@metamask/profile-sync-controller 28.3.0 → 30.0.0

package/CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [30.0.0]
+
+### Added
+
+- **BREAKING:** Add social identifier pairing after SRP sign-in (`POST /api/v2/profile/pair/identifier`) ([#10128](https://github.com/MetaMask/core/pull/10128))
+  - Add `needsSocialPairing?: boolean` to state (defaults `true`; cleared on success or 409 Conflict; left `true` on other failures so the next `performSignIn` retries; cleared without an API call when the user never logged in with a social provider). If `authConnection` is set but the seedless vault is not written yet, the flag stays `true` so onboarding-in-flight sign-ins can retry. Optional in the type so partial-state selectors stay assignable; treat `undefined` as `true`.
+  - Add optional `isSocialPairingEnabled` config callback (defaults to `() => false`). When it returns `true`, Google/Apple/Telegram seedless users are paired after SRP login and profile pairing. Telegram never sends `email` (clients store a display name there).
+  - Use `SeedlessOnboardingController:getAccessToken` to fetch the social JWT (refreshed when expired).
+  - Add `pairSocialIdentifier` to `JwtBearerAuth` / `SRPJwtBearerAuth` and `PairConflictError` for 409 Conflict.
+
+### Changed
+
+- **BREAKING:** Derive auth and user-storage message-signing keys natively via SIP-6 from HD keyring seeds instead of calling `@metamask/message-signing-snap` through `SnapController`. `AuthenticationController` and `UserStorageController` now require `KeyringController:withKeyringV2Unsafe` and no longer call `SnapController:handleRequest`. The message-signing snap remains for Portfolio / external origins ([#9824](https://github.com/MetaMask/core/pull/9824))
+  - Derive native SIP-6 keys with `@noble/hashes` HMAC-SHA-512 instead of Web Crypto, so auth works on React Native, whose SubtleCrypto cannot HMAC.
+- Resolve HD entropy source IDs from `KeyringController` instead of the message-signing snap (`getBearerToken` primary ID, `performSignIn` SRP enumeration) ([#9794](https://github.com/MetaMask/core/pull/9794))
+- Bump `@metamask/keyring-controller` from `^27.1.0` to `^27.1.1` ([#9791](https://github.com/MetaMask/core/pull/9791))
+- Add `@metamask/key-tree` and `@noble/curves`; remove unused `@metamask/snaps-controllers`, `@metamask/snaps-sdk`, and `@metamask/snaps-utils` dependencies ([#9824](https://github.com/MetaMask/core/pull/9824))
+- Bump `@metamask/utils` from `^11.11.0` to `^11.12.0` ([#10076](https://github.com/MetaMask/core/pull/10076))
+
+## [29.0.0]
+
+### Changed
+
+- **BREAKING:** Tag `/srp/login` with SRP slot and social provider metadata ([#9741](https://github.com/MetaMask/core/pull/9741), [#9776](https://github.com/MetaMask/core/pull/9776))
+  - Append `primary` | `secondary` to `raw_message` (`metamask:<nonce>:<pubkey>:<tag>`; `primary` for the first HD entropy source). Leave `raw_message` untagged when `getLoginTag` is not provided. Include `metametrics.identifier_type` (`SRP` | `GOOGLE` | `APPLE` | `TELEGRAM`; social vault primary maps from `SeedlessOnboardingController.state.authConnection`).
