npm - @metamask/profile-sync-controller - Versions diffs - 28.3.0 → 30.0.0 - Mend

@metamask/profile-sync-controller 28.3.0 → 30.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (231) hide show

package/dist/sdk/authentication-jwt-bearer/services.cjs CHANGED Viewed

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getCustomerServiceToken = exports.getUserProfileLineage = exports.authenticate = exports.authorizeOIDC = exports.getNonce = exports.pairProfiles = exports.pairIdentifiers = exports.CUSTOMER_SERVICE_TOKEN_URL = exports.PROFILE_LINEAGE_URL = exports.PAIR_PROFILES_URL = exports.SIWE_LOGIN_URL = exports.SRP_LOGIN_URL = exports.OIDC_TOKEN_URL = exports.PAIR_IDENTIFIERS = exports.NONCE_URL = void 0;
-const env_1 = require("../../shared/env.cjs");
-const constants_1 = require("../constants.cjs");
-const errors_1 = require("../errors.cjs");
-const validate_pair_response_1 = require("../utils/validate-pair-response.cjs");
-const types_1 = require("./types.cjs");
+exports.getCustomerServiceToken = exports.getUserProfileLineage = exports.authenticate = exports.authorizeOIDC = exports.getNonce = exports.pairSocialIdentifier = exports.pairProfiles = exports.pairIdentifiers = exports.CUSTOMER_SERVICE_TOKEN_URL = exports.PROFILE_LINEAGE_URL = exports.PAIR_SOCIAL_IDENTIFIER_URL = exports.PAIR_PROFILES_URL = exports.SIWE_LOGIN_URL = exports.SRP_LOGIN_URL = exports.OIDC_TOKEN_URL = exports.PAIR_IDENTIFIERS = exports.NONCE_URL = void 0;
+const env_js_1 = require("../../shared/env.cjs");
+const constants_js_1 = require("../constants.cjs");
+const errors_js_1 = require("../errors.cjs");
+const validate_pair_response_js_1 = require("../utils/validate-pair-response.cjs");
+const types_js_1 = require("./types.cjs");
 /**
  * Parse Retry-After header into milliseconds if possible.
  * Supports seconds or HTTP-date formats.
@@ -84,7 +84,7 @@ const isErrorResponse = (obj) => typeof obj === 'object' &&
  */
 async function throwServiceError(error, errorPrefix, ErrorClass) {
     // Re-throw RateLimitedError or matching ErrorClass as-is (don't double-wrap)
-    if (error instanceof errors_1.RateLimitedError || error instanceof ErrorClass) {
+    if (error instanceof errors_js_1.RateLimitedError || error instanceof ErrorClass) {
         throw error;
     }
     // Not a Response-like object - handle as regular error
@@ -96,38 +96,40 @@ async function throwServiceError(error, errorPrefix, ErrorClass) {
     const response = error;
     const { status } = response;
     const responseMessage = await getResponseErrorMessage(response);
-    if (status === constants_1.HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
+    if (status === constants_js_1.HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
         const retryAfterHeader = response.headers.get('Retry-After');
         const retryAfterMs = parseRetryAfter(retryAfterHeader);
-        throw new errors_1.RateLimitedError(`${errorPrefix}: ${responseMessage}`, retryAfterMs ?? undefined);
+        throw new errors_js_1.RateLimitedError(`${errorPrefix}: ${responseMessage}`, retryAfterMs ