@metamask/profile-sync-controller 28.1.0 → 28.2.0

package/dist/controllers/user-storage/UserStorageController.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"UserStorageController.mjs","sourceRoot":"","sources":["../../../src/controllers/user-storage/UserStorageController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAQA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAW3D,OAAO,EAAE,YAAY,EAAE,qCAAqC;AAc5D,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,4BAAkB;AAE7C,OAAO,EAAE,UAAU,EAAE,2CAAuC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,iDAA6C;AAOpF,OAAO,EAAE,sBAAsB,EAAE,wBAAoB;AACrD,OAAO,EAAE,2BAA2B,EAAE,qDAAiD;AACvF,OAAO,EAAE,gCAAgC,EAAE,kDAA8C;AAGzF,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA0B/C,MAAM,CAAC,MAAM,YAAY,GAA+B;IACtD,sBAAsB,EAAE,IAAI;IAC5B,4BAA4B,EAAE,KAAK;IACnC,uBAAuB,EAAE,IAAI;IAC7B,uBAAuB,EAAE,IAAI;IAC7B,0BAA0B,EAAE,KAAK;CAClC,CAAC;AAEF,MAAM,QAAQ,GAA8C;IAC1D,sBAAsB,EAAE;QACtB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,4BAA4B,EAAE;QAC5B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,0BAA0B,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AA6BF,MAAM,yBAAyB,GAAG;IAChC,mBAAmB;IACnB,oCAAoC;IACpC,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,2BAA2B;IAC3B,eAAe;IACf,uCAAuC;IACvC,oBAAoB;IACpB,kCAAkC;IAClC,+BAA+B;IAC/B,6BAA6B;CACrB,CAAC;AAgDX;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,cAI1C;IAkDC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,kBAAkB,EAClB,KAAK,GAON;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QAnEI,qDAA0B;QAE1B,sCAAQ;YACf,YAAY,EAAE,KAAK,EAAE,eAAwB,EAAE,EAAE;gBAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9C,4CAA4C,EAC5C,eAAe,CAChB,CAAC;gBACF,OAAO,cAAc,EAAE,SAAS,CAAC;YACnC,CAAC;YACD,UAAU,EAAE,GAAG,EAAE;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,wCAAwC,CACzC,CAAC;YACJ,CAAC;SACF,EAAC;QAEO,wCAA4B;YACnC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,EAAC;QAEO,+CAAsB;QAE/B,4CAAc,KAAK,EAAC;QAEpB,iDAAyD,EAAE,EAAC;QAEnD,mDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,qCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,qCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,qCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QAEO,oDAAgD,SAAS,EAAC;QAEnE,eAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QA+P9B,uDAA+D,EAAE,EAAC;QAzOhE,uBAAA,IAAI,iCAAW;YACb,GAAG,uBAAA,IAAI,qCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QACF,uBAAA,IAAI,gCACF,KAAK;YACL,CAAC,KAAK,EACJ,QAAsB,EACtB,EAA2C,EACtB,EAAE;gBACvB,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,OAAO,SAAuB,CAAC;gBACjC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC,MAAA,CAAC;QAEL,uBAAA,IAAI,sCAAgB,IAAI,WAAW,CACjC;YACE,GAAG,EAAE,uBAAA,IAAI,qCAAQ,CAAC,GAAG;YACrB,IAAI,EAAE;gBACJ,cAAc,EAAE,CAAC,eAAwB,EAAE,EAAE,CAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,yCAAyC,EACzC,eAAe,CAChB;gBACH,cAAc,EAAE,KAAK,EAAE,eAAwB,EAAE,EAAE;oBACjD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,4CAA4C,EAC5C,eAAe,CAChB,CAAC;gBACJ,CAAC;gBACD,WAAW,EAAE,CAAC,OAAe,EAAE,eAAwB,EAAE,EAAE,CACzD,uBAAA,IAAI,gFAAiB,MAArB,IAAI,EACF,OAA+B,EAC/B,eAAe,CAChB;aACJ;SACF,EACD;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC/B,uBAAA,IAAI,8CAAiB,CAAC,OAAO,CAAC,IAAI,IAAI;gBACxC,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;oBACpC,uBAAA,IAAI,8CAAiB,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;gBACvC,CAAC;aACF;SACF,CACF,MAAA,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;QAEF,uBAAA,IAAI,gDAAmB,CAAC,6BAA6B,EAAE,CAAC;QACxD,uBAAA,IAAI,6CAAuB,kBAAkB,MAAA,CAAC;QAE9C,kBAAkB;QAClB,gCAAgC,CAAC;YAC/B,gCAAgC,EAAE,GAAG,EAAE,CAAC,IAAI;YAC5C,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YAClC,KAAK,EAAE,uBAAA,IAAI,oCAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAA6C,EAC7C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,OAAO,CAAC,IAAI,EAAE;YAC3C,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,kCAAkC,CAC7C,IAA2C,EAC3C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,kBAAkB,CAAC,IAAI,EAAE;YACtD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAA6C,EAC7C,KAAa,EACb,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,sBAAsB,CACjC,IAA2C,EAC3C,MAAgD,EAChD,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;YACzD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,oBAAoB,CAC/B,IAA6C,EAC7C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,UAAU,CAAC,IAAI,EAAE;YAC9C,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,qCAAqC,CAChD,IAA2C,EAC3C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,qBAAqB,CAAC,IAAI,EAAE;YACzD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAA2C,EAC3C,MAAsC,EACtC,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE;YAC5D,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa;QACxB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACI,oBAAoB;QACzB,uBAAA,IAAI,0CAAoB,EAAE,MAAA,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACvE,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;aAChE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAqCM,KAAK,CAAC,gCAAgC,CAC3C,OAA4C,EAC5C,OAAgB;QAEhB,IAAI,CAAC;YACH,uBAAA,IAAI,gGAAiC,MAArC,IAAI,EAAkC,IAAI,CAAC,CAAC;YAE5C,IAAI,OAAO,EAAE,CAAC;gBACZ,8EAA8E;gBAC9E,MAAM,UAAU,GAAG,uBAAA,IAAI,mCAAM,CAAC,UAAU,EAAE,CAAC;gBAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,uBAAA,IAAI,mCAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,IAAI,OAAO,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;oBAC5C,KAAK,CAAC,sBAAsB,GAAG,OAAO,CAAC;gBACzC,CAAC;gBAED,IAAI,OAAO,KAAK,sBAAsB,CAAC,cAAc,EAAE,CAAC;oBACtD,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC;gBAC1C,CAAC;gBAED,IAAI,OAAO,KAAK,sBAAsB,CAAC,cAAc,EAAE,CAAC;oBACtD,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,uBAAuB;YACvB,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,uBAAuB;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,gBAAgB,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,MAAM,YAAY,EAAE,CAC/F,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,uBAAA,IAAI,gGAAiC,MAArC,IAAI,EAAkC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAUD;;;;OAIG;IACH,KAAK,CAAC,6BAA6B,CACjC,0BAAmC;QAEnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,0BAA0B,GAAG,0BAA0B,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,2BAA2B;QAC/B,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,mCAAM,CAAC,YAAY,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG;YACb,gBAAgB,EAAE,GAAG,EAAE;gBACrB,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,gBAAgB,EAAE,GAAG,EAAE;gBACrB,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,+BAA+B,EAAE,CAC/B,YAAoB,EACpB,aAAuC,EACvC,EAAE;gBACF,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,+BAA+B,EAAE,CAC7D,SAAS,EACT,YAAY,EACZ,aAAa,CACd,CAAC;YACJ,CAAC;SACF,CAAC;QAEF,MAAM,2BAA2B,CAAC,MAAM,EAAE;YACxC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YAClC,gCAAgC,EAAE,GAAG,EAAE,CAAC,IAAI;YAC5C,KAAK,EAAE,uBAAA,IAAI,oCAAO;SACnB,CAAC,CAAC;IACL,CAAC;CACF;;AA/HC;;;;;;;GAOG;AACH,KAAK,iDACH,OAA6B,EAC7B,eAAwB;IAExB,kGAAkG;IAClG,IAAI,uBAAA,IAAI,oDAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,oDAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,4BAA4B,CAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,oDAAuB,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC,2HA2CC,4BAAqC;IAErC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,4BAA4B,GAAG,4BAA4B,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AddressBookControllerContactUpdatedEvent,\n  AddressBookControllerContactDeletedEvent,\n  AddressBookControllerActions,\n  AddressBookControllerListAction,\n  AddressBookControllerSetAction,\n  AddressBookControllerDeleteAction,\n} from '@metamask/address-book-controller';\nimport { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  TraceCallback,\n  TraceContext,\n  TraceRequest,\n} from '@metamask/controller-utils';\nimport { KeyringTypes } from '@metamask/keyring-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\n\nimport type {\n  UserStorageGenericFeatureKey,\n  UserStorageGenericPathWithFeatureAndKey,\n  UserStorageGenericPathWithFeatureOnly,\n} from '../../sdk';\nimport { Env, UserStorage } from '../../sdk';\nimport type { NativeScrypt } from '../../shared/types/encryption';\nimport { EventQueue } from '../../shared/utils/event-queue';\nimport { createSnapSignMessageRequest } from '../authentication/auth-snap-requests';\nimport type {\n  AuthenticationControllerGetBearerTokenAction,\n  AuthenticationControllerGetSessionProfileAction,\n  AuthenticationControllerIsSignedInAction,\n  AuthenticationControllerPerformSignInAction,\n} from '../authentication/AuthenticationController-method-action-types';\nimport { BACKUPANDSYNC_FEATURES } from './constants';\nimport { syncContactsWithUserStorage } from './contact-syncing/controller-integration';\nimport { setupContactSyncingSubscriptions } from './contact-syncing/setup-subscriptions';\nimport type { UserStorageControllerMethodActions } from './UserStorageController-method-action-types';\n\nconst controllerName = 'UserStorageController';\n\n// State\nexport type UserStorageControllerState = {\n  /**\n   * Condition used by UI and to determine if we can use some of the User Storage methods.\n   */\n  isBackupAndSyncEnabled: boolean;\n  /**\n   * Loading state for the backup and sync update\n   */\n  isBackupAndSyncUpdateLoading: boolean;\n  /**\n   * Condition used by UI to determine if account syncing is enabled.\n   */\n  isAccountSyncingEnabled: boolean;\n  /**\n   * Condition used by UI to determine if contact syncing is enabled.\n   */\n  isContactSyncingEnabled: boolean;\n  /**\n   * Condition used by UI to determine if contact syncing is in progress.\n   */\n  isContactSyncingInProgress: boolean;\n};\n\nexport const defaultState: UserStorageControllerState = {\n  isBackupAndSyncEnabled: true,\n  isBackupAndSyncUpdateLoading: false,\n  isAccountSyncingEnabled: true,\n  isContactSyncingEnabled: true,\n  isContactSyncingInProgress: false,\n};\n\nconst metadata: StateMetadata<UserStorageControllerState> = {\n  isBackupAndSyncEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isBackupAndSyncUpdateLoading: {\n    includeInStateLogs: false,\n    persist: false,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n  isAccountSyncingEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isContactSyncingEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isContactSyncingInProgress: {\n    includeInStateLogs: false,\n    persist: false,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n  contactSyncing?: {\n    /**\n     * Callback that fires when contact sync updates a contact.\n     * This is used for analytics.\n     */\n    onContactUpdated?: (profileId: string) => void;\n\n    /**\n     * Callback that fires when contact sync deletes a contact.\n     * This is used for analytics.\n     */\n    onContactDeleted?: (profileId: string) => void;\n\n    /**\n     * Callback that fires when an erroneous situation happens during contact sync.\n     * This is used for analytics.\n     */\n    onContactSyncErroneousSituation?: (\n      profileId: string,\n      situationMessage: string,\n      sentryContext?: Record<string, unknown>,\n    ) => void;\n  };\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performGetStorage',\n  'performGetStorageAllFeatureEntries',\n  'performSetStorage',\n  'performBatchSetStorage',\n  'performDeleteStorage',\n  'performBatchDeleteStorage',\n  'getStorageKey',\n  'performDeleteStorageAllFeatureEntries',\n  'listEntropySources',\n  'setIsBackupAndSyncFeatureEnabled',\n  'setIsContactSyncingInProgress',\n  'syncContactsWithUserStorage',\n] as const;\n\nexport type UserStorageControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  UserStorageControllerState\n>;\nexport type Actions =\n  | UserStorageControllerGetStateAction\n  | UserStorageControllerMethodActions;\n\nexport type AllowedActions =\n  // Keyring Requests\n  | KeyringControllerGetStateAction\n  // Snap Requests\n  | SnapControllerHandleRequestAction\n  // Auth Requests\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerIsSignedInAction\n  // Contact Syncing\n  | AddressBookControllerListAction\n  | AddressBookControllerSetAction\n  | AddressBookControllerDeleteAction\n  | AddressBookControllerActions;\n\n// Messenger events\nexport type UserStorageControllerStateChangeEvent = ControllerStateChangeEvent<\n  typeof controllerName,\n  UserStorageControllerState\n>;\n\nexport type Events = UserStorageControllerStateChangeEvent;\n\nexport type AllowedEvents =\n  | KeyringControllerLockEvent\n  | KeyringControllerUnlockEvent\n  // Address Book Events\n  | AddressBookControllerContactUpdatedEvent\n  | AddressBookControllerContactDeletedEvent;\n\n// Messenger\nexport type UserStorageControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Reusable controller that allows any team to store synchronized data for a given user.\n * These can be settings shared cross MetaMask clients, or data we want to persist when uninstalling/reinstalling.\n *\n * NOTE:\n * - data stored on UserStorage is FULLY encrypted, with the only keys stored/managed on the client.\n * - No one can access this data unless they are have the SRP and are able to run the signing snap.\n */\nexport class UserStorageController extends BaseController<\n  typeof controllerName,\n  UserStorageControllerState,\n  UserStorageControllerMessenger\n> {\n  readonly #userStorage: UserStorage;\n\n  readonly #auth = {\n    getProfileId: async (entropySourceId?: string) => {\n      const sessionProfile = await this.messenger.call(\n        'AuthenticationController:getSessionProfile',\n        entropySourceId,\n      );\n      return sessionProfile?.profileId;\n    },\n    isSignedIn: () => {\n      return this.messenger.call('AuthenticationController:isSignedIn');\n    },\n    signIn: async () => {\n      return await this.messenger.call(\n        'AuthenticationController:performSignIn',\n      );\n    },\n  };\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  readonly #trace: TraceCallback;\n\n  #isUnlocked = false;\n\n  #storageKeyCache: Record<`metamask:${string}`, string> = {};\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  readonly #nativeScryptCrypto: NativeScrypt | undefined = undefined;\n\n  eventQueue = new EventQueue();\n\n  constructor({\n    messenger,\n    state,\n    config,\n    nativeScryptCrypto,\n    trace,\n  }: {\n    messenger: UserStorageControllerMessenger;\n    state?: UserStorageControllerState;\n    config?: Partial<ControllerConfig>;\n    nativeScryptCrypto?: NativeScrypt;\n    trace?: TraceCallback;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n    this.