAAmB;AAAA,EACrB;AAGA,SAAO,IAAI,KAAK,KAAK,EAAE,QAAQ,UAAU;AAC3C;AAEA;AAAA,4BAAuB,SACrB,UACA,GACA,MACA;AACA,QAAM,iBAAiB,iBAAiB,QAAQ;AAChD,QAAM,YAAY,OACd,mBAAmB,gBAAgB,IAAI,IACvC,gBAAgB,cAAc;AAElC,MAAI,WAAW;AACb,WAAO;AAAA,MACL,KAAK,UAAU;AAAA,MACf,MAAM,UAAU;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU,QAAQ,YAAY,gBAAgB;AACpD,QAAM,SAAS,OAAO,UAAU,SAAS;AAAA,IACvC,GAAG,EAAE;AAAA,IACL,GAAG,EAAE;AAAA,IACL,GAAG,EAAE;AAAA,IACL,OAAO,EAAE;AAAA,EACX,CAAC;AACD,eAAa,gBAAgB,SAAS,MAAM;AAE5C,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;AAGF,IAAM,aAAa,IAAI,mBAAmB;AAC1C,IAAO,qBAAQ;AAOR,SAAS,iBAAiB,MAAsB;AACrD,QAAM,aAAa,OAAO,IAAI;AAC9B,SAAO,WAAW,UAAU;AAC9B;","names":[]}

package/dist/chunk-QHL6SQTC.mjs

@@ -0,0 +1,112 @@
+import {
+  AuthenticationController
+} from "./chunk-PRDECQM6.mjs";
+import {
+  AUTH_LOGIN_ENDPOINT,
+  AUTH_NONCE_ENDPOINT,
+  OIDC_TOKENS_ENDPOINT
+} from "./chunk-W7JFFMEZ.mjs";
+import {
+  require_nock
+} from "./chunk-JMU3OVPK.mjs";
+import {
+  __export,
+  __toESM
+} from "./chunk-26CCETCM.mjs";
+
+// src/controllers/authentication/index.ts
+var authentication_exports = {};
+__export(authentication_exports, {
+  Controller: () => AuthenticationController,
+  Mocks: () => fixtures_exports
+});
+
+// src/controllers/authentication/__fixtures__/index.ts
+var fixtures_exports = {};
+__export(fixtures_exports, {
+  MOCK_ACCESS_TOKEN: () => MOCK_ACCESS_TOKEN,
+  MOCK_JWT: () => MOCK_JWT,
+  MOCK_LOGIN_RESPONSE: () => MOCK_LOGIN_RESPONSE,
+  MOCK_NONCE: () => MOCK_NONCE,
+  MOCK_NONCE_RESPONSE: () => MOCK_NONCE_RESPONSE,
+  MOCK_OATH_TOKEN_RESPONSE: () => MOCK_OATH_TOKEN_RESPONSE,
+  getMockAuthAccessTokenResponse: () => getMockAuthAccessTokenResponse,
+  getMockAuthLoginResponse: () => getMockAuthLoginResponse,
+  getMockAuthNonceResponse: () => getMockAuthNonceResponse,
+  mockEndpointAccessToken: () => mockEndpointAccessToken,
+  mockEndpointGetNonce: () => mockEndpointGetNonce,
+  mockEndpointLogin: () => mockEndpointLogin
+});
+
+// src/controllers/authentication/__fixtures__/mockResponses.ts
+var MOCK_NONCE = "4cbfqzoQpcNxVImGv";
+var MOCK_NONCE_RESPONSE = {
+  nonce: MOCK_NONCE
+};
+var getMockAuthNonceResponse = () => {
+  return {
+    url: AUTH_NONCE_ENDPOINT,
+    requestMethod: "GET",
+    response: MOCK_NONCE_RESPONSE
+  };
+};
+var MOCK_JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
+var MOCK_LOGIN_RESPONSE = {
+  token: MOCK_JWT,
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  expires_in: (/* @__PURE__ */ new Date()).toString(),
+  profile: {
+    // eslint-disable-next-line @typescript-eslint/naming-convention
+    identifier_id: "MOCK_IDENTIFIER",
+    // eslint-disable-next-line @typescript-eslint/naming-convention
+    profile_id: "MOCK_PROFILE_ID"
+  }
+};
+var getMockAuthLoginResponse = () => {
+  return {
+    url: AUTH_LOGIN_ENDPOINT,
+    requestMethod: "POST",
+    response: MOCK_LOGIN_RESPONSE
+  };
+};
+var MOCK_ACCESS_TOKEN = `MOCK_ACCESS_TOKEN-${MOCK_JWT}`;
+var MOCK_OATH_TOKEN_RESPONSE = {
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  access_token: MOCK_ACCESS_TOKEN,
+  // eslint-disable-next-line @typescript-eslint/naming-convention
+  expires_in: (/* @__PURE__ */ new Date()).getTime()
+};
+var getMockAuthAccessTokenResponse = () => {
+  return {
+    url: OIDC_TOKENS_ENDPOINT,
+    requestMethod: "POST",
+    response: MOCK_OATH_TOKEN_RESPONSE
+  };
+};
+
+// src/controllers/authentication/__fixtures__/mockServices.ts
+var import_nock = __toESM(require_nock());
+var mockEndpointGetNonce = (mockReply) => {
+  const mockResponse = getMockAuthNonceResponse();
+  const reply = mockReply ?? { status: 200, body: mockResponse.response };
+  const mockNonceEndpoint = (0, import_nock.default)(mockResponse.url).get("").query(true).reply(reply.status, reply.body);
+  return mockNonceEndpoint;
+};
+var mockEndpointLogin = (mockReply) => {
+  const mockResponse = getMockAuthLoginResponse();
+  const reply = mockReply ?? { status: 200, body: mockResponse.response };
+  const mockLoginEndpoint = (0, import_nock.default)(mockResponse.url).post("").reply(reply.status, reply.body);
+  return mockLoginEndpoint;
+};
+var mockEndpointAccessToken = (mockReply) => {
+  const mockResponse = getMockAuthAccessTokenResponse();
+  const reply = mockReply ?? { status: 200, body: mockResponse.response };
+  const mockOidcTokensEndpoint = (0, import_nock.default)(mockResponse.url).post("").reply(reply.status, reply.body);
+  return mockOidcTokensEndpoint;
+};
+
+export {
+  fixtures_exports,
+  authentication_exports
+};
+//# sourceMappingURL=chunk-QHL6SQTC.mjs.map