+- Bump `@metamask/seedless-onboarding-controller` from `^10.1.0` to `^10.1.1` ([#9779](https://github.com/MetaMask/core/pull/9779))
+
 ## [28.3.0]
 
 ### Added
@@ -897,7 +924,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial release
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@28.3.0...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@30.0.0...HEAD
+[30.0.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@29.0.0...@metamask/profile-sync-controller@30.0.0
+[29.0.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@28.3.0...@metamask/profile-sync-controller@29.0.0
 [28.3.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@28.2.0...@metamask/profile-sync-controller@28.3.0
 [28.2.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@28.1.1...@metamask/profile-sync-controller@28.2.0
 [28.1.1]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@28.1.0...@metamask/profile-sync-controller@28.1.1

package/LICENSE

@@ -18,3 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/controllers/authentication/AuthenticationController-method-action-types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}
+{"version":3,"file":"AuthenticationController-method-action-types.cjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,uCAAmC;AAE3E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,wCAAwC,CAAC"}
+{"version":3,"file":"AuthenticationController-method-action-types.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,uCAAsC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,wCAAwC,CAAC"}

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,uCAAmC;AAE3E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,wCAAwC,CAAC"}
+{"version":3,"file":"AuthenticationController-method-action-types.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,uCAAsC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,4CAA4C,GAC5C,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,wCAAwC,CAAC"}

package/dist/controllers/authentication/AuthenticationController-method-action-types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}
+{"version":3,"file":"AuthenticationController-method-action-types.mjs","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}

package/dist/controllers/authentication/AuthenticationController.cjs

@@ -10,16 +10,19 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_cachedPrimaryEntropySourceId, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_snapGetPublicKey, _AuthenticationController_snapGetAllPublicKeys, _AuthenticationController__snapSignMessageCache, _AuthenticationController_snapSignMessage;
+var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getHdKeyringEntropySourceIds, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_identifierTypeFromSeedlessState, _AuthenticationController_trySocialPairing, _AuthenticationController_clearNeedsSocialPairing, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_getHdKeyringSeed, _AuthenticationController_getPublicKey, _AuthenticationController__signMessageCache, _AuthenticationController_scopedCacheKey, _AuthenticationController_signMessage;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthenticationController = exports.defaultState = void 0;
 const base_controller_1 = require("@metamask/base-controller");
-const sdk_1 = require("../../sdk/index.cjs");
-const auth_snap_requests_1 = require("./auth-snap-requests.cjs");
+const index_js_1 = require("../../sdk/index.cjs");
+const entropy_source_js_1 = require("../../shared/utils/entropy-source.cjs");
+const hd_keyring_seed_js_1 = require("../../shared/utils/hd-keyring-seed.cjs");
+const message_signing_js_1 = require("../../shared/utils/message-signing.cjs");
 const controllerName = 'AuthenticationController';
 exports.defaultState = {
     isSignedIn: false,
     needsProfilePairing: true,
+    needsSocialPairing: true,
 };
 const metadata = {
     isSignedIn: {
@@ -34,6 +37,12 @@ const metadata = {
         includeInDebugSnapshot: true,
         usedInUi: true,
     },
+    needsSocialPairing: {
+        includeInStateLogs: true,
+        persist: true,
+        includeInDebugSnapshot: true,
+        usedInUi: true,
+    },
     srpSessionData: {
         // Remove access token from state logs
         includeInStateLogs: (srpSessionData) => {
@@ -86,10 +95,10 @@ class AuthenticationController extends base_controller_1.BaseController {
         _AuthenticationController_metametrics.set(this, void 0);
         _AuthenticationController_auth.set(this, void 0);
         _AuthenticationController_config.set(this, {
-            env: sdk_1.Env.PRD,
+            env: index_js_1.Env.PRD,
+            isSocialPairingEnabled: () => false,
         });
         _AuthenticationController_isUnlocked.set(this, false);
-        _AuthenticationController_cachedPrimaryEntropySourceId.set(this, void 0);
         // Bumped by `requestProfilePairing`. `performSignIn` snapshots this
         // before its first await; if it changes mid-flight we must NOT clear
         // `needsProfilePairing` (the rearm signal wins).