#trace =\n      trace ??\n      (async <ReturnType>(\n        _request: TraceRequest,\n        fn?: (context?: TraceContext) => ReturnType,\n      ): Promise<ReturnType> => {\n        if (!fn) {\n          return undefined as ReturnType;\n        }\n        return await Promise.resolve(fn());\n      });\n\n    this.#userStorage = new UserStorage(\n      {\n        env: this.#config.env,\n        auth: {\n          getAccessToken: (entropySourceId?: string) =>\n            this.messenger.call(\n              'AuthenticationController:getBearerToken',\n              entropySourceId,\n            ),\n          getUserProfile: async (entropySourceId?: string) => {\n            return await this.messenger.call(\n              'AuthenticationController:getSessionProfile',\n              entropySourceId,\n            );\n          },\n          signMessage: (message: string, entropySourceId?: string) =>\n            this.#snapSignMessage(\n              message as `metamask:${string}`,\n              entropySourceId,\n            ),\n        },\n      },\n      {\n        storage: {\n          getStorageKey: async (message) =>\n            this.#storageKeyCache[message] ?? null,\n          setStorageKey: async (message, key) => {\n            this.#storageKeyCache[message] = key;\n          },\n        },\n      },\n    );\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n    this.#nativeScryptCrypto = nativeScryptCrypto;\n\n    // Contact Syncing\n    setupContactSyncingSubscriptions({\n      getUserStorageControllerInstance: () => this,\n      getMessenger: () => this.messenger,\n      trace: this.#trace,\n    });\n  }\n\n  /**\n   * Allows retrieval of stored data. Data stored is string formatted.\n   * Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns the decrypted string contents found from user storage (or null if not found)\n   */\n  public async performGetStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    entropySourceId?: string,\n  ): Promise<string | null> {\n    return await this.#userStorage.getItem(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows retrieval of all stored data for a specific feature. Data stored is formatted as an array of strings.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns the array of decrypted string contents found from user storage (or null if not found)\n   */\n  public async performGetStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    entropySourceId?: string,\n  ): Promise<string[] | null> {\n    return await this.#userStorage.getAllFeatureItems(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows storage of user data. Data stored must be string formatted.\n   * Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param value - The string data you want to store.\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performSetStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    value: string,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.setItem(path, value, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows storage of multiple user data entries for one specific feature. Data stored must be string formatted.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param values - data to store, in the form of an array of `[entryKey, entryValue]` pairs\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performBatchSetStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    values: [UserStorageGenericFeatureKey, string][],\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.batchSetItems(path, values, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows deletion of user data. Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to delete data.\n   */\n  public async performDeleteStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.deleteItem(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows deletion of all user data entries for a specific feature.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to delete data.\n   */\n  public async performDeleteStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.deleteAllFeatureItems(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows delete of multiple user data entries for one specific feature. Data deleted must be string formatted.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param values - data to store, in the form of an array of entryKey[]\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performBatchDeleteStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    values: UserStorageGenericFeatureKey[],\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.batchDeleteItems(path, values, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Retrieves the storage key, for internal use only!\n   *\n   * @returns the storage key\n   */\n  public async getStorageKey(): Promise<string> {\n    return await this.#userStorage.getStorageKey();\n  }\n\n  /**\n   * Flushes the storage key cache.\n   * CAUTION: This is only public for testing purposes.\n   * It should not be used in production code.\n   */\n  public flushStorageKeyCache(): void {\n    this.#storageKeyCache = {};\n  }\n\n  /**\n   * Lists all the available HD keyring metadata IDs.\n   * These IDs can be used in a multi-SRP context to segregate data specific to different SRPs.\n   *\n   * @returns A promise that resolves to an array of HD keyring metadata IDs.\n   */\n  async listEntropySources(): Promise<string[]> {\n    if (!this.#isUnlocked) {\n      throw new Error(\n        'listEntropySources - unable to list entropy sources, wallet is locked',\n      );\n    }\n\n    const { keyrings } = this.messenger.call('KeyringController:getState');\n    return keyrings\n      .filter((keyring) => keyring.type === KeyringTypes.hd.toString())\n      .map((keyring) => keyring.metadata.id);\n  }\n\n  #_snapSignMessageCache: Record<`metamask:${string}`, string> = {};\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ): Promise<string> {\n    // the message is SRP specific already, so there's no need to use the entropySourceId in the cache\n    if (this.#_snapSignMessageCache[message]) {\n      return this.#_snapSignMessageCache[message];\n    }\n\n    if (!this.#isUnlocked) {\n      throw new Error(\n        '#snapSignMessage - unable to call snap, wallet is locked',\n      );\n    }\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#_snapSignMessageCache[message] = result;\n\n    return result;\n  }\n\n  public async setIsBackupAndSyncFeatureEnabled(\n    feature: keyof typeof BACKUPANDSYNC_FEATURES,\n    enabled: boolean,\n  ): Promise<void> {\n    try {\n      this.#setIsBackupAndSyncUpdateLoading(true);\n\n      if (enabled) {\n        // If any of the features are enabled, we need to ensure the user is signed in\n        const isSignedIn = this.#auth.isSignedIn();\n        if (!isSignedIn) {\n          await this.#auth.signIn();\n        }\n      }\n\n      this.update((state) => {\n        if (feature === BACKUPANDSYNC_FEATURES.main) {\n          state.isBackupAndSyncEnabled = enabled;\n        }\n\n        if (feature === BACKUPANDSYNC_FEATURES.accountSyncing) {\n          state.isAccountSyncingEnabled = enabled;\n        }\n\n        if (feature === BACKUPANDSYNC_FEATURES.contactSyncing) {\n          state.isContactSyncingEnabled = enabled;\n        }\n      });\n    } catch (e) {\n      // istanbul ignore next\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      // istanbul ignore next\n      throw new Error(\n        `${controllerName} - failed to ${enabled ? 'enable' : 'disable'} ${feature} - ${errorMessage}`,\n      );\n    } finally {\n      this.#setIsBackupAndSyncUpdateLoading(false);\n    }\n  }\n\n  #setIsBackupAndSyncUpdateLoading(\n    isBackupAndSyncUpdateLoading: boolean,\n  ): void {\n    this.update((state) => {\n      state.isBackupAndSyncUpdateLoading = isBackupAndSyncUpdateLoading;\n    });\n  }\n\n  /**\n   * Sets the isContactSyncingInProgress flag to prevent infinite loops during contact synchronization\n   *\n   * @param isContactSyncingInProgress - Whether contact syncing is in progress\n   */\n  async setIsContactSyncingInProgress(\n    isContactSyncingInProgress: boolean,\n  ): Promise<void> {\n    this.update((state) => {\n      state.isContactSyncingInProgress = isContactSyncingInProgress;\n    });\n  }\n\n  /**\n   * Syncs the address book list with the user storage address book list.\n   * This method is used to make sure that the address book list is up-to-date with the user storage address book list and vice-versa.\n   * It will add new contacts to the address book list, update/merge conflicting contacts and re-upload the results in some cases to the user storage.\n   */\n  async syncContactsWithUserStorage(): Promise<void> {\n    const profileId = await this.#auth.getProfileId();\n\n    const config = {\n      onContactUpdated: () => {\n        this.#config?.contactSyncing?.onContactUpdated?.(profileId);\n      },\n      onContactDeleted: () => {\n        this.#config?.contactSyncing?.onContactDeleted?.(profileId);\n      },\n      onContactSyncErroneousSituation: (\n        errorMessage: string,\n        sentryContext?: Record<string, unknown>,\n      ) => {\n        this.#config?.contactSyncing?.onContactSyncErroneousSituation?.(\n          profileId,\n          errorMessage,\n          sentryContext,\n        );\n      },\n    };\n\n    await syncContactsWithUserStorage(config, {\n      getMessenger: () => this.messenger,\n      getUserStorageControllerInstance: () => this,\n      trace: this.#trace,\n    });\n  }\n}\n"]}
+{"version":3,"file":"UserStorageController.mjs","sourceRoot":"","sources":["../../../src/controllers/user-storage/UserStorageController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAQA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAW3D,OAAO,EAAE,YAAY,EAAE,qCAAqC;AAc5D,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,4BAAkB;AAE7C,OAAO,EAAE,UAAU,EAAE,2CAAuC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,iDAA6C;AAOpF,OAAO,EAAE,sBAAsB,EAAE,wBAAoB;AACrD,OAAO,EAAE,2BAA2B,EAAE,qDAAiD;AACvF,OAAO,EAAE,gCAAgC,EAAE,kDAA8C;AAGzF,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA0B/C,MAAM,CAAC,MAAM,YAAY,GAA+B;IACtD,sBAAsB,EAAE,IAAI;IAC5B,4BAA4B,EAAE,KAAK;IACnC,uBAAuB,EAAE,IAAI;IAC7B,uBAAuB,EAAE,IAAI;IAC7B,0BAA0B,EAAE,KAAK;CAClC,CAAC;AAEF,MAAM,QAAQ,GAA8C;IAC1D,sBAAsB,EAAE;QACtB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,4BAA4B,EAAE;QAC5B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,sBAAsB,EAAE,IAAI;QAC5B,QAAQ,EAAE,IAAI;KACf;IACD,0BAA0B,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,KAAK;QAC7B,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AA6BF,MAAM,yBAAyB,GAAG;IAChC,mBAAmB;IACnB,oCAAoC;IACpC,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,2BAA2B;IAC3B,eAAe;IACf,uCAAuC;IACvC,oBAAoB;IACpB,kCAAkC;IAClC,+BAA+B;IAC/B,6BAA6B;CACrB,CAAC;AAgDX;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,cAI1C;IAwDC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,kBAAkB,EAClB,KAAK,GAON;QACC,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,EAAE;SACrC,CAAC,CAAC;;QAzEI,qDAA0B;QAE1B,sCAAQ;YACf,YAAY,EAAE,KAAK,EAAE,eAAwB,EAAE,EAAE;gBAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9C,4CAA4C,EAC5C,eAAe,CAChB,CAAC;gBACF,OAAO,cAAc,EAAE,SAAS,CAAC;YACnC,CAAC;YACD,UAAU,EAAE,GAAG,EAAE;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,wCAAwC,CACzC,CAAC;YACJ,CAAC;SACF,EAAC;QAEO,wCAA4B;YACnC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,EAAC;QAEO,+CAAsB;QAE/B,4CAAc,KAAK,EAAC;QAEpB,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,4DAA4D;QAC5D,iDAA2C,EAAE,EAAC;QAE9C,sDAAgD,EAAE,EAAC;QAE1C,mDAAqB;YAC5B,6BAA6B,EAAE,GAAG,EAAE;gBAClC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBACzE,uBAAA,IAAI,qCAAe,UAAU,MAAA,CAAC;gBAE9B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0BAA0B,EAAE,GAAG,EAAE;oBACxD,uBAAA,IAAI,qCAAe,IAAI,MAAA,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,EAAE,GAAG,EAAE;oBACtD,uBAAA,IAAI,qCAAe,KAAK,MAAA,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;SACF,EAAC;QAEO,oDAAgD,SAAS,EAAC;QAEnE,eAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QAsB5B,uBAAA,IAAI,iCAAW;YACb,GAAG,uBAAA,IAAI,qCAAQ;YACf,GAAG,MAAM;SACV,MAAA,CAAC;QACF,uBAAA,IAAI,gCACF,KAAK;YACL,CAAC,KAAK,EACJ,QAAsB,EACtB,EAA2C,EACtB,EAAE;gBACvB,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,OAAO,SAAuB,CAAC;gBACjC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC,MAAA,CAAC;QAEL,uBAAA,IAAI,sCAAgB,IAAI,WAAW,CACjC;YACE,GAAG,EAAE,uBAAA,IAAI,qCAAQ,CAAC,GAAG;YACrB,IAAI,EAAE;gBACJ,cAAc,EAAE,CAAC,eAAwB,EAAE,EAAE,CAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,yCAAyC,EACzC,eAAe,CAChB;gBACH,cAAc,EAAE,KAAK,EAAE,eAAwB,EAAE,EAAE;oBACjD,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC9B,4CAA4C,EAC5C,eAAe,CAChB,CAAC;gBACJ,CAAC;gBACD,WAAW,EAAE,CAAC,OAAe,EAAE,eAAwB,EAAE,EAAE,CACzD,uBAAA,IAAI,gFAAiB,MAArB,IAAI,EACF,OAA+B,EAC/B,eAAe,CAChB;aACJ;SACF,EACD;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;oBAChD,+DAA+D;oBAC/D,8DAA8D;oBAC9D,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,OAAO,CACL,uBAAA,IAAI,8CAAiB,CACnB,uBAAA,IAAI,+EAAgB,MAApB,IAAI,EAAiB,OAAO,EAAE,eAAe,CAAC,CAC/C,IAAI,IAAI,CACV,CAAC;gBACJ,CAAC;gBACD,uEAAuE;gBACvE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;oBACrD,uBAAA,IAAI,8CAAiB,CACnB,uBAAA,IAAI,+EAAgB,MAApB,IAAI,EAAiB,OAAO,EAAE,eAAe,CAAC,CAC/C,GAAG,GAAG,CAAC;gBACV,CAAC;aACF;SACF,CACF,MAAA,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;QAEF,uBAAA,IAAI,gDAAmB,CAAC,6BAA6B,EAAE,CAAC;QACxD,uBAAA,IAAI,6CAAuB,kBAAkB,MAAA,CAAC;QAE9C,kBAAkB;QAClB,gCAAgC,CAAC;YAC/B,gCAAgC,EAAE,GAAG,EAAE,CAAC,IAAI;YAC5C,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YAClC,KAAK,EAAE,uBAAA,IAAI,oCAAO;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAA6C,EAC7C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,OAAO,CAAC,IAAI,EAAE;YAC3C,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,kCAAkC,CAC7C,IAA2C,EAC3C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,kBAAkB,CAAC,IAAI,EAAE;YACtD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,iBAAiB,CAC5B,IAA6C,EAC7C,KAAa,EACb,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,sBAAsB,CACjC,IAA2C,EAC3C,MAAgD,EAChD,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;YACzD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,oBAAoB,CAC/B,IAA6C,EAC7C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,UAAU,CAAC,IAAI,EAAE;YAC9C,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,qCAAqC,CAChD,IAA2C,EAC3C,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,qBAAqB,CAAC,IAAI,EAAE;YACzD,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,yBAAyB,CACpC,IAA2C,EAC3C,MAAsC,EACtC,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE;YAC5D,kBAAkB,EAAE,uBAAA,IAAI,iDAAoB;YAC5C,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa;QACxB,OAAO,MAAM,uBAAA,IAAI,0CAAa,CAAC,aAAa,EAAE,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACI,oBAAoB;QACzB,uBAAA,IAAI,0CAAoB,EAAE,MAAA,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,OAAO,uBAAA,IAAI,6FAA8B,MAAlC,IAAI,CAAgC,CAAC;IAC9C,CAAC;IAyFM,KAAK,CAAC,gCAAgC,CAC3C,OAA4C,EAC5C,OAAgB;QAEhB,IAAI,CAAC;YACH,uBAAA,IAAI,gGAAiC,MAArC,IAAI,EAAkC,IAAI,CAAC,CAAC;YAE5C,IAAI,OAAO,EAAE,CAAC;gBACZ,8EAA8E;gBAC9E,MAAM,UAAU,GAAG,uBAAA,IAAI,mCAAM,CAAC,UAAU,EAAE,CAAC;gBAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,uBAAA,IAAI,mCAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,IAAI,OAAO,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;oBAC5C,KAAK,CAAC,sBAAsB,GAAG,OAAO,CAAC;gBACzC,CAAC;gBAED,IAAI,OAAO,KAAK,sBAAsB,CAAC,cAAc,EAAE,CAAC;oBACtD,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC;gBAC1C,CAAC;gBAED,IAAI,OAAO,KAAK,sBAAsB,CAAC,cAAc,EAAE,CAAC;oBACtD,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,uBAAuB;YACvB,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,uBAAuB;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,gBAAgB,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,MAAM,YAAY,EAAE,CAC/F,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,uBAAA,IAAI,gGAAiC,MAArC,IAAI,EAAkC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAUD;;;;OAIG;IACH,KAAK,CAAC,6BAA6B,CACjC,0BAAmC;QAEnC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,0BAA0B,GAAG,0BAA0B,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,2BAA2B;QAC/B,MAAM,SAAS,GAAG,MAAM,uBAAA,IAAI,mCAAM,CAAC,YAAY,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG;YACb,gBAAgB,EAAE,GAAG,EAAE;gBACrB,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,gBAAgB,EAAE,GAAG,EAAE;gBACrB,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YACD,+BAA+B,EAAE,CAC/B,YAAoB,EACpB,aAAuC,EACvC,EAAE;gBACF,uBAAA,IAAI,qCAAQ,EAAE,cAAc,EAAE,+BAA+B,EAAE,CAC7D,SAAS,EACT,YAAY,EACZ,aAAa,CACd,CAAC;YACJ,CAAC;SACF,CAAC;QAEF,MAAM,2BAA2B,CAAC,MAAM,EAAE;YACxC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;YAClC,gCAAgC,EAAE,GAAG,EAAE,CAAC,IAAI;YAC5C,KAAK,EAAE,uBAAA,IAAI,oCAAO;SACnB,CAAC,CAAC;IACL,CAAC;CACF;;IA7KG,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACvE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;SAChE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;IAaC,MAAM,CAAC,sBAAsB,CAAC,GAAG,uBAAA,IAAI,6FAA8B,MAAlC,IAAI,CAAgC,CAAC;IACtE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC,yFAkBC,OAA6B,EAC7B,eAAwB;IAExB,OAAO,GAAG,eAAe,IAAI,uBAAA,IAAI,0FAA2B,MAA/B,IAAI,CAA6B,IAAI,OAAO,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,iDACH,OAA6B,EAC7B,eAAwB;IAExB,IAAI,CAAC,uBAAA,IAAI,yCAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,uBAAA,IAAI,+EAAgB,MAApB,IAAI,EAAiB,OAAO,EAAE,eAAe,CAAC,CAAC;IAChE,IAAI,uBAAA,IAAI,mDAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,uBAAA,IAAI,mDAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,8BAA8B,EAC9B,4BAA4B,CAAC,OAAO,EAAE,eAAe,CAAC,CACvD,CAAW,CAAC;IAEb,uBAAA,IAAI,mDAAsB,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC,2HA2CC,4BAAqC;IAErC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpB,KAAK,CAAC,4BAA4B,GAAG,4BAA4B,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  AddressBookControllerContactUpdatedEvent,\n  AddressBookControllerContactDeletedEvent,\n  AddressBookControllerActions,\n  AddressBookControllerListAction,\n  AddressBookControllerSetAction,\n  AddressBookControllerDeleteAction,\n} from '@metamask/address-book-controller';\nimport { BaseController } from '@metamask/base-controller';\nimport type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport type {\n  TraceCallback,\n  TraceContext,\n  TraceRequest,\n} from '@metamask/controller-utils';\nimport { KeyringTypes } from '@metamask/keyring-controller';\nimport type {\n  KeyringControllerGetStateAction,\n  KeyringControllerLockEvent,\n  KeyringControllerUnlockEvent,\n} from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type { SnapControllerHandleRequestAction } from '@metamask/snaps-controllers';\n\nimport type {\n  UserStorageGenericFeatureKey,\n  UserStorageGenericPathWithFeatureAndKey,\n  UserStorageGenericPathWithFeatureOnly,\n} from '../../sdk';\nimport { Env, UserStorage } from '../../sdk';\nimport type { NativeScrypt } from '../../shared/types/encryption';\nimport { EventQueue } from '../../shared/utils/event-queue';\nimport { createSnapSignMessageRequest } from '../authentication/auth-snap-requests';\nimport type {\n  AuthenticationControllerGetBearerTokenAction,\n  AuthenticationControllerGetSessionProfileAction,\n  AuthenticationControllerIsSignedInAction,\n  AuthenticationControllerPerformSignInAction,\n} from '../authentication/AuthenticationController-method-action-types';\nimport { BACKUPANDSYNC_FEATURES } from './constants';\nimport { syncContactsWithUserStorage } from './contact-syncing/controller-integration';\nimport { setupContactSyncingSubscriptions } from './contact-syncing/setup-subscriptions';\nimport type { UserStorageControllerMethodActions } from './UserStorageController-method-action-types';\n\nconst controllerName = 'UserStorageController';\n\n// State\nexport type UserStorageControllerState = {\n  /**\n   * Condition used by UI and to determine if we can use some of the User Storage methods.\n   */\n  isBackupAndSyncEnabled: boolean;\n  /**\n   * Loading state for the backup and sync update\n   */\n  isBackupAndSyncUpdateLoading: boolean;\n  /**\n   * Condition used by UI to determine if account syncing is enabled.\n   */\n  isAccountSyncingEnabled: boolean;\n  /**\n   * Condition used by UI to determine if contact syncing is enabled.\n   */\n  isContactSyncingEnabled: boolean;\n  /**\n   * Condition used by UI to determine if contact syncing is in progress.\n   */\n  isContactSyncingInProgress: boolean;\n};\n\nexport const defaultState: UserStorageControllerState = {\n  isBackupAndSyncEnabled: true,\n  isBackupAndSyncUpdateLoading: false,\n  isAccountSyncingEnabled: true,\n  isContactSyncingEnabled: true,\n  isContactSyncingInProgress: false,\n};\n\nconst metadata: StateMetadata<UserStorageControllerState> = {\n  isBackupAndSyncEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isBackupAndSyncUpdateLoading: {\n    includeInStateLogs: false,\n    persist: false,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n  isAccountSyncingEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isContactSyncingEnabled: {\n    includeInStateLogs: true,\n    persist: true,\n    includeInDebugSnapshot: true,\n    usedInUi: true,\n  },\n  isContactSyncingInProgress: {\n    includeInStateLogs: false,\n    persist: false,\n    includeInDebugSnapshot: false,\n    usedInUi: true,\n  },\n};\n\ntype ControllerConfig = {\n  env: Env;\n  contactSyncing?: {\n    /**\n     * Callback that fires when contact sync updates a contact.\n     * This is used for analytics.\n     */\n    onContactUpdated?: (profileId: string) => void;\n\n    /**\n     * Callback that fires when contact sync deletes a contact.\n     * This is used for analytics.\n     */\n    onContactDeleted?: (profileId: string) => void;\n\n    /**\n     * Callback that fires when an erroneous situation happens during contact sync.\n     * This is used for analytics.\n     */\n    onContactSyncErroneousSituation?: (\n      profileId: string,\n      situationMessage: string,\n      sentryContext?: Record<string, unknown>,\n    ) => void;\n  };\n};\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'performGetStorage',\n  'performGetStorageAllFeatureEntries',\n  'performSetStorage',\n  'performBatchSetStorage',\n  'performDeleteStorage',\n  'performBatchDeleteStorage',\n  'getStorageKey',\n  'performDeleteStorageAllFeatureEntries',\n  'listEntropySources',\n  'setIsBackupAndSyncFeatureEnabled',\n  'setIsContactSyncingInProgress',\n  'syncContactsWithUserStorage',\n] as const;\n\nexport type UserStorageControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  UserStorageControllerState\n>;\nexport type Actions =\n  | UserStorageControllerGetStateAction\n  | UserStorageControllerMethodActions;\n\nexport type AllowedActions =\n  // Keyring Requests\n  | KeyringControllerGetStateAction\n  // Snap Requests\n  | SnapControllerHandleRequestAction\n  // Auth Requests\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerIsSignedInAction\n  // Contact Syncing\n  | AddressBookControllerListAction\n  | AddressBookControllerSetAction\n  | AddressBookControllerDeleteAction\n  | AddressBookControllerActions;\n\n// Messenger events\nexport type UserStorageControllerStateChangeEvent = ControllerStateChangeEvent<\n  typeof controllerName,\n  UserStorageControllerState\n>;\n\nexport type Events = UserStorageControllerStateChangeEvent;\n\nexport type AllowedEvents =\n  | KeyringControllerLockEvent\n  | KeyringControllerUnlockEvent\n  // Address Book Events\n  | AddressBookControllerContactUpdatedEvent\n  | AddressBookControllerContactDeletedEvent;\n\n// Messenger\nexport type UserStorageControllerMessenger = Messenger<\n  typeof controllerName,\n  Actions | AllowedActions,\n  Events | AllowedEvents\n>;\n\n/**\n * Reusable controller that allows any team to store synchronized data for a given user.\n * These can be settings shared cross MetaMask clients, or data we want to persist when uninstalling/reinstalling.\n *\n * NOTE:\n * - data stored on UserStorage is FULLY encrypted, with the only keys stored/managed on the client.\n * - No one can access this data unless they are have the SRP and are able to run the signing snap.\n */\nexport class UserStorageController extends BaseController<\n  typeof controllerName,\n  UserStorageControllerState,\n  UserStorageControllerMessenger\n> {\n  readonly #userStorage: UserStorage;\n\n  readonly #auth = {\n    getProfileId: async (entropySourceId?: string) => {\n      const sessionProfile = await this.messenger.call(\n        'AuthenticationController:getSessionProfile',\n        entropySourceId,\n      );\n      return sessionProfile?.profileId;\n    },\n    isSignedIn: () => {\n      return this.messenger.call('AuthenticationController:isSignedIn');\n    },\n    signIn: async () => {\n      return await this.messenger.call(\n        'AuthenticationController:performSignIn',\n      );\n    },\n  };\n\n  readonly #config: ControllerConfig = {\n    env: Env.PRD,\n  };\n\n  readonly #trace: TraceCallback;\n\n  #isUnlocked = false;\n\n  // Both caches are keyed by `${entropySourceId}:${message}` (the primary SRP\n  // resolves to its HD keyring metadata ID) so two SRPs that transiently\n  // resolve to the same `profileId` can never share a cached storage key /\n  // signature and leak data across each other's user storage.\n  #storageKeyCache: Record<string, string> = {};\n\n  #snapSignMessageCache: Record<string, string> = {};\n\n  readonly #keyringController = {\n    setupLockedStateSubscriptions: () => {\n      const { isUnlocked } = this.messenger.call('KeyringController:getState');\n      this.#isUnlocked = isUnlocked;\n\n      this.messenger.subscribe('KeyringController:unlock', () => {\n        this.#isUnlocked = true;\n      });\n\n      this.messenger.subscribe('KeyringController:lock', () => {\n        this.#isUnlocked = false;\n      });\n    },\n  };\n\n  readonly #nativeScryptCrypto: NativeScrypt | undefined = undefined;\n\n  eventQueue = new EventQueue();\n\n  constructor({\n    messenger,\n    state,\n    config,\n    nativeScryptCrypto,\n    trace,\n  }: {\n    messenger: UserStorageControllerMessenger;\n    state?: UserStorageControllerState;\n    config?: Partial<ControllerConfig>;\n    nativeScryptCrypto?: NativeScrypt;\n    trace?: TraceCallback;\n  }) {\n    super({\n      messenger,\n      metadata,\n      name: controllerName,\n      state: { ...defaultState, ...state },\n    });\n\n    this.#config = {\n      ...this.#config,\n      ...config,\n    };\n    this.#trace =\n      trace ??\n      (async <ReturnType>(\n        _request: TraceRequest,\n        fn?: (context?: TraceContext) => ReturnType,\n      ): Promise<ReturnType> => {\n        if (!fn) {\n          return undefined as ReturnType;\n        }\n        return await Promise.resolve(fn());\n      });\n\n    this.#userStorage = new UserStorage(\n      {\n        env: this.#config.env,\n        auth: {\n          getAccessToken: (entropySourceId?: string) =>\n            this.messenger.call(\n              'AuthenticationController:getBearerToken',\n              entropySourceId,\n            ),\n          getUserProfile: async (entropySourceId?: string) => {\n            return await this.messenger.call(\n              'AuthenticationController:getSessionProfile',\n              entropySourceId,\n            );\n          },\n          signMessage: (message: string, entropySourceId?: string) =>\n            this.