@metamask/profile-sync-controller 0.0.0 → 0.1.1

package/dist/chunk-ELHJSRS2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/authentication/services.ts"],"names":[],"mappings":";;;;;;AAEA,IAAM,WAAW,0BAAkB;AAEnC,IAAM,gBAAwB,SAAS;AAChC,IAAM,sBAAsB,GAAG,aAAa;AAC5C,IAAM,sBAAsB,GAAG,aAAa;AAEnD,IAAM,gBAAwB,SAAS,cAAc;AAC9C,IAAM,uBAAuB,GAAG,aAAa;AACpD,IAAM,iBAAiB,4DAA2C;AAClE,IAAM,kBAAkB;AAYxB,eAAsB,SAAS,WAA2C;AACxE,QAAM,WAAW,IAAI,IAAI,mBAAmB;AAC5C,WAAS,aAAa,IAAI,cAAc,SAAS;AAEjD,MAAI;AACF,UAAM,gBAAgB,MAAM,MAAM,SAAS,SAAS,CAAC;AACrD,QAAI,CAAC,cAAc,IAAI;AACrB,aAAO;AAAA,IACT;AAEA,UAAM,YAA2B,MAAM,cAAc,KAAK;AAC1D,WAAO,WAAW,SAAS;AAAA,EAC7B,SAAS,GAAG;AACV,YAAQ,MAAM,2DAA2D,CAAC;AAC1E,WAAO;AAAA,EACT;AACF;AAqCA,eAAsB,MACpB,YACA,WACA,mBAC+B;AAC/B,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,qBAAqB;AAAA,MAChD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB;AAAA;AAAA,QAEA,aAAa;AAAA,QACb,aAAa;AAAA;AAAA,UAEX,gBAAgB,kBAAkB;AAAA,UAClC,OAAO,kBAAkB;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,gBAA+B,MAAM,SAAS,KAAK;AACzD,WAAO,iBAAiB;AAAA,EAC1B,SAAS,GAAG;AACV,YAAQ,MAAM,uDAAuD,CAAC;AACtE,WAAO;AAAA,EACT;AACF;AAmBA,eAAsB,eAAe,UAA0C;AAC7E,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,gBAAgB;AAAA,EAClB,CAAC;AAED,QAAM,iBAAiB,IAAI,gBAAgB;AAC3C,iBAAe,OAAO,cAAc,eAAe;AACnD,iBAAe,OAAO,aAAa,cAAc;AACjD,iBAAe,OAAO,aAAa,QAAQ;AAE3C,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,sBAAsB;AAAA,MACjD,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,eAAe,SAAS;AAAA,IAChC,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,sBAA0C,MAAM,SAAS,KAAK;AACpE,WAAO,qBAAqB,gBAAgB;AAAA,EAC9C,SAAS,GAAG;AACV,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AASO,SAAS,sBACd,OACA,WACgC;AAChC,SAAO,YAAY,KAAK,IAAI,SAAS;AACvC","sourcesContent":["import { Env, Platform, getEnvUrls, getOidcClientId } from '../../sdk';\n\nconst ENV_URLS = getEnvUrls(Env.PRD);\n\nconst AUTH_ENDPOINT: string = ENV_URLS.authApiUrl;\nexport const AUTH_NONCE_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/nonce`;\nexport const AUTH_LOGIN_ENDPOINT = `${AUTH_ENDPOINT}/api/v2/srp/login`;\n\nconst OIDC_ENDPOINT: string = ENV_URLS.oidcApiUrl || '';\nexport const OIDC_TOKENS_ENDPOINT = `${OIDC_ENDPOINT}/oauth2/token`;\nconst OIDC_CLIENT_ID = getOidcClientId(Env.PRD, Platform.EXTENSION);\nconst OIDC_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n\nexport type NonceResponse = {\n  nonce: string;\n};\n\n/**\n * Auth Service - Get Nonce. Used for the initial JWTBearer flow\n *\n * @param publicKey - public key to associate a nonce with\n * @returns the nonce or null if failed\n */\nexport async function getNonce(publicKey: string): Promise<string | null> {\n  const nonceUrl = new URL(AUTH_NONCE_ENDPOINT);\n  nonceUrl.searchParams.set('identifier', publicKey);\n\n  try {\n    const nonceResponse = await fetch(nonceUrl.toString());\n    if (!nonceResponse.ok) {\n      return null;\n    }\n\n    const nonceJson: NonceResponse = await nonceResponse.json();\n    return nonceJson?.nonce ?? null;\n  } catch (e) {\n    console.error('authentication-controller/services: unable to get nonce', e);\n    return null;\n  }\n}\n\n/**\n * The Login API Server Response Shape\n */\nexport type LoginResponse = {\n  token: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: string;\n  /**\n   * Contains anonymous information about the logged in profile.\n   *\n   * @property identifier_id - a deterministic unique identifier on the method used to sign in\n   * @property profile_id - a unique id for a given profile\n   * @property metametrics_id - an anonymous server id\n   */\n  profile: {\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    identifier_id: string;\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    profile_id: string;\n  };\n};\n\ntype ClientMetaMetrics = {\n  metametricsId: string;\n  agent: 'extension' | 'mobile';\n};\n\n/**\n * Auth Service - Login. Will perform login with a given signature and will return a single use JWT Token.\n *\n * @param rawMessage - the original message before signing\n * @param signature - the signed message\n * @param clientMetaMetrics - optional client metametrics id (to associate on backend)\n * @returns The Login Response\n */\nexport async function login(\n  rawMessage: string,\n  signature: string,\n  clientMetaMetrics: ClientMetaMetrics,\n): Promise<LoginResponse | null> {\n  try {\n    const response = await fetch(AUTH_LOGIN_ENDPOINT, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n      body: JSON.stringify({\n        signature,\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        raw_message: rawMessage,\n        metametrics: {\n          // eslint-disable-next-line @typescript-eslint/naming-convention\n          metametrics_id: clientMetaMetrics.metametricsId,\n          agent: clientMetaMetrics.agent,\n        },\n      }),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const loginResponse: LoginResponse = await response.json();\n    return loginResponse ?? null;\n  } catch (e) {\n    console.error('authentication-controller/services: unable to login', e);\n    return null;\n  }\n}\n\n/**\n * The Auth API Token Response Shape\n */\nexport type OAuthTokenResponse = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  access_token: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  expires_in: number;\n};\n\n/**\n * OIDC Service - Access Token. Trades the Auth Token for an access token (to be used for other authenticated endpoints)\n * NOTE - the access token is short lived, which means it is best practice to validate session before calling authenticated endpoints\n *\n * @param jwtToken - the JWT Auth Token, received from `/login`\n * @returns JWT Access token to store and use on authorized endpoints.\n */\nexport async function getAccessToken(jwtToken: string): Promise<string | null> {\n  const headers = new Headers({\n    'Content-Type': 'application/x-www-form-urlencoded',\n  });\n\n  const urlEncodedBody = new URLSearchParams();\n  urlEncodedBody.append('grant_type', OIDC_GRANT_TYPE);\n  urlEncodedBody.append('client_id', OIDC_CLIENT_ID);\n  urlEncodedBody.append('assertion', jwtToken);\n\n  try {\n    const response = await fetch(OIDC_TOKENS_ENDPOINT, {\n      method: 'POST',\n      headers,\n      body: urlEncodedBody.toString(),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const accessTokenResponse: OAuthTokenResponse = await response.json();\n    return accessTokenResponse?.access_token ?? null;\n  } catch (e) {\n    console.error(\n      'authentication-controller/services: unable to get access token',\n      e,\n    );\n    return null;\n  }\n}\n\n/**\n * Utility to create the raw login message for the JWT bearer flow (via SRP)\n *\n * @param nonce - nonce received from `/nonce` endpoint\n * @param publicKey - public key used to retrieve nonce and for message signing\n * @returns Raw Message which will be used for signing & logging in.\n */\nexport function createLoginRawMessage(\n  nonce: string,\n  publicKey: string,\n): `metamask:${string}:${string}` {\n  return `metamask:${nonce}:${publicKey}` as const;\n}\n"]}

package/dist/chunk-FCT2LIGH.mjs

@@ -0,0 +1,106 @@
+import {
+  SIWEJwtBearerAuth
+} from "./chunk-JLDFMYAH.mjs";
+import {
+  SRPJwtBearerAuth
+} from "./chunk-Y46NMA3V.mjs";
+import {
+  getNonce,
+  pairIdentifiers
+} from "./chunk-WB6MUIML.mjs";
+import {
+  PairError,
+  UnsupportedAuthTypeError
+} from "./chunk-TFFQFIJV.mjs";
+import {
+  __privateAdd,
+  __privateGet,
+  __privateMethod,
+  __privateSet
+} from "./chunk-U5UIDVOO.mjs";
+
+// src/sdk/authentication.ts
+var _type, _env, _sdk, _assertSIWE, assertSIWE_fn;
+var JwtBearerAuth = class {
+  constructor(...args) {
+    __privateAdd(this, _assertSIWE);
+    __privateAdd(this, _type, void 0);
+    __privateAdd(this, _env, void 0);
+    __privateAdd(this, _sdk, void 0);
+    __privateSet(this, _type, args[0].type);
+    __privateSet(this, _env, args[0].env);
+    if (args[0].type === "SRP" /* SRP */) {
+      __privateSet(this, _sdk, new SRPJwtBearerAuth(args[0], args[1]));
+      return;
+    }
+    if (args[0].type === "SiWE" /* SiWE */) {
+      __privateSet(this, _sdk, new SIWEJwtBearerAuth(args[0], args[1]));
+      return;
+    }
+    throw new UnsupportedAuthTypeError("unsupported auth type");
+  }
+  async getAccessToken() {
+    return await __privateGet(this, _sdk).getAccessToken();
+  }
+  async getUserProfile() {
+    return await __privateGet(this, _sdk).getUserProfile();
+  }
+  async getIdentifier() {
+    return await __privateGet(this, _sdk).getIdentifier();
+  }
+  async signMessage(message) {
+    return await __privateGet(this, _sdk).signMessage(message);
+  }
+  async pairIdentifiers(pairing) {
+    const profile = await this.getUserProfile();
+    const n = await getNonce(profile.profileId, __privateGet(this, _env));
+    const logins = await Promise.all(
+      pairing.map(async (p) => {
+        try {
+          const raw = `metamask:${n.nonce}:${p.identifier}`;
+          const sig = await p.signMessage(raw);
+          return {
+            signature: sig,
+            // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            raw_message: raw,
+            // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            encrypted_storage_key: p.encryptedStorageKey,
+            // TODO: Either fix this lint violation or explain why it's necessary to ignore.
+            // eslint-disable-next-line @typescript-eslint/naming-convention
+            identifier_type: p.identifierType
+          };
+        } catch (e) {
+          const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? "");
+          throw new PairError(
+            `failed to sign pairing message: ${errorMessage}`
+          );
+        }
+      })
+    );
+    const accessToken = await this.getAccessToken();
+    await pairIdentifiers(n.nonce, logins, accessToken, __privateGet(this, _env));
+  }
+  prepare(signer) {
+    __privateMethod(this, _assertSIWE, assertSIWE_fn).call(this, __privateGet(this, _type), __privateGet(this, _sdk));
+    __privateGet(this, _sdk).prepare(signer);
+  }
+};
+_type = new WeakMap();
+_env = new WeakMap();
+_sdk = new WeakMap();
+_assertSIWE = new WeakSet();
+assertSIWE_fn = function(type, sdk) {
+  if (type === "SiWE" /* SiWE */) {
+    return;
+  }
+  throw new UnsupportedAuthTypeError(
+    "This method is only available via SIWE auth type"
+  );
+};
+
+export {
+  JwtBearerAuth
+};
+//# sourceMappingURL=chunk-FCT2LIGH.mjs.map