package/dist/chunk-QHL6SQTC.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/authentication/index.ts","../src/controllers/authentication/__fixtures__/index.ts","../src/controllers/authentication/__fixtures__/mockResponses.ts","../src/controllers/authentication/__fixtures__/mockServices.ts"],"sourcesContent":["import Controller from './AuthenticationController';\n\nexport { Controller };\nexport * from './AuthenticationController';\nexport * as Mocks from './__fixtures__';\n","export * from './mockResponses';\nexport * from './mockServices';\n","import type {\n  LoginResponse,\n  NonceResponse,\n  OAuthTokenResponse,\n} from '../services';\nimport {\n  AUTH_LOGIN_ENDPOINT,\n  AUTH_NONCE_ENDPOINT,\n  OIDC_TOKENS_ENDPOINT,\n} from '../services';\n\ntype MockResponse = {\n  url: string;\n  requestMethod: 'GET' | 'POST' | 'PUT';\n  response: unknown;\n};\n\nexport const MOCK_NONCE = '4cbfqzoQpcNxVImGv';\nexport const MOCK_NONCE_RESPONSE: NonceResponse = {\n  nonce: MOCK_NONCE,\n};\n\nexport const getMockAuthNonceResponse = () => {\n  return {\n    url: AUTH_NONCE_ENDPOINT,\n    requestMethod: 'GET',\n    response: MOCK_NONCE_RESPONSE,\n  } satisfies MockResponse;\n};\n\nexport const MOCK_JWT =\n  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';\nexport const MOCK_LOGIN_RESPONSE: LoginResponse = {\n  token: MOCK_JWT,\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: new Date().toString(),\n  profile: {\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    identifier_id: 'MOCK_IDENTIFIER',\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    profile_id: 'MOCK_PROFILE_ID',\n  },\n};\n\nexport const getMockAuthLoginResponse = () => {\n  return {\n    url: AUTH_LOGIN_ENDPOINT,\n    requestMethod: 'POST',\n    response: MOCK_LOGIN_RESPONSE,\n  } satisfies MockResponse;\n};\n\nexport const MOCK_ACCESS_TOKEN = `MOCK_ACCESS_TOKEN-${MOCK_JWT}`;\nexport const MOCK_OATH_TOKEN_RESPONSE: OAuthTokenResponse = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  access_token: MOCK_ACCESS_TOKEN,\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: new Date().getTime(),\n};\n\nexport const getMockAuthAccessTokenResponse = () => {\n  return {\n    url: OIDC_TOKENS_ENDPOINT,\n    requestMethod: 'POST',\n    response: MOCK_OATH_TOKEN_RESPONSE,\n  } satisfies MockResponse;\n};\n","import nock from 'nock';\n\nimport {\n  getMockAuthAccessTokenResponse,\n  getMockAuthLoginResponse,\n  getMockAuthNonceResponse,\n} from './mockResponses';\n\ntype MockReply = {\n  status: nock.StatusCode;\n  body?: nock.Body;\n};\n\nexport const mockEndpointGetNonce = (mockReply?: MockReply) => {\n  const mockResponse = getMockAuthNonceResponse();\n  const reply = mockReply ?? { status: 200, body: mockResponse.response };\n  const mockNonceEndpoint = nock(mockResponse.url)\n    .get('')\n    .query(true)\n    .reply(reply.status, reply.body);\n\n  return mockNonceEndpoint;\n};\n\nexport const mockEndpointLogin = (mockReply?: MockReply) => {\n  const mockResponse = getMockAuthLoginResponse();\n  const reply = mockReply ?? { status: 200, body: mockResponse.response };\n  const mockLoginEndpoint = nock(mockResponse.url)\n    .post('')\n    .reply(reply.status, reply.body);\n\n  return mockLoginEndpoint;\n};\n\nexport const mockEndpointAccessToken = (mockReply?: MockReply) => {\n  const mockResponse = getMockAuthAccessTokenResponse();\n  const reply = mockReply ?? { status: 200, body: mockResponse.response };\n  const mockOidcTokensEndpoint = nock(mockResponse.url)\n    .post('')\n    .reply(reply.status, reply.body);\n\n  return mockOidcTokensEndpoint;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiBO,IAAM,aAAa;AACnB,IAAM,sBAAqC;AAAA,EAChD,OAAO;AACT;AAEO,IAAM,2BAA2B,MAAM;AAC5C,SAAO;AAAA,IACL,KAAK;AAAA,IACL,eAAe;AAAA,IACf,UAAU;AAAA,EACZ;AACF;AAEO,IAAM,WACX;AACK,IAAM,sBAAqC;AAAA,EAChD,OAAO;AAAA;AAAA,EAEP,aAAY,oBAAI,KAAK,GAAE,SAAS;AAAA,EAChC,SAAS;AAAA;AAAA,IAEP,eAAe;AAAA;AAAA,IAEf,YAAY;AAAA,EACd;AACF;AAEO,IAAM,2BAA2B,MAAM;AAC5C,SAAO;AAAA,IACL,KAAK;AAAA,IACL,eAAe;AAAA,IACf,UAAU;AAAA,EACZ;AACF;AAEO,IAAM,oBAAoB,qBAAqB,QAAQ;AACvD,IAAM,2BAA+C;AAAA;AAAA,EAE1D,cAAc;AAAA;AAAA,EAEd,aAAY,oBAAI,KAAK,GAAE,QAAQ;AACjC;AAEO,IAAM,iCAAiC,MAAM;AAClD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,eAAe;AAAA,IACf,UAAU;AAAA,EACZ;AACF;;;AClEA,kBAAiB;AAaV,IAAM,uBAAuB,CAAC,cAA0B;AAC7D,QAAM,eAAe,yBAAyB;AAC9C,QAAM,QAAQ,aAAa,EAAE,QAAQ,KAAK,MAAM,aAAa,SAAS;AACtE,QAAM,wBAAoB,YAAAA,SAAK,aAAa,GAAG,EAC5C,IAAI,EAAE,EACN,MAAM,IAAI,EACV,MAAM,MAAM,QAAQ,MAAM,IAAI;AAEjC,SAAO;AACT;AAEO,IAAM,oBAAoB,CAAC,cAA0B;AAC1D,QAAM,eAAe,yBAAyB;AAC9C,QAAM,QAAQ,aAAa,EAAE,QAAQ,KAAK,MAAM,aAAa,SAAS;AACtE,QAAM,wBAAoB,YAAAA,SAAK,aAAa,GAAG,EAC5C,KAAK,EAAE,EACP,MAAM,MAAM,QAAQ,MAAM,IAAI;AAEjC,SAAO;AACT;AAEO,IAAM,0BAA0B,CAAC,cAA0B;AAChE,QAAM,eAAe,+BAA+B;AACpD,QAAM,QAAQ,aAAa,EAAE,QAAQ,KAAK,MAAM,aAAa,SAAS;AACtE,QAAM,6BAAyB,YAAAA,SAAK,aAAa,GAAG,EACjD,KAAK,EAAE,EACP,MAAM,MAAM,QAAQ,MAAM,IAAI;AAEjC,SAAO;AACT;","names":["nock"]}

