@metamask/profile-sync-controller 0.0.0 → 0.1.1

package/dist/{chunk-OF3TQWGX.js → chunk-AVOOINGJ.js}

@@ -2,7 +2,7 @@
 
 
 
-var _chunkNRH6O4QZjs = require('./chunk-NRH6O4QZ.js');
+var _chunkBOET676Pjs = require('./chunk-BOET676P.js');
 
 
 var _chunkRG4II6WHjs = require('./chunk-RG4II6WH.js');
@@ -11,33 +11,30 @@ var _chunkRG4II6WHjs = require('./chunk-RG4II6WH.js');
 var _chunkPQ5T4GHYjs = require('./chunk-PQ5T4GHY.js');
 
 
-var _chunkGQLHSQGZjs = require('./chunk-GQLHSQGZ.js');
+var _chunkMBTBE4P5js = require('./chunk-MBTBE4P5.js');
 
 
-var _chunkBARZBXO7js = require('./chunk-BARZBXO7.js');
 
 
 
-
-
-var _chunkZ4BLTVTBjs = require('./chunk-Z4BLTVTB.js');
+var _chunkIGY2S5BCjs = require('./chunk-IGY2S5BC.js');
 
 // src/sdk/authentication-jwt-bearer/flow-srp.ts
 var defaultEIP6963SigningOptions = {
   getIdentifier: async () => {
     const provider = await _chunkRG4II6WHjs.getMetaMaskProviderEIP6963.call(void 0, );
     if (!provider) {
-      throw new (0, _chunkGQLHSQGZjs.ValidationError)("No MetaMask wallet connected");
+      throw new (0, _chunkMBTBE4P5js.ValidationError)("No MetaMask wallet connected");
     }
     return await _chunkPQ5T4GHYjs.MESSAGE_SIGNING_SNAP.getPublicKey(provider);
   },
   signMessage: async (message) => {
     const provider = await _chunkRG4II6WHjs.getMetaMaskProviderEIP6963.call(void 0, );
     if (!provider) {
-      throw new (0, _chunkGQLHSQGZjs.ValidationError)("No MetaMask wallet connected");
+      throw new (0, _chunkMBTBE4P5js.ValidationError)("No MetaMask wallet connected");
     }
     if (!message.startsWith("metamask:")) {
-      throw new (0, _chunkGQLHSQGZjs.ValidationError)('message must start with "metamask:"');
+      throw new (0, _chunkMBTBE4P5js.ValidationError)('message must start with "metamask:"');
     }
     const formattedMessage = message;
     return await _chunkPQ5T4GHYjs.MESSAGE_SIGNING_SNAP.signMessage(provider, formattedMessage);
@@ -46,51 +43,53 @@ var defaultEIP6963SigningOptions = {
 var _config, _options, _getAuthSession, getAuthSession_fn, _login, login_fn, _createSrpLoginRawMessage, createSrpLoginRawMessage_fn;
 var SRPJwtBearerAuth = class {
   constructor(config, options) {
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _getAuthSession);
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _login);
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _createSrpLoginRawMessage);
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _config, void 0);
-    _chunkZ4BLTVTBjs.__privateAdd.call(void 0, this, _options, void 0);
-    _chunkZ4BLTVTBjs.__privateSet.call(void 0, this, _config, config);
-    _chunkZ4BLTVTBjs.__privateSet.call(void 0, this, _options, {
+    // convert expiresIn from seconds to milliseconds and use 90% of expiresIn
+    _chunkIGY2S5BCjs.__privateAdd.call(void 0, this, _getAuthSession);
+    _chunkIGY2S5BCjs.__privateAdd.call(void 0, this, _login);
+    _chunkIGY2S5BCjs.__privateAdd.call(void 0, this, _createSrpLoginRawMessage);
+    _chunkIGY2S5BCjs.__privateAdd.call(void 0, this, _config, void 0);
+    _chunkIGY2S5BCjs.__privateAdd.call(void 0, this, _options, void 0);
+    _chunkIGY2S5BCjs.__privateSet.call(void 0, this, _config, config);
+    _chunkIGY2S5BCjs.__privateSet.call(void 0, this, _options, {
       storage: options.storage,
       signing: options.signing ?? defaultEIP6963SigningOptions
     });
   }
   async getAccessToken() {
-    const session = await _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _getAuthSession, getAuthSession_fn).call(this);
+    const session = await _chunkIGY2S5BCjs.__privateMethod.call(void 0, this, _getAuthSession, getAuthSession_fn).call(this);
     if (session) {
       return session.token.accessToken;
     }
-    const loginResponse = await _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _login, login_fn).call(this);
+    const loginResponse = await _chunkIGY2S5BCjs.__privateMethod.call(void 0, this, _login, login_fn).call(this);
     return loginResponse.token.accessToken;
   }
   async getUserProfile() {
-    const session = await _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _getAuthSession, getAuthSession_fn).call(this);
+    const session = await _chunkIGY2S5BCjs.__privateMethod.call(void 0, this, _getAuthSession, getAuthSession_fn).call(this);
     if (session) {
       return session.profile;
     }
-    const loginResponse = await _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _login, login_fn).call(this);
+    const loginResponse = await _chunkIGY2S5BCjs.__privateMethod.call(void 0, this, _login, login_fn).call(this);
     return loginResponse.profile;
   }
   async getIdentifier() {
-    return await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).signing.getIdentifier();
+    return await _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _options).signing.getIdentifier();
   }
   async signMessage(message) {
-    return await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).signing.signMessage(message);
+    return await _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _options).signing.signMessage(message);
   }
 };
 _config = new WeakMap();
 _options = new WeakMap();
 _getAuthSession = new WeakSet();
 getAuthSession_fn = async function() {
-  const auth = await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).storage.getLoginResponse();
+  const auth = await _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _options).storage.getLoginResponse();
   if (!auth) {
     return null;
   }
   const currentTime = Date.now();
   const sessionAge = currentTime - auth.token.obtainedAt;
-  if (sessionAge < _chunkBARZBXO7js.SESSION_LIFETIME_MS) {
+  const refreshThreshold = auth.token.expiresIn * 1e3 * 0.9;
+  if (sessionAge < refreshThreshold) {
     return auth;
   }
   return null;
@@ -98,25 +97,26 @@ getAuthSession_fn = async function() {
 _login = new WeakSet();
 login_fn = async function() {
   const address = await this.getIdentifier();
-  const nonceRes = await _chunkNRH6O4QZjs.getNonce.call(void 0, address, _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _config).env);
-  const publicKey = await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).signing.getIdentifier();
-  const rawMessage = _chunkZ4BLTVTBjs.__privateMethod.call(void 0, this, _createSrpLoginRawMessage, createSrpLoginRawMessage_fn).call(this, nonceRes.nonce, publicKey);
+  const nonceRes = await _chunkBOET676Pjs.getNonce.call(void 0, address, _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _config).env);
+  const publicKey = await _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _options).signing.getIdentifier();
+  const rawMessage = _chunkIGY2S5BCjs.__privateMethod.call(void 0, this, _createSrpLoginRawMessage, createSrpLoginRawMessage_fn).call(this, nonceRes.nonce, publicKey);
   const signature = await this.signMessage(rawMessage);
-  const authResponse = await _chunkNRH6O4QZjs.authenticate.call(void 0, 
+  const authResponse = await _chunkBOET676Pjs.authenticate.call(void 0, 
     rawMessage,
     signature,
-    _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _config).type,
-    _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _config).env
+    _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _config).type,
+    _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _config).env
   );
-  const tokenResponse = await _chunkNRH6O4QZjs.authorizeOIDC.call(void 0, 
+  const tokenResponse = await _chunkBOET676Pjs.authorizeOIDC.call(void 0, 
     authResponse.token,
-    _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _config).env
+    _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _config).env,
+    _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _config).platform
   );
   const result = {
     profile: authResponse.profile,
     token: tokenResponse
   };
-  await _chunkZ4BLTVTBjs.__privateGet.call(void 0, this, _options).storage.setLoginResponse(result);
+  await _chunkIGY2S5BCjs.__privateGet.call(void 0, this, _options).storage.setLoginResponse(result);
   return result;
 };
 _createSrpLoginRawMessage = new WeakSet();
@@ -127,4 +127,4 @@ createSrpLoginRawMessage_fn = function(nonce, publicKey) {
 
 
 exports.SRPJwtBearerAuth = SRPJwtBearerAuth;
-//# sourceMappingURL=chunk-OF3TQWGX.js.map
+//# sourceMappingURL=chunk-AVOOINGJ.js.map

package/dist/chunk-AVOOINGJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqBA,IAAM,+BAAmD;AAAA,EACvD,eAAe,YAA6B;AAC1C,UAAM,WAAW,MAAM,2BAA2B;AAClD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,8BAA8B;AAAA,IAC1D;AACA,WAAO,MAAM,qBAAqB,aAAa,QAAQ;AAAA,EACzD;AAAA,EACA,aAAa,OAAO,YAAqC;AACvD,UAAM,WAAW,MAAM,2BAA2B;AAClD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,8BAA8B;AAAA,IAC1D;AACA,QAAI,CAAC,QAAQ,WAAW,WAAW,GAAG;AACpC,YAAM,IAAI,gBAAgB,qCAAqC;AAAA,IACjE;AACA,UAAM,mBAAmB;AACzB,WAAO,MAAM,qBAAqB,YAAY,UAAU,gBAAgB;AAAA,EAC1E;AACF;AAxCA;AA0CO,IAAM,mBAAN,MAA4C;AAAA,EAKjD,YACE,QACA,SACA;AAqCF;AAAA,uBAAM;AAgBN,uBAAM;AAqCN;AAjGA;AAEA;AAME,uBAAK,SAAU;AACf,uBAAK,UAAW;AAAA,MACd,SAAS,QAAQ;AAAA,MACjB,SAAS,QAAQ,WAAW;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,UAAU,MAAM,sBAAK,oCAAL;AACtB,QAAI,SAAS;AACX,aAAO,QAAQ,MAAM;AAAA,IACvB;AAEA,UAAM,gBAAgB,MAAM,sBAAK,kBAAL;AAC5B,WAAO,cAAc,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAM,iBAAuC;AAC3C,UAAM,UAAU,MAAM,sBAAK,oCAAL;AACtB,QAAI,SAAS;AACX,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,gBAAgB,MAAM,sBAAK,kBAAL;AAC5B,WAAO,cAAc;AAAA,EACvB;AAAA,EAEA,MAAM,gBAAiC;AACrC,WAAO,MAAM,mBAAK,UAAS,QAAQ,cAAc;AAAA,EACnD;AAAA,EAEA,MAAM,YAAY,SAAkC;AAClD,WAAO,MAAM,mBAAK,UAAS,QAAQ,YAAY,OAAO;AAAA,EACxD;AA8DF;AAvGE;AAEA;AA0CM;AAAA,oBAAe,iBAAkC;AACrD,QAAM,OAAO,MAAM,mBAAK,UAAS,QAAQ,iBAAiB;AAC1D,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK,IAAI;AAC7B,QAAM,aAAa,cAAc,KAAK,MAAM;AAC5C,QAAM,mBAAmB,KAAK,MAAM,YAAY,MAAO;AAEvD,MAAI,aAAa,kBAAkB;AACjC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEM;AAAA,WAAM,iBAA2B;AAErC,QAAM,UAAU,MAAM,KAAK,cAAc;AACzC,QAAM,WAAW,MAAM,SAAS,SAAS,mBAAK,SAAQ,GAAG;AACzD,QAAM,YAAY,MAAM,mBAAK,UAAS,QAAQ,cAAc;AAC5D,QAAM,aAAa,sBAAK,wDAAL,WACjB,SAAS,OACT;AAEF,QAAM,YAAY,MAAM,KAAK,YAAY,UAAU;AAGnD,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,mBAAK,SAAQ;AAAA,IACb,mBAAK,SAAQ;AAAA,EACf;AAGA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,aAAa;AAAA,IACb,mBAAK,SAAQ;AAAA,IACb,mBAAK,SAAQ;AAAA,EACf;AAGA,QAAM,SAAwB;AAAA,IAC5B,SAAS,aAAa;AAAA,IACtB,OAAO;AAAA,EACT;AAEA,QAAM,mBAAK,UAAS,QAAQ,iBAAiB,MAAM;AAEnD,SAAO;AACT;AAEA;AAAA,8BAAyB,SACvB,OACA,WACgC;AAChC,SAAO,YAAY,KAAK,IAAI,SAAS;AACvC","sourcesContent":["import { ValidationError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport { MESSAGE_SIGNING_SNAP } from '../utils/messaging-signing-snap-requests';\nimport { authenticate, authorizeOIDC, getNonce } from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n} from './types';\n\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n};\n\nconst defaultEIP6963SigningOptions: AuthSigningOptions = {\n  getIdentifier: async (): Promise<string> => {\n    const provider = await getMetaMaskProviderEIP6963();\n    if (!provider) {\n      throw new ValidationError('No MetaMask wallet connected');\n    }\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider);\n  },\n  signMessage: async (message: string): Promise<string> => {\n    const provider = await getMetaMaskProviderEIP6963();\n    if (!provider) {\n      throw new ValidationError('No MetaMask wallet connected');\n    }\n    if (!message.startsWith('metamask:')) {\n      throw new ValidationError('message must start with \"metamask:\"');\n    }\n    const formattedMessage = message as `metamask:${string}`;\n    return await MESSAGE_SIGNING_SNAP.signMessage(provider, formattedMessage);\n  },\n};\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  #config: AuthConfig;\n\n  #options: Required<JwtBearerAuth_SRP_Options>;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options,\n  ) {\n    this.#config = config;\n    this.#options = {\n      storage: options.storage,\n      signing: options.signing ?? defaultEIP6963SigningOptions,\n    };\n  }\n\n  async getAccessToken(): Promise<string> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(): Promise<string> {\n    return await this.#options.signing.getIdentifier();\n  }\n\n  async signMessage(message: string): Promise<string> {\n    return await this.#options.signing.signMessage(message);\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse();\n    if (!auth) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(): Promise<LoginResponse> {\n    // Nonce\n    const address = await this.getIdentifier();\n    const nonceRes = await getNonce(address, this.#config.env);\n    const publicKey = await this.#options.signing.getIdentifier();\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result);\n\n    return result;\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}

package/dist/{chunk-CZ7YK35S.mjs → chunk-AXWK4Y23.mjs}

@@ -1,19 +1,19 @@
 import {
   createSHA256Hash,
   encryption_default
-} from "./chunk-UMKBFFZ5.mjs";
+} from "./chunk-B5DBQDB3.mjs";
 import {
   getEnvUrls
-} from "./chunk-WJRV2JCX.mjs";
+} from "./chunk-FQ5SDMRE.mjs";
 import {
   NotFoundError,
   UserStorageError,
   ValidationError
-} from "./chunk-BHVT2QEA.mjs";
+} from "./chunk-TFFQFIJV.mjs";
 import {
   __privateAdd,
   __privateMethod
-} from "./chunk-XUI43LEZ.mjs";
+} from "./chunk-U5UIDVOO.mjs";
 
 // src/sdk/user-storage.ts
 var STORAGE_URL = (env, feature, entry) => `${getEnvUrls(env).userStorageApiUrl}/api/v1/userstorage/${feature}/${entry}`;
@@ -23,6 +23,8 @@ var UserStorage = class {
     __privateAdd(this, _upsertUserStorage);
     __privateAdd(this, _getUserStorage);
     __privateAdd(this, _createEntryKey);
+    // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+    // eslint-disable-next-line @typescript-eslint/naming-convention
     __privateAdd(this, _getAuthorizationHeader);
     this.env = config.env;
     this.config = config;
@@ -139,4 +141,4 @@ export {
   STORAGE_URL,
   UserStorage
 };
-//# sourceMappingURL=chunk-CZ7YK35S.mjs.map
+//# sourceMappingURL=chunk-AXWK4Y23.mjs.map