#snapSignMessage(\n              message as `metamask:${string}`,\n              entropySourceId,\n            ),\n        },\n      },\n      {\n        storage: {\n          getStorageKey: async (message, entropySourceId) => {\n            // No derived key can exist while locked (the KeyringController\n            // clears its keyrings on lock, so the scope is unresolvable).\n            if (!this.#isUnlocked) {\n              return null;\n            }\n            return (\n              this.#storageKeyCache[\n                this.#scopedCacheKey(message, entropySourceId)\n              ] ?? null\n            );\n          },\n          // Only ever reached after a successful signature, i.e. while unlocked.\n          setStorageKey: async (message, key, entropySourceId) => {\n            this.#storageKeyCache[\n              this.#scopedCacheKey(message, entropySourceId)\n            ] = key;\n          },\n        },\n      },\n    );\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n\n    this.#keyringController.setupLockedStateSubscriptions();\n    this.#nativeScryptCrypto = nativeScryptCrypto;\n\n    // Contact Syncing\n    setupContactSyncingSubscriptions({\n      getUserStorageControllerInstance: () => this,\n      getMessenger: () => this.messenger,\n      trace: this.#trace,\n    });\n  }\n\n  /**\n   * Allows retrieval of stored data. Data stored is string formatted.\n   * Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns the decrypted string contents found from user storage (or null if not found)\n   */\n  public async performGetStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    entropySourceId?: string,\n  ): Promise<string | null> {\n    return await this.#userStorage.getItem(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows retrieval of all stored data for a specific feature. Data stored is formatted as an array of strings.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns the array of decrypted string contents found from user storage (or null if not found)\n   */\n  public async performGetStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    entropySourceId?: string,\n  ): Promise<string[] | null> {\n    return await this.#userStorage.getAllFeatureItems(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows storage of user data. Data stored must be string formatted.\n   * Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param value - The string data you want to store.\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performSetStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    value: string,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.setItem(path, value, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows storage of multiple user data entries for one specific feature. Data stored must be string formatted.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param values - data to store, in the form of an array of `[entryKey, entryValue]` pairs\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performBatchSetStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    values: [UserStorageGenericFeatureKey, string][],\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.batchSetItems(path, values, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows deletion of user data. Developers can extend the entry path and entry name through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}.${key}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to delete data.\n   */\n  public async performDeleteStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.deleteItem(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows deletion of all user data entries for a specific feature.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to delete data.\n   */\n  public async performDeleteStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.deleteAllFeatureItems(path, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Allows delete of multiple user data entries for one specific feature. Data deleted must be string formatted.\n   * Developers can extend the entry path through the `schema.ts` file.\n   *\n   * @param path - string in the form of `${feature}` that matches schema\n   * @param values - data to store, in the form of an array of entryKey[]\n   * @param entropySourceId - The entropy source ID used to generate the encryption key.\n   * @returns nothing. NOTE that an error is thrown if fails to store data.\n   */\n  public async performBatchDeleteStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    values: UserStorageGenericFeatureKey[],\n    entropySourceId?: string,\n  ): Promise<void> {\n    return await this.#userStorage.batchDeleteItems(path, values, {\n      nativeScryptCrypto: this.#nativeScryptCrypto,\n      entropySourceId,\n    });\n  }\n\n  /**\n   * Retrieves the storage key, for internal use only!\n   *\n   * @returns the storage key\n   */\n  public async getStorageKey(): Promise<string> {\n    return await this.#userStorage.getStorageKey();\n  }\n\n  /**\n   * Flushes the storage key cache.\n   * CAUTION: This is only public for testing purposes.\n   * It should not be used in production code.\n   */\n  public flushStorageKeyCache(): void {\n    this.#storageKeyCache = {};\n  }\n\n  /**\n   * Lists all the available HD keyring metadata IDs.\n   * These IDs can be used in a multi-SRP context to segregate data specific to different SRPs.\n   *\n   * @returns A promise that resolves to an array of HD keyring metadata IDs.\n   */\n  async listEntropySources(): Promise<string[]> {\n    if (!this.#isUnlocked) {\n      throw new Error(\n        'listEntropySources - unable to list entropy sources, wallet is locked',\n      );\n    }\n\n    return this.#getHdKeyringEntropySourceIds();\n  }\n\n  /**\n   * Reads the HD keyring entropy source IDs (metadata IDs) from the\n   * KeyringController, primary first. Returns an empty array when none are\n   * available (e.g. the wallet is locked, where `keyrings` is cleared).\n   *\n   * @returns The HD keyring metadata IDs, primary first.\n   */\n  #getHdKeyringEntropySourceIds(): string[] {\n    const { keyrings } = this.messenger.call('KeyringController:getState');\n    return (keyrings ?? [])\n      .filter((keyring) => keyring.type === KeyringTypes.hd.toString())\n      .map((keyring) => keyring.metadata.id);\n  }\n\n  /**\n   * Resolves the primary SRP's entropy source ID (the first HD keyring's\n   * metadata ID), used to scope the primary's cache entries. The ID is randomly\n   * regenerated whenever the vault is recreated (e.g. on restore), so a new\n   * primary can never inherit a previous vault's cached key.\n   *\n   * @returns The primary HD keyring metadata ID.\n   * @throws If no HD keyring is available; callers must only resolve the scope\n   * while the wallet is unlocked.\n   */\n  #getPrimaryEntropySourceId(): string {\n    const [primaryEntropySourceId] = this.#getHdKeyringEntropySourceIds();\n    if (!primaryEntropySourceId) {\n      throw new Error('#getPrimaryEntropySourceId - no HD keyring available');\n    }\n    return primaryEntropySourceId;\n  }\n\n  /**\n   * Builds a cache key scoped to a specific entropy source, so each SRP's\n   * signature/storage key derivation stays isolated even when two SRPs\n   * transiently resolve to the same `profileId` (see `#storageKeyCache`).\n   *\n   * When `entropySourceId` is omitted (primary SRP), it is resolved to the\n   * primary HD keyring's metadata ID rather than a stable literal. Because that\n   * ID is randomly regenerated whenever the vault is recreated (e.g. on\n   * restore), the cached entry is naturally invalidated across vaults — a\n   * different SRP can never inherit the previous primary's cached key.\n   *\n   * @param message - The tagged message used for signing.\n   * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n   * @returns The scoped cache key.\n   */\n  #scopedCacheKey(\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ): string {\n    return `${entropySourceId ?? this.#getPrimaryEntropySourceId()}:${message}`;\n  }\n\n  /**\n   * Signs a specific message using an underlying auth snap.\n   *\n   * @param message - A specific tagged message to sign.\n   * @param entropySourceId - The entropy source ID used to derive the key,\n   * when multiple sources are available (Multi-SRP).\n   * @returns A Signature created by the snap.\n   */\n  async #snapSignMessage(\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ): Promise<string> {\n    if (!this.#isUnlocked) {\n      throw new Error(\n        '#snapSignMessage - unable to call snap, wallet is locked',\n      );\n    }\n\n    const cacheKey = this.#scopedCacheKey(message, entropySourceId);\n    if (this.#snapSignMessageCache[cacheKey]) {\n      return this.#snapSignMessageCache[cacheKey];\n    }\n\n    const result = (await this.messenger.call(\n      'SnapController:handleRequest',\n      createSnapSignMessageRequest(message, entropySourceId),\n    )) as string;\n\n    this.#snapSignMessageCache[cacheKey] = result;\n\n    return result;\n  }\n\n  public async setIsBackupAndSyncFeatureEnabled(\n    feature: keyof typeof BACKUPANDSYNC_FEATURES,\n    enabled: boolean,\n  ): Promise<void> {\n    try {\n      this.#setIsBackupAndSyncUpdateLoading(true);\n\n      if (enabled) {\n        // If any of the features are enabled, we need to ensure the user is signed in\n        const isSignedIn = this.#auth.isSignedIn();\n        if (!isSignedIn) {\n          await this.#auth.signIn();\n        }\n      }\n\n      this.update((state) => {\n        if (feature === BACKUPANDSYNC_FEATURES.main) {\n          state.isBackupAndSyncEnabled = enabled;\n        }\n\n        if (feature === BACKUPANDSYNC_FEATURES.accountSyncing) {\n          state.isAccountSyncingEnabled = enabled;\n        }\n\n        if (feature === BACKUPANDSYNC_FEATURES.contactSyncing) {\n          state.isContactSyncingEnabled = enabled;\n        }\n      });\n    } catch (e) {\n      // istanbul ignore next\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      // istanbul ignore next\n      throw new Error(\n        `${controllerName} - failed to ${enabled ? 'enable' : 'disable'} ${feature} - ${errorMessage}`,\n      );\n    } finally {\n      this.#setIsBackupAndSyncUpdateLoading(false);\n    }\n  }\n\n  #setIsBackupAndSyncUpdateLoading(\n    isBackupAndSyncUpdateLoading: boolean,\n  ): void {\n    this.update((state) => {\n      state.isBackupAndSyncUpdateLoading = isBackupAndSyncUpdateLoading;\n    });\n  }\n\n  /**\n   * Sets the isContactSyncingInProgress flag to prevent infinite loops during contact synchronization\n   *\n   * @param isContactSyncingInProgress - Whether contact syncing is in progress\n   */\n  async setIsContactSyncingInProgress(\n    isContactSyncingInProgress: boolean,\n  ): Promise<void> {\n    this.update((state) => {\n      state.isContactSyncingInProgress = isContactSyncingInProgress;\n    });\n  }\n\n  /**\n   * Syncs the address book list with the user storage address book list.\n   * This method is used to make sure that the address book list is up-to-date with the user storage address book list and vice-versa.\n   * It will add new contacts to the address book list, update/merge conflicting contacts and re-upload the results in some cases to the user storage.\n   */\n  async syncContactsWithUserStorage(): Promise<void> {\n    const profileId = await this.#auth.getProfileId();\n\n    const config = {\n      onContactUpdated: () => {\n        this.#config?.contactSyncing?.onContactUpdated?.(profileId);\n      },\n      onContactDeleted: () => {\n        this.#config?.contactSyncing?.onContactDeleted?.(profileId);\n      },\n      onContactSyncErroneousSituation: (\n        errorMessage: string,\n        sentryContext?: Record<string, unknown>,\n      ) => {\n        this.#config?.contactSyncing?.onContactSyncErroneousSituation?.(\n          profileId,\n          errorMessage,\n          sentryContext,\n        );\n      },\n    };\n\n    await syncContactsWithUserStorage(config, {\n      getMessenger: () => this.messenger,\n      getUserStorageControllerInstance: () => this,\n      trace: this.#trace,\n    });\n  }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/flow-srp.cjs

@@ -33,9 +33,9 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SRPJwtBearerAuth_instances, _SRPJwtBearerAuth_config, _SRPJwtBearerAuth_options, _SRPJwtBearerAuth_metametrics, _SRPJwtBearerAuth_ongoingLogins, _SRPJwtBearerAuth_cooldownDefaultMs, _SRPJwtBearerAuth_maxLoginRetries, _SRPJwtBearerAuth_customProvider, _SRPJwtBearerAuth_getAuthSession, _SRPJwtBearerAuth_login, _SRPJwtBearerAuth_performLogin, _SRPJwtBearerAuth_deferredLogin, _SRPJwtBearerAuth_loginWithRetry, _SRPJwtBearerAuth_createSrpLoginRawMessage;
+var _SRPJwtBearerAuth_instances, _SRPJwtBearerAuth_config, _SRPJwtBearerAuth_options, _SRPJwtBearerAuth_metametrics, _SRPJwtBearerAuth_ongoingLogins, _SRPJwtBearerAuth_ongoingPairings, _SRPJwtBearerAuth_cooldownDefaultMs, _SRPJwtBearerAuth_maxLoginRetries, _SRPJwtBearerAuth_customProvider, _SRPJwtBearerAuth_getAuthSession, _SRPJwtBearerAuth_login, _SRPJwtBearerAuth_performLogin, _SRPJwtBearerAuth_deferredLogin, _SRPJwtBearerAuth_loginWithRetry, _SRPJwtBearerAuth_createSrpLoginRawMessage;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SRPJwtBearerAuth = void 0;
+exports.SRPJwtBearerAuth = exports.PAIR_DEDUPE_TTL_MS = void 0;
 const errors_1 = require("../errors.cjs");
 const eip_6963_metamask_provider_1 = require("../utils/eip-6963-metamask-provider.cjs");
 const messaging_signing_snap_requests_1 = require("../utils/messaging-signing-snap-requests.cjs");
@@ -43,6 +43,9 @@ const validate_login_response_1 = require("../utils/validate-login-response.cjs"
 const services_1 = require("./services.cjs");
 const identifier_1 = require("./utils/identifier.cjs");
 const timeUtils = __importStar(require("./utils/time.cjs"));
+// How long a successful pairing result stays cached so identical payloads
+// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.