package/dist/chunk-QILE6KIE.js

@@ -0,0 +1,79 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkDLXLU44Zjs = require('./chunk-DLXLU44Z.js');
+
+
+var _chunkLHDVZNW5js = require('./chunk-LHDVZNW5.js');
+
+
+var _chunk6TK7544Ljs = require('./chunk-6TK7544L.js');
+
+
+var _chunkT77FC4PBjs = require('./chunk-T77FC4PB.js');
+
+
+
+
+
+
+var _chunkPQ5T4GHYjs = require('./chunk-PQ5T4GHY.js');
+
+
+
+var _chunkLUKNP4HMjs = require('./chunk-LUKNP4HM.js');
+
+
+
+var _chunkGLDUXN2Tjs = require('./chunk-GLDUXN2T.js');
+
+
+
+
+
+var _chunk4OMJ7A6Ajs = require('./chunk-4OMJ7A6A.js');
+
+
+
+
+
+
+
+
+var _chunkMBTBE4P5js = require('./chunk-MBTBE4P5.js');
+
+
+var _chunkV46WVGWNjs = require('./chunk-V46WVGWN.js');
+
+// src/sdk/index.ts
+var sdk_exports = {};
+_chunkV46WVGWNjs.__export.call(void 0, sdk_exports, {
+  AuthType: () => _chunkT77FC4PBjs.AuthType,
+  Encryption: () => _chunkGLDUXN2Tjs.Encryption,
+  Env: () => _chunk4OMJ7A6Ajs.Env,
+  JwtBearerAuth: () => _chunkDLXLU44Zjs.JwtBearerAuth,
+  MESSAGE_SIGNING_SNAP: () => _chunkPQ5T4GHYjs.MESSAGE_SIGNING_SNAP,
+  NonceRetrievalError: () => _chunkMBTBE4P5js.NonceRetrievalError,
+  NotFoundError: () => _chunkMBTBE4P5js.NotFoundError,
+  PairError: () => _chunkMBTBE4P5js.PairError,
+  Platform: () => _chunk4OMJ7A6Ajs.Platform,
+  SIWEJwtBearerAuth: () => _chunkLHDVZNW5js.SIWEJwtBearerAuth,
+  SNAP_ORIGIN: () => _chunkPQ5T4GHYjs.SNAP_ORIGIN,
+  SRPJwtBearerAuth: () => _chunk6TK7544Ljs.SRPJwtBearerAuth,
+  STORAGE_URL: () => _chunkLUKNP4HMjs.STORAGE_URL,
+  SignInError: () => _chunkMBTBE4P5js.SignInError,
+  UnsupportedAuthTypeError: () => _chunkMBTBE4P5js.UnsupportedAuthTypeError,
+  UserStorage: () => _chunkLUKNP4HMjs.UserStorage,
+  UserStorageError: () => _chunkMBTBE4P5js.UserStorageError,
+  ValidationError: () => _chunkMBTBE4P5js.ValidationError,
+  connectSnap: () => _chunkPQ5T4GHYjs.connectSnap,
+  createSHA256Hash: () => _chunkGLDUXN2Tjs.createSHA256Hash,
+  getEnvUrls: () => _chunk4OMJ7A6Ajs.getEnvUrls,
+  getOidcClientId: () => _chunk4OMJ7A6Ajs.getOidcClientId,
+  getSnap: () => _chunkPQ5T4GHYjs.getSnap,
+  getSnaps: () => _chunkPQ5T4GHYjs.getSnaps
+});
+
+
+
+exports.sdk_exports = sdk_exports;
+//# sourceMappingURL=chunk-QILE6KIE.js.map

package/dist/chunk-QILE6KIE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA","sourcesContent":["export * from './authentication';\nexport * from './user-storage';\nexport * from './env';\nexport * from './errors';\nexport * from './encryption';\nexport * from './utils/messaging-signing-snap-requests';\n"]}

package/dist/{chunk-CFST6GWE.js → chunk-T77FC4PB.js}

@@ -8,4 +8,4 @@ var AuthType = /* @__PURE__ */ ((AuthType2) => {
 
 
 exports.AuthType = AuthType;
-//# sourceMappingURL=chunk-CFST6GWE.js.map
+//# sourceMappingURL=chunk-T77FC4PB.js.map

package/dist/chunk-T77FC4PB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication-jwt-bearer/types.ts"],"names":["AuthType"],"mappings":";AAEO,IAAW,WAAX,kBAAWA,cAAX;AAGL,EAAAA,UAAA,SAAM;AAGN,EAAAA,UAAA,UAAO;AANS,SAAAA;AAAA,GAAA","sourcesContent":["import type { Env, Platform } from '../env';\n\nexport const enum AuthType {\n  /* sign in using a private key derived from your secret recovery phrase (SRP). \n       Uses message signing snap to perform this operation */\n  SRP = 'SRP',\n\n  /* sign in with Ethereum */\n  SiWE = 'SiWE',\n}\n\nexport type AuthConfig = {\n  env: Env;\n  platform: Platform;\n  type: AuthType;\n};\n\nexport type AccessToken = {\n  /**\n   * The JWT Access Token\n   */\n  accessToken: string;\n  /**\n   * Expiration in seconds\n   */\n  expiresIn: number;\n  /**\n   * Date in milliseconds\n   */\n  obtainedAt: number;\n};\n\nexport type UserProfile = {\n  /**\n   * The \"Identifier\" used to log in with.\n   */\n  identifierId: string;\n  /**\n   * The Unique profile for a logged in user. A Profile can be logged in via multiple Identifiers\n   */\n  profileId: string;\n  /**\n   * Server MetaMetrics ID. Allows grouping of user events cross platform.\n   */\n  metaMetricsId: string;\n};\n\nexport type LoginResponse = {\n  token: AccessToken;\n  profile: UserProfile;\n};\n\nexport type IBaseAuth = {\n  getAccessToken: () => Promise<string>;\n  getUserProfile: () => Promise<UserProfile>;\n  getIdentifier: () => Promise<string>;\n  signMessage: (message: string) => Promise<string>;\n};\n\nexport type AuthStorageOptions = {\n  getLoginResponse: () => Promise<LoginResponse | null>;\n  setLoginResponse: (val: LoginResponse) => Promise<void>;\n};\n\nexport type AuthSigningOptions = {\n  signMessage: (message: string) => Promise<string>;\n  getIdentifier: () => Promise<string>;\n};\n\nexport type ErrorMessage = {\n  message: string;\n  error: string;\n};\n\nexport type Pair = {\n  identifier: string;\n  encryptedStorageKey: string;\n  identifierType: 'SIWE' | 'SRP';\n  signMessage: (message: string) => Promise<string>;\n};\n"]}

package/dist/{chunk-BHVT2QEA.mjs → chunk-TFFQFIJV.mjs}

@@ -11,6 +11,12 @@ var SignInError = class extends Error {
     this.name = "SignInError";
   }
 };
+var PairError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PairError";
+  }
+};
 var UserStorageError = class extends Error {
   constructor(message) {
     super(message);
@@ -39,9 +45,10 @@ var NotFoundError = class extends Error {
 export {
   NonceRetrievalError,
   SignInError,
+  PairError,
   UserStorageError,
   ValidationError,
   UnsupportedAuthTypeError,
   NotFoundError
 };
-//# sourceMappingURL=chunk-BHVT2QEA.mjs.map
+//# sourceMappingURL=chunk-TFFQFIJV.mjs.map