package/dist/chunk-FCT2LIGH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication.ts"],"sourcesContent":["import { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe';\nimport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp';\nimport {\n  getNonce,\n  pairIdentifiers,\n} from './authentication-jwt-bearer/services';\nimport type { UserProfile, Pair } from './authentication-jwt-bearer/types';\nimport { AuthType } from './authentication-jwt-bearer/types';\nimport type { Env } from './env';\nimport { PairError, UnsupportedAuthTypeError } from './errors';\n\n// Computing the Classes, so we only get back the public methods for the interface.\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype Compute<T> = T extends infer U ? { [K in keyof U]: U[K] } : never;\ntype SIWEInterface = Compute<SIWEJwtBearerAuth>;\ntype SRPInterface = Compute<SRPJwtBearerAuth>;\n\ntype SiweParams = ConstructorParameters<typeof SIWEJwtBearerAuth>;\ntype SRPParams = ConstructorParameters<typeof SRPJwtBearerAuth>;\ntype JwtBearerAuthParams = SiweParams | SRPParams;\n\nexport class JwtBearerAuth implements SIWEInterface, SRPInterface {\n  #type: AuthType;\n\n  #env: Env;\n\n  #sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth;\n\n  constructor(...args: JwtBearerAuthParams) {\n    this.#type = args[0].type;\n    this.#env = args[0].env;\n\n    if (args[0].type === AuthType.SRP) {\n      this.#sdk = new SRPJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    if (args[0].type === AuthType.SiWE) {\n      this.#sdk = new SIWEJwtBearerAuth(args[0], args[1]);\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError('unsupported auth type');\n  }\n\n  async getAccessToken(): Promise<string> {\n    return await this.#sdk.getAccessToken();\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    return await this.#sdk.getUserProfile();\n  }\n\n  async getIdentifier(): Promise<string> {\n    return await this.#sdk.getIdentifier();\n  }\n\n  async signMessage(message: string): Promise<string> {\n    return await this.#sdk.signMessage(message);\n  }\n\n  async pairIdentifiers(pairing: Pair[]): Promise<void> {\n    const profile = await this.getUserProfile();\n    const n = await getNonce(profile.profileId, this.#env);\n\n    const logins = await Promise.all(\n      pairing.map(async (p) => {\n        try {\n          const raw = `metamask:${n.nonce}:${p.identifier}`;\n          const sig = await p.signMessage(raw);\n          return {\n            signature: sig,\n            // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n            // eslint-disable-next-line @typescript-eslint/naming-convention\n            raw_message: raw,\n            // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n            // eslint-disable-next-line @typescript-eslint/naming-convention\n            encrypted_storage_key: p.encryptedStorageKey,\n            // TODO: Either fix this lint violation or explain why it's necessary to ignore.\n            // eslint-disable-next-line @typescript-eslint/naming-convention\n            identifier_type: p.identifierType,\n          };\n        } catch (e) {\n          /* istanbul ignore next */\n          const errorMessage =\n            e instanceof Error ? e.message : JSON.stringify(e ?? '');\n          throw new PairError(\n            `failed to sign pairing message: ${errorMessage}`,\n          );\n        }\n      }),\n    );\n\n    const accessToken = await this.getAccessToken();\n    await pairIdentifiers(n.nonce, logins, accessToken, this.#env);\n  }\n\n  prepare(signer: {\n    address: string;\n    chainId: number;\n    signMessage: (message: string) => Promise<string>;\n    domain: string;\n  }): void {\n    this.#assertSIWE(this.#type, this.#sdk);\n    this.#sdk.prepare(signer);\n  }\n\n  #assertSIWE(\n    type: AuthType,\n    sdk: SIWEJwtBearerAuth | SRPJwtBearerAuth,\n  ): asserts sdk is SIWEJwtBearerAuth {\n    if (type === AuthType.SiWE) {\n      return;\n    }\n\n    throw new UnsupportedAuthTypeError(\n      'This method is only available via SIWE auth type',\n    );\n  }\n}\n\nexport { SIWEJwtBearerAuth } from './authentication-jwt-bearer/flow-siwe';\nexport { SRPJwtBearerAuth } from './authentication-jwt-bearer/flow-srp';\nexport * from './authentication-jwt-bearer/types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAsBO,IAAM,gBAAN,MAA2D;AAAA,EAOhE,eAAe,MAA2B;AA+E1C;AArFA;AAEA;AAEA;AAGE,uBAAK,OAAQ,KAAK,CAAC,EAAE;AACrB,uBAAK,MAAO,KAAK,CAAC,EAAE;AAEpB,QAAI,KAAK,CAAC,EAAE,0BAAuB;AACjC,yBAAK,MAAO,IAAI,iBAAiB,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC;AACjD;AAAA,IACF;AAEA,QAAI,KAAK,CAAC,EAAE,4BAAwB;AAClC,yBAAK,MAAO,IAAI,kBAAkB,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC;AAClD;AAAA,IACF;AAEA,UAAM,IAAI,yBAAyB,uBAAuB;AAAA,EAC5D;AAAA,EAEA,MAAM,iBAAkC;AACtC,WAAO,MAAM,mBAAK,MAAK,eAAe;AAAA,EACxC;AAAA,EAEA,MAAM,iBAAuC;AAC3C,WAAO,MAAM,mBAAK,MAAK,eAAe;AAAA,EACxC;AAAA,EAEA,MAAM,gBAAiC;AACrC,WAAO,MAAM,mBAAK,MAAK,cAAc;AAAA,EACvC;AAAA,EAEA,MAAM,YAAY,SAAkC;AAClD,WAAO,MAAM,mBAAK,MAAK,YAAY,OAAO;AAAA,EAC5C;AAAA,EAEA,MAAM,gBAAgB,SAAgC;AACpD,UAAM,UAAU,MAAM,KAAK,eAAe;AAC1C,UAAM,IAAI,MAAM,SAAS,QAAQ,WAAW,mBAAK,KAAI;AAErD,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,QAAQ,IAAI,OAAO,MAAM;AACvB,YAAI;AACF,gBAAM,MAAM,YAAY,EAAE,KAAK,IAAI,EAAE,UAAU;AAC/C,gBAAM,MAAM,MAAM,EAAE,YAAY,GAAG;AACnC,iBAAO;AAAA,YACL,WAAW;AAAA;AAAA;AAAA,YAGX,aAAa;AAAA;AAAA;AAAA,YAGb,uBAAuB,EAAE;AAAA;AAAA;AAAA,YAGzB,iBAAiB,EAAE;AAAA,UACrB;AAAA,QACF,SAAS,GAAG;AAEV,gBAAM,eACJ,aAAa,QAAQ,EAAE,UAAU,KAAK,UAAU,KAAK,EAAE;AACzD,gBAAM,IAAI;AAAA,YACR,mCAAmC,YAAY;AAAA,UACjD;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,KAAK,eAAe;AAC9C,UAAM,gBAAgB,EAAE,OAAO,QAAQ,aAAa,mBAAK,KAAI;AAAA,EAC/D;AAAA,EAEA,QAAQ,QAKC;AACP,0BAAK,4BAAL,WAAiB,mBAAK,QAAO,mBAAK;AAClC,uBAAK,MAAK,QAAQ,MAAM;AAAA,EAC1B;AAcF;AAjGE;AAEA;AAEA;AAiFA;AAAA,gBAAW,SACT,MACA,KACkC;AAClC,MAAI,4BAAwB;AAC1B;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-FQ5SDMRE.mjs

@@ -0,0 +1,77 @@
+// src/sdk/env.ts
+var Env = /* @__PURE__ */ ((Env2) => {
+  Env2["DEV"] = "dev";
+  Env2["UAT"] = "uat";
+  Env2["PRD"] = "prd";
+  return Env2;
+})(Env || {});
+var Platform = /* @__PURE__ */ ((Platform2) => {
+  Platform2["MOBILE"] = "mobile";
+  Platform2["EXTENSION"] = "extension";
+  Platform2["PORTFOLIO"] = "portfolio";
+  Platform2["INFURA"] = "infura";
+  return Platform2;
+})(Platform || {});
+var ENV_URLS = {
+  dev: {
+    authApiUrl: "https://authentication.dev-api.cx.metamask.io",
+    oidcApiUrl: "https://oidc.dev-api.cx.metamask.io",
+    userStorageApiUrl: "https://user-storage.dev-api.cx.metamask.io"
+  },
+  uat: {
+    authApiUrl: "https://authentication.uat-api.cx.metamask.io",
+    oidcApiUrl: "https://oidc.uat-api.cx.metamask.io",
+    userStorageApiUrl: "https://user-storage.uat-api.cx.metamask.io"
+  },
+  prd: {
+    authApiUrl: "https://authentication.api.cx.metamask.io",
+    oidcApiUrl: "https://oidc.api.cx.metamask.io",
+    userStorageApiUrl: "https://user-storage.api.cx.metamask.io"
+  }
+};
+function getEnvUrls(env) {
+  if (!ENV_URLS[env]) {
+    throw new Error("invalid environment configuration");
+  }
+  return ENV_URLS[env];
+}
+function getOidcClientId(env, platform) {
+  const clientIds = {
+    ["dev" /* DEV */]: {
+      ["portfolio" /* PORTFOLIO */]: "c7ca94a0-5d52-4635-9502-1a50a9c410cc",
+      ["mobile" /* MOBILE */]: "e83c7cc9-267d-4fb4-8fec-f0e3bbe5ae8e",
+      ["extension" /* EXTENSION */]: "f1a963d7-50dc-4cb5-8d81-f1f3654f0df3",
+      ["infura" /* INFURA */]: "bd887006-0d55-481a-a395-5ff9a0dc52c9"
+    },
+    ["uat" /* UAT */]: {
+      ["portfolio" /* PORTFOLIO */]: "8f2dd4ac-db07-4819-9ba5-1ee0ec1b56d1",
+      ["mobile" /* MOBILE */]: "c3cfdcd2-51d6-4fae-ad2c-ff238c8fef53",
+      ["extension" /* EXTENSION */]: "a9de167c-c9a6-43d8-af39-d301fd44c485",
+      ["infura" /* INFURA */]: "01929890-7002-4c97-9913-8f6c09a6d674"
+    },
+    ["prd" /* PRD */]: {
+      ["portfolio" /* PORTFOLIO */]: "35e1cd62-49c5-4be8-8b6e-a5212f2d2cfb",
+      ["mobile" /* MOBILE */]: "75fa62a3-9ca0-4b91-9fe5-76bec86b0257",
+      ["extension" /* EXTENSION */]: "1132f10a-b4e5-4390-a5f2-d9c6022db564",
+      ["infura" /* INFURA */]: ""
+      // unset
+    }
+  };
+  if (!clientIds[env]) {
+    throw new Error(`invalid env ${env}: cannot determine oidc client id`);
+  }
+  if (!clientIds[env][platform]) {
+    throw new Error(
+      `invalid env ${env} and platform ${platform} combination: cannot determine oidc client id`
+    );
+  }
+  return clientIds[env][platform];
+}
+
+export {
+  Env,
+  Platform,
+  getEnvUrls,
+  getOidcClientId
+};
+//# sourceMappingURL=chunk-FQ5SDMRE.mjs.map

package/dist/chunk-FQ5SDMRE.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/env.ts"],"sourcesContent":["export enum Env {\n  DEV = 'dev',\n  UAT = 'uat',\n  PRD = 'prd',\n}\n\nexport enum Platform {\n  MOBILE = 'mobile',\n  EXTENSION = 'extension',\n  PORTFOLIO = 'portfolio',\n  INFURA = 'infura',\n}\n\ntype EnvUrlsEntry = {\n  authApiUrl: string;\n  oidcApiUrl: string;\n  userStorageApiUrl: string;\n};\n\nconst ENV_URLS: Record<Env, EnvUrlsEntry> = {\n  dev: {\n    authApiUrl: 'https://authentication.dev-api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.dev-api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.dev-api.cx.metamask.io',\n  },\n  uat: {\n    authApiUrl: 'https://authentication.uat-api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.uat-api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.uat-api.cx.metamask.io',\n  },\n  prd: {\n    authApiUrl: 'https://authentication.api.cx.metamask.io',\n    oidcApiUrl: 'https://oidc.api.cx.metamask.io',\n    userStorageApiUrl: 'https://user-storage.api.cx.metamask.io',\n  },\n};\n\n/**\n * Validates and returns correct environment endpoints\n *\n * @param env - environment field\n * @returns the correct environment url\n * @throws on invalid environment passed\n */\nexport function getEnvUrls(env: Env): EnvUrlsEntry {\n  if (!ENV_URLS[env]) {\n    throw new Error('invalid environment configuration');\n  }\n  return ENV_URLS[env];\n}\n\n/**\n * Returns the valid OIDC Client ID (used during authorization)\n *\n * @param env - environment field\n * @param platform - platform field\n * @returns the OIDC client id for the environment\n */\nexport function getOidcClientId(env: Env, platform: Platform): string {\n  const clientIds = {\n    [Env.DEV]: {\n      [Platform.PORTFOLIO]: 'c7ca94a0-5d52-4635-9502-1a50a9c410cc',\n      [Platform.MOBILE]: 'e83c7cc9-267d-4fb4-8fec-f0e3bbe5ae8e',\n      [Platform.EXTENSION]: 'f1a963d7-50dc-4cb5-8d81-f1f3654f0df3',\n      [Platform.INFURA]: 'bd887006-0d55-481a-a395-5ff9a0dc52c9',\n    },\n    [Env.UAT]: {\n      [Platform.PORTFOLIO]: '8f2dd4ac-db07-4819-9ba5-1ee0ec1b56d1',\n      [Platform.MOBILE]: 'c3cfdcd2-51d6-4fae-ad2c-ff238c8fef53',\n      [Platform.EXTENSION]: 'a9de167c-c9a6-43d8-af39-d301fd44c485',\n      [Platform.INFURA]: '01929890-7002-4c97-9913-8f6c09a6d674',\n    },\n    [Env.PRD]: {\n      [Platform.PORTFOLIO]: '35e1cd62-49c5-4be8-8b6e-a5212f2d2cfb',\n      [Platform.MOBILE]: '75fa62a3-9ca0-4b91-9fe5-76bec86b0257',\n      [Platform.EXTENSION]: '1132f10a-b4e5-4390-a5f2-d9c6022db564',\n      [Platform.INFURA]: '', // unset\n    },\n  };\n\n  if (!clientIds[env]) {\n    throw new Error(`invalid env ${env}: cannot determine oidc client id`);\n  }\n\n  if (!clientIds[env][platform]) {\n    throw new Error(\n      `invalid env ${env} and platform ${platform} combination: cannot determine oidc client id`,\n    );\n  }\n\n  return clientIds[env][platform];\n}\n"],"mappings":";AAAO,IAAK,MAAL,kBAAKA,SAAL;AACL,EAAAA,KAAA,SAAM;AACN,EAAAA,KAAA,SAAM;AACN,EAAAA,KAAA,SAAM;AAHI,SAAAA;AAAA,GAAA;AAML,IAAK,WAAL,kBAAKC,cAAL;AACL,EAAAA,UAAA,YAAS;AACT,EAAAA,UAAA,eAAY;AACZ,EAAAA,UAAA,eAAY;AACZ,EAAAA,UAAA,YAAS;AAJC,SAAAA;AAAA,GAAA;AAaZ,IAAM,WAAsC;AAAA,EAC1C,KAAK;AAAA,IACH,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,KAAK;AAAA,IACH,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,KAAK;AAAA,IACH,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AACF;AASO,SAAS,WAAW,KAAwB;AACjD,MAAI,CAAC,SAAS,GAAG,GAAG;AAClB,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AACA,SAAO,SAAS,GAAG;AACrB;AASO,SAAS,gBAAgB,KAAU,UAA4B;AACpE,QAAM,YAAY;AAAA,IAChB,CAAC,eAAO,GAAG;AAAA,MACT,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,MACnB,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,IACrB;AAAA,IACA,CAAC,eAAO,GAAG;AAAA,MACT,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,MACnB,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,IACrB;AAAA,IACA,CAAC,eAAO,GAAG;AAAA,MACT,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA,MACnB,CAAC,2BAAkB,GAAG;AAAA,MACtB,CAAC,qBAAe,GAAG;AAAA;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,UAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;AAAA,EACvE;AAEA,MAAI,CAAC,UAAU,GAAG,EAAE,QAAQ,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR,eAAe,GAAG,iBAAiB,QAAQ;AAAA,IAC7C;AAAA,EACF;AAEA,SAAO,UAAU,GAAG,EAAE,QAAQ;AAChC;","names":["Env","Platform"]}