package/dist/{chunk-CZ7YK35S.mjs.map → chunk-AXWK4Y23.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/sdk/user-storage.ts"],"sourcesContent":["import type { IBaseAuth } from './authentication-jwt-bearer/types';\nimport encryption, { createSHA256Hash } from './encryption';\nimport type { Env } from './env';\nimport { getEnvUrls } from './env';\nimport { NotFoundError, UserStorageError, ValidationError } from './errors';\n\nexport const STORAGE_URL = (env: Env, feature: string, entry: string) =>\n  `${getEnvUrls(env).userStorageApiUrl}/api/v1/userstorage/${feature}/${entry}`;\n\nexport type UserStorageConfig = {\n  env: Env;\n  auth: Pick<IBaseAuth, 'getAccessToken' | 'getUserProfile' | 'signMessage'>;\n};\n\nexport type StorageOptions = {\n  getStorageKey: () => Promise<string | null>;\n  setStorageKey: (val: string) => Promise<void>;\n};\n\nexport type UserStorageOptions = {\n  storage?: StorageOptions;\n};\n\ntype ErrorMessage = {\n  message: string;\n  error: string;\n};\n\nexport class UserStorage {\n  protected config: UserStorageConfig;\n\n  protected options: UserStorageOptions;\n\n  protected env: Env;\n\n  constructor(config: UserStorageConfig, options: UserStorageOptions) {\n    this.env = config.env;\n    this.config = config;\n    this.options = options;\n  }\n\n  async setItem(feature: string, key: string, value: string): Promise<void> {\n    if (!feature.trim() || !key.trim()) {\n      throw new ValidationError('feature or key cannot be empty strings');\n    }\n    await this.#upsertUserStorage(feature, key, value);\n  }\n\n  async getItem(feature: string, key: string): Promise<string> {\n    if (!feature.trim() || !key.trim()) {\n      throw new ValidationError('feature or key cannot be empty strings');\n    }\n    return this.#getUserStorage(feature, key);\n  }\n\n  async getStorageKey(): Promise<string> {\n    const storageKey = await this.options.storage?.getStorageKey();\n    if (storageKey) {\n      return storageKey;\n    }\n\n    const userProfile = await this.config.auth.getUserProfile();\n    const storageKeySignature = await this.config.auth.signMessage(\n      `metamask:${userProfile.profileId}`,\n    );\n    const hashedStorageKeySignature = createSHA256Hash(storageKeySignature);\n    await this.options.storage?.setStorageKey(hashedStorageKeySignature);\n    return hashedStorageKeySignature;\n  }\n\n  async #upsertUserStorage(\n    feature: string,\n    key: string,\n    data: string,\n  ): Promise<void> {\n    try {\n      const headers = await this.#getAuthorizationHeader();\n      const storageKey = await this.getStorageKey();\n      const encryptedData = encryption.encryptString(data, storageKey);\n      const url = new URL(\n        STORAGE_URL(this.env, feature, this.#createEntryKey(key, storageKey)),\n      );\n\n      const response = await fetch(url.toString(), {\n        method: 'PUT',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: JSON.stringify({ data: encryptedData }),\n      });\n\n      if (!response.ok) {\n        const responseBody: ErrorMessage = await response.json().catch(() => ({\n          message: 'unknown',\n          error: 'unknown',\n        }));\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n      throw new UserStorageError(\n        `failed to upsert user storage for feature '${feature}' and key '${key}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #getUserStorage(feature: string, key: string): Promise<string> {\n    try {\n      const headers = await this.#getAuthorizationHeader();\n      const storageKey = await this.getStorageKey();\n      const url = new URL(\n        STORAGE_URL(this.env, feature, this.#createEntryKey(key, storageKey)),\n      );\n\n      const response = await fetch(url.toString(), {\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n      });\n\n      if (response.status === 404) {\n        throw new NotFoundError(\n          `feature/key set not found for feature '${feature}' and key '${key}'.`,\n        );\n      }\n\n      if (!response.ok) {\n        const responseBody = (await response.json()) as ErrorMessage;\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n\n      const { Data: encryptedData } = await response.json();\n      return encryption.decryptString(encryptedData, storageKey);\n    } catch (e) {\n      if (e instanceof NotFoundError) {\n        throw e;\n      }\n\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n\n      throw new UserStorageError(\n        `failed to get user storage for feature '${feature}' and key '${key}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  #createEntryKey(key: string, storageKey: string): string {\n    const hashedKey = createSHA256Hash(key + storageKey);\n    return hashedKey;\n  }\n\n  async #getAuthorizationHeader(): Promise<{ Authorization: string }> {\n    const accessToken = await this.config.auth.getAccessToken();\n    return { Authorization: `Bearer ${accessToken}` };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAMO,IAAM,cAAc,CAAC,KAAU,SAAiB,UACrD,GAAG,WAAW,GAAG,EAAE,iBAAiB,uBAAuB,OAAO,IAAI,KAAK;AAP7E;AA4BO,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,QAA2B,SAA6B;AAmCpE,uBAAM;AAyCN,uBAAM;AA6CN;AAKA,uBAAM;AA7HJ,SAAK,MAAM,OAAO;AAClB,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,QAAQ,SAAiB,KAAa,OAA8B;AACxE,QAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG;AAClC,YAAM,IAAI,gBAAgB,wCAAwC;AAAA,IACpE;AACA,UAAM,sBAAK,0CAAL,WAAwB,SAAS,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAM,QAAQ,SAAiB,KAA8B;AAC3D,QAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG;AAClC,YAAM,IAAI,gBAAgB,wCAAwC;AAAA,IACpE;AACA,WAAO,sBAAK,oCAAL,WAAqB,SAAS;AAAA,EACvC;AAAA,EAEA,MAAM,gBAAiC;AACrC,UAAM,aAAa,MAAM,KAAK,QAAQ,SAAS,cAAc;AAC7D,QAAI,YAAY;AACd,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe;AAC1D,UAAM,sBAAsB,MAAM,KAAK,OAAO,KAAK;AAAA,MACjD,YAAY,YAAY,SAAS;AAAA,IACnC;AACA,UAAM,4BAA4B,iBAAiB,mBAAmB;AACtE,UAAM,KAAK,QAAQ,SAAS,cAAc,yBAAyB;AACnE,WAAO;AAAA,EACT;AAiGF;AA/FQ;AAAA,uBAAkB,eACtB,SACA,KACA,MACe;AACf,MAAI;AACF,UAAM,UAAU,MAAM,sBAAK,oDAAL;AACtB,UAAM,aAAa,MAAM,KAAK,cAAc;AAC5C,UAAM,gBAAgB,mBAAW,cAAc,MAAM,UAAU;AAC/D,UAAM,MAAM,IAAI;AAAA,MACd,YAAY,KAAK,KAAK,SAAS,sBAAK,oCAAL,WAAqB,KAAK,WAAW;AAAA,IACtE;AAEA,UAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAAA,IAC9C,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAA6B,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO;AAAA,QACpE,SAAS;AAAA,QACT,OAAO;AAAA,MACT,EAAE;AACF,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAEV,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,UAAM,IAAI;AAAA,MACR,8CAA8C,OAAO,cAAc,GAAG,MAAM,YAAY;AAAA,IAC1F;AAAA,EACF;AACF;AAEM;AAAA,oBAAe,eAAC,SAAiB,KAA8B;AACnE,MAAI;AACF,UAAM,UAAU,MAAM,sBAAK,oDAAL;AACtB,UAAM,aAAa,MAAM,KAAK,cAAc;AAC5C,UAAM,MAAM,IAAI;AAAA,MACd,YAAY,KAAK,KAAK,SAAS,sBAAK,oCAAL,WAAqB,KAAK,WAAW;AAAA,IACtE;AAEA,UAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,MAC3C,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAED,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,IAAI;AAAA,QACR,0CAA0C,OAAO,cAAc,GAAG;AAAA,MACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAAgB,MAAM,SAAS,KAAK;AAC1C,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,SAAS,KAAK;AACpD,WAAO,mBAAW,cAAc,eAAe,UAAU;AAAA,EAC3D,SAAS,GAAG;AACV,QAAI,aAAa,eAAe;AAC9B,YAAM;AAAA,IACR;AAGA,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AAEzD,UAAM,IAAI;AAAA,MACR,2CAA2C,OAAO,cAAc,GAAG,MAAM,YAAY;AAAA,IACvF;AAAA,EACF;AACF;AAEA;AAAA,oBAAe,SAAC,KAAa,YAA4B;AACvD,QAAM,YAAY,iBAAiB,MAAM,UAAU;AACnD,SAAO;AACT;AAEM;AAAA,4BAAuB,iBAAuC;AAClE,QAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe;AAC1D,SAAO,EAAE,eAAe,UAAU,WAAW,GAAG;AAClD;","names":[]}
+{"version":3,"sources":["../src/sdk/user-storage.ts"],"sourcesContent":["import type { IBaseAuth } from './authentication-jwt-bearer/types';\nimport encryption, { createSHA256Hash } from './encryption';\nimport type { Env } from './env';\nimport { getEnvUrls } from './env';\nimport { NotFoundError, UserStorageError, ValidationError } from './errors';\n\nexport const STORAGE_URL = (env: Env, feature: string, entry: string) =>\n  `${getEnvUrls(env).userStorageApiUrl}/api/v1/userstorage/${feature}/${entry}`;\n\nexport type UserStorageConfig = {\n  env: Env;\n  auth: Pick<IBaseAuth, 'getAccessToken' | 'getUserProfile' | 'signMessage'>;\n};\n\nexport type StorageOptions = {\n  getStorageKey: () => Promise<string | null>;\n  setStorageKey: (val: string) => Promise<void>;\n};\n\nexport type UserStorageOptions = {\n  storage?: StorageOptions;\n};\n\ntype ErrorMessage = {\n  message: string;\n  error: string;\n};\n\nexport class UserStorage {\n  protected config: UserStorageConfig;\n\n  protected options: UserStorageOptions;\n\n  protected env: Env;\n\n  constructor(config: UserStorageConfig, options: UserStorageOptions) {\n    this.env = config.env;\n    this.config = config;\n    this.options = options;\n  }\n\n  async setItem(feature: string, key: string, value: string): Promise<void> {\n    if (!feature.trim() || !key.trim()) {\n      throw new ValidationError('feature or key cannot be empty strings');\n    }\n    await this.#upsertUserStorage(feature, key, value);\n  }\n\n  async getItem(feature: string, key: string): Promise<string> {\n    if (!feature.trim() || !key.trim()) {\n      throw new ValidationError('feature or key cannot be empty strings');\n    }\n    return this.#getUserStorage(feature, key);\n  }\n\n  async getStorageKey(): Promise<string> {\n    const storageKey = await this.options.storage?.getStorageKey();\n    if (storageKey) {\n      return storageKey;\n    }\n\n    const userProfile = await this.config.auth.getUserProfile();\n    const storageKeySignature = await this.config.auth.signMessage(\n      `metamask:${userProfile.profileId}`,\n    );\n    const hashedStorageKeySignature = createSHA256Hash(storageKeySignature);\n    await this.options.storage?.setStorageKey(hashedStorageKeySignature);\n    return hashedStorageKeySignature;\n  }\n\n  async #upsertUserStorage(\n    feature: string,\n    key: string,\n    data: string,\n  ): Promise<void> {\n    try {\n      const headers = await this.#getAuthorizationHeader();\n      const storageKey = await this.getStorageKey();\n      const encryptedData = encryption.encryptString(data, storageKey);\n      const url = new URL(\n        STORAGE_URL(this.env, feature, this.#createEntryKey(key, storageKey)),\n      );\n\n      const response = await fetch(url.toString(), {\n        method: 'PUT',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: JSON.stringify({ data: encryptedData }),\n      });\n\n      if (!response.ok) {\n        const responseBody: ErrorMessage = await response.json().catch(() => ({\n          message: 'unknown',\n          error: 'unknown',\n        }));\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n      throw new UserStorageError(\n        `failed to upsert user storage for feature '${feature}' and key '${key}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #getUserStorage(feature: string, key: string): Promise<string> {\n    try {\n      const headers = await this.#getAuthorizationHeader();\n      const storageKey = await this.getStorageKey();\n      const url = new URL(\n        STORAGE_URL(this.env, feature, this.#createEntryKey(key, storageKey)),\n      );\n\n      const response = await fetch(url.toString(), {\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n      });\n\n      if (response.status === 404) {\n        throw new NotFoundError(\n          `feature/key set not found for feature '${feature}' and key '${key}'.`,\n        );\n      }\n\n      if (!response.ok) {\n        const responseBody = (await response.json()) as ErrorMessage;\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n\n      const { Data: encryptedData } = await response.json();\n      return encryption.decryptString(encryptedData, storageKey);\n    } catch (e) {\n      if (e instanceof NotFoundError) {\n        throw e;\n      }\n\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n\n      throw new UserStorageError(\n        `failed to get user storage for feature '${feature}' and key '${key}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  #createEntryKey(key: string, storageKey: string): string {\n    const hashedKey = createSHA256Hash(key + storageKey);\n    return hashedKey;\n  }\n\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  async #getAuthorizationHeader(): Promise<{ Authorization: string }> {\n    const accessToken = await this.config.auth.getAccessToken();\n    return { Authorization: `Bearer ${accessToken}` };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAMO,IAAM,cAAc,CAAC,KAAU,SAAiB,UACrD,GAAG,WAAW,GAAG,EAAE,iBAAiB,uBAAuB,OAAO,IAAI,KAAK;AAP7E;AA4BO,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,QAA2B,SAA6B;AAmCpE,uBAAM;AAyCN,uBAAM;AA6CN;AAOA;AAAA;AAAA,uBAAM;AA/HJ,SAAK,MAAM,OAAO;AAClB,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,QAAQ,SAAiB,KAAa,OAA8B;AACxE,QAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG;AAClC,YAAM,IAAI,gBAAgB,wCAAwC;AAAA,IACpE;AACA,UAAM,sBAAK,0CAAL,WAAwB,SAAS,KAAK;AAAA,EAC9C;AAAA,EAEA,MAAM,QAAQ,SAAiB,KAA8B;AAC3D,QAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG;AAClC,YAAM,IAAI,gBAAgB,wCAAwC;AAAA,IACpE;AACA,WAAO,sBAAK,oCAAL,WAAqB,SAAS;AAAA,EACvC;AAAA,EAEA,MAAM,gBAAiC;AACrC,UAAM,aAAa,MAAM,KAAK,QAAQ,SAAS,cAAc;AAC7D,QAAI,YAAY;AACd,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe;AAC1D,UAAM,sBAAsB,MAAM,KAAK,OAAO,KAAK;AAAA,MACjD,YAAY,YAAY,SAAS;AAAA,IACnC;AACA,UAAM,4BAA4B,iBAAiB,mBAAmB;AACtE,UAAM,KAAK,QAAQ,SAAS,cAAc,yBAAyB;AACnE,WAAO;AAAA,EACT;AAmGF;AAjGQ;AAAA,uBAAkB,eACtB,SACA,KACA,MACe;AACf,MAAI;AACF,UAAM,UAAU,MAAM,sBAAK,oDAAL;AACtB,UAAM,aAAa,MAAM,KAAK,cAAc;AAC5C,UAAM,gBAAgB,mBAAW,cAAc,MAAM,UAAU;AAC/D,UAAM,MAAM,IAAI;AAAA,MACd,YAAY,KAAK,KAAK,SAAS,sBAAK,oCAAL,WAAqB,KAAK,WAAW;AAAA,IACtE;AAEA,UAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,MAC3C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAAA,IAC9C,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAA6B,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO;AAAA,QACpE,SAAS;AAAA,QACT,OAAO;AAAA,MACT,EAAE;AACF,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAEV,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,UAAM,IAAI;AAAA,MACR,8CAA8C,OAAO,cAAc,GAAG,MAAM,YAAY;AAAA,IAC1F;AAAA,EACF;AACF;AAEM;AAAA,oBAAe,eAAC,SAAiB,KAA8B;AACnE,MAAI;AACF,UAAM,UAAU,MAAM,sBAAK,oDAAL;AACtB,UAAM,aAAa,MAAM,KAAK,cAAc;AAC5C,UAAM,MAAM,IAAI;AAAA,MACd,YAAY,KAAK,KAAK,SAAS,sBAAK,oCAAL,WAAqB,KAAK,WAAW;AAAA,IACtE;AAEA,UAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,MAC3C,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AAED,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,IAAI;AAAA,QACR,0CAA0C,OAAO,cAAc,GAAG;AAAA,MACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAAgB,MAAM,SAAS,KAAK;AAC1C,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAEA,UAAM,EAAE,MAAM,cAAc,IAAI,MAAM,SAAS,KAAK;AACpD,WAAO,mBAAW,cAAc,eAAe,UAAU;AAAA,EAC3D,SAAS,GAAG;AACV,QAAI,aAAa,eAAe;AAC9B,YAAM;AAAA,IACR;AAGA,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AAEzD,UAAM,IAAI;AAAA,MACR,2CAA2C,OAAO,cAAc,GAAG,MAAM,YAAY;AAAA,IACvF;AAAA,EACF;AACF;AAEA;AAAA,oBAAe,SAAC,KAAa,YAA4B;AACvD,QAAM,YAAY,iBAAiB,MAAM,UAAU;AACnD,SAAO;AACT;AAIM;AAAA,4BAAuB,iBAAuC;AAClE,QAAM,cAAc,MAAM,KAAK,OAAO,KAAK,eAAe;AAC1D,SAAO,EAAE,eAAe,UAAU,WAAW,GAAG;AAClD;","names":[]}