package/dist/chunk-TFFQFIJV.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/errors.ts"],"sourcesContent":["export class NonceRetrievalError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NonceRetrievalError';\n  }\n}\n\nexport class SignInError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignInError';\n  }\n}\n\nexport class PairError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairError';\n  }\n}\n\nexport class UserStorageError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UserStorageError';\n  }\n}\n\nexport class ValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UnsupportedAuthTypeError';\n  }\n}\n\nexport class NotFoundError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NotFoundError';\n  }\n}\n"],"mappings":";AAAO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;","names":[]}

package/dist/chunk-UAXWZN5J.js

@@ -0,0 +1,58 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _chunkPCOIRDTOjs = require('./chunk-PCOIRDTO.js');
+
+// src/controllers/user-storage/encryption/cache.ts
+var MAX_PASSWORD_CACHES = 3;
+var MAX_SALT_CACHES = 10;
+var inMemCachedKDF = {};
+var getPasswordCache = (hashedPassword) => {
+  inMemCachedKDF[hashedPassword] ?? (inMemCachedKDF[hashedPassword] = /* @__PURE__ */ new Map());
+  return inMemCachedKDF[hashedPassword];
+};
+function getCachedKeyBySalt(hashedPassword, salt) {
+  const cache = getPasswordCache(hashedPassword);
+  const base64Salt = _chunkPCOIRDTOjs.byteArrayToBase64.call(void 0, salt);
+  const cachedKey = cache.get(base64Salt);
+  if (!cachedKey) {
+    return void 0;
+  }
+  return {
+    salt,
+    base64Salt,
+    key: cachedKey
+  };
+}
+function getAnyCachedKey(hashedPassword) {
+  const cache = getPasswordCache(hashedPassword);
+  const cachedEntry = cache.entries().next().value;
+  if (!cachedEntry) {
+    return void 0;
+  }
+  const base64Salt = cachedEntry[0];
+  const bytesSalt = _chunkPCOIRDTOjs.base64ToByteArray.call(void 0, base64Salt);
+  return {
+    salt: bytesSalt,
+    base64Salt,
+    key: cachedEntry[1]
+  };
+}
+function setCachedKey(hashedPassword, salt, key) {
+  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {
+    inMemCachedKDF = {};
+  }
+  const cache = getPasswordCache(hashedPassword);
+  const base64Salt = _chunkPCOIRDTOjs.byteArrayToBase64.call(void 0, salt);
+  if (cache.size > MAX_SALT_CACHES) {
+    cache.clear();
+  }
+  cache.set(base64Salt, key);
+}
+
+
+
+
+
+exports.getCachedKeyBySalt = getCachedKeyBySalt; exports.getAnyCachedKey = getAnyCachedKey; exports.setCachedKey = setCachedKey;
+//# sourceMappingURL=chunk-UAXWZN5J.js.map

package/dist/chunk-UAXWZN5J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/user-storage/encryption/cache.ts"],"names":[],"mappings":";;;;;;AAQA,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAQxB,IAAI,iBAAuC,CAAC;AAC5C,IAAM,mBAAmB,CAAC,mBAA2B;AACnD,sEAAmC,oBAAI,IAAI;AAC3C,SAAO,eAAe,cAAc;AACtC;AASO,SAAS,mBACd,gBACA,MACyB;AACzB,QAAM,QAAQ,iBAAiB,cAAc;AAC7C,QAAM,aAAa,kBAAkB,IAAI;AACzC,QAAM,YAAY,MAAM,IAAI,UAAU;AACtC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP;AACF;AAQO,SAAS,gBACd,gBACyB;AACzB,QAAM,QAAQ,iBAAiB,cAAc;AAG7C,QAAM,cAAgD,MACnD,QAAQ,EACR,KAAK,EAAE;AAEV,MAAI,CAAC,aAAa;AAChB,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,YAAY,CAAC;AAChC,QAAM,YAAY,kBAAkB,UAAU;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,KAAK,YAAY,CAAC;AAAA,EACpB;AACF;AAUO,SAAS,aACd,gBACA,MACA,KACM;AAEN,MAAI,OAAO,KAAK,cAAc,EAAE,SAAS,qBAAqB;AAC5D,qBAAiB,CAAC;AAAA,EACpB;AAEA,QAAM,QAAQ,iBAAiB,cAAc;AAC7C,QAAM,aAAa,kBAAkB,IAAI;AAGzC,MAAI,MAAM,OAAO,iBAAiB;AAChC,UAAM,MAAM;AAAA,EACd;AAEA,QAAM,IAAI,YAAY,GAAG;AAC3B","sourcesContent":["import { base64ToByteArray, byteArrayToBase64 } from './utils';\n\ntype CachedEntry = {\n  salt: Uint8Array;\n  base64Salt: string;\n  key: Uint8Array;\n};\n\nconst MAX_PASSWORD_CACHES = 3;\nconst MAX_SALT_CACHES = 10;\n\n/**\n * In-Memory Caching derived keys based from a given salt and password.\n */\ntype PasswordMemCachedKDF = {\n  [hashedPassword: string]: Map<string, Uint8Array>;\n};\nlet inMemCachedKDF: PasswordMemCachedKDF = {};\nconst getPasswordCache = (hashedPassword: string) => {\n  inMemCachedKDF[hashedPassword] ??= new Map();\n  return inMemCachedKDF[hashedPassword];\n};\n\n/**\n * Returns a given cached derived key from a hashed password and salt\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - provide salt to receive cached key\n * @returns cached key\n */\nexport function getCachedKeyBySalt(\n  hashedPassword: string,\n  salt: Uint8Array,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n  const cachedKey = cache.get(base64Salt);\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Gets any cached key for a given hashed password\n *\n * @param hashedPassword - hashed password for cache lookup\n * @returns any (the first) cached key\n */\nexport function getAnyCachedKey(\n  hashedPassword: string,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n\n  // Takes 1 item from an Iterator via Map.entries()\n  const cachedEntry: [string, Uint8Array] | undefined = cache\n    .entries()\n    .next().value;\n\n  if (!cachedEntry) {\n    return undefined;\n  }\n\n  const base64Salt = cachedEntry[0];\n  const bytesSalt = base64ToByteArray(base64Salt);\n  return {\n    salt: bytesSalt,\n    base64Salt,\n    key: cachedEntry[1],\n  };\n}\n\n/**\n * Sets a key to the in memory cache.\n * We have set an arbitrary size of 10 cached keys per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - salt to set new derived key\n * @param key - derived key we are setting\n */\nexport function setCachedKey(\n  hashedPassword: string,\n  salt: Uint8Array,\n  key: Uint8Array,\n): void {\n  // Max password caches\n  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {\n    inMemCachedKDF = {};\n  }\n\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n\n  // Max salt caches\n  if (cache.size > MAX_SALT_CACHES) {\n    cache.clear();\n  }\n\n  cache.set(base64Salt, key);\n}\n"]}

package/dist/{chunk-CZ7YK35S.mjs → chunk-UEZI2POO.mjs}

@@ -1,19 +1,19 @@
 import {
   createSHA256Hash,
   encryption_default
-} from "./chunk-UMKBFFZ5.mjs";
+} from "./chunk-VTM5T7Y4.mjs";
 import {
   getEnvUrls
-} from "./chunk-WJRV2JCX.mjs";
+} from "./chunk-GLS4QZF6.mjs";
 import {
   NotFoundError,
   UserStorageError,
   ValidationError
-} from "./chunk-BHVT2QEA.mjs";
+} from "./chunk-TFFQFIJV.mjs";
 import {
   __privateAdd,
   __privateMethod
-} from "./chunk-XUI43LEZ.mjs";
+} from "./chunk-26CCETCM.mjs";
 