package/dist/chunk-H25EBXG5.mjs

@@ -0,0 +1,58 @@
+import {
+  base64ToByteArray,
+  byteArrayToBase64
+} from "./chunk-76VRE4BI.mjs";
+
+// src/controllers/user-storage/encryption/cache.ts
+var MAX_PASSWORD_CACHES = 3;
+var MAX_SALT_CACHES = 10;
+var inMemCachedKDF = {};
+var getPasswordCache = (hashedPassword) => {
+  inMemCachedKDF[hashedPassword] ?? (inMemCachedKDF[hashedPassword] = /* @__PURE__ */ new Map());
+  return inMemCachedKDF[hashedPassword];
+};
+function getCachedKeyBySalt(hashedPassword, salt) {
+  const cache = getPasswordCache(hashedPassword);
+  const base64Salt = byteArrayToBase64(salt);
+  const cachedKey = cache.get(base64Salt);
+  if (!cachedKey) {
+    return void 0;
+  }
+  return {
+    salt,
+    base64Salt,
+    key: cachedKey
+  };
+}
+function getAnyCachedKey(hashedPassword) {
+  const cache = getPasswordCache(hashedPassword);
+  const cachedEntry = cache.entries().next().value;
+  if (!cachedEntry) {
+    return void 0;
+  }
+  const base64Salt = cachedEntry[0];
+  const bytesSalt = base64ToByteArray(base64Salt);
+  return {
+    salt: bytesSalt,
+    base64Salt,
+    key: cachedEntry[1]
+  };
+}
+function setCachedKey(hashedPassword, salt, key) {
+  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {
+    inMemCachedKDF = {};
+  }
+  const cache = getPasswordCache(hashedPassword);
+  const base64Salt = byteArrayToBase64(salt);
+  if (cache.size > MAX_SALT_CACHES) {
+    cache.clear();
+  }
+  cache.set(base64Salt, key);
+}
+
+export {
+  getCachedKeyBySalt,
+  getAnyCachedKey,
+  setCachedKey
+};
+//# sourceMappingURL=chunk-H25EBXG5.mjs.map

package/dist/chunk-H25EBXG5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/user-storage/encryption/cache.ts"],"sourcesContent":["import { base64ToByteArray, byteArrayToBase64 } from './utils';\n\ntype CachedEntry = {\n  salt: Uint8Array;\n  base64Salt: string;\n  key: Uint8Array;\n};\n\nconst MAX_PASSWORD_CACHES = 3;\nconst MAX_SALT_CACHES = 10;\n\n/**\n * In-Memory Caching derived keys based from a given salt and password.\n */\ntype PasswordMemCachedKDF = {\n  [hashedPassword: string]: Map<string, Uint8Array>;\n};\nlet inMemCachedKDF: PasswordMemCachedKDF = {};\nconst getPasswordCache = (hashedPassword: string) => {\n  inMemCachedKDF[hashedPassword] ??= new Map();\n  return inMemCachedKDF[hashedPassword];\n};\n\n/**\n * Returns a given cached derived key from a hashed password and salt\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - provide salt to receive cached key\n * @returns cached key\n */\nexport function getCachedKeyBySalt(\n  hashedPassword: string,\n  salt: Uint8Array,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n  const cachedKey = cache.get(base64Salt);\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Gets any cached key for a given hashed password\n *\n * @param hashedPassword - hashed password for cache lookup\n * @returns any (the first) cached key\n */\nexport function getAnyCachedKey(\n  hashedPassword: string,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n\n  // Takes 1 item from an Iterator via Map.entries()\n  const cachedEntry: [string, Uint8Array] | undefined = cache\n    .entries()\n    .next().value;\n\n  if (!cachedEntry) {\n    return undefined;\n  }\n\n  const base64Salt = cachedEntry[0];\n  const bytesSalt = base64ToByteArray(base64Salt);\n  return {\n    salt: bytesSalt,\n    base64Salt,\n    key: cachedEntry[1],\n  };\n}\n\n/**\n * Sets a key to the in memory cache.\n * We have set an arbitrary size of 10 cached keys per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - salt to set new derived key\n * @param key - derived key we are setting\n */\nexport function setCachedKey(\n  hashedPassword: string,\n  salt: Uint8Array,\n  key: Uint8Array,\n): void {\n  // Max password caches\n  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {\n    inMemCachedKDF = {};\n  }\n\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n\n  // Max salt caches\n  if (cache.size > MAX_SALT_CACHES) {\n    cache.clear();\n  }\n\n  cache.set(base64Salt, key);\n}\n"],"mappings":";;;;;;AAQA,IAAM,sBAAsB;AAC5B,IAAM,kBAAkB;AAQxB,IAAI,iBAAuC,CAAC;AAC5C,IAAM,mBAAmB,CAAC,mBAA2B;AACnD,sEAAmC,oBAAI,IAAI;AAC3C,SAAO,eAAe,cAAc;AACtC;AASO,SAAS,mBACd,gBACA,MACyB;AACzB,QAAM,QAAQ,iBAAiB,cAAc;AAC7C,QAAM,aAAa,kBAAkB,IAAI;AACzC,QAAM,YAAY,MAAM,IAAI,UAAU;AACtC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP;AACF;AAQO,SAAS,gBACd,gBACyB;AACzB,QAAM,QAAQ,iBAAiB,cAAc;AAG7C,QAAM,cAAgD,MACnD,QAAQ,EACR,KAAK,EAAE;AAEV,MAAI,CAAC,aAAa;AAChB,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,YAAY,CAAC;AAChC,QAAM,YAAY,kBAAkB,UAAU;AAC9C,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,KAAK,YAAY,CAAC;AAAA,EACpB;AACF;AAUO,SAAS,aACd,gBACA,MACA,KACM;AAEN,MAAI,OAAO,KAAK,cAAc,EAAE,SAAS,qBAAqB;AAC5D,qBAAiB,CAAC;AAAA,EACpB;AAEA,QAAM,QAAQ,iBAAiB,cAAc;AAC7C,QAAM,aAAa,kBAAkB,IAAI;AAGzC,MAAI,MAAM,OAAO,iBAAiB;AAChC,UAAM,MAAM;AAAA,EACd;AAEA,QAAM,IAAI,YAAY,GAAG;AAC3B;","names":[]}