@@ -106,28 +115,31 @@ class AuthenticationController extends base_controller_1.BaseController {
                 });
             },
         });
-        _AuthenticationController__snapSignMessageCache.set(this, {});
+        _AuthenticationController__signMessageCache.set(this, {});
         if (!metametrics) {
             throw new Error('`metametrics` field is required');
         }
         __classPrivateFieldSet(this, _AuthenticationController_config, {
             ...__classPrivateFieldGet(this, _AuthenticationController_config, "f"),
             ...config,
+            isSocialPairingEnabled: config?.isSocialPairingEnabled ?? __classPrivateFieldGet(this, _AuthenticationController_config, "f").isSocialPairingEnabled,
         }, "f");
         __classPrivateFieldSet(this, _AuthenticationController_metametrics, metametrics, "f");
-        __classPrivateFieldSet(this, _AuthenticationController_auth, new sdk_1.JwtBearerAuth({
+        __classPrivateFieldSet(this, _AuthenticationController_auth, new index_js_1.JwtBearerAuth({
             env: __classPrivateFieldGet(this, _AuthenticationController_config, "f").env,
             platform: metametrics.agent,
-            type: sdk_1.AuthType.SRP,
+            type: index_js_1.AuthType.SRP,
         }, {
             storage: {
                 getLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginResponseFromState).bind(this),
                 setLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_setLoginResponseToState).bind(this),
             },
             signing: {
-                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetPublicKey).bind(this),
-                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapSignMessage).bind(this),
+                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPublicKey).bind(this),
+                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_signMessage).bind(this),
             },
+            getLoginTag: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginTag).bind(this),
+            getLoginIdentifierType: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginIdentifierType).bind(this),
             metametrics: __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f"),
         }), "f");
         __classPrivateFieldGet(this, _AuthenticationController_keyringController, "f").setupLockedStateSubscriptions();
@@ -136,15 +148,15 @@ class AuthenticationController extends base_controller_1.BaseController {
     async performSignIn() {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'performSignIn');
         const epochAtStart = __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f");
-        const allPublicKeys = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetAllPublicKeys).call(this);
+        const entropySourceIds = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringEntropySourceIds).call(this);
         const accessTokens = [];
         // We iterate sequentially in order to be sure that the first entry
         // is the primary SRP LoginResponse.
-        for (const [entropySourceId] of allPublicKeys) {
+        for (const entropySourceId of entropySourceIds) {
             const accessToken = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(entropySourceId);
             accessTokens.push(accessToken);
         }
-        if (allPublicKeys.length < 2) {
+        if (entropySourceIds.length < 2) {
             // Single-SRP wallet: nothing to pair.
             __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
         }
@@ -157,6 +169,12 @@ class AuthenticationController extends base_controller_1.BaseController {
                 // noop
             }
         }
+        try {
+            await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_trySocialPairing).call(this, accessTokens[0]);
+        }
+        catch {
+            // noop
+        }
         return accessTokens;
     }
     /**
@@ -173,7 +191,6 @@ class AuthenticationController extends base_controller_1.BaseController {
         }
     }
     performSignOut() {
-        __classPrivateFieldSet(this, _AuthenticationController_cachedPrimaryEntropySourceId, undefined, "f");
         this.update((state) => {
             state.isSignedIn = false;
             state.srpSessionData = undefined;
@@ -192,7 +209,7 @@ class AuthenticationController extends base_controller_1.BaseController {
      */
     async getBearerToken(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getBearerToken');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(resolvedId);
     }
     /**
@@ -210,7 +227,7 @@ class AuthenticationController extends base_controller_1.BaseController {
      */
     async getSessionProfile(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getSessionProfile');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfile(resolvedId);
     }
     /**
@@ -231,10 +248,10 @@ class AuthenticationController extends base_controller_1.BaseController {
      */
     async refreshCanonicalProfileId() {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'refreshCanonicalProfileId');
-        const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+        const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_invalidateSrpSession).call(this, primaryEntropySourceId);
         await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(primaryEntropySourceId);
-        const canonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+        const canonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
         if (!canonical) {
             throw new Error('refreshCanonicalProfileId - Unable to resolve canonical profile ID');
         }
@@ -243,7 +260,7 @@ class AuthenticationController extends base_controller_1.BaseController {
     }
     async getUserProfileLineage(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getUserProfileLineage');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
     }
     /**
@@ -259,7 +276,7 @@ class AuthenticationController extends base_controller_1.BaseController {
      */
     async getCustomerServiceToken(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
     }
     isSignedIn() {
@@ -267,14 +284,14 @@ class AuthenticationController extends base_controller_1.BaseController {
     }
 }
 exports.AuthenticationController = AuthenticationController;
-_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_cachedPrimaryEntropySourceId = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__snapSignMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
-    const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__signMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     if (!this.state.srpSessionData?.[resolvedId]) {
         return null;
     }
     return this.state.srpSessionData[resolvedId];
 }, _AuthenticationController_setLoginResponseToState = async function _AuthenticationController_setLoginResponseToState(loginResponse, entropySourceId) {
-    const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     const metaMetricsId = await __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f").getMetaMetricsId();
     this.update((state) => {
         state.isSignedIn = true;
@@ -293,20 +310,168 @@ _AuthenticationController_metametrics = new WeakMap(), _AuthenticationController
     if (!__classPrivateFieldGet(this, _AuthenticationController_isUnlocked, "f")) {
         throw new Error(`${methodName} - unable to proceed, wallet is locked`);
     }
-}, _AuthenticationController_getPrimaryEntropySourceId = async function _AuthenticationController_getPrimaryEntropySourceId() {
-    if (__classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f")) {
-        return __classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f");
+}, _AuthenticationController_getHdKeyringEntropySourceIds = function _AuthenticationController_getHdKeyringEntropySourceIds() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return (0, entropy_source_js_1.getHdKeyringEntropySourceIds)(keyrings);
+}, _AuthenticationController_getPrimaryEntropySourceId = function _AuthenticationController_getPrimaryEntropySourceId() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return (0, entropy_source_js_1.getPrimaryHdKeyringEntropySourceId)(keyrings);
+}, _AuthenticationController_getLoginTag = 
+/**
+ * Resolves the SRP login tag for `raw_message`.