 // src/sdk/user-storage.ts
 var STORAGE_URL = (env, feature, entry) => `${getEnvUrls(env).userStorageApiUrl}/api/v1/userstorage/${feature}/${entry}`;
@@ -23,6 +23,8 @@ var UserStorage = class {
     __privateAdd(this, _upsertUserStorage);
     __privateAdd(this, _getUserStorage);
     __privateAdd(this, _createEntryKey);
+    // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+    // eslint-disable-next-line @typescript-eslint/naming-convention
     __privateAdd(this, _getAuthorizationHeader);
     this.env = config.env;
     this.config = config;
@@ -139,4 +141,4 @@ export {
   STORAGE_URL,
   UserStorage
 };
-//# sourceMappingURL=chunk-CZ7YK35S.mjs.map
+//# sourceMappingURL=chunk-UEZI2POO.mjs.map

package/dist/{chunk-CZ7YK35S.mjs.map → chunk-UEZI2POO.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/sdk/user-storage.ts"],"sourcesContent":["import type { IBaseAuth } from './authentication-jwt-bearer/types';\nimport encryption, { createSHA256Hash } from './encryption';\nimport type { Env } from './env';\nimport { getEnvUrls } from './env';\nimport { NotFoundError, UserStorageError, ValidationError } from './errors';\n\nexport const STORAGE_URL = (env: Env, feature: string, entry: string) =>\n  `${getEnvUrls(env).userStorageApiUrl}/api/v1/userstorage/${feature}/${entry}`;\n\nexport type UserStorageConfig = {\n  env: Env;\n  auth: Pick<IBaseAuth, 'getAccessToken' | 'getUserProfile' | 'signMessage'>;\n};\n\nexport type StorageOptions = {\n  getStorageKey: () => Promise<string | null>;\n  setStorageKey: (val: string) => Promise<void>;\n};\n\nexport type UserStorageOptions = {\n  storage?: StorageOptions;\n};\n\ntype ErrorMessage = {\n  message: string;\n  error: string;\n};\n\nexport class UserStorage {\n  protected config: UserStorageConfig;\n\n  protected options: UserStorageOptions;\n\n  protected env: Env;\n\n  constructor(config: UserStorageConfig, options: UserStorageOptions) {\n    this.env = config.env;\n    this.config = config;\n    this.options = options;\n  }\n\n  async setItem(feature: string, key: string, value: string): Promise<void> {\n    if (!feature.trim() || !key.trim()) {\n      throw new ValidationError('feature or key cannot be empty strings');\n    }\n    await this.#upsertUserStorage(feature, key, value);\n  }\n\n  async getItem(feature: string, key: string): Promise<string> {\n    if (!feature.trim() || !key.trim()) {\n      throw new ValidationError('feature or key cannot be empty strings');\n    }\n    return this.#getUserStorage(feature, key);\n  }\n\n  async getStorageKey(): Promise<string> {\n    const storageKey = await this.options.storage?.getStorageKey();\n    if (storageKey) {\n      return storageKey;\n    }\n\n    const userProfile = await this.config.auth.getUserProfile();\n    const storageKeySignature = await this.config.auth.signMessage(\n      `metamask:${userProfile.profileId}`,\n    );\n    const hashedStorageKeySignature = createSHA256Hash(storageKeySignature);\n    await this.options.storage?.setStorageKey(hashedStorageKeySignature);\n    return hashedStorageKeySignature;\n  }\n\n  async #upsertUserStorage(\n    feature: string,\n    key: string,\n    data: string,\n  ): Promise<void> {\n    try {\n      const headers = await this.#getAuthorizationHeader();\n      const storageKey = await this.getStorageKey();\n      const encryptedData = encryption.encryptString(data, storageKey);\n      const url = new URL(\n        STORAGE_URL(this.env, feature, this.#createEntryKey(key, storageKey)),\n      );\n\n      const response = await fetch(url.toString(), {\n        method: 'PUT',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: JSON.stringify({ data: encryptedData }),\n      });\n\n      if (!response.ok) {\n        const responseBody: ErrorMessage = await response.json().catch(() => ({\n          message: 'unknown',\n          error: 'unknown',\n        }));\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n      throw new UserStorageError(\n        `failed to upsert user storage for feature '${feature}' and key '${key}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #getUserStorage(feature: string, key: string): Promise<string> {\n    try {\n      const headers = await this.#getAuthorizationHeader();\n      const storageKey = await this.getStorageKey();\n      const url = new URL(\n        STORAGE_URL(this.env, feature, this.#createEntryKey(key, storageKey)),\n      );\n\n      const response = await fetch(url.toString(), {\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n      });\n\n      if (response.status === 404) {\n        throw new NotFoundError(\n          `feature/key set not found for feature '${feature}' and key '${key}'.`,\n        );\n      }\n\n      if (!response.ok) {\n        const responseBody = (await response.json()) as ErrorMessage;\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n\n      const { Data: encryptedData } = await response.json();\n      return encryption.decryptString(encryptedData, storageKey);\n    } catch (e) {\n      if (e instanceof NotFoundError) {\n        throw e;\n      }\n\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n\n      throw new UserStorageError(\n        `failed to get user storage for feature '${feature}' and key '${key}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  #createEntryKey(key: string, storageKey: string): string {\n    const hashedKey = createSHA256Hash(key + storageKey);\n    return hashedKey;\n  }\n\n  async #getAuthorizationHeader(): Promise<{ Authorization: string }> {\n    const accessToken = await this.config.auth.getAccessToken();\n    return { Authorization: `Bearer ${accessToken}` };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAMO,IAAM,cAAc,CAAC,KAAU,SAAiB,UACrD,GAAG,WAAW,GAAG,EAAE,iBAAiB,uBAAuB,OAAO,IAAI,KAAK;AAP7E;AA4BO,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,QAA2B,SAA6B;AAmCpE,uBAAM;AAyCN,uBAAM;AA6CN;AAKA,uBAAM;AA7HJ,SAAK,MAAM,OAAO;AAClB,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,QAAQ,SAAiB,KAAa,OAA8B;AACxE,QAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG;AAClC,YAAM,IAAI,gBAAgB,wCAAwC;AAAA,IACpE;AACA,UAAM,sBAAK,0CAAL,WAAwB,SAAS,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAM,QAAQ,SAAiB,KAA8B;AAC3D,QAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG;AAClC,YAAM,IAAI,gBAAgB,wCAAwC;AAAA,IACpE;AACA,WAAO,sBAAK,oCAAL,WAAqB,SAAS;AAAA,EACvC;AAAA,EAEA,MAAM,gBAAiC;AACrC,UAAM,aAAa,MAAM,KAAK,QAAQ,SAAS,cAAc;AAC7D,QAAI,YAAY;AACd,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe;AAC1D,UAAM,sBAAsB,MAAM,KAAK,OAAO,KAAK;AAAA,MACjD,YAAY,YAAY,SAAS;AAAA,IACnC;AACA,UAAM,4BAA4B,iBAAiB,mBAAmB;AACtE,UAAM,KAAK,QAAQ,SAAS,cAAc,yBAAyB;AACnE,WAAO;AAAA,EACT;AAiGF;AA/FQ;AAAA,uBAAkB,eACtB,SACA,KACA,MACe;AACf,MAAI;AACF,UAAM,UAAU,MAAM,sBAAK,oDAAL;AACtB,UAAM,aAAa,MAAM,KAAK,cAAc;AAC5C,UAAM,gBAAgB,mBAAW,cAAc,MAAM,UAAU;AAC/D,UAAM,MAAM,IAAI;AAAA,MACd,YAAY,KAAK,KAAK,SAAS,sBAAK,oCAAL,WAAqB,KAAK,WAAW;AAAA,IACtE;AAEA,UAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAAA,IAC9C,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAA6B,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO;AAAA,QACpE,SAAS;AAAA,QACT,OAAO;AAAA,MACT,EAAE;AACF,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAEV,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,UAAM,IAAI;AAAA,MACR,8CAA8C,OAAO,cAAc,GAAG,MAAM,YAAY;AAAA,IAC1F;AAAA,EACF;AACF;AAEM;AAAA,oBAAe,eAAC,SAAiB,KAA8B;AACnE,MAAI;AACF,UAAM,UAAU,MAAM,sBAAK,oDAAL;AACtB,UAAM,aAAa,MAAM,KAAK,cAAc;AAC5C,UAAM,MAAM,IAAI;AAAA,MACd,YAAY,KAAK,KAAK,SAAS,sBAAK,oCAAL,WAAqB,KAAK,WAAW;AAAA,IACtE;AAEA,UAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,MAC3C,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAED,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,IAAI;AAAA,QACR,0CAA0C,OAAO,cAAc,GAAG;AAAA,MACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAAgB,MAAM,SAAS,KAAK;AAC1C,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,SAAS,KAAK;AACpD,WAAO,mBAAW,cAAc,eAAe,UAAU;AAAA,EAC3D,SAAS,GAAG;AACV,QAAI,aAAa,eAAe;AAC9B,YAAM;AAAA,IACR;AAGA,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AAEzD,UAAM,IAAI;AAAA,MACR,2CAA2C,OAAO,cAAc,GAAG,MAAM,YAAY;AAAA,IACvF;AAAA,EACF;AACF;AAEA;AAAA,oBAAe,SAAC,KAAa,YAA4B;AACvD,QAAM,YAAY,iBAAiB,MAAM,UAAU;AACnD,SAAO;AACT;AAEM;AAAA,4BAAuB,iBAAuC;AAClE,QAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe;AAC1D,SAAO,EAAE,eAAe,UAAU,WAAW,GAAG;AAClD;","names":[]}