package/dist/chunk-H4TDS65R.js

@@ -0,0 +1,81 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _chunkYASNOFBVjs = require('./chunk-YASNOFBV.js');
+
+
+var _chunk5SXXO4MVjs = require('./chunk-5SXXO4MV.js');
+
+
+var _chunkB6CSNLGEjs = require('./chunk-B6CSNLGE.js');
+
+
+var _chunkAK7OTIWAjs = require('./chunk-AK7OTIWA.js');
+
+
+
+var _chunkT3FNDVE3js = require('./chunk-T3FNDVE3.js');
+
+
+var _chunkIGY2S5BCjs = require('./chunk-IGY2S5BC.js');
+
+// src/controllers/user-storage/index.ts
+var user_storage_exports = {};
+_chunkIGY2S5BCjs.__export.call(void 0, user_storage_exports, {
+  Controller: () => _chunkYASNOFBVjs.UserStorageController,
+  Encryption: () => _chunkT3FNDVE3js.encryption_default,
+  Mocks: () => fixtures_exports,
+  createSHA256Hash: () => _chunkT3FNDVE3js.createSHA256Hash,
+  defaultState: () => _chunkYASNOFBVjs.defaultState
+});
+
+// src/controllers/user-storage/__fixtures__/index.ts
+var fixtures_exports = {};
+_chunkIGY2S5BCjs.__export.call(void 0, fixtures_exports, {
+  MOCK_ENCRYPTED_STORAGE_DATA: () => MOCK_ENCRYPTED_STORAGE_DATA,
+  MOCK_STORAGE_DATA: () => MOCK_STORAGE_DATA,
+  MOCK_STORAGE_KEY: () => MOCK_STORAGE_KEY,
+  MOCK_STORAGE_KEY_SIGNATURE: () => MOCK_STORAGE_KEY_SIGNATURE,
+  MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT: () => MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT,
+  getMockUserStorageGetResponse: () => getMockUserStorageGetResponse,
+  getMockUserStoragePutResponse: () => getMockUserStoragePutResponse
+});
+
+// src/controllers/user-storage/__fixtures__/mockStorage.ts
+var MOCK_STORAGE_KEY_SIGNATURE = "mockStorageKey";
+var MOCK_STORAGE_KEY = _chunkT3FNDVE3js.createSHA256Hash.call(void 0, MOCK_STORAGE_KEY_SIGNATURE);
+var MOCK_STORAGE_DATA = JSON.stringify({ hello: "world" });
+var MOCK_ENCRYPTED_STORAGE_DATA = _chunkAK7OTIWAjs.encryption_default.encryptString(
+  MOCK_STORAGE_DATA,
+  MOCK_STORAGE_KEY
+);
+
+// src/controllers/user-storage/__fixtures__/mockResponses.ts
+var MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT = `${_chunk5SXXO4MVjs.USER_STORAGE_ENDPOINT}${_chunkB6CSNLGEjs.createEntryPath.call(void 0, 
+  "notificationSettings",
+  MOCK_STORAGE_KEY
+)}`;
+var MOCK_GET_USER_STORAGE_RESPONSE = {
+  HashedKey: "HASHED_KEY",
+  Data: MOCK_ENCRYPTED_STORAGE_DATA
+};
+var getMockUserStorageGetResponse = () => {
+  return {
+    url: MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT,
+    requestMethod: "GET",
+    response: MOCK_GET_USER_STORAGE_RESPONSE
+  };
+};
+var getMockUserStoragePutResponse = () => {
+  return {
+    url: MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT,
+    requestMethod: "PUT",
+    response: null
+  };
+};
+
+
+
+
+exports.fixtures_exports = fixtures_exports; exports.user_storage_exports = user_storage_exports;
+//# sourceMappingURL=chunk-H4TDS65R.js.map

package/dist/chunk-H4TDS65R.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/user-storage/index.ts","../src/controllers/user-storage/__fixtures__/index.ts","../src/controllers/user-storage/__fixtures__/mockStorage.ts","../src/controllers/user-storage/__fixtures__/mockResponses.ts"],"names":["encryption_default"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,6BAA6B;AACnC,IAAM,mBAAmB,iBAAiB,0BAA0B;AACpE,IAAM,oBAAoB,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAC3D,IAAM,8BAA8BA,oBAAW;AAAA,EACpD;AAAA,EACA;AACF;;;ACGO,IAAM,2CAA2C,GAAG,qBAAqB,GAAG;AAAA,EACjF;AAAA,EACA;AACF,CAAC;AAED,IAAM,iCAAyD;AAAA,EAC7D,WAAW;AAAA,EACX,MAAM;AACR;AAEO,IAAM,gCAAgC,MAAM;AACjD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,eAAe;AAAA,IACf,UAAU;AAAA,EACZ;AACF;AAEO,IAAM,gCAAgC,MAAM;AACjD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,eAAe;AAAA,IACf,UAAU;AAAA,EACZ;AACF","sourcesContent":["import Controller from './UserStorageController';\n\nexport { Controller };\nexport * from './UserStorageController';\nexport * from './encryption';\nexport * as Mocks from './__fixtures__';\n","export * from './mockResponses';\nexport * from './mockStorage';\n","import encryption, { createSHA256Hash } from '../encryption';\n\nexport const MOCK_STORAGE_KEY_SIGNATURE = 'mockStorageKey';\nexport const MOCK_STORAGE_KEY = createSHA256Hash(MOCK_STORAGE_KEY_SIGNATURE);\nexport const MOCK_STORAGE_DATA = JSON.stringify({ hello: 'world' });\nexport const MOCK_ENCRYPTED_STORAGE_DATA = encryption.encryptString(\n  MOCK_STORAGE_DATA,\n  MOCK_STORAGE_KEY,\n);\n","import { createEntryPath } from '../schema';\nimport type { GetUserStorageResponse } from '../services';\nimport { USER_STORAGE_ENDPOINT } from '../services';\nimport { MOCK_ENCRYPTED_STORAGE_DATA, MOCK_STORAGE_KEY } from './mockStorage';\n\ntype MockResponse = {\n  url: string;\n  requestMethod: 'GET' | 'POST' | 'PUT';\n  response: unknown;\n};\n\nexport const MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT = `${USER_STORAGE_ENDPOINT}${createEntryPath(\n  'notificationSettings',\n  MOCK_STORAGE_KEY,\n)}`;\n\nconst MOCK_GET_USER_STORAGE_RESPONSE: GetUserStorageResponse = {\n  HashedKey: 'HASHED_KEY',\n  Data: MOCK_ENCRYPTED_STORAGE_DATA,\n};\n\nexport const getMockUserStorageGetResponse = () => {\n  return {\n    url: MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT,\n    requestMethod: 'GET',\n    response: MOCK_GET_USER_STORAGE_RESPONSE,\n  } satisfies MockResponse;\n};\n\nexport const getMockUserStoragePutResponse = () => {\n  return {\n    url: MOCK_USER_STORAGE_NOTIFICATIONS_ENDPOINT,\n    requestMethod: 'PUT',\n    response: null,\n  } satisfies MockResponse;\n};\n"]}