+exports.PAIR_DEDUPE_TTL_MS = 30000;
 const getDefaultEIP6963Provider = async () => {
     const provider = await (0, eip_6963_metamask_provider_1.getMetaMaskProviderEIP6963)();
     if (!provider) {
@@ -69,6 +72,10 @@ class SRPJwtBearerAuth {
         _SRPJwtBearerAuth_metametrics.set(this, void 0);
         // Map to store ongoing login promises by entropySourceId
         _SRPJwtBearerAuth_ongoingLogins.set(this, new Map());
+        // Map to dedupe pairing calls by an order-insensitive token-set key.
+        // Holds the in-flight promise (coalescing concurrent callers) and keeps it
+        // for a short TTL after success (collapsing sequential retries).
+        _SRPJwtBearerAuth_ongoingPairings.set(this, new Map());
         // Default cooldown when 429 has no Retry-After header
         _SRPJwtBearerAuth_cooldownDefaultMs.set(this, void 0);
         // Maximum number of login retries on rate limit errors
@@ -115,7 +122,36 @@ class SRPJwtBearerAuth {
         return await (0, services_1.getUserProfileLineage)(__classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env, accessToken);
     }
     async pairSrpProfiles(accessTokens, authAccessToken) {
-        return await (0, services_1.pairProfiles)(accessTokens, authAccessToken, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+        // Order-insensitive key: the same token set in any order maps to the same
+        // entry. Sort a copy so the request payload itself stays primary-first.
+        const key = JSON.stringify([...accessTokens].sort());
+        const cached = __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").get(key);
+        if (cached && cached.expiresAt > Date.now()) {
+            return await cached.promise;
+        }
+        const promise = (0, services_1.pairProfiles)(accessTokens, authAccessToken, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+        // Store the in-flight promise immediately so concurrent callers coalesce
+        // regardless of how long the request takes.
+        __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").set(key, {
+            promise,
+            expiresAt: Number.MAX_SAFE_INTEGER,
+        });
+        try {
+            const result = await promise;
+            // Keep the resolved result cached for a short window so sequential
+            // retries with the same payload reuse it.
+            __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").set(key, {
+                promise,
+                expiresAt: Date.now() + exports.PAIR_DEDUPE_TTL_MS,
+            });
+            return result;
+        }
+        catch (error) {
+            // Never cache failures: the pairing retry loop must be able to re-hit
+            // the endpoint on the next attempt.
+            __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").delete(key);
+            throw error;
+        }
     }
     async signMessage(message, entropySourceId) {
         return await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").signing.signMessage(message, entropySourceId);
@@ -135,7 +171,7 @@ class SRPJwtBearerAuth {
     }
 }
 exports.SRPJwtBearerAuth = SRPJwtBearerAuth;
-_SRPJwtBearerAuth_config = new WeakMap(), _SRPJwtBearerAuth_options = new WeakMap(), _SRPJwtBearerAuth_metametrics = new WeakMap(), _SRPJwtBearerAuth_ongoingLogins = new WeakMap(), _SRPJwtBearerAuth_cooldownDefaultMs = new WeakMap(), _SRPJwtBearerAuth_maxLoginRetries = new WeakMap(), _SRPJwtBearerAuth_customProvider = new WeakMap(), _SRPJwtBearerAuth_instances = new WeakSet(), _SRPJwtBearerAuth_getAuthSession = 
+_SRPJwtBearerAuth_config = new WeakMap(), _SRPJwtBearerAuth_options = new WeakMap(), _SRPJwtBearerAuth_metametrics = new WeakMap(), _SRPJwtBearerAuth_ongoingLogins = new WeakMap(), _SRPJwtBearerAuth_ongoingPairings = new WeakMap(), _SRPJwtBearerAuth_cooldownDefaultMs = new WeakMap(), _SRPJwtBearerAuth_maxLoginRetries = new WeakMap(), _SRPJwtBearerAuth_customProvider = new WeakMap(), _SRPJwtBearerAuth_instances = new WeakSet(), _SRPJwtBearerAuth_getAuthSession = 
 // convert expiresIn from seconds to milliseconds and use 90% of expiresIn
 async function _SRPJwtBearerAuth_getAuthSession(entropySourceId) {
     const auth = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").storage.getLoginResponse(entropySourceId);

package/dist/sdk/authentication-jwt-bearer/flow-srp.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,0CAA8D;AAC9D,wFAAiF;AACjF,kGAKkD;AAClD,kFAAyE;AACzE,6CAMoB;AAYpB,uDAAyD;AACzD,4DAA0C;AAW1C,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,IAAA,uDAA0B,GAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,wBAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,sDAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,IAAA,iEAA+B,EAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,sDAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAa,gBAAgB;IAwB3B,YACE,MAA2C,EAC3C,OAGC;;QA5BM,2CAAoB;QAEpB,4CAGP;QAEO,gDAA+B;QAExC,yDAAyD;QAChD,0CAAiB,IAAI,GAAG,EAG9B,EAAC;QAEJ,sDAAsD;QAC7C,sDAA2B;QAEpC,uDAAuD;QAC9C,oDAAyB;QAElC,mDAAkC;QAShC,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,oCAAmB,OAAO,CAAC,cAAc,MAAA,CAAC;QAC9C,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,uBAAA,IAAI,wCAAgB,CAAC;SACxD,MAAA,CAAC;QACF,uBAAA,IAAI,iCAAgB,OAAO,CAAC,WAAW,MAAA,CAAC;QAExC,4CAA4C;QAC5C,uBAAA,IAAI,uCACF,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,MAAA,CAAC;QACrD,uBAAA,IAAI,qCAAoB,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,MAAA,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,uBAAA,IAAI,oCAAmB,QAAQ,MAAA,CAAC;QAChC,uBAAA,IAAI,iCAAS,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,IAAA,gCAAqB,EAAC,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,OAAO,MAAM,IAAA,uBAAY,EAAC,YAAY,EAAE,eAAe,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAA,iDAAe,EAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,IAAA,6CAAW,EAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CA4JF;AA/QD,4CA+QC;;AA1JC,0EAA0E;AAC1E,KAAK,2CACH,eAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAA,+CAAqB,EAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK,kCAAQ,eAAwB;IACnC,gDAAgD;IAChD,OAAO,MAAM,uBAAA,IAAI,oEAAe,MAAnB,IAAI,EAAgB,eAAe,CAAC,CAAC;AACpD,CAAC,mCAED,KAAK,yCAAe,eAAwB;IAC1C,QAAQ;IACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAQ,EAAC,SAAS,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtE,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,IAAA,uBAAY,EACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,qCAAa,CAClB,CAAC;IAEF,2CAA2C;IAC3C,oFAAoF;IACpF,8DAA8D;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;IAE5C,IAAI,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,kBAAkB,GAAG,IAAA,gCAAmB,EAC5C,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CACjB,CAAC;QAEF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAC/D,CAAC;QAEF,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,WAAW,GACf,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;YACjE,eAAe,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAEhD,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,IAAA,wBAAa,EACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO;QACP,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC,oCAED,KAAK,0CAAgB,eAAwB;IAC3C,qEAAqE;IACrE,MAAM,aAAa,GAAG,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,iCAAiC;QACjC,OAAO,MAAM,YAAY,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,uBAAA,IAAI,uCAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,qCAED,KAAK,2CAAiB,eAAwB;IAC5C,uDAAuD;IACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,uBAAA,IAAI,yCAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,EAAe,eAAe,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,CAAC,yBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,IAAI,uBAAA,IAAI,yCAAiB,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2CAA2C;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,uBAAA,IAAI,2CAAmB,CAAC;YACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { ValidationError, RateLimitedError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\nimport {\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n  getUserProfileLineage,\n  pairProfiles,\n} from './services';\nimport type { PairProfilesResponse } from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types';\nimport { computeIdentifierId } from './utils/identifier';\nimport * as timeUtils from './utils/time';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<\n    string | undefined,\n    Promise<LoginResponse>\n  >();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    return await pairProfiles(accessTokens, authAccessToken, this.#config.env);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    // get canonical profile id from server if not present in the cached session\n    if (!auth.profile.canonicalProfileId) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n    );\n\n    // Resolve original profileId from aliases.\n    // This is done mainly to preserve the original profileId for storage key derivation\n    // until we migrate to the canonical profileId storage system.\n    const canonicalProfileId = authResponse.profile.profileId;\n    const profile = { ...authResponse.profile };\n\n    if (authResponse.profileAliases?.length > 0) {\n      const targetIdentifierId = computeIdentifierId(\n        publicKey,\n        this.#config.env,\n      );\n\n      const matchingAliases = authResponse.profileAliases.filter((alias) =>\n        alias.identifierIds.some((id) => id.id === targetIdentifierId),\n      );\n\n      // Prefer the leaf alias (single identifier) — it's the original profile\n      // created for this SRP. Multi-identifier aliases are former canonicals\n      // that absorbed other profiles; they are correct only when this SRP's\n      // original profile was itself a canonical before being absorbed.\n      const targetAlias =\n        matchingAliases.find((alias) => alias.identifierIds.length === 1) ??\n        matchingAliases[0];\n\n      if (targetAlias) {\n        profile.profileId = targetAlias.aliasProfileId;\n      }\n    }\n\n    profile.canonicalProfileId = canonicalProfileId;\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(entropySourceId);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      return await loginPromise;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(entropySourceId);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}
+{"version":3,"file":"flow-srp.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,0CAA8D;AAC9D,wFAAiF;AACjF,kGAKkD;AAClD,kFAAyE;AACzE,6CAMoB;AAYpB,uDAAyD;AACzD,4DAA0C;AAW1C,0EAA0E;AAC1E,kFAAkF;AACrE,QAAA,kBAAkB,GAAG,KAAM,CAAC;AAEzC,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,IAAA,uDAA0B,GAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,wBAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,sDAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,IAAA,iEAA+B,EAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,sDAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAa,gBAAgB;IAgC3B,YACE,MAA2C,EAC3C,OAGC;;QApCM,2CAAoB;QAEpB,4CAGP;QAEO,gDAA+B;QAExC,yDAAyD;QAChD,0CAAiB,IAAI,GAAG,EAG9B,EAAC;QAEJ,qEAAqE;QACrE,2EAA2E;QAC3E,iEAAiE;QACxD,4CAAmB,IAAI,GAAG,EAGhC,EAAC;QAEJ,sDAAsD;QAC7C,sDAA2B;QAEpC,uDAAuD;QAC9C,oDAAyB;QAElC,mDAAkC;QAShC,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,oCAAmB,OAAO,CAAC,cAAc,MAAA,CAAC;QAC9C,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,uBAAA,IAAI,wCAAgB,CAAC;SACxD,MAAA,CAAC;QACF,uBAAA,IAAI,iCAAgB,OAAO,CAAC,WAAW,MAAA,CAAC;QAExC,4CAA4C;QAC5C,uBAAA,IAAI,uCACF,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,MAAA,CAAC;QACrD,uBAAA,IAAI,qCAAoB,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,MAAA,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,uBAAA,IAAI,oCAAmB,QAAQ,MAAA,CAAC;QAChC,uBAAA,IAAI,iCAAS,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,IAAA,gCAAqB,EAAC,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,uBAAA,IAAI,yCAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,uBAAY,EAC1B,YAAY,EACZ,eAAe,EACf,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CACjB,CAAC;QACF,yEAAyE;QACzE,4CAA4C;QAC5C,uBAAA,IAAI,yCAAiB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC7B,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,gBAAgB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,mEAAmE;YACnE,0CAA0C;YAC1C,uBAAA,IAAI,yCAAiB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC7B,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,0BAAkB;aAC3C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,oCAAoC;YACpC,uBAAA,IAAI,yCAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAA,iDAAe,EAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,IAAA,6CAAW,EAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CA4JF;AA1TD,4CA0TC;;AA1JC,0EAA0E;AAC1E,KAAK,2CACH,eAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAA,+CAAqB,EAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK,kCAAQ,eAAwB;IACnC,gDAAgD;IAChD,OAAO,MAAM,uBAAA,IAAI,oEAAe,MAAnB,IAAI,EAAgB,eAAe,CAAC,CAAC;AACpD,CAAC,mCAED,KAAK,yCAAe,eAAwB;IAC1C,QAAQ;IACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAQ,EAAC,SAAS,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtE,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,IAAA,uBAAY,EACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,qCAAa,CAClB,CAAC;IAEF,2CAA2C;IAC3C,oFAAoF;IACpF,8DAA8D;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;IAE5C,IAAI,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,kBAAkB,GAAG,IAAA,gCAAmB,EAC5C,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CACjB,CAAC;QAEF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAC/D,CAAC;QAEF,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,WAAW,GACf,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;YACjE,eAAe,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAEhD,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,IAAA,wBAAa,EACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO;QACP,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC,oCAED,KAAK,0CAAgB,eAAwB;IAC3C,qEAAqE;IACrE,MAAM,aAAa,GAAG,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,iCAAiC;QACjC,OAAO,MAAM,YAAY,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,uBAAA,IAAI,uCAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,qCAED,KAAK,2CAAiB,eAAwB;IAC5C,uDAAuD;IACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,uBAAA,IAAI,yCAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,EAAe,eAAe,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,CAAC,yBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,IAAI,uBAAA,IAAI,yCAAiB,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2CAA2C;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,uBAAA,IAAI,2CAAmB,CAAC;YACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { ValidationError, RateLimitedError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\nimport {\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n  getUserProfileLineage,\n  pairProfiles,\n} from './services';\nimport type { PairProfilesResponse } from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types';\nimport { computeIdentifierId } from './utils/identifier';\nimport * as timeUtils from './utils/time';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\n// How long a successful pairing result stays cached so identical payloads\n// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.