package/dist/{chunk-UMKBFFZ5.mjs → chunk-B5DBQDB3.mjs}

@@ -2,7 +2,7 @@ import {
   __privateAdd,
   __privateGet,
   __privateMethod
-} from "./chunk-XUI43LEZ.mjs";
+} from "./chunk-U5UIDVOO.mjs";
 
 // src/sdk/encryption.ts
 import { gcm } from "@noble/ciphers/aes";
@@ -27,12 +27,20 @@ var EncryptorDecryptor = class {
     __privateAdd(this, _decryptStringV1);
     __privateAdd(this, _encrypt);
     __privateAdd(this, _decrypt);
+    // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+    // eslint-disable-next-line @typescript-eslint/naming-convention
     __privateAdd(this, _ALGORITHM_NONCE_SIZE, 12);
     // 12 bytes
+    // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+    // eslint-disable-next-line @typescript-eslint/naming-convention
     __privateAdd(this, _ALGORITHM_KEY_SIZE, 16);
     // 16 bytes
+    // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+    // eslint-disable-next-line @typescript-eslint/naming-convention
     __privateAdd(this, _PBKDF2_SALT_SIZE, 16);
     // 16 bytes
+    // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+    // eslint-disable-next-line @typescript-eslint/naming-convention
     __privateAdd(this, _PBKDF2_ITERATIONS, 9e5);
   }
   encryptString(plaintext, password) {
@@ -117,15 +125,16 @@ decrypt_fn = function(ciphertextAndNonce, key) {
   );
   return gcm(key, nonce).decrypt(ciphertext);
 };
-var encryption = new EncryptorDecryptor();
-var encryption_default = encryption;
+var Encryption = new EncryptorDecryptor();
+var encryption_default = Encryption;
 function createSHA256Hash(data) {
   const hashedData = sha256(data);
   return bytesToHex(hashedData);
 }
 
 export {
+  Encryption,
   encryption_default,
   createSHA256Hash
 };
-//# sourceMappingURL=chunk-UMKBFFZ5.mjs.map
+//# sourceMappingURL=chunk-B5DBQDB3.mjs.map