+{"version":3,"sources":["../src/sdk/user-storage.ts"],"sourcesContent":["import type { IBaseAuth } from './authentication-jwt-bearer/types';\nimport encryption, { createSHA256Hash } from './encryption';\nimport type { Env } from './env';\nimport { getEnvUrls } from './env';\nimport { NotFoundError, UserStorageError, ValidationError } from './errors';\n\nexport const STORAGE_URL = (env: Env, feature: string, entry: string) =>\n  `${getEnvUrls(env).userStorageApiUrl}/api/v1/userstorage/${feature}/${entry}`;\n\nexport type UserStorageConfig = {\n  env: Env;\n  auth: Pick<IBaseAuth, 'getAccessToken' | 'getUserProfile' | 'signMessage'>;\n};\n\nexport type StorageOptions = {\n  getStorageKey: () => Promise<string | null>;\n  setStorageKey: (val: string) => Promise<void>;\n};\n\nexport type UserStorageOptions = {\n  storage?: StorageOptions;\n};\n\ntype ErrorMessage = {\n  message: string;\n  error: string;\n};\n\nexport class UserStorage {\n  protected config: UserStorageConfig;\n\n  protected options: UserStorageOptions;\n\n  protected env: Env;\n\n  constructor(config: UserStorageConfig, options: UserStorageOptions) {\n    this.env = config.env;\n    this.config = config;\n    this.options = options;\n  }\n\n  async setItem(feature: string, key: string, value: string): Promise<void> {\n    if (!feature.trim() || !key.trim()) {\n      throw new ValidationError('feature or key cannot be empty strings');\n    }\n    await this.#upsertUserStorage(feature, key, value);\n  }\n\n  async getItem(feature: string, key: string): Promise<string> {\n    if (!feature.trim() || !key.trim()) {\n      throw new ValidationError('feature or key cannot be empty strings');\n    }\n    return this.#getUserStorage(feature, key);\n  }\n\n  async getStorageKey(): Promise<string> {\n    const storageKey = await this.options.storage?.getStorageKey();\n    if (storageKey) {\n      return storageKey;\n    }\n\n    const userProfile = await this.config.auth.getUserProfile();\n    const storageKeySignature = await this.config.auth.signMessage(\n      `metamask:${userProfile.profileId}`,\n    );\n    const hashedStorageKeySignature = createSHA256Hash(storageKeySignature);\n    await this.options.storage?.setStorageKey(hashedStorageKeySignature);\n    return hashedStorageKeySignature;\n  }\n\n  async #upsertUserStorage(\n    feature: string,\n    key: string,\n    data: string,\n  ): Promise<void> {\n    try {\n      const headers = await this.#getAuthorizationHeader();\n      const storageKey = await this.getStorageKey();\n      const encryptedData = encryption.encryptString(data, storageKey);\n      const url = new URL(\n        STORAGE_URL(this.env, feature, this.#createEntryKey(key, storageKey)),\n      );\n\n      const response = await fetch(url.toString(), {\n        method: 'PUT',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: JSON.stringify({ data: encryptedData }),\n      });\n\n      if (!response.ok) {\n        const responseBody: ErrorMessage = await response.json().catch(() => ({\n          message: 'unknown',\n          error: 'unknown',\n        }));\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n      throw new UserStorageError(\n        `failed to upsert user storage for feature '${feature}' and key '${key}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #getUserStorage(feature: string, key: string): Promise<string> {\n    try {\n      const headers = await this.#getAuthorizationHeader();\n      const storageKey = await this.getStorageKey();\n      const url = new URL(\n        STORAGE_URL(this.env, feature, this.#createEntryKey(key, storageKey)),\n      );\n\n      const response = await fetch(url.toString(), {\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n      });\n\n      if (response.status === 404) {\n        throw new NotFoundError(\n          `feature/key set not found for feature '${feature}' and key '${key}'.`,\n        );\n      }\n\n      if (!response.ok) {\n        const responseBody = (await response.json()) as ErrorMessage;\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n\n      const { Data: encryptedData } = await response.json();\n      return encryption.decryptString(encryptedData, storageKey);\n    } catch (e) {\n      if (e instanceof NotFoundError) {\n        throw e;\n      }\n\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n\n      throw new UserStorageError(\n        `failed to get user storage for feature '${feature}' and key '${key}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  #createEntryKey(key: string, storageKey: string): string {\n    const hashedKey = createSHA256Hash(key + storageKey);\n    return hashedKey;\n  }\n\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  async #getAuthorizationHeader(): Promise<{ Authorization: string }> {\n    const accessToken = await this.config.auth.getAccessToken();\n    return { Authorization: `Bearer ${accessToken}` };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAMO,IAAM,cAAc,CAAC,KAAU,SAAiB,UACrD,GAAG,WAAW,GAAG,EAAE,iBAAiB,uBAAuB,OAAO,IAAI,KAAK;AAP7E;AA4BO,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,QAA2B,SAA6B;AAmCpE,uBAAM;AAyCN,uBAAM;AA6CN;AAOA;AAAA;AAAA,uBAAM;AA/HJ,SAAK,MAAM,OAAO;AAClB,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,QAAQ,SAAiB,KAAa,OAA8B;AACxE,QAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG;AAClC,YAAM,IAAI,gBAAgB,wCAAwC;AAAA,IACpE;AACA,UAAM,sBAAK,0CAAL,WAAwB,SAAS,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAM,QAAQ,SAAiB,KAA8B;AAC3D,QAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG;AAClC,YAAM,IAAI,gBAAgB,wCAAwC;AAAA,IACpE;AACA,WAAO,sBAAK,oCAAL,WAAqB,SAAS;AAAA,EACvC;AAAA,EAEA,MAAM,gBAAiC;AACrC,UAAM,aAAa,MAAM,KAAK,QAAQ,SAAS,cAAc;AAC7D,QAAI,YAAY;AACd,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe;AAC1D,UAAM,sBAAsB,MAAM,KAAK,OAAO,KAAK;AAAA,MACjD,YAAY,YAAY,SAAS;AAAA,IACnC;AACA,UAAM,4BAA4B,iBAAiB,mBAAmB;AACtE,UAAM,KAAK,QAAQ,SAAS,cAAc,yBAAyB;AACnE,WAAO;AAAA,EACT;AAmGF;AAjGQ;AAAA,uBAAkB,eACtB,SACA,KACA,MACe;AACf,MAAI;AACF,UAAM,UAAU,MAAM,sBAAK,oDAAL;AACtB,UAAM,aAAa,MAAM,KAAK,cAAc;AAC5C,UAAM,gBAAgB,mBAAW,cAAc,MAAM,UAAU;AAC/D,UAAM,MAAM,IAAI;AAAA,MACd,YAAY,KAAK,KAAK,SAAS,sBAAK,oCAAL,WAAqB,KAAK,WAAW;AAAA,IACtE;AAEA,UAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAAA,IAC9C,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAA6B,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO;AAAA,QACpE,SAAS;AAAA,QACT,OAAO;AAAA,MACT,EAAE;AACF,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAEV,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,UAAM,IAAI;AAAA,MACR,8CAA8C,OAAO,cAAc,GAAG,MAAM,YAAY;AAAA,IAC1F;AAAA,EACF;AACF;AAEM;AAAA,oBAAe,eAAC,SAAiB,KAA8B;AACnE,MAAI;AACF,UAAM,UAAU,MAAM,sBAAK,oDAAL;AACtB,UAAM,aAAa,MAAM,KAAK,cAAc;AAC5C,UAAM,MAAM,IAAI;AAAA,MACd,YAAY,KAAK,KAAK,SAAS,sBAAK,oCAAL,WAAqB,KAAK,WAAW;AAAA,IACtE;AAEA,UAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,MAC3C,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAED,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,IAAI;AAAA,QACR,0CAA0C,OAAO,cAAc,GAAG;AAAA,MACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAAgB,MAAM,SAAS,KAAK;AAC1C,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,SAAS,KAAK;AACpD,WAAO,mBAAW,cAAc,eAAe,UAAU;AAAA,EAC3D,SAAS,GAAG;AACV,QAAI,aAAa,eAAe;AAC9B,YAAM;AAAA,IACR;AAGA,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AAEzD,UAAM,IAAI;AAAA,MACR,2CAA2C,OAAO,cAAc,GAAG,MAAM,YAAY;AAAA,IACvF;AAAA,EACF;AACF;AAEA;AAAA,oBAAe,SAAC,KAAa,YAA4B;AACvD,QAAM,YAAY,iBAAiB,MAAM,UAAU;AACnD,SAAO;AACT;AAIM;AAAA,4BAAuB,iBAAuC;AAClE,QAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe;AAC1D,SAAO,EAAE,eAAe,UAAU,WAAW,GAAG;AAClD;","names":[]}