package/dist/{chunk-Z4BLTVTB.js → chunk-IGY2S5BC.js}

@@ -1,4 +1,9 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});var __accessCheck = (obj, member, msg) => {
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __accessCheck = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
@@ -26,5 +31,6 @@ var __privateMethod = (obj, member, method) => {
 
 
 
-exports.__privateGet = __privateGet; exports.__privateAdd = __privateAdd; exports.__privateSet = __privateSet; exports.__privateMethod = __privateMethod;
-//# sourceMappingURL=chunk-Z4BLTVTB.js.map
+
+exports.__export = __export; exports.__privateGet = __privateGet; exports.__privateAdd = __privateAdd; exports.__privateSet = __privateSet; exports.__privateMethod = __privateMethod;
+//# sourceMappingURL=chunk-IGY2S5BC.js.map

package/dist/chunk-IPSBQ3MS.js

@@ -0,0 +1,30 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/controllers/authentication/auth-snap-requests.ts
+var _snapsutils = require('@metamask/snaps-utils');
+var snapId = "npm:@metamask/message-signing-snap";
+function createSnapPublicKeyRequest() {
+  return {
+    snapId,
+    origin: "",
+    handler: _snapsutils.HandlerType.OnRpcRequest,
+    request: {
+      method: "getPublicKey"
+    }
+  };
+}
+function createSnapSignMessageRequest(message) {
+  return {
+    snapId,
+    origin: "",
+    handler: _snapsutils.HandlerType.OnRpcRequest,
+    request: {
+      method: "signMessage",
+      params: { message }
+    }
+  };
+}
+
+
+
+
+exports.createSnapPublicKeyRequest = createSnapPublicKeyRequest; exports.createSnapSignMessageRequest = createSnapSignMessageRequest;
+//# sourceMappingURL=chunk-IPSBQ3MS.js.map

package/dist/chunk-IPSBQ3MS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/controllers/authentication/auth-snap-requests.ts"],"names":[],"mappings":";AAEA,SAAS,mBAAmB;AAI5B,IAAM,SAAS;AAOR,SAAS,6BAA6C;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,SAAS,YAAY;AAAA,IACrB,SAAS;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAQO,SAAS,6BACd,SACgB;AAChB,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,SAAS,YAAY;AAAA,IACrB,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ,EAAE,QAAQ;AAAA,IACpB;AAAA,EACF;AACF","sourcesContent":["import type { HandleSnapRequest } from '@metamask/snaps-controllers';\nimport type { SnapId } from '@metamask/snaps-sdk';\nimport { HandlerType } from '@metamask/snaps-utils';\n\ntype SnapRPCRequest = Parameters<HandleSnapRequest['handler']>[0];\n\nconst snapId = 'npm:@metamask/message-signing-snap' as SnapId;\n\n/**\n * Constructs Request to Message Signing Snap to get Public Key\n *\n * @returns Snap Public Key Request\n */\nexport function createSnapPublicKeyRequest(): SnapRPCRequest {\n  return {\n    snapId,\n    origin: '',\n    handler: HandlerType.OnRpcRequest,\n    request: {\n      method: 'getPublicKey',\n    },\n  };\n}\n\n/**\n * Constructs Request to get Message Signing Snap to sign a message.\n *\n * @param message - message to sign\n * @returns Snap Sign Message Request\n */\nexport function createSnapSignMessageRequest(\n  message: `metamask:${string}`,\n): SnapRPCRequest {\n  return {\n    snapId,\n    origin: '',\n    handler: HandlerType.OnRpcRequest,\n    request: {\n      method: 'signMessage',\n      params: { message },\n    },\n  };\n}\n"]}

package/dist/{chunk-4NGEEDGV.mjs → chunk-JLDFMYAH.mjs}

@@ -3,25 +3,23 @@ import {
   authenticate,
   authorizeOIDC,
   getNonce
-} from "./chunk-CYGZ4WLJ.mjs";
+} from "./chunk-WB6MUIML.mjs";
 import {
   ValidationError
-} from "./chunk-BHVT2QEA.mjs";
-import {
-  SESSION_LIFETIME_MS
-} from "./chunk-KKRIOEXD.mjs";
+} from "./chunk-TFFQFIJV.mjs";
 import {
   __privateAdd,
   __privateGet,
   __privateMethod,
   __privateSet
-} from "./chunk-XUI43LEZ.mjs";
+} from "./chunk-U5UIDVOO.mjs";
 
 // src/sdk/authentication-jwt-bearer/flow-siwe.ts
 import { SiweMessage } from "siwe";
 var _config, _options, _signer, _getAuthSession, getAuthSession_fn, _login, login_fn, _createSiWELoginRawMessage, createSiWELoginRawMessage_fn, _assertSigner, assertSigner_fn;
 var SIWEJwtBearerAuth = class {
   constructor(config, options) {
+    // convert expiresIn from seconds to milliseconds and use 90% of expiresIn
     __privateAdd(this, _getAuthSession);
     __privateAdd(this, _login);
     __privateAdd(this, _createSiWELoginRawMessage);
@@ -71,7 +69,8 @@ getAuthSession_fn = async function() {
   }
   const currentTime = Date.now();
   const sessionAge = currentTime - auth.token.obtainedAt;
-  if (sessionAge < SESSION_LIFETIME_MS) {
+  const refreshThreshold = auth.token.expiresIn * 1e3 * 0.9;
+  if (sessionAge < refreshThreshold) {
     return auth;
   }
   return null;
@@ -91,7 +90,8 @@ login_fn = async function() {
   );
   const tokenResponse = await authorizeOIDC(
     authResponse.token,
-    __privateGet(this, _config).env
+    __privateGet(this, _config).env,
+    __privateGet(this, _config).platform
   );
   const result = {
     profile: authResponse.profile,
@@ -123,4 +123,4 @@ assertSigner_fn = function(signer) {
 export {
   SIWEJwtBearerAuth
 };
-//# sourceMappingURL=chunk-4NGEEDGV.mjs.map
+//# sourceMappingURL=chunk-JLDFMYAH.mjs.map