+ *
+ * - `primary` for the first HD entropy source
+ * - `secondary` for any other entropy source
+ *
+ * @param entropySourceId - Entropy source for this login attempt.
+ * @returns The login tag to append to the signed message.
+ */
+async function _AuthenticationController_getLoginTag(entropySourceId) {
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const resolvedId = entropySourceId ?? primaryEntropySourceId;
+    return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';
+}, _AuthenticationController_getLoginIdentifierType = 
+/**
+ * Resolves metametrics `identifier_type` for `/srp/login`
+ * (`SRP` | `GOOGLE` | `APPLE` | `TELEGRAM`).
+ *
+ * This is the auth method for the entropy source, independent of
+ * {@link SrpLoginTag} (`primary` / `secondary`).
+ *
+ * SeedlessOnboarding currently exposes a single vault-level
+ * `authConnection`, which always backs the primary entropy source. Non-
+ * primary sources therefore return `SRP`. If social identities become
+ * per-entropy later, resolve from that metadata instead of assuming
+ * primary === social.
+ *
+ * Soft-fails to `SRP` when SeedlessOnboarding is not registered.
+ *
+ * @param entropySourceId - Entropy source for this login attempt.
+ * @returns The login identifier type.
+ */
+async function _AuthenticationController_getLoginIdentifierType(entropySourceId) {
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const resolvedId = entropySourceId ?? primaryEntropySourceId;
+    // Social vault authConnection is only associated with the primary source.
+    if (resolvedId !== primaryEntropySourceId) {
+        return 'SRP';
+    }
+    return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_resolveSocialIdentifierType).call(this);
+}, _AuthenticationController_resolveSocialIdentifierType = function _AuthenticationController_resolveSocialIdentifierType() {
+    try {
+        return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_identifierTypeFromSeedlessState).call(this, this.messenger.call('SeedlessOnboardingController:getState'));
     }
-    const allPublicKeys = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetAllPublicKeys).call(this);
-    if (allPublicKeys.length === 0) {
-        throw new Error('#getPrimaryEntropySourceId - No entropy sources found from snap');
+    catch {
+        return 'SRP';
     }
-    const primaryId = allPublicKeys[0][0];
-    if (!primaryId) {
-        throw new Error('#getPrimaryEntropySourceId - Primary entropy source ID is undefined');
+}, _AuthenticationController_identifierTypeFromSeedlessState = function _AuthenticationController_identifierTypeFromSeedlessState(state) {
+    if (state.vault === null || state.vault === undefined) {
+        return 'SRP';
+    }
+    // Match provider strings from SeedlessOnboarding state rather than
+    // importing AuthConnection — a value import would load that package
+    // (and its heavy deps) whenever this controller is imported.
+    switch (state.authConnection) {
+        case 'google':
+            return 'GOOGLE';
+        case 'apple':
+            return 'APPLE';
+        case 'telegram':
+            return 'TELEGRAM';
+        default:
+            return 'SRP';
+    }
+}, _AuthenticationController_trySocialPairing = 
+/**
+ * Attaches a Google/Apple/Telegram social identifier to the primary SRP
+ * profile via `POST /api/v2/profile/pair/identifier`.
+ *
+ * Runs only when `isSocialPairingEnabled()` is true and
+ * `needsSocialPairing` is not `false` (`undefined` is treated as true).
+ * No social provider (`authConnection` unset) → clear the flag (nothing
+ * to pair). Social provider set but vault missing → skip (onboarding
+ * still in flight). Google without email → skip (API requires it).