package/dist/{chunk-4NGEEDGV.mjs → chunk-UWRKMJBI.mjs}

@@ -3,25 +3,23 @@ import {
   authenticate,
   authorizeOIDC,
   getNonce
-} from "./chunk-CYGZ4WLJ.mjs";
+} from "./chunk-7VMXBDXN.mjs";
 import {
   ValidationError
-} from "./chunk-BHVT2QEA.mjs";
-import {
-  SESSION_LIFETIME_MS
-} from "./chunk-KKRIOEXD.mjs";
+} from "./chunk-TFFQFIJV.mjs";
 import {
   __privateAdd,
   __privateGet,
   __privateMethod,
   __privateSet
-} from "./chunk-XUI43LEZ.mjs";
+} from "./chunk-26CCETCM.mjs";
 
 // src/sdk/authentication-jwt-bearer/flow-siwe.ts
 import { SiweMessage } from "siwe";
 var _config, _options, _signer, _getAuthSession, getAuthSession_fn, _login, login_fn, _createSiWELoginRawMessage, createSiWELoginRawMessage_fn, _assertSigner, assertSigner_fn;
 var SIWEJwtBearerAuth = class {
   constructor(config, options) {
+    // convert expiresIn from seconds to milliseconds and use 90% of expiresIn
     __privateAdd(this, _getAuthSession);
     __privateAdd(this, _login);
     __privateAdd(this, _createSiWELoginRawMessage);
@@ -71,7 +69,8 @@ getAuthSession_fn = async function() {
   }
   const currentTime = Date.now();
   const sessionAge = currentTime - auth.token.obtainedAt;
-  if (sessionAge < SESSION_LIFETIME_MS) {
+  const refreshThreshold = auth.token.expiresIn * 1e3 * 0.9;
+  if (sessionAge < refreshThreshold) {
     return auth;
   }
   return null;
@@ -91,7 +90,8 @@ login_fn = async function() {
   );
   const tokenResponse = await authorizeOIDC(
     authResponse.token,
-    __privateGet(this, _config).env
+    __privateGet(this, _config).env,
+    __privateGet(this, _config).platform
   );
   const result = {
     profile: authResponse.profile,
@@ -123,4 +123,4 @@ assertSigner_fn = function(signer) {
 export {
   SIWEJwtBearerAuth
 };
-//# sourceMappingURL=chunk-4NGEEDGV.mjs.map
+//# sourceMappingURL=chunk-UWRKMJBI.mjs.map