package/dist/chunk-B5DBQDB3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/encryption.ts"],"sourcesContent":["import { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { pbkdf2 } from '@noble/hashes/pbkdf2';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { utf8ToBytes, concatBytes, bytesToHex } from '@noble/hashes/utils';\n\nexport type EncryptedPayload = {\n  v: '1'; // version\n  d: string; // data\n  iterations: number;\n};\n\n/**\n * Converts Byte Array to Base64 String\n *\n * @param byteArray - array of bytes\n * @returns base64 string\n */\nfunction byteArrayToBase64(byteArray: Uint8Array): string {\n  return Buffer.from(byteArray).toString('base64');\n}\n\n/**\n * Converts Base64 String into Byte Array\n *\n * @param base64 - base64 encoded string\n * @returns byte array\n */\nfunction base64ToByteArray(base64: string): Uint8Array {\n  return new Uint8Array(Buffer.from(base64, 'base64'));\n}\n\n/**\n * Converts Bytes into UTF-8 Encoded String\n * @param byteArray - array of bytes\n * @returns uft-8 encoded string\n */\nfunction bytesToUtf8(byteArray: Uint8Array): string {\n  const decoder = new TextDecoder('utf-8');\n  return decoder.decode(byteArray);\n}\n\nclass EncryptorDecryptor {\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  #ALGORITHM_NONCE_SIZE = 12; // 12 bytes\n\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  #ALGORITHM_KEY_SIZE = 16; // 16 bytes\n\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  #PBKDF2_SALT_SIZE = 16; // 16 bytes\n\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  #PBKDF2_ITERATIONS = 900_000;\n\n  encryptString(plaintext: string, password: string): string {\n    try {\n      if (plaintext.trim().length === 0) {\n        throw new Error('No plain text provided');\n      }\n\n      return this.#encryptStringV1(plaintext, password);\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage = e instanceof Error ? e.message : String(e);\n      throw new Error(`Unable to encrypt string - ${errorMessage}`);\n    }\n  }\n\n  decryptString(encryptedDataStr: string, password: string): string {\n    try {\n      const encryptedData: EncryptedPayload = JSON.parse(encryptedDataStr);\n      if (encryptedData.v === '1') {\n        return this.#decryptStringV1(encryptedData, password);\n      }\n      throw new Error(\n        `Unsupported encrypted data payload - ${JSON.stringify(encryptedData)}`,\n      );\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage = e instanceof Error ? e.message : String(e);\n      throw new Error(`Unable to decrypt string - ${errorMessage}`);\n    }\n  }\n\n  #encryptStringV1(plaintext: string, password: string): string {\n    const salt = randomBytes(this.#PBKDF2_SALT_SIZE);\n\n    // Derive a key using PBKDF2.\n    const key = pbkdf2(sha256, password, salt, {\n      c: this.#PBKDF2_ITERATIONS,\n      dkLen: this.#ALGORITHM_KEY_SIZE,\n    });\n\n    // Encrypt and prepend salt.\n    const plaintextRaw = utf8ToBytes(plaintext);\n    const ciphertextAndNonceAndSalt = concatBytes(\n      salt,\n      this.#encrypt(plaintextRaw, key),\n    );\n\n    // Convert to Base64\n    const encryptedData = byteArrayToBase64(ciphertextAndNonceAndSalt);\n\n    const encryptedPayload: EncryptedPayload = {\n      v: '1',\n      d: encryptedData,\n      iterations: this.#PBKDF2_ITERATIONS,\n    };\n\n    return JSON.stringify(encryptedPayload);\n  }\n\n  #decryptStringV1(data: EncryptedPayload, password: string): string {\n    const { iterations, d: base64CiphertextAndNonceAndSalt } = data;\n\n    // Decode the base64.\n    const ciphertextAndNonceAndSalt = base64ToByteArray(\n      base64CiphertextAndNonceAndSalt,\n    );\n\n    // Create buffers of salt and ciphertextAndNonce.\n    const salt = ciphertextAndNonceAndSalt.slice(0, this.#PBKDF2_SALT_SIZE);\n    const ciphertextAndNonce = ciphertextAndNonceAndSalt.slice(\n      this.#PBKDF2_SALT_SIZE,\n      ciphertextAndNonceAndSalt.length,\n    );\n\n    // Derive the key using PBKDF2.\n    const key = pbkdf2(sha256, password, salt, {\n      c: iterations,\n      dkLen: this.#ALGORITHM_KEY_SIZE,\n    });\n\n    // Decrypt and return result.\n    return bytesToUtf8(this.#decrypt(ciphertextAndNonce, key));\n  }\n\n  #encrypt(plaintext: Uint8Array, key: Uint8Array): Uint8Array {\n    const nonce = randomBytes(this.#ALGORITHM_NONCE_SIZE);\n\n    // Encrypt and prepend nonce.\n    const ciphertext = gcm(key, nonce).encrypt(plaintext);\n\n    return concatBytes(nonce, ciphertext);\n  }\n\n  #decrypt(ciphertextAndNonce: Uint8Array, key: Uint8Array): Uint8Array {\n    // Create buffers of nonce and ciphertext.\n    const nonce = ciphertextAndNonce.slice(0, this.#ALGORITHM_NONCE_SIZE);\n    const ciphertext = ciphertextAndNonce.slice(\n      this.#ALGORITHM_NONCE_SIZE,\n      ciphertextAndNonce.length,\n    );\n\n    // Decrypt and return result.\n    return gcm(key, nonce).decrypt(ciphertext);\n  }\n}\n\nexport const Encryption = new EncryptorDecryptor();\nexport default Encryption;\n\n/**\n * Create a SHA-256 hash from a given string.\n *\n * @param data - input\n * @returns hash\n */\nexport function createSHA256Hash(data: string): string {\n  const hashedData = sha256(data);\n  return bytesToHex(hashedData);\n}\n"],"mappings":";;;;;;;AAAA,SAAS,WAAW;AACpB,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,cAAc;AACvB,SAAS,aAAa,aAAa,kBAAkB;AAcrD,SAAS,kBAAkB,WAA+B;AACxD,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,QAAQ;AACjD;AAQA,SAAS,kBAAkB,QAA4B;AACrD,SAAO,IAAI,WAAW,OAAO,KAAK,QAAQ,QAAQ,CAAC;AACrD;AAOA,SAAS,YAAY,WAA+B;AAClD,QAAM,UAAU,IAAI,YAAY,OAAO;AACvC,SAAO,QAAQ,OAAO,SAAS;AACjC;AAxCA;AA0CA,IAAM,qBAAN,MAAyB;AAAA,EAAzB;AA+CE;AA4BA;AAyBA;AASA;AA1GA;AAAA;AAAA,8CAAwB;AAIxB;AAAA;AAAA;AAAA,4CAAsB;AAItB;AAAA;AAAA;AAAA,0CAAoB;AAIpB;AAAA;AAAA;AAAA,2CAAqB;AAAA;AAAA,EAErB,cAAc,WAAmB,UAA0B;AACzD,QAAI;AACF,UAAI,UAAU,KAAK,EAAE,WAAW,GAAG;AACjC,cAAM,IAAI,MAAM,wBAAwB;AAAA,MAC1C;AAEA,aAAO,sBAAK,sCAAL,WAAsB,WAAW;AAAA,IAC1C,SAAS,GAAG;AAEV,YAAM,eAAe,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAC9D,YAAM,IAAI,MAAM,8BAA8B,YAAY,EAAE;AAAA,IAC9D;AAAA,EACF;AAAA,EAEA,cAAc,kBAA0B,UAA0B;AAChE,QAAI;AACF,YAAM,gBAAkC,KAAK,MAAM,gBAAgB;AACnE,UAAI,cAAc,MAAM,KAAK;AAC3B,eAAO,sBAAK,sCAAL,WAAsB,eAAe;AAAA,MAC9C;AACA,YAAM,IAAI;AAAA,QACR,wCAAwC,KAAK,UAAU,aAAa,CAAC;AAAA,MACvE;AAAA,IACF,SAAS,GAAG;AAEV,YAAM,eAAe,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAC9D,YAAM,IAAI,MAAM,8BAA8B,YAAY,EAAE;AAAA,IAC9D;AAAA,EACF;AA2EF;AArHE;AAIA;AAIA;AAIA;AAgCA;AAAA,qBAAgB,SAAC,WAAmB,UAA0B;AAC5D,QAAM,OAAO,YAAY,mBAAK,kBAAiB;AAG/C,QAAM,MAAM,OAAO,QAAQ,UAAU,MAAM;AAAA,IACzC,GAAG,mBAAK;AAAA,IACR,OAAO,mBAAK;AAAA,EACd,CAAC;AAGD,QAAM,eAAe,YAAY,SAAS;AAC1C,QAAM,4BAA4B;AAAA,IAChC;AAAA,IACA,sBAAK,sBAAL,WAAc,cAAc;AAAA,EAC9B;AAGA,QAAM,gBAAgB,kBAAkB,yBAAyB;AAEjE,QAAM,mBAAqC;AAAA,IACzC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,YAAY,mBAAK;AAAA,EACnB;AAEA,SAAO,KAAK,UAAU,gBAAgB;AACxC;AAEA;AAAA,qBAAgB,SAAC,MAAwB,UAA0B;AACjE,QAAM,EAAE,YAAY,GAAG,gCAAgC,IAAI;AAG3D,QAAM,4BAA4B;AAAA,IAChC;AAAA,EACF;AAGA,QAAM,OAAO,0BAA0B,MAAM,GAAG,mBAAK,kBAAiB;AACtE,QAAM,qBAAqB,0BAA0B;AAAA,IACnD,mBAAK;AAAA,IACL,0BAA0B;AAAA,EAC5B;AAGA,QAAM,MAAM,OAAO,QAAQ,UAAU,MAAM;AAAA,IACzC,GAAG;AAAA,IACH,OAAO,mBAAK;AAAA,EACd,CAAC;AAGD,SAAO,YAAY,sBAAK,sBAAL,WAAc,oBAAoB,IAAI;AAC3D;AAEA;AAAA,aAAQ,SAAC,WAAuB,KAA6B;AAC3D,QAAM,QAAQ,YAAY,mBAAK,sBAAqB;AAGpD,QAAM,aAAa,IAAI,KAAK,KAAK,EAAE,QAAQ,SAAS;AAEpD,SAAO,YAAY,OAAO,UAAU;AACtC;AAEA;AAAA,aAAQ,SAAC,oBAAgC,KAA6B;AAEpE,QAAM,QAAQ,mBAAmB,MAAM,GAAG,mBAAK,sBAAqB;AACpE,QAAM,aAAa,mBAAmB;AAAA,IACpC,mBAAK;AAAA,IACL,mBAAmB;AAAA,EACrB;AAGA,SAAO,IAAI,KAAK,KAAK,EAAE,QAAQ,UAAU;AAC3C;AAGK,IAAM,aAAa,IAAI,mBAAmB;AACjD,IAAO,qBAAQ;AAQR,SAAS,iBAAiB,MAAsB;AACrD,QAAM,aAAa,OAAO,IAAI;AAC9B,SAAO,WAAW,UAAU;AAC9B;","names":[]}

package/dist/chunk-B6CSNLGE.js

@@ -0,0 +1,25 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkT3FNDVE3js = require('./chunk-T3FNDVE3.js');
+
+// src/controllers/user-storage/schema.ts
+var USER_STORAGE_ENTRIES = {
+  notificationSettings: {
+    path: "notifications",
+    entryName: "notificationSettings"
+  }
+};
+function createEntryPath(entryKey, storageKey) {
+  const entry = USER_STORAGE_ENTRIES[entryKey];
+  if (!entry) {
+    throw new Error(`user-storage - invalid entry provided: ${entryKey}`);
+  }
+  const hashedKey = _chunkT3FNDVE3js.createSHA256Hash.call(void 0, entry.entryName + storageKey);
+  return `/${entry.path}/${hashedKey}`;
+}
+
+
+
+
+exports.USER_STORAGE_ENTRIES = USER_STORAGE_ENTRIES; exports.createEntryPath = createEntryPath;
+//# sourceMappingURL=chunk-B6CSNLGE.js.map

package/dist/chunk-B6CSNLGE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/user-storage/schema.ts"],"names":[],"mappings":";;;;;AAQO,IAAM,uBAAuB;AAAA,EAClC,sBAAsB;AAAA,IACpB,MAAM;AAAA,IACN,WAAW;AAAA,EACb;AACF;AAaO,SAAS,gBACd,UACA,YACQ;AACR,QAAM,QAAQ,qBAAqB,QAAQ;AAC3C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,0CAA0C,QAAQ,EAAE;AAAA,EACtE;AAEA,QAAM,YAAY,iBAAiB,MAAM,YAAY,UAAU;AAC/D,SAAO,IAAI,MAAM,IAAI,IAAI,SAAS;AACpC","sourcesContent":["import { createSHA256Hash } from './encryption';\n\ntype UserStorageEntry = { path: string; entryName: string };\n\n/**\n * The User Storage Endpoint requires a path and an entry name.\n * Developers can provide additional paths by extending this variable below\n */\nexport const USER_STORAGE_ENTRIES = {\n  notificationSettings: {\n    path: 'notifications',\n    entryName: 'notificationSettings',\n  },\n} satisfies Record<string, UserStorageEntry>;\n\nexport type UserStorageEntryKeys = keyof typeof USER_STORAGE_ENTRIES;\n\n/**\n * Constructs a unique entry path for a user.\n * This can be done due to the uniqueness of the storage key (no users will share the same storage key).\n * The users entry is a unique hash that cannot be reversed.\n *\n * @param entryKey - storage schema entry key\n * @param storageKey - users storage key\n * @returns path to store entry\n */\nexport function createEntryPath(\n  entryKey: UserStorageEntryKeys,\n  storageKey: string,\n): string {\n  const entry = USER_STORAGE_ENTRIES[entryKey];\n  if (!entry) {\n    throw new Error(`user-storage - invalid entry provided: ${entryKey}`);\n  }\n\n  const hashedKey = createSHA256Hash(entry.entryName + storageKey);\n  return `/${entry.path}/${hashedKey}`;\n}\n"]}

package/dist/{chunk-NRH6O4QZ.js → chunk-BOET676P.js}

@@ -1,18 +1,20 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkKHFPE566js = require('./chunk-KHFPE566.js');
+var _chunkSMKTWM6Ijs = require('./chunk-SMKTWM6I.js');
 
 
 
 
-var _chunkGQLHSQGZjs = require('./chunk-GQLHSQGZ.js');
+
+var _chunkMBTBE4P5js = require('./chunk-MBTBE4P5.js');
 
 // src/sdk/authentication-jwt-bearer/services.ts
-var NONCE_URL = (env) => `${_chunkKHFPE566js.getEnvUrls.call(void 0, env).authApiUrl}/api/v2/nonce`;
-var OIDC_TOKEN_URL = (env) => `${_chunkKHFPE566js.getEnvUrls.call(void 0, env).oidcApiUrl}/oauth2/token`;
-var SRP_LOGIN_URL = (env) => `${_chunkKHFPE566js.getEnvUrls.call(void 0, env).authApiUrl}/api/v2/srp/login`;
-var SIWE_LOGIN_URL = (env) => `${_chunkKHFPE566js.getEnvUrls.call(void 0, env).authApiUrl}/api/v2/siwe/login`;
+var NONCE_URL = (env) => `${_chunkSMKTWM6Ijs.getEnvUrls.call(void 0, env).authApiUrl}/api/v2/nonce`;
+var PAIR_IDENTIFIERS = (env) => `${_chunkSMKTWM6Ijs.getEnvUrls.call(void 0, env).authApiUrl}/api/v2/identifiers/pair`;
+var OIDC_TOKEN_URL = (env) => `${_chunkSMKTWM6Ijs.getEnvUrls.call(void 0, env).oidcApiUrl}/oauth2/token`;
+var SRP_LOGIN_URL = (env) => `${_chunkSMKTWM6Ijs.getEnvUrls.call(void 0, env).authApiUrl}/api/v2/srp/login`;
+var SIWE_LOGIN_URL = (env) => `${_chunkSMKTWM6Ijs.getEnvUrls.call(void 0, env).authApiUrl}/api/v2/siwe/login`;
 var getAuthenticationUrl = (authType, env) => {
   switch (authType) {
     case "SRP" /* SRP */:
@@ -20,11 +22,36 @@ var getAuthenticationUrl = (authType, env) => {
     case "SiWE" /* SiWE */:
       return SIWE_LOGIN_URL(env);
     default:
-      throw new (0, _chunkGQLHSQGZjs.ValidationError)(
+      throw new (0, _chunkMBTBE4P5js.ValidationError)(
         `Invalid AuthType: ${authType} - unable to create Auth URL`
       );
   }
 };
+async function pairIdentifiers(nonce, logins, accessToken, env) {
+  const pairUrl = new URL(PAIR_IDENTIFIERS(env));
+  try {
+    const response = await fetch(pairUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${accessToken}`
+      },
+      body: JSON.stringify({
+        nonce,
+        logins
+      })
+    });
+    if (!response.ok) {
+      const responseBody = await response.json();
+      throw new Error(
+        `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`
+      );
+    }
+  } catch (e) {
+    const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? "");
+    throw new (0, _chunkMBTBE4P5js.PairError)(`unable to pair identifiers: ${errorMessage}`);
+  }
+}
 async function getNonce(id, env) {
   const nonceUrl = new URL(NONCE_URL(env));
   nonceUrl.searchParams.set("identifier", id);
@@ -44,17 +71,17 @@ async function getNonce(id, env) {
     };
   } catch (e) {
     const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? "");
-    throw new (0, _chunkGQLHSQGZjs.NonceRetrievalError)(`failed to generate nonce: ${errorMessage}`);
+    throw new (0, _chunkMBTBE4P5js.NonceRetrievalError)(`failed to generate nonce: ${errorMessage}`);
   }
 }
-async function authorizeOIDC(jwtToken, env) {
+async function authorizeOIDC(jwtToken, env, platform) {
   const grantType = "urn:ietf:params:oauth:grant-type:jwt-bearer";
   const headers = new Headers({
     "Content-Type": "application/x-www-form-urlencoded"
   });
   const urlEncodedBody = new URLSearchParams();
   urlEncodedBody.append("grant_type", grantType);
-  urlEncodedBody.append("client_id", _chunkKHFPE566js.getOidcClientId.call(void 0, env));
+  urlEncodedBody.append("client_id", _chunkSMKTWM6Ijs.getOidcClientId.call(void 0, env, platform));
   urlEncodedBody.append("assertion", jwtToken);
   try {
     const response = await fetch(OIDC_TOKEN_URL(env), {
@@ -76,7 +103,7 @@ async function authorizeOIDC(jwtToken, env) {
     };
   } catch (e) {
     const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? "");
-    throw new (0, _chunkGQLHSQGZjs.SignInError)(`unable to get access token: ${errorMessage}`);
+    throw new (0, _chunkMBTBE4P5js.SignInError)(`unable to get access token: ${errorMessage}`);
   }
 }
 async function authenticate(rawMessage, signature, authType, env) {
@@ -89,6 +116,8 @@ async function authenticate(rawMessage, signature, authType, env) {
       },
       body: JSON.stringify({
         signature,
+        // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+        // eslint-disable-next-line @typescript-eslint/naming-convention
         raw_message: rawMessage
       })
     });
@@ -110,7 +139,7 @@ async function authenticate(rawMessage, signature, authType, env) {
     };
   } catch (e) {
     const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? "");
-    throw new (0, _chunkGQLHSQGZjs.SignInError)(`unable to perform SRP login: ${errorMessage}`);
+    throw new (0, _chunkMBTBE4P5js.SignInError)(`unable to perform SRP login: ${errorMessage}`);
   }
 }
 
@@ -122,5 +151,7 @@ async function authenticate(rawMessage, signature, authType, env) {
 
 
 