\nexport const PAIR_DEDUPE_TTL_MS = 30_000;\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<\n    string | undefined,\n    Promise<LoginResponse>\n  >();\n\n  // Map to dedupe pairing calls by an order-insensitive token-set key.\n  // Holds the in-flight promise (coalescing concurrent callers) and keeps it\n  // for a short TTL after success (collapsing sequential retries).\n  readonly #ongoingPairings = new Map<\n    string,\n    { promise: Promise<PairProfilesResponse>; expiresAt: number }\n  >();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    // Order-insensitive key: the same token set in any order maps to the same\n    // entry. Sort a copy so the request payload itself stays primary-first.\n    const key = JSON.stringify([...accessTokens].sort());\n\n    const cached = this.#ongoingPairings.get(key);\n    if (cached && cached.expiresAt > Date.now()) {\n      return await cached.promise;\n    }\n\n    const promise = pairProfiles(\n      accessTokens,\n      authAccessToken,\n      this.#config.env,\n    );\n    // Store the in-flight promise immediately so concurrent callers coalesce\n    // regardless of how long the request takes.\n    this.#ongoingPairings.set(key, {\n      promise,\n      expiresAt: Number.MAX_SAFE_INTEGER,\n    });\n\n    try {\n      const result = await promise;\n      // Keep the resolved result cached for a short window so sequential\n      // retries with the same payload reuse it.\n      this.#ongoingPairings.set(key, {\n        promise,\n        expiresAt: Date.now() + PAIR_DEDUPE_TTL_MS,\n      });\n      return result;\n    } catch (error) {\n      // Never cache failures: the pairing retry loop must be able to re-hit\n      // the endpoint on the next attempt.\n      this.#ongoingPairings.delete(key);\n      throw error;\n    }\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    // get canonical profile id from server if not present in the cached session\n    if (!auth.profile.canonicalProfileId) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n    );\n\n    // Resolve original profileId from aliases.\n    // This is done mainly to preserve the original profileId for storage key derivation\n    // until we migrate to the canonical profileId storage system.\n    const canonicalProfileId = authResponse.profile.profileId;\n    const profile = { ...authResponse.profile };\n\n    if (authResponse.profileAliases?.length > 0) {\n      const targetIdentifierId = computeIdentifierId(\n        publicKey,\n        this.#config.env,\n      );\n\n      const matchingAliases = authResponse.profileAliases.filter((alias) =>\n        alias.identifierIds.some((id) => id.id === targetIdentifierId),\n      );\n\n      // Prefer the leaf alias (single identifier) — it's the original profile\n      // created for this SRP. Multi-identifier aliases are former canonicals\n      // that absorbed other profiles; they are correct only when this SRP's\n      // original profile was itself a canonical before being absorbed.\n      const targetAlias =\n        matchingAliases.find((alias) => alias.identifierIds.length === 1) ??\n        matchingAliases[0];\n\n      if (targetAlias) {\n        profile.profileId = targetAlias.aliasProfileId;\n      }\n    }\n\n    profile.canonicalProfileId = canonicalProfileId;\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(entropySourceId);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      return await loginPromise;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(entropySourceId);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/flow-srp.d.cts

@@ -10,6 +10,7 @@ type JwtBearerAuth_SRP_Options = {
         maxLoginRetries?: number;
     };
 };
+export declare const PAIR_DEDUPE_TTL_MS = 30000;
 export declare class SRPJwtBearerAuth implements IBaseAuth {
     #private;
     constructor(config: AuthConfig & {

package/dist/sdk/authentication-jwt-bearer/flow-srp.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe;AAE9C,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAiBnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAmB;AACvD,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAgB;AAIjB,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AA+BF,qBAAa,gBAAiB,YAAW,SAAS;;gBAyB9C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;KAAE,EAC3C,OAAO,EAAE,yBAAyB,GAAG;QACnC,cAAc,CAAC,EAAE,eAAe,CAAC;QACjC,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B;IAkBH,iBAAiB,CAAC,QAAQ,EAAE,eAAe;IAMrC,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU9D,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAKxB,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAI1B,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAIZ,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAkKrC"}
+{"version":3,"file":"flow-srp.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe;AAE9C,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAiBnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAmB;AACvD,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAgB;AAIjB,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AAIF,eAAO,MAAM,kBAAkB,QAAS,CAAC;AA+BzC,qBAAa,gBAAiB,YAAW,SAAS;;gBAiC9C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;KAAE,EAC3C,OAAO,EAAE,yBAAyB,GAAG;QACnC,cAAc,CAAC,EAAE,eAAe,CAAC;QACjC,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B;IAkBH,iBAAiB,CAAC,QAAQ,EAAE,eAAe;IAMrC,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU9D,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAKxB,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAuC1B,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAIZ,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAkKrC"}

package/dist/sdk/authentication-jwt-bearer/flow-srp.d.mts

@@ -10,6 +10,7 @@ type JwtBearerAuth_SRP_Options = {
         maxLoginRetries?: number;
     };
 };
+export declare const PAIR_DEDUPE_TTL_MS = 30000;
 export declare class SRPJwtBearerAuth implements IBaseAuth {
     #private;
     constructor(config: AuthConfig & {

package/dist/sdk/authentication-jwt-bearer/flow-srp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe;AAE9C,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAiBnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAmB;AACvD,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAgB;AAIjB,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AA+BF,qBAAa,gBAAiB,YAAW,SAAS;;gBAyB9C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;KAAE,EAC3C,OAAO,EAAE,yBAAyB,GAAG;QACnC,cAAc,CAAC,EAAE,eAAe,CAAC;QACjC,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B;IAkBH,iBAAiB,CAAC,QAAQ,EAAE,eAAe;IAMrC,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU9D,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAKxB,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAI1B,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAIZ,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAkKrC"}
+{"version":3,"file":"flow-srp.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe;AAE9C,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAoC;AAiBnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAmB;AACvD,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EAET,WAAW,EACX,kBAAkB,EACnB,oBAAgB;AAIjB,KAAK,yBAAyB,GAAG;IAC/B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE;QACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,CAAC;AAIF,eAAO,MAAM,kBAAkB,QAAS,CAAC;AA+BzC,qBAAa,gBAAiB,YAAW,SAAS;;gBAiC9C,MAAM,EAAE,UAAU,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAA;KAAE,EAC3C,OAAO,EAAE,yBAAyB,GAAG;QACnC,cAAc,CAAC,EAAE,eAAe,CAAC;QACjC,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B;IAkBH,iBAAiB,CAAC,QAAQ,EAAE,eAAe;IAMrC,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzD,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAU9D,aAAa,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIxD,qBAAqB,CACzB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAKxB,eAAe,CACnB,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAuC1B,WAAW,CACf,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAIZ,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAkKrC"}

package/dist/sdk/authentication-jwt-bearer/flow-srp.mjs

@@ -9,7 +9,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _SRPJwtBearerAuth_instances, _SRPJwtBearerAuth_config, _SRPJwtBearerAuth_options, _SRPJwtBearerAuth_metametrics, _SRPJwtBearerAuth_ongoingLogins, _SRPJwtBearerAuth_cooldownDefaultMs, _SRPJwtBearerAuth_maxLoginRetries, _SRPJwtBearerAuth_customProvider, _SRPJwtBearerAuth_getAuthSession, _SRPJwtBearerAuth_login, _SRPJwtBearerAuth_performLogin, _SRPJwtBearerAuth_deferredLogin, _SRPJwtBearerAuth_loginWithRetry, _SRPJwtBearerAuth_createSrpLoginRawMessage;
+var _SRPJwtBearerAuth_instances, _SRPJwtBearerAuth_config, _SRPJwtBearerAuth_options, _SRPJwtBearerAuth_metametrics, _SRPJwtBearerAuth_ongoingLogins, _SRPJwtBearerAuth_ongoingPairings, _SRPJwtBearerAuth_cooldownDefaultMs, _SRPJwtBearerAuth_maxLoginRetries, _SRPJwtBearerAuth_customProvider, _SRPJwtBearerAuth_getAuthSession, _SRPJwtBearerAuth_login, _SRPJwtBearerAuth_performLogin, _SRPJwtBearerAuth_deferredLogin, _SRPJwtBearerAuth_loginWithRetry, _SRPJwtBearerAuth_createSrpLoginRawMessage;
 import { ValidationError, RateLimitedError } from "../errors.mjs";
 import { getMetaMaskProviderEIP6963 } from "../utils/eip-6963-metamask-provider.mjs";
 import { MESSAGE_SIGNING_SNAP, assertMessageStartsWithMetamask, connectSnap, isSnapConnected } from "../utils/messaging-signing-snap-requests.mjs";
@@ -17,6 +17,9 @@ import { validateLoginResponse } from "../utils/validate-login-response.mjs";
 import { authenticate, authorizeOIDC, getNonce, getUserProfileLineage, pairProfiles } from "./services.mjs";
 import { computeIdentifierId } from "./utils/identifier.mjs";
 import * as timeUtils from "./utils/time.mjs";
+// How long a successful pairing result stays cached so identical payloads
+// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.
+export const PAIR_DEDUPE_TTL_MS = 30000;
 const getDefaultEIP6963Provider = async () => {
     const provider = await getMetaMaskProviderEIP6963();
     if (!provider) {
@@ -43,6 +46,10 @@ export class SRPJwtBearerAuth {
         _SRPJwtBearerAuth_metametrics.set(this, void 0);
         // Map to store ongoing login promises by entropySourceId
         _SRPJwtBearerAuth_ongoingLogins.set(this, new Map());
+        // Map to dedupe pairing calls by an order-insensitive token-set key.
+        // Holds the in-flight promise (coalescing concurrent callers) and keeps it
+        // for a short TTL after success (collapsing sequential retries).
+        _SRPJwtBearerAuth_ongoingPairings.set(this, new Map());
         // Default cooldown when 429 has no Retry-After header
         _SRPJwtBearerAuth_cooldownDefaultMs.set(this, void 0);
         // Maximum number of login retries on rate limit errors
@@ -89,7 +96,36 @@ export class SRPJwtBearerAuth {
         return await getUserProfileLineage(__classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env, accessToken);
     }
     async pairSrpProfiles(accessTokens, authAccessToken) {
-        return await pairProfiles(accessTokens, authAccessToken, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+        // Order-insensitive key: the same token set in any order maps to the same
+        // entry. Sort a copy so the request payload itself stays primary-first.
+        const key = JSON.stringify([...accessTokens].sort());
+        const cached = __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").get(key);
+        if (cached && cached.expiresAt > Date.now()) {
+            return await cached.promise;
+        }
+        const promise = pairProfiles(accessTokens, authAccessToken, __classPrivateFieldGet(this, _SRPJwtBearerAuth_config, "f").env);
+        // Store the in-flight promise immediately so concurrent callers coalesce
+        // regardless of how long the request takes.
+        __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").set(key, {
+            promise,
+            expiresAt: Number.MAX_SAFE_INTEGER,
+        });
+        try {
+            const result = await promise;
+            // Keep the resolved result cached for a short window so sequential
+            // retries with the same payload reuse it.
+            __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").set(key, {
+                promise,
+                expiresAt: Date.now() + PAIR_DEDUPE_TTL_MS,
+            });
+            return result;
+        }
+        catch (error) {
+            // Never cache failures: the pairing retry loop must be able to re-hit
+            // the endpoint on the next attempt.
+            __classPrivateFieldGet(this, _SRPJwtBearerAuth_ongoingPairings, "f").delete(key);
+            throw error;
+        }
     }
     async signMessage(message, entropySourceId) {
         return await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").signing.signMessage(message, entropySourceId);
@@ -108,7 +144,7 @@ export class SRPJwtBearerAuth {
         return res;
     }
 }
-_SRPJwtBearerAuth_config = new WeakMap(), _SRPJwtBearerAuth_options = new WeakMap(), _SRPJwtBearerAuth_metametrics = new WeakMap(), _SRPJwtBearerAuth_ongoingLogins = new WeakMap(), _SRPJwtBearerAuth_cooldownDefaultMs = new WeakMap(), _SRPJwtBearerAuth_maxLoginRetries = new WeakMap(), _SRPJwtBearerAuth_customProvider = new WeakMap(), _SRPJwtBearerAuth_instances = new WeakSet(), _SRPJwtBearerAuth_getAuthSession = 
+_SRPJwtBearerAuth_config = new WeakMap(), _SRPJwtBearerAuth_options = new WeakMap(), _SRPJwtBearerAuth_metametrics = new WeakMap(), _SRPJwtBearerAuth_ongoingLogins = new WeakMap(), _SRPJwtBearerAuth_ongoingPairings = new WeakMap(), _SRPJwtBearerAuth_cooldownDefaultMs = new WeakMap(), _SRPJwtBearerAuth_maxLoginRetries = new WeakMap(), _SRPJwtBearerAuth_customProvider = new WeakMap(), _SRPJwtBearerAuth_instances = new WeakSet(), _SRPJwtBearerAuth_getAuthSession = 
 // convert expiresIn from seconds to milliseconds and use 90% of expiresIn
 async function _SRPJwtBearerAuth_getAuthSession(entropySourceId) {
     const auth = await __classPrivateFieldGet(this, _SRPJwtBearerAuth_options, "f").storage.getLoginResponse(entropySourceId);

package/dist/sdk/authentication-jwt-bearer/flow-srp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"flow-srp.mjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAkB;AAC9D,OAAO,EAAE,0BAA0B,EAAE,gDAA4C;AACjF,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,WAAW,EACX,eAAe,EAChB,qDAAiD;AAClD,OAAO,EAAE,qBAAqB,EAAE,6CAAyC;AACzE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,qBAAqB,EACrB,YAAY,EACb,uBAAmB;AAYpB,OAAO,EAAE,mBAAmB,EAAE,+BAA2B;AACzD,OAAO,KAAK,SAAS,yBAAqB;AAW1C,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IAwB3B,YACE,MAA2C,EAC3C,OAGC;;QA5BM,2CAAoB;QAEpB,4CAGP;QAEO,gDAA+B;QAExC,yDAAyD;QAChD,0CAAiB,IAAI,GAAG,EAG9B,EAAC;QAEJ,sDAAsD;QAC7C,sDAA2B;QAEpC,uDAAuD;QAC9C,oDAAyB;QAElC,mDAAkC;QAShC,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,oCAAmB,OAAO,CAAC,cAAc,MAAA,CAAC;QAC9C,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,uBAAA,IAAI,wCAAgB,CAAC;SACxD,MAAA,CAAC;QACF,uBAAA,IAAI,iCAAgB,OAAO,CAAC,WAAW,MAAA,CAAC;QAExC,4CAA4C;QAC5C,uBAAA,IAAI,uCACF,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,MAAA,CAAC;QACrD,uBAAA,IAAI,qCAAoB,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,MAAA,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,uBAAA,IAAI,oCAAmB,QAAQ,MAAA,CAAC;QAChC,uBAAA,IAAI,iCAAS,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,qBAAqB,CAAC,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,OAAO,MAAM,YAAY,CAAC,YAAY,EAAE,eAAe,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CA4JF;;AA1JC,0EAA0E;AAC1E,KAAK,2CACH,eAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK,kCAAQ,eAAwB;IACnC,gDAAgD;IAChD,OAAO,MAAM,uBAAA,IAAI,oEAAe,MAAnB,IAAI,EAAgB,eAAe,CAAC,CAAC;AACpD,CAAC,mCAED,KAAK,yCAAe,eAAwB;IAC1C,QAAQ;IACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtE,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,qCAAa,CAClB,CAAC;IAEF,2CAA2C;IAC3C,oFAAoF;IACpF,8DAA8D;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;IAE5C,IAAI,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,kBAAkB,GAAG,mBAAmB,CAC5C,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CACjB,CAAC;QAEF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAC/D,CAAC;QAEF,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,WAAW,GACf,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;YACjE,eAAe,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAEhD,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO;QACP,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC,oCAED,KAAK,0CAAgB,eAAwB;IAC3C,qEAAqE;IACrE,MAAM,aAAa,GAAG,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,iCAAiC;QACjC,OAAO,MAAM,YAAY,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,uBAAA,IAAI,uCAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,qCAED,KAAK,2CAAiB,eAAwB;IAC5C,uDAAuD;IACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,uBAAA,IAAI,yCAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,EAAe,eAAe,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,IAAI,uBAAA,IAAI,yCAAiB,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2CAA2C;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,uBAAA,IAAI,2CAAmB,CAAC;YACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { ValidationError, RateLimitedError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\nimport {\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n  getUserProfileLineage,\n  pairProfiles,\n} from './services';\nimport type { PairProfilesResponse } from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types';\nimport { computeIdentifierId } from './utils/identifier';\nimport * as timeUtils from './utils/time';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<\n    string | undefined,\n    Promise<LoginResponse>\n  >();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    return await pairProfiles(accessTokens, authAccessToken, this.#config.env);\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    // get canonical profile id from server if not present in the cached session\n    if (!auth.profile.canonicalProfileId) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n    );\n\n    // Resolve original profileId from aliases.\n    // This is done mainly to preserve the original profileId for storage key derivation\n    // until we migrate to the canonical profileId storage system.\n    const canonicalProfileId = authResponse.profile.profileId;\n    const profile = { ...authResponse.profile };\n\n    if (authResponse.profileAliases?.length > 0) {\n      const targetIdentifierId = computeIdentifierId(\n        publicKey,\n        this.#config.env,\n      );\n\n      const matchingAliases = authResponse.profileAliases.filter((alias) =>\n        alias.identifierIds.some((id) => id.id === targetIdentifierId),\n      );\n\n      // Prefer the leaf alias (single identifier) — it's the original profile\n      // created for this SRP. Multi-identifier aliases are former canonicals\n      // that absorbed other profiles; they are correct only when this SRP's\n      // original profile was itself a canonical before being absorbed.\n      const targetAlias =\n        matchingAliases.find((alias) => alias.identifierIds.length === 1) ??\n        matchingAliases[0];\n\n      if (targetAlias) {\n        profile.profileId = targetAlias.aliasProfileId;\n      }\n    }\n\n    profile.canonicalProfileId = canonicalProfileId;\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(entropySourceId);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      return await loginPromise;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(entropySourceId);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}
+{"version":3,"file":"flow-srp.mjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/flow-srp.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,sBAAkB;AAC9D,OAAO,EAAE,0BAA0B,EAAE,gDAA4C;AACjF,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,WAAW,EACX,eAAe,EAChB,qDAAiD;AAClD,OAAO,EAAE,qBAAqB,EAAE,6CAAyC;AACzE,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,qBAAqB,EACrB,YAAY,EACb,uBAAmB;AAYpB,OAAO,EAAE,mBAAmB,EAAE,+BAA2B;AACzD,OAAO,KAAK,SAAS,yBAAqB;AAW1C,0EAA0E;AAC1E,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAEzC,MAAM,yBAAyB,GAAG,KAAK,IAAI,EAAE;IAC3C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CACtC,cAAgC,EACZ,EAAE,CAAC,CAAC;IACxB,aAAa,EAAE,KAAK,EAAE,eAAwB,EAAmB,EAAE;QACjE,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,CAAC;IACD,WAAW,EAAE,KAAK,EAChB,OAAe,EACf,eAAwB,EACP,EAAE;QACnB,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QACvE,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,oBAAoB,CAAC,WAAW,CAC3C,QAAQ,EACR,OAAO,EACP,eAAe,CAChB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,gBAAgB;IAgC3B,YACE,MAA2C,EAC3C,OAGC;;QApCM,2CAAoB;QAEpB,4CAGP;QAEO,gDAA+B;QAExC,yDAAyD;QAChD,0CAAiB,IAAI,GAAG,EAG9B,EAAC;QAEJ,qEAAqE;QACrE,2EAA2E;QAC3E,iEAAiE;QACxD,4CAAmB,IAAI,GAAG,EAGhC,EAAC;QAEJ,sDAAsD;QAC7C,sDAA2B;QAEpC,uDAAuD;QAC9C,oDAAyB;QAElC,mDAAkC;QAShC,uBAAA,IAAI,4BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,oCAAmB,OAAO,CAAC,cAAc,MAAA,CAAC;QAC9C,uBAAA,IAAI,6BAAY;YACd,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EACL,OAAO,CAAC,OAAO;gBACf,+BAA+B,CAAC,uBAAA,IAAI,wCAAgB,CAAC;SACxD,MAAA,CAAC;QACF,uBAAA,IAAI,iCAAgB,OAAO,CAAC,WAAW,MAAA,CAAC;QAExC,4CAA4C;QAC5C,uBAAA,IAAI,uCACF,OAAO,CAAC,cAAc,EAAE,iBAAiB,IAAI,KAAK,MAAA,CAAC;QACrD,uBAAA,IAAI,qCAAoB,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,CAAC,MAAA,CAAC;IACvE,CAAC;IAED,iBAAiB,CAAC,QAAyB;QACzC,uBAAA,IAAI,oCAAmB,QAAQ,MAAA,CAAC;QAChC,uBAAA,IAAI,iCAAS,CAAC,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED,0HAA0H;IAC1H,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACnC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAAwB;QAC3C,MAAM,OAAO,GAAG,MAAM,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,uBAAA,IAAI,4DAAO,MAAX,IAAI,EAAQ,eAAe,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC/D,OAAO,MAAM,qBAAqB,CAAC,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,YAAsB,EACtB,eAAuB;QAEvB,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,uBAAA,IAAI,yCAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAC1B,YAAY,EACZ,eAAe,EACf,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CACjB,CAAC;QACF,yEAAyE;QACzE,4CAA4C;QAC5C,uBAAA,IAAI,yCAAiB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC7B,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,gBAAgB;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC7B,mEAAmE;YACnE,0CAA0C;YAC1C,uBAAA,IAAI,yCAAiB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC7B,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;aAC3C,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,oCAAoC;YACpC,uBAAA,IAAI,yCAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,eAAwB;QAExB,OAAO,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GACZ,uBAAA,IAAI,wCAAgB,IAAI,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC;IACb,CAAC;CA4JF;;AA1JC,0EAA0E;AAC1E,KAAK,2CACH,eAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC3E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,GAAG,GAAG,CAAC;IAE3D,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,4BAED,KAAK,kCAAQ,eAAwB;IACnC,gDAAgD;IAChD,OAAO,MAAM,uBAAA,IAAI,oEAAe,MAAnB,IAAI,EAAgB,eAAe,CAAC,CAAC;AACpD,CAAC,mCAED,KAAK,yCAAe,eAAwB;IAC1C,QAAQ;IACR,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,uBAAA,IAAI,+EAA0B,MAA9B,IAAI,EACrB,QAAQ,CAAC,KAAK,EACd,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAEtE,eAAe;IACf,MAAM,YAAY,GAAG,MAAM,YAAY,CACrC,UAAU,EACV,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,IAAI,EACjB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,qCAAa,CAClB,CAAC;IAEF,2CAA2C;IAC3C,oFAAoF;IACpF,8DAA8D;IAC9D,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1D,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;IAE5C,IAAI,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,kBAAkB,GAAG,mBAAmB,CAC5C,SAAS,EACT,uBAAA,IAAI,gCAAQ,CAAC,GAAG,CACjB,CAAC;QAEF,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAC/D,CAAC;QAEF,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,WAAW,GACf,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;YACjE,eAAe,CAAC,CAAC,CAAC,CAAC;QAErB,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAEhD,YAAY;IACZ,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,YAAY,CAAC,KAAK,EAClB,uBAAA,IAAI,gCAAQ,CAAC,GAAG,EAChB,uBAAA,IAAI,gCAAQ,CAAC,QAAQ,CACtB,CAAC;IAEF,OAAO;IACP,MAAM,MAAM,GAAkB;QAC5B,OAAO;QACP,KAAK,EAAE,aAAa;KACrB,CAAC;IAEF,MAAM,uBAAA,IAAI,iCAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC;AAChB,CAAC,oCAED,KAAK,0CAAgB,eAAwB;IAC3C,qEAAqE;IACrE,MAAM,aAAa,GAAG,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/D,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,uBAAA,IAAI,qEAAgB,MAApB,IAAI,EAAiB,eAAe,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,uBAAA,IAAI,uCAAe,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,iCAAiC;QACjC,OAAO,MAAM,YAAY,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,uBAAA,IAAI,uCAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,qCAED,KAAK,2CAAiB,eAAwB;IAC5C,uDAAuD;IACvD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,uBAAA,IAAI,yCAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,MAAM,uBAAA,IAAI,mEAAc,MAAlB,IAAI,EAAe,eAAe,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,CAAC;YACV,CAAC;YAED,uCAAuC;YACvC,IAAI,OAAO,IAAI,uBAAA,IAAI,yCAAiB,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC;YACV,CAAC;YAED,2CAA2C;YAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,IAAI,uBAAA,IAAI,2CAAmB,CAAC;YACzD,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE9B,0BAA0B;QAC5B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC,mGAGC,KAAa,EACb,SAAiB;IAEjB,OAAO,YAAY,KAAK,IAAI,SAAS,EAAW,CAAC;AACnD,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { ValidationError, RateLimitedError } from '../errors';\nimport { getMetaMaskProviderEIP6963 } from '../utils/eip-6963-metamask-provider';\nimport {\n  MESSAGE_SIGNING_SNAP,\n  assertMessageStartsWithMetamask,\n  connectSnap,\n  isSnapConnected,\n} from '../utils/messaging-signing-snap-requests';\nimport { validateLoginResponse } from '../utils/validate-login-response';\nimport {\n  authenticate,\n  authorizeOIDC,\n  getNonce,\n  getUserProfileLineage,\n  pairProfiles,\n} from './services';\nimport type { PairProfilesResponse } from './services';\nimport type {\n  AuthConfig,\n  AuthSigningOptions,\n  AuthStorageOptions,\n  AuthType,\n  IBaseAuth,\n  LoginResponse,\n  UserProfile,\n  UserProfileLineage,\n} from './types';\nimport { computeIdentifierId } from './utils/identifier';\nimport * as timeUtils from './utils/time';\n\ntype JwtBearerAuth_SRP_Options = {\n  storage: AuthStorageOptions;\n  signing?: AuthSigningOptions;\n  rateLimitRetry?: {\n    cooldownDefaultMs?: number; // default cooldown when 429 has no Retry-After\n    maxLoginRetries?: number; // maximum number of login retries on rate limit\n  };\n};\n\n// How long a successful pairing result stays cached so identical payloads\n// (concurrent or sequential retries) reuse it instead of re-hitting the endpoint.