package/dist/chunk-JLDFMYAH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/authentication-jwt-bearer/flow-siwe.ts"],"sourcesContent":["import { SiweMessage } from 'siwe';\n\nimport { ValidationError } from '../errors';\nimport {\n  SIWE_LOGIN_URL,\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n} from './services';\nimport type {\n  AuthConfig,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n} from './types';\n\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype JwtBearerAuth_SIWE_Options = {\n  storage: AuthStorageOptions;\n};\n\n// TODO: Either fix this lint violation or explain why it's necessary to ignore.\n// eslint-disable-next-line @typescript-eslint/naming-convention\ntype JwtBearerAuth_SIWE_Signer = {\n  address: string;\n  chainId: number;\n  signMessage: (message: string) => Promise<string>;\n  domain: string;\n};\n\nexport class SIWEJwtBearerAuth implements IBaseAuth {\n  #config: AuthConfig;\n\n  #options: JwtBearerAuth_SIWE_Options;\n\n  #signer: JwtBearerAuth_SIWE_Signer | undefined;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SiWE },\n    options: JwtBearerAuth_SIWE_Options,\n  ) {\n    this.#config = config;\n    this.#options = options;\n  }\n\n  async getAccessToken(): Promise<string> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(): Promise<UserProfile> {\n    const session = await this.#getAuthSession();\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login();\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(): Promise<string> {\n    this.#assertSigner(this.#signer);\n    return this.#signer.address;\n  }\n\n  async signMessage(message: string): Promise<string> {\n    this.#assertSigner(this.#signer);\n    return await this.#signer.signMessage(message);\n  }\n\n  prepare(signer: JwtBearerAuth_SIWE_Signer) {\n    this.#signer = signer;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse();\n    if (!auth) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(): Promise<LoginResponse> {\n    this.#assertSigner(this.#signer);\n\n    // Nonce\n    const address = await this.getIdentifier();\n    const nonceRes = await getNonce(address, this.#config.env);\n    const rawMessage = this.#createSiWELoginRawMessage(nonceRes.nonce);\n    const signature = await this.signMessage(rawMessage);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n    );\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile: authResponse.profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result);\n\n    return result;\n  }\n\n  #createSiWELoginRawMessage(nonce: string): string {\n    this.#assertSigner(this.#signer);\n\n    return new SiweMessage({\n      domain: this.#signer?.domain,\n      address: this.#signer?.address,\n      uri: SIWE_LOGIN_URL(this.#config.env),\n      version: '1',\n      chainId: this.#signer?.chainId,\n      nonce,\n      issuedAt: new Date().toISOString(),\n    }).prepareMessage();\n  }\n\n  #assertSigner(\n    signer?: JwtBearerAuth_SIWE_Signer,\n  ): asserts signer is JwtBearerAuth_SIWE_Signer {\n    if (!signer) {\n      throw new ValidationError(`you must call 'prepare()' before logging in`);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,mBAAmB;AAA5B;AAiCO,IAAM,oBAAN,MAA6C;AAAA,EAOlD,YACE,QACA,SACA;AAwCF;AAAA,uBAAM;AAgBN,uBAAM;AAmCN;AAcA;AAlHA;AAEA;AAEA;AAME,uBAAK,SAAU;AACf,uBAAK,UAAW;AAAA,EAClB;AAAA,EAEA,MAAM,iBAAkC;AACtC,UAAM,UAAU,MAAM,sBAAK,oCAAL;AACtB,QAAI,SAAS;AACX,aAAO,QAAQ,MAAM;AAAA,IACvB;AAEA,UAAM,gBAAgB,MAAM,sBAAK,kBAAL;AAC5B,WAAO,cAAc,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAM,iBAAuC;AAC3C,UAAM,UAAU,MAAM,sBAAK,oCAAL;AACtB,QAAI,SAAS;AACX,aAAO,QAAQ;AAAA,IACjB;AAEA,UAAM,gBAAgB,MAAM,sBAAK,kBAAL;AAC5B,WAAO,cAAc;AAAA,EACvB;AAAA,EAEA,MAAM,gBAAiC;AACrC,0BAAK,gCAAL,WAAmB,mBAAK;AACxB,WAAO,mBAAK,SAAQ;AAAA,EACtB;AAAA,EAEA,MAAM,YAAY,SAAkC;AAClD,0BAAK,gCAAL,WAAmB,mBAAK;AACxB,WAAO,MAAM,mBAAK,SAAQ,YAAY,OAAO;AAAA,EAC/C;AAAA,EAEA,QAAQ,QAAmC;AACzC,uBAAK,SAAU;AAAA,EACjB;AA2EF;AAzHE;AAEA;AAEA;AA6CM;AAAA,oBAAe,iBAAkC;AACrD,QAAM,OAAO,MAAM,mBAAK,UAAS,QAAQ,iBAAiB;AAC1D,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK,IAAI;AAC7B,QAAM,aAAa,cAAc,KAAK,MAAM;AAC5C,QAAM,mBAAmB,KAAK,MAAM,YAAY,MAAO;AAEvD,MAAI,aAAa,kBAAkB;AACjC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEM;AAAA,WAAM,iBAA2B;AACrC,wBAAK,gCAAL,WAAmB,mBAAK;AAGxB,QAAM,UAAU,MAAM,KAAK,cAAc;AACzC,QAAM,WAAW,MAAM,SAAS,SAAS,mBAAK,SAAQ,GAAG;AACzD,QAAM,aAAa,sBAAK,0DAAL,WAAgC,SAAS;AAC5D,QAAM,YAAY,MAAM,KAAK,YAAY,UAAU;AAGnD,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,mBAAK,SAAQ;AAAA,IACb,mBAAK,SAAQ;AAAA,EACf;AAGA,QAAM,gBAAgB,MAAM;AAAA,IAC1B,aAAa;AAAA,IACb,mBAAK,SAAQ;AAAA,IACb,mBAAK,SAAQ;AAAA,EACf;AAGA,QAAM,SAAwB;AAAA,IAC5B,SAAS,aAAa;AAAA,IACtB,OAAO;AAAA,EACT;AAEA,QAAM,mBAAK,UAAS,QAAQ,iBAAiB,MAAM;AAEnD,SAAO;AACT;AAEA;AAAA,+BAA0B,SAAC,OAAuB;AAChD,wBAAK,gCAAL,WAAmB,mBAAK;AAExB,SAAO,IAAI,YAAY;AAAA,IACrB,QAAQ,mBAAK,UAAS;AAAA,IACtB,SAAS,mBAAK,UAAS;AAAA,IACvB,KAAK,eAAe,mBAAK,SAAQ,GAAG;AAAA,IACpC,SAAS;AAAA,IACT,SAAS,mBAAK,UAAS;AAAA,IACvB;AAAA,IACA,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC,EAAE,eAAe;AACpB;AAEA;AAAA,kBAAa,SACX,QAC6C;AAC7C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,gBAAgB,6CAA6C;AAAA,EACzE;AACF;","names":[]}