-exports.NONCE_URL = NONCE_URL; exports.OIDC_TOKEN_URL = OIDC_TOKEN_URL; exports.SRP_LOGIN_URL = SRP_LOGIN_URL; exports.SIWE_LOGIN_URL = SIWE_LOGIN_URL; exports.getNonce = getNonce; exports.authorizeOIDC = authorizeOIDC; exports.authenticate = authenticate;
-//# sourceMappingURL=chunk-NRH6O4QZ.js.map
+
+
+exports.NONCE_URL = NONCE_URL; exports.PAIR_IDENTIFIERS = PAIR_IDENTIFIERS; exports.OIDC_TOKEN_URL = OIDC_TOKEN_URL; exports.SRP_LOGIN_URL = SRP_LOGIN_URL; exports.SIWE_LOGIN_URL = SIWE_LOGIN_URL; exports.pairIdentifiers = pairIdentifiers; exports.getNonce = getNonce; exports.authorizeOIDC = authorizeOIDC; exports.authenticate = authenticate;
+//# sourceMappingURL=chunk-BOET676P.js.map

package/dist/chunk-BOET676P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWO,IAAM,YAAY,CAAC,QACxB,GAAG,WAAW,GAAG,EAAE,UAAU;AAExB,IAAM,mBAAmB,CAAC,QAC/B,GAAG,WAAW,GAAG,EAAE,UAAU;AAExB,IAAM,iBAAiB,CAAC,QAC7B,GAAG,WAAW,GAAG,EAAE,UAAU;AAExB,IAAM,gBAAgB,CAAC,QAC5B,GAAG,WAAW,GAAG,EAAE,UAAU;AAExB,IAAM,iBAAiB,CAAC,QAC7B,GAAG,WAAW,GAAG,EAAE,UAAU;AAE/B,IAAM,uBAAuB,CAAC,UAAoB,QAAqB;AACrE,UAAQ,UAAU;AAAA,IAChB;AACE,aAAO,cAAc,GAAG;AAAA,IAC1B;AACE,aAAO,eAAe,GAAG;AAAA,IAE3B;AACE,YAAM,IAAI;AAAA,QACR,qBAAqB,QAAkB;AAAA,MACzC;AAAA,EACJ;AACF;AA8BA,eAAsB,gBACpB,OACA,QACA,aACA,KACe;AACf,QAAM,UAAU,IAAI,IAAI,iBAAiB,GAAG,CAAC;AAE7C,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,SAAS;AAAA,MACpC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAAgB,MAAM,SAAS,KAAK;AAC1C,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAEV,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,UAAM,IAAI,UAAU,+BAA+B,YAAY,EAAE;AAAA,EACnE;AACF;AASA,eAAsB,SAAS,IAAY,KAAkC;AAC3E,QAAM,WAAW,IAAI,IAAI,UAAU,GAAG,CAAC;AACvC,WAAS,aAAa,IAAI,cAAc,EAAE;AAE1C,MAAI;AACF,UAAM,gBAAgB,MAAM,MAAM,SAAS,SAAS,CAAC;AACrD,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,eAAgB,MAAM,cAAc,KAAK;AAC/C,YAAM,IAAI;AAAA,QACR,uBAAuB,aAAa,OAAO,YAAY,aAAa,KAAK;AAAA,MAC3E;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,cAAc,KAAK;AAC3C,WAAO;AAAA,MACL,OAAO,UAAU;AAAA,MACjB,YAAY,UAAU;AAAA,MACtB,WAAW,UAAU;AAAA,IACvB;AAAA,EACF,SAAS,GAAG;AAEV,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,UAAM,IAAI,oBAAoB,6BAA6B,YAAY,EAAE;AAAA,EAC3E;AACF;AAUA,eAAsB,cACpB,UACA,KACA,UACsB;AACtB,QAAM,YAAY;AAClB,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,gBAAgB;AAAA,EAClB,CAAC;AAED,QAAM,iBAAiB,IAAI,gBAAgB;AAC3C,iBAAe,OAAO,cAAc,SAAS;AAC7C,iBAAe,OAAO,aAAa,gBAAgB,KAAK,QAAQ,CAAC;AACjE,iBAAe,OAAO,aAAa,QAAQ;AAE3C,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,eAAe,GAAG,GAAG;AAAA,MAChD,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,eAAe,SAAS;AAAA,IAChC,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAAgB,MAAM,SAAS,KAAK;AAM1C,YAAM,IAAI;AAAA,QACR,eAAe,aAAa,iBAAiB,iBAAiB,aAAa,KAAK;AAAA,MAClF;AAAA,IACF;AAEA,UAAM,sBAAsB,MAAM,SAAS,KAAK;AAChD,WAAO;AAAA,MACL,aAAa,oBAAoB;AAAA,MACjC,WAAW,oBAAoB;AAAA,MAC/B,YAAY,KAAK,IAAI;AAAA,IACvB;AAAA,EACF,SAAS,GAAG;AAEV,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,UAAM,IAAI,YAAY,+BAA+B,YAAY,EAAE;AAAA,EACrE;AACF;AAgBA,eAAsB,aACpB,YACA,WACA,UACA,KACyB;AACzB,QAAM,oBAAoB,qBAAqB,UAAU,GAAG;AAE5D,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,mBAAmB;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB;AAAA;AAAA;AAAA,QAGA,aAAa;AAAA,MACf,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,eAAgB,MAAM,SAAS,KAAK;AAC1C,YAAM,IAAI;AAAA,QACR,GAAG,QAAQ,sBAAsB,aAAa,OAAO,iBAAiB,aAAa,KAAK;AAAA,MAC1F;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAM,SAAS,KAAK;AAC1C,WAAO;AAAA,MACL,OAAO,cAAc;AAAA,MACrB,WAAW,cAAc;AAAA,MACzB,SAAS;AAAA,QACP,cAAc,cAAc,QAAQ;AAAA,QACpC,eAAe,cAAc,QAAQ;AAAA,QACrC,WAAW,cAAc,QAAQ;AAAA,MACnC;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAEV,UAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,UAAM,IAAI,YAAY,gCAAgC,YAAY,EAAE;AAAA,EACtE;AACF","sourcesContent":["import type { Env, Platform } from '../env';\nimport { getEnvUrls, getOidcClientId } from '../env';\nimport {\n  NonceRetrievalError,\n  PairError,\n  SignInError,\n  ValidationError,\n} from '../errors';\nimport type { AccessToken, ErrorMessage, UserProfile } from './types';\nimport { AuthType } from './types';\n\nexport const NONCE_URL = (env: Env) =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/nonce`;\n\nexport const PAIR_IDENTIFIERS = (env: Env) =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/identifiers/pair`;\n\nexport const OIDC_TOKEN_URL = (env: Env) =>\n  `${getEnvUrls(env).oidcApiUrl}/oauth2/token`;\n\nexport const SRP_LOGIN_URL = (env: Env) =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/srp/login`;\n\nexport const SIWE_LOGIN_URL = (env: Env) =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/siwe/login`;\n\nconst getAuthenticationUrl = (authType: AuthType, env: Env): string => {\n  switch (authType) {\n    case AuthType.SRP:\n      return SRP_LOGIN_URL(env);\n    case AuthType.SiWE:\n      return SIWE_LOGIN_URL(env);\n    /* istanbul ignore next */\n    default:\n      throw new ValidationError(\n        `Invalid AuthType: ${authType as number} - unable to create Auth URL`,\n      );\n  }\n};\n\ntype NonceResponse = {\n  nonce: string;\n  identifier: string;\n  expiresIn: number;\n};\n\ntype PairRequest = {\n  signature: string;\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  raw_message: string;\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  encrypted_storage_key: string;\n  // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  identifier_type: 'SIWE' | 'SRP';\n};\n\n/**\n * Pair multiple identifiers under a single profile\n *\n * @param nonce - session nonce\n * @param logins - pairing request payload\n * @param accessToken - JWT access token used to access protected resources\n * @param env - server environment\n * @returns void.\n */\nexport async function pairIdentifiers(\n  nonce: string,\n  logins: PairRequest[],\n  accessToken: string,\n  env: Env,\n): Promise<void> {\n  const pairUrl = new URL(PAIR_IDENTIFIERS(env));\n\n  try {\n    const response = await fetch(pairUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${accessToken}`,\n      },\n      body: JSON.stringify({\n        nonce,\n        logins,\n      }),\n    });\n\n    if (!response.ok) {\n      const responseBody = (await response.json()) as ErrorMessage;\n      throw new Error(\n        `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n      );\n    }\n  } catch (e) {\n    /* istanbul ignore next */\n    const errorMessage =\n      e instanceof Error ? e.message : JSON.stringify(e ?? '');\n    throw new PairError(`unable to pair identifiers: ${errorMessage}`);\n  }\n}\n\n/**\n * Service to Get Nonce for JWT Bearer Flow\n *\n * @param id - identifier ID\n * @param env - server environment\n * @returns the nonce.\n */\nexport async function getNonce(id: string, env: Env): Promise<NonceResponse> {\n  const nonceUrl = new URL(NONCE_URL(env));\n  nonceUrl.searchParams.set('identifier', id);\n\n  try {\n    const nonceResponse = await fetch(nonceUrl.toString());\n    if (!nonceResponse.ok) {\n      const responseBody = (await nonceResponse.json()) as ErrorMessage;\n      throw new Error(\n        `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n      );\n    }\n\n    const nonceJson = await nonceResponse.json();\n    return {\n      nonce: nonceJson.nonce,\n      identifier: nonceJson.identifier,\n      expiresIn: nonceJson.expires_in,\n    };\n  } catch (e) {\n    /* istanbul ignore next */\n    const errorMessage =\n      e instanceof Error ? e.message : JSON.stringify(e ?? '');\n    throw new NonceRetrievalError(`failed to generate nonce: ${errorMessage}`);\n  }\n}\n\n/**\n * Service to Authorize And perform OIDC Flow to get the Access Token\n *\n * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)\n * @param env - server environment\n * @param platform - SDK platform\n * @returns Access Token from Authorization server\n */\nexport async function authorizeOIDC(\n  jwtToken: string,\n  env: Env,\n  platform: Platform,\n): Promise<AccessToken> {\n  const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n  const headers = new Headers({\n    'Content-Type': 'application/x-www-form-urlencoded',\n  });\n\n  const urlEncodedBody = new URLSearchParams();\n  urlEncodedBody.append('grant_type', grantType);\n  urlEncodedBody.append('client_id', getOidcClientId(env, platform));\n  urlEncodedBody.append('assertion', jwtToken);\n\n  try {\n    const response = await fetch(OIDC_TOKEN_URL(env), {\n      method: 'POST',\n      headers,\n      body: urlEncodedBody.toString(),\n    });\n\n    if (!response.ok) {\n      const responseBody = (await response.json()) as {\n        // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        error_description: string;\n        error: string;\n      };\n      throw new Error(\n        `HTTP error: ${responseBody.error_description}, error code: ${responseBody.error}`,\n      );\n    }\n\n    const accessTokenResponse = await response.json();\n    return {\n      accessToken: accessTokenResponse.access_token,\n      expiresIn: accessTokenResponse.expires_in,\n      obtainedAt: Date.now(),\n    };\n  } catch (e) {\n    /* istanbul ignore next */\n    const errorMessage =\n      e instanceof Error ? e.message : JSON.stringify(e ?? '');\n    throw new SignInError(`unable to get access token: ${errorMessage}`);\n  }\n}\n\ntype Authentication = {\n  token: string;\n  expiresIn: number;\n  profile: UserProfile;\n};\n/**\n * Service to Authenticate/Login a user via SIWE or SRP derived key.\n *\n * @param rawMessage - raw message for validation when authenticating\n * @param signature - signed raw message\n * @param authType - authentication type/flow used\n * @param env - server environment\n * @returns Authentication Token\n */\nexport async function authenticate(\n  rawMessage: string,\n  signature: string,\n  authType: AuthType,\n  env: Env,\n): Promise<Authentication> {\n  const authenticationUrl = getAuthenticationUrl(authType, env);\n\n  try {\n    const response = await fetch(authenticationUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        signature,\n        // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        raw_message: rawMessage,\n      }),\n    });\n\n    if (!response.ok) {\n      const responseBody = (await response.json()) as ErrorMessage;\n      throw new Error(\n        `${authType} login HTTP error: ${responseBody.message}, error code: ${responseBody.error}`,\n      );\n    }\n\n    const loginResponse = await response.json();\n    return {\n      token: loginResponse.token,\n      expiresIn: loginResponse.expires_in,\n      profile: {\n        identifierId: loginResponse.profile.identifier_id,\n        metaMetricsId: loginResponse.profile.metametrics_id,\n        profileId: loginResponse.profile.profile_id,\n      },\n    };\n  } catch (e) {\n    /* istanbul ignore next */\n    const errorMessage =\n      e instanceof Error ? e.message : JSON.stringify(e ?? '');\n    throw new SignInError(`unable to perform SRP login: ${errorMessage}`);\n  }\n}\n"]}

package/dist/{chunk-2FZSWVHT.mjs → chunk-CAIIVJAO.mjs}

@@ -8,4 +8,4 @@ var AuthType = /* @__PURE__ */ ((AuthType2) => {
 export {
   AuthType
 };
-//# sourceMappingURL=chunk-2FZSWVHT.mjs.map
+//# sourceMappingURL=chunk-CAIIVJAO.mjs.map

package/dist/chunk-CAIIVJAO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication-jwt-bearer/types.ts"],"sourcesContent":["import type { Env, Platform } from '../env';\n\nexport enum AuthType {\n  /* sign in using a private key derived from your secret recovery phrase (SRP). \n       Uses message signing snap to perform this operation */\n  SRP = 'SRP',\n\n  /* sign in with Ethereum */\n  SiWE = 'SiWE',\n}\n\nexport type AuthConfig = {\n  env: Env;\n  platform: Platform;\n  type: AuthType;\n};\n\nexport type AccessToken = {\n  /**\n   * The JWT Access Token\n   */\n  accessToken: string;\n  /**\n   * Expiration in seconds\n   */\n  expiresIn: number;\n  /**\n   * Date in milliseconds\n   */\n  obtainedAt: number;\n};\n\nexport type UserProfile = {\n  /**\n   * The \"Identifier\" used to log in with.\n   */\n  identifierId: string;\n  /**\n   * The Unique profile for a logged in user. A Profile can be logged in via multiple Identifiers\n   */\n  profileId: string;\n  /**\n   * Server MetaMetrics ID. Allows grouping of user events cross platform.\n   */\n  metaMetricsId: string;\n};\n\nexport type LoginResponse = {\n  token: AccessToken;\n  profile: UserProfile;\n};\n\nexport type IBaseAuth = {\n  getAccessToken: () => Promise<string>;\n  getUserProfile: () => Promise<UserProfile>;\n  getIdentifier: () => Promise<string>;\n  signMessage: (message: string) => Promise<string>;\n};\n\nexport type AuthStorageOptions = {\n  getLoginResponse: () => Promise<LoginResponse | null>;\n  setLoginResponse: (val: LoginResponse) => Promise<void>;\n};\n\nexport type AuthSigningOptions = {\n  signMessage: (message: string) => Promise<string>;\n  getIdentifier: () => Promise<string>;\n};\n\nexport type ErrorMessage = {\n  message: string;\n  error: string;\n};\n\nexport type Pair = {\n  identifier: string;\n  encryptedStorageKey: string;\n  identifierType: 'SIWE' | 'SRP';\n  signMessage: (message: string) => Promise<string>;\n};\n"],"mappings":";AAEO,IAAK,WAAL,kBAAKA,cAAL;AAGL,EAAAA,UAAA,SAAM;AAGN,EAAAA,UAAA,UAAO;AANG,SAAAA;AAAA,GAAA;","names":["AuthType"]}

package/dist/chunk-ELHJSRS2.js

@@ -0,0 +1,98 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _chunkSMKTWM6Ijs = require('./chunk-SMKTWM6I.js');
+
+// src/controllers/authentication/services.ts
+var ENV_URLS = _chunkSMKTWM6Ijs.getEnvUrls.call(void 0, "prd" /* PRD */);
+var AUTH_ENDPOINT = ENV_URLS.authApiUrl;
+var AUTH_NONCE_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/nonce`;
+var AUTH_LOGIN_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/srp/login`;
+var OIDC_ENDPOINT = ENV_URLS.oidcApiUrl || "";
+var OIDC_TOKENS_ENDPOINT = `${OIDC_ENDPOINT}/oauth2/token`;
+var OIDC_CLIENT_ID = _chunkSMKTWM6Ijs.getOidcClientId.call(void 0, "prd" /* PRD */, "extension" /* EXTENSION */);
+var OIDC_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+async function getNonce(publicKey) {
+  const nonceUrl = new URL(AUTH_NONCE_ENDPOINT);
+  nonceUrl.searchParams.set("identifier", publicKey);
+  try {
+    const nonceResponse = await fetch(nonceUrl.toString());
+    if (!nonceResponse.ok) {
+      return null;
+    }
+    const nonceJson = await nonceResponse.json();
+    return nonceJson?.nonce ?? null;
+  } catch (e) {
+    console.error("authentication-controller/services: unable to get nonce", e);
+    return null;
+  }
+}
+async function login(rawMessage, signature, clientMetaMetrics) {
+  try {
+    const response = await fetch(AUTH_LOGIN_ENDPOINT, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        signature,
+        // eslint-disable-next-line @typescript-eslint/naming-convention
+        raw_message: rawMessage,
+        metametrics: {
+          // eslint-disable-next-line @typescript-eslint/naming-convention
+          metametrics_id: clientMetaMetrics.metametricsId,
+          agent: clientMetaMetrics.agent
+        }
+      })
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const loginResponse = await response.json();
+    return loginResponse ?? null;
+  } catch (e) {
+    console.error("authentication-controller/services: unable to login", e);
+    return null;
+  }
+}
+async function getAccessToken(jwtToken) {
+  const headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded"
+  });
+  const urlEncodedBody = new URLSearchParams();
+  urlEncodedBody.append("grant_type", OIDC_GRANT_TYPE);
+  urlEncodedBody.append("client_id", OIDC_CLIENT_ID);
+  urlEncodedBody.append("assertion", jwtToken);
+  try {
+    const response = await fetch(OIDC_TOKENS_ENDPOINT, {
+      method: "POST",
+      headers,
+      body: urlEncodedBody.toString()
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const accessTokenResponse = await response.json();
+    return accessTokenResponse?.access_token ?? null;
+  } catch (e) {
+    console.error(
+      "authentication-controller/services: unable to get access token",
+      e
+    );
+    return null;
+  }
+}
+function createLoginRawMessage(nonce, publicKey) {
+  return `metamask:${nonce}:${publicKey}`;
+}
+
+
+
+
+
+
+
+
+
+exports.AUTH_NONCE_ENDPOINT = AUTH_NONCE_ENDPOINT; exports.AUTH_LOGIN_ENDPOINT = AUTH_LOGIN_ENDPOINT; exports.OIDC_TOKENS_ENDPOINT = OIDC_TOKENS_ENDPOINT; exports.getNonce = getNonce; exports.login = login; exports.getAccessToken = getAccessToken; exports.createLoginRawMessage = createLoginRawMessage;
+//# sourceMappingURL=chunk-ELHJSRS2.js.map