\nexport const PAIR_DEDUPE_TTL_MS = 30_000;\n\nconst getDefaultEIP6963Provider = async () => {\n  const provider = await getMetaMaskProviderEIP6963();\n  if (!provider) {\n    throw new ValidationError('No MetaMask wallet connected');\n  }\n  return provider;\n};\n\nconst getDefaultEIP6963SigningOptions = (\n  customProvider?: Eip1193Provider,\n): AuthSigningOptions => ({\n  getIdentifier: async (entropySourceId?: string): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    return await MESSAGE_SIGNING_SNAP.getPublicKey(provider, entropySourceId);\n  },\n  signMessage: async (\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> => {\n    const provider = customProvider ?? (await getDefaultEIP6963Provider());\n    assertMessageStartsWithMetamask(message);\n    return await MESSAGE_SIGNING_SNAP.signMessage(\n      provider,\n      message,\n      entropySourceId,\n    );\n  },\n});\n\nexport class SRPJwtBearerAuth implements IBaseAuth {\n  readonly #config: AuthConfig;\n\n  readonly #options: {\n    storage: AuthStorageOptions;\n    signing: AuthSigningOptions;\n  };\n\n  readonly #metametrics?: MetaMetricsAuth;\n\n  // Map to store ongoing login promises by entropySourceId\n  readonly #ongoingLogins = new Map<\n    string | undefined,\n    Promise<LoginResponse>\n  >();\n\n  // Map to dedupe pairing calls by an order-insensitive token-set key.\n  // Holds the in-flight promise (coalescing concurrent callers) and keeps it\n  // for a short TTL after success (collapsing sequential retries).\n  readonly #ongoingPairings = new Map<\n    string,\n    { promise: Promise<PairProfilesResponse>; expiresAt: number }\n  >();\n\n  // Default cooldown when 429 has no Retry-After header\n  readonly #cooldownDefaultMs: number;\n\n  // Maximum number of login retries on rate limit errors\n  readonly #maxLoginRetries: number;\n\n  #customProvider?: Eip1193Provider;\n\n  constructor(\n    config: AuthConfig & { type: AuthType.SRP },\n    options: JwtBearerAuth_SRP_Options & {\n      customProvider?: Eip1193Provider;\n      metametrics?: MetaMetricsAuth;\n    },\n  ) {\n    this.#config = config;\n    this.#customProvider = options.customProvider;\n    this.#options = {\n      storage: options.storage,\n      signing:\n        options.signing ??\n        getDefaultEIP6963SigningOptions(this.#customProvider),\n    };\n    this.#metametrics = options.metametrics;\n\n    // Apply rate limit retry config if provided\n    this.#cooldownDefaultMs =\n      options.rateLimitRetry?.cooldownDefaultMs ?? 10000;\n    this.#maxLoginRetries = options.rateLimitRetry?.maxLoginRetries ?? 1;\n  }\n\n  setCustomProvider(provider: Eip1193Provider) {\n    this.#customProvider = provider;\n    this.#options.signing = getDefaultEIP6963SigningOptions(provider);\n  }\n\n  // TODO: might be easier to keep entropySourceId as a class param and use multiple SRPJwtBearerAuth instances where needed\n  async getAccessToken(entropySourceId?: string): Promise<string> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.token.accessToken;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.token.accessToken;\n  }\n\n  async getUserProfile(entropySourceId?: string): Promise<UserProfile> {\n    const session = await this.#getAuthSession(entropySourceId);\n    if (session) {\n      return session.profile;\n    }\n\n    const loginResponse = await this.#login(entropySourceId);\n    return loginResponse.profile;\n  }\n\n  async getIdentifier(entropySourceId?: string): Promise<string> {\n    return await this.#options.signing.getIdentifier(entropySourceId);\n  }\n\n  async getUserProfileLineage(\n    entropySourceId?: string,\n  ): Promise<UserProfileLineage> {\n    const accessToken = await this.getAccessToken(entropySourceId);\n    return await getUserProfileLineage(this.#config.env, accessToken);\n  }\n\n  async pairSrpProfiles(\n    accessTokens: string[],\n    authAccessToken: string,\n  ): Promise<PairProfilesResponse> {\n    // Order-insensitive key: the same token set in any order maps to the same\n    // entry. Sort a copy so the request payload itself stays primary-first.\n    const key = JSON.stringify([...accessTokens].sort());\n\n    const cached = this.#ongoingPairings.get(key);\n    if (cached && cached.expiresAt > Date.now()) {\n      return await cached.promise;\n    }\n\n    const promise = pairProfiles(\n      accessTokens,\n      authAccessToken,\n      this.#config.env,\n    );\n    // Store the in-flight promise immediately so concurrent callers coalesce\n    // regardless of how long the request takes.\n    this.#ongoingPairings.set(key, {\n      promise,\n      expiresAt: Number.MAX_SAFE_INTEGER,\n    });\n\n    try {\n      const result = await promise;\n      // Keep the resolved result cached for a short window so sequential\n      // retries with the same payload reuse it.\n      this.#ongoingPairings.set(key, {\n        promise,\n        expiresAt: Date.now() + PAIR_DEDUPE_TTL_MS,\n      });\n      return result;\n    } catch (error) {\n      // Never cache failures: the pairing retry loop must be able to re-hit\n      // the endpoint on the next attempt.\n      this.#ongoingPairings.delete(key);\n      throw error;\n    }\n  }\n\n  async signMessage(\n    message: string,\n    entropySourceId?: string,\n  ): Promise<string> {\n    return await this.#options.signing.signMessage(message, entropySourceId);\n  }\n\n  async isSnapConnected(): Promise<boolean> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n    if (!provider) {\n      return false;\n    }\n\n    const isConnected = await isSnapConnected(provider);\n    return isConnected;\n  }\n\n  async connectSnap(): Promise<string> {\n    const provider =\n      this.#customProvider ?? (await getDefaultEIP6963Provider());\n\n    const res = await connectSnap(provider);\n    return res;\n  }\n\n  // convert expiresIn from seconds to milliseconds and use 90% of expiresIn\n  async #getAuthSession(\n    entropySourceId?: string,\n  ): Promise<LoginResponse | null> {\n    const auth = await this.#options.storage.getLoginResponse(entropySourceId);\n    if (!validateLoginResponse(auth)) {\n      return null;\n    }\n\n    // get canonical profile id from server if not present in the cached session\n    if (!auth.profile.canonicalProfileId) {\n      return null;\n    }\n\n    const currentTime = Date.now();\n    const sessionAge = currentTime - auth.token.obtainedAt;\n    const refreshThreshold = auth.token.expiresIn * 1000 * 0.9;\n\n    if (sessionAge < refreshThreshold) {\n      return auth;\n    }\n    return null;\n  }\n\n  async #login(entropySourceId?: string): Promise<LoginResponse> {\n    // Use a deferred login to avoid race conditions\n    return await this.#deferredLogin(entropySourceId);\n  }\n\n  async #performLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Nonce\n    const publicKey = await this.getIdentifier(entropySourceId);\n    const nonceRes = await getNonce(publicKey, this.#config.env);\n\n    const rawMessage = this.#createSrpLoginRawMessage(\n      nonceRes.nonce,\n      publicKey,\n    );\n    const signature = await this.signMessage(rawMessage, entropySourceId);\n\n    // Authenticate\n    const authResponse = await authenticate(\n      rawMessage,\n      signature,\n      this.#config.type,\n      this.#config.env,\n      this.#metametrics,\n    );\n\n    // Resolve original profileId from aliases.\n    // This is done mainly to preserve the original profileId for storage key derivation\n    // until we migrate to the canonical profileId storage system.\n    const canonicalProfileId = authResponse.profile.profileId;\n    const profile = { ...authResponse.profile };\n\n    if (authResponse.profileAliases?.length > 0) {\n      const targetIdentifierId = computeIdentifierId(\n        publicKey,\n        this.#config.env,\n      );\n\n      const matchingAliases = authResponse.profileAliases.filter((alias) =>\n        alias.identifierIds.some((id) => id.id === targetIdentifierId),\n      );\n\n      // Prefer the leaf alias (single identifier) — it's the original profile\n      // created for this SRP. Multi-identifier aliases are former canonicals\n      // that absorbed other profiles; they are correct only when this SRP's\n      // original profile was itself a canonical before being absorbed.\n      const targetAlias =\n        matchingAliases.find((alias) => alias.identifierIds.length === 1) ??\n        matchingAliases[0];\n\n      if (targetAlias) {\n        profile.profileId = targetAlias.aliasProfileId;\n      }\n    }\n\n    profile.canonicalProfileId = canonicalProfileId;\n\n    // Authorize\n    const tokenResponse = await authorizeOIDC(\n      authResponse.token,\n      this.#config.env,\n      this.#config.platform,\n    );\n\n    // Save\n    const result: LoginResponse = {\n      profile,\n      token: tokenResponse,\n    };\n\n    await this.#options.storage.setLoginResponse(result, entropySourceId);\n\n    return result;\n  }\n\n  async #deferredLogin(entropySourceId?: string): Promise<LoginResponse> {\n    // Check if there's already an ongoing login for this entropySourceId\n    const existingLogin = this.#ongoingLogins.get(entropySourceId);\n    if (existingLogin) {\n      return existingLogin;\n    }\n\n    // Create a new login promise\n    const loginPromise = this.#loginWithRetry(entropySourceId);\n\n    // Store the promise in the map\n    this.#ongoingLogins.set(entropySourceId, loginPromise);\n\n    try {\n      // Wait for the login to complete\n      return await loginPromise;\n    } finally {\n      // Always clean up the ongoing login promise when done\n      this.#ongoingLogins.delete(entropySourceId);\n    }\n  }\n\n  async #loginWithRetry(entropySourceId?: string): Promise<LoginResponse> {\n    // Allow max attempts: initial + maxLoginRetries on 429\n    for (let attempt = 0; attempt < 1 + this.#maxLoginRetries; attempt += 1) {\n      try {\n        return await this.#performLogin(entropySourceId);\n      } catch (e) {\n        // Only retry on rate-limit (429) errors\n        if (!RateLimitedError.isRateLimitError(e)) {\n          throw e;\n        }\n\n        // If we've exhausted attempts, rethrow\n        if (attempt >= this.#maxLoginRetries) {\n          throw e;\n        }\n\n        // Wait for Retry-After or default cooldown\n        const waitMs = e.retryAfterMs ?? this.#cooldownDefaultMs;\n        await timeUtils.delay(waitMs);\n\n        // Loop continues to retry\n      }\n    }\n\n    // Should never reach here due to loop logic, but TypeScript needs a return\n    throw new Error('Unexpected: login loop exhausted without result');\n  }\n\n  #createSrpLoginRawMessage(\n    nonce: string,\n    publicKey: string,\n  ): `metamask:${string}:${string}` {\n    return `metamask:${nonce}:${publicKey}` as const;\n  }\n}\n"]}

package/dist/sdk/user-storage.cjs

@@ -68,13 +68,13 @@ class UserStorage {
     async getStorageKey(entropySourceId) {
         const userProfile = await this.config.auth.getUserProfile(entropySourceId);
         const message = `metamask:${userProfile.profileId}`;
-        const storageKey = await this.options.storage?.getStorageKey(message);
+        const storageKey = await this.options.storage?.getStorageKey(message, entropySourceId);
         if (storageKey) {
             return storageKey;
         }
         const storageKeySignature = await this.config.auth.signMessage(message, entropySourceId);
         const hashedStorageKeySignature = (0, encryption_1.createSHA256Hash)(storageKeySignature);
-        await this.options.storage?.setStorageKey(message, hashedStorageKeySignature);
+        await this.options.storage?.setStorageKey(message, hashedStorageKeySignature, entropySourceId);
         return hashedStorageKeySignature;
     }
 }