+ * Telegram never sends `email` (the field holds a display name, not an
+ * address). Missing social JWT → skip. 409 Conflict → clear the flag
+ * (identifier already owned; retry is pointless). Other errors
+ * propagate so the caller can swallow them and leave the flag set for
+ * retry.
+ *
+ * @param primaryAccessToken - Primary SRP OIDC access token used as the
+ * Bearer credential. The profile associated with this JWT becomes the
+ * canonical owner of the social identifier.
+ */
+async function _AuthenticationController_trySocialPairing(primaryAccessToken) {
+    if (!__classPrivateFieldGet(this, _AuthenticationController_config, "f").isSocialPairingEnabled() ||
+        this.state.needsSocialPairing === false ||
+        !primaryAccessToken) {
+        return;
+    }
+    let seedlessState;
+    try {
+        seedlessState = this.messenger.call('SeedlessOnboardingController:getState');
+    }
+    catch {
+        // Controller missing or getState failed — retry next performSignIn.
+        return;
+    }
+    // `SRP` here does not describe the vault: it is the mapping's "no social
+    // identity" result, returned when there is no seedless vault or the
+    // provider is unrecognised. In both cases there is nothing to pair.
+    const identifierType = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_identifierTypeFromSeedlessState).call(this, seedlessState);
+    if (identifierType === 'SRP') {
+        const { vault, authConnection } = seedlessState;
+        // Vault not written yet but a social provider is already known —
+        // onboarding is still in flight. Do not clear; retry next sign-in.
+        if ((vault === null || vault === undefined) && Boolean(authConnection)) {
+            return;
+        }
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+        return;
+    }
+    // Email policy follows the API contract: GOOGLE requires `email` (400
+    // without it), APPLE accepts it optionally, TELEGRAM must not send it
+    // (clients store a display name in `socialLoginEmail` for Telegram).
+    // Clients request the `email` scope for Google, so a missing value is a
+    // defensive case rather than an expected one; returning here leaves
+    // `needsSocialPairing` set so the next sign-in retries instead of
+    // sending a request that would fail.
+    const { socialLoginEmail } = seedlessState;
+    let email;
+    if (identifierType === 'GOOGLE') {
+        if (!socialLoginEmail) {
+            return;
+        }
+        email = socialLoginEmail;
+    }
+    else if (identifierType === 'APPLE') {
+        email = socialLoginEmail;
+    }
+    const socialJwt = await this.messenger.call('SeedlessOnboardingController:getAccessToken');
+    if (socialJwt === undefined || socialJwt === '') {
+        return;
+    }
+    try {
+        await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").pairSocialIdentifier({
+            identifierType,
+            socialJwt,
+            ...(email ? { email } : {}),
+        }, primaryAccessToken);
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+    }
+    catch (error) {
+        if (error instanceof index_js_1.PairConflictError) {
+            __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+            return;
+        }
+        throw error;
+    }
+}, _AuthenticationController_clearNeedsSocialPairing = function _AuthenticationController_clearNeedsSocialPairing() {
+    if (this.state.needsSocialPairing !== false) {
+        this.update((state) => {
+            state.needsSocialPairing = false;
+        });
     }
-    __classPrivateFieldSet(this, _AuthenticationController_cachedPrimaryEntropySourceId, primaryId, "f");
-    return __classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f");
 }, _AuthenticationController_tryClearNeedsProfilePairing = function _AuthenticationController_tryClearNeedsProfilePairing(epochAtStart) {
     if (__classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") !== epochAtStart) {
         return;
@@ -329,9 +494,9 @@ _AuthenticationController_metametrics = new WeakMap(), _AuthenticationController
  * pair API call was in-flight.
  */
 async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
-    const previousCanonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+    const previousCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
     const profileAliases = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_pairSrpProfiles).call(this, accessTokens);
-    const newCanonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+    const newCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
     // If somehow we cannot compute the new canonical profile ID after pairing,
     // we just return now and do not update the `needsProfilePairing` flag.
     if (!newCanonical) {
@@ -367,18 +532,8 @@ async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
             }
         }
     });
-}, _AuthenticationController_getCanonicalProfileId = 
-/**
- * Returns the canonical profile id from the primary SRP's cached session.
- * Returns `null` when no session exists yet for the primary SRP.