package/dist/chunk-UWRKMJBI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication-jwt-bearer/flow-siwe.ts"],"sourcesContent":["import { SiweMessage } from 'siwe';\n\nimport { ValidationError } from '../errors';\nimport {\n  SIWE_LOGIN_URL,\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n} from './services';\nimport type {\n  AuthConfig,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n} from './types';\n\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype JwtBearerAuth_SIWE_Options = {\n  storage: AuthStorageOptions;\n};\n\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype JwtBearerAuth_SIWE_Signer = {\n  address: string;\n  chainId: number;\n  signMessage: (message: string) => Promise<string>;\n  domain: string;\n};\n\nexport class SIWEJwtBearerAuth implements IBaseAuth {\n  #config: AuthConfig;\n\n  #options: JwtBearerAuth_SIWE_Options;\n\n  #signer: JwtBearerAuth_SIWE_Signer | undefined;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SiWE },\n    options: JwtBearerAuth_SIWE_Options,\n  ) {\n    this.#config = config;\n    this.#options = options;\n  }\n\n  async getAccessToken(): Promise<string> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(): Promise<string> {\n    this.#assertSigner(this.#signer);\n    return this.#signer.address;\n  }\n\n  async signMessage(message: string): Promise<string> {\n    this.#assertSigner(this.#signer);\n    return await this.#signer.signMessage(message);\n  }\n\n  prepare(signer: JwtBearerAuth_SIWE_Signer) {\n    this.#signer = signer;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse();\n    if (!auth) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(): Promise<LoginResponse> {\n    this.#assertSigner(this.#signer);\n\n    // Nonce\n    const address = await this.getIdentifier();\n    const nonceRes = await getNonce(address, this.#config.env);\n    const rawMessage = this.#createSiWELoginRawMessage(nonceRes.nonce);\n    const signature = await this.signMessage(rawMessage);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result);\n\n    return result;\n  }\n\n  #createSiWELoginRawMessage(nonce: string): string {\n    this.#assertSigner(this.#signer);\n\n    return new SiweMessage({\n      domain: this.#signer?.domain,\n      address: this.#signer?.address,\n      uri: SIWE_LOGIN_URL(this.#config.env),\n      version: '1',\n      chainId: this.#signer?.chainId,\n      nonce,\n      issuedAt: new Date().toISOString(),\n    }).prepareMessage();\n  }\n\n  #assertSigner(\n    signer?: JwtBearerAuth_SIWE_Signer,\n  ): asserts signer is JwtBearerAuth_SIWE_Signer {\n    if (!signer) {\n      throw new ValidationError(`you must call 'prepare()' before logging in`);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,mBAAmB;AAA5B;AAiCO,IAAM,oBAAN,MAA6C;AAAA,EAOlD,YACE,QACA,SACA;AAwCF;AAAA,uBAAM;AAgBN,uBAAM;AAmCN;AAcA;AAlHA;AAEA;AAEA;AAME,uBAAK,SAAU;AACf,uBAAK,UAAW;AAAA,EAClB;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,UAAU,MAAM,sBAAK,oCAAL;AACtB,QAAI,SAAS;AACX,aAAO,QAAQ,MAAM;AAAA,IACvB;AAEA,UAAM,gBAAgB,MAAM,sBAAK,kBAAL;AAC5B,WAAO,cAAc,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAM,iBAAuC;AAC3C,UAAM,UAAU,MAAM,sBAAK,oCAAL;AACtB,QAAI,SAAS;AACX,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,gBAAgB,MAAM,sBAAK,kBAAL;AAC5B,WAAO,cAAc;AAAA,EACvB;AAAA,EAEA,MAAM,gBAAiC;AACrC,0BAAK,gCAAL,WAAmB,mBAAK;AACxB,WAAO,mBAAK,SAAQ;AAAA,EACtB;AAAA,EAEA,MAAM,YAAY,SAAkC;AAClD,0BAAK,gCAAL,WAAmB,mBAAK;AACxB,WAAO,MAAM,mBAAK,SAAQ,YAAY,OAAO;AAAA,EAC/C;AAAA,EAEA,QAAQ,QAAmC;AACzC,uBAAK,SAAU;AAAA,EACjB;AA2EF;AAzHE;AAEA;AAEA;AA6CM;AAAA,oBAAe,iBAAkC;AACrD,QAAM,OAAO,MAAM,mBAAK,UAAS,QAAQ,iBAAiB;AAC1D,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK,IAAI;AAC7B,QAAM,aAAa,cAAc,KAAK,MAAM;AAC5C,QAAM,mBAAmB,KAAK,MAAM,YAAY,MAAO;AAEvD,MAAI,aAAa,kBAAkB;AACjC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEM;AAAA,WAAM,iBAA2B;AACrC,wBAAK,gCAAL,WAAmB,mBAAK;AAGxB,QAAM,UAAU,MAAM,KAAK,cAAc;AACzC,QAAM,WAAW,MAAM,SAAS,SAAS,mBAAK,SAAQ,GAAG;AACzD,QAAM,aAAa,sBAAK,0DAAL,WAAgC,SAAS;AAC5D,QAAM,YAAY,MAAM,KAAK,YAAY,UAAU;AAGnD,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,mBAAK,SAAQ;AAAA,IACb,mBAAK,SAAQ;AAAA,EACf;AAGA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,aAAa;AAAA,IACb,mBAAK,SAAQ;AAAA,IACb,mBAAK,SAAQ;AAAA,EACf;AAGA,QAAM,SAAwB;AAAA,IAC5B,SAAS,aAAa;AAAA,IACtB,OAAO;AAAA,EACT;AAEA,QAAM,mBAAK,UAAS,QAAQ,iBAAiB,MAAM;AAEnD,SAAO;AACT;AAEA;AAAA,+BAA0B,SAAC,OAAuB;AAChD,wBAAK,gCAAL,WAAmB,mBAAK;AAExB,SAAO,IAAI,YAAY;AAAA,IACrB,QAAQ,mBAAK,UAAS;AAAA,IACtB,SAAS,mBAAK,UAAS;AAAA,IACvB,KAAK,eAAe,mBAAK,SAAQ,GAAG;AAAA,IACpC,SAAS;AAAA,IACT,SAAS,mBAAK,UAAS;AAAA,IACvB;AAAA,IACA,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC,EAAE,eAAe;AACpB;AAEA;AAAA,kBAAa,SACX,QAC6C;AAC7C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,gBAAgB,6CAA6C;AAAA,EACzE;AACF;","names":[]}