- *
- * Always reads from the primary SRP because the canonical is shared across
- * all paired SRPs after `#propagateCanonical`.
- *
- * @returns The canonical profile id, or `null` if unavailable.
- */
-async function _AuthenticationController_getCanonicalProfileId() {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+}, _AuthenticationController_getCanonicalProfileId = function _AuthenticationController_getCanonicalProfileId() {
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     return (this.state.srpSessionData?.[primaryEntropySourceId]?.profile
         ?.canonicalProfileId ?? null);
 }, _AuthenticationController_invalidateSrpSession = function _AuthenticationController_invalidateSrpSession(entropySourceId) {
@@ -391,45 +546,51 @@ async function _AuthenticationController_getCanonicalProfileId() {
             entry.profile.canonicalProfileId = '';
         }
     });
-}, _AuthenticationController_snapGetPublicKey = 
+}, _AuthenticationController_getHdKeyringSeed = 
 /**
- * Returns the auth snap public key.
+ * Reads the BIP-39 seed for an HD entropy source from KeyringController.
  *
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns The snap public key.
+ * @param entropySourceId - Entropy source ID. Defaults to the primary HD
+ * keyring.
+ * @returns The HD keyring seed.
  */
-async function _AuthenticationController_snapGetPublicKey(entropySourceId) {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapGetPublicKey');
-    const result = (await this.messenger.call('SnapController:handleRequest', (0, auth_snap_requests_1.createSnapPublicKeyRequest)(entropySourceId)));
-    return result;
-}, _AuthenticationController_snapGetAllPublicKeys = 
+async function _AuthenticationController_getHdKeyringSeed(entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    return (0, hd_keyring_seed_js_1.getHdKeyringSeed)(this.messenger, resolvedId);
+}, _AuthenticationController_getPublicKey = 
 /**
- * Returns a mapping of entropy source IDs to auth snap public keys.
+ * Returns the message-signing public key via native SIP-6 derivation
+ * (same key as `@metamask/message-signing-snap` with empty salt).
  *
- * @returns A mapping of entropy source IDs to public keys.
+ * @param entropySourceId - The entropy source ID used to derive the key,
+ * when multiple sources are available (Multi-SRP).
+ * @returns The public key hex.
  */
-async function _AuthenticationController_snapGetAllPublicKeys() {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapGetAllPublicKeys');
-    const result = (await this.messenger.call('SnapController:handleRequest', (0, auth_snap_requests_1.createSnapAllPublicKeysRequest)()));
-    return result;
-}, _AuthenticationController_snapSignMessage = 
+async function _AuthenticationController_getPublicKey(entropySourceId) {
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#getPublicKey');
+    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
+    return (0, message_signing_js_1.getMessageSigningPublicKey)(seed);
+}, _AuthenticationController_scopedCacheKey = function _AuthenticationController_scopedCacheKey(message, entropySourceId) {
+    return `${entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this)}:${message}`;
+}, _AuthenticationController_signMessage = 
 /**
- * Signs a specific message using an underlying auth snap.
+ * Signs a `metamask:…` message with the native SIP-6 message-signing key.
  *
  * @param message - A specific tagged message to sign.
  * @param entropySourceId - The entropy source ID used to derive the key,
  * when multiple sources are available (Multi-SRP).
- * @returns A Signature created by the snap.
+ * @returns Compact secp256k1 signature hex.
  */
-async function _AuthenticationController_snapSignMessage(message, entropySourceId) {
-    (0, sdk_1.assertMessageStartsWithMetamask)(message);
-    if (__classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message]) {
-        return __classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message];
-    }
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapSignMessage');
-    const result = (await this.messenger.call('SnapController:handleRequest', (0, auth_snap_requests_1.createSnapSignMessageRequest)(message, entropySourceId)));
-    __classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message] = result;
+async function _AuthenticationController_signMessage(message, entropySourceId) {
+    (0, index_js_1.assertMessageStartsWithMetamask)(message);
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#signMessage');
+    const cacheKey = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_scopedCacheKey).call(this, message, entropySourceId);
+    if (__classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey]) {
+        return __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey];
+    }
+    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
+    const result = await (0, message_signing_js_1.signMessageWithMessageSigningKey)(message, seed);
+    __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey] = result;
     return result;
 };
 //# sourceMappingURL=AuthenticationController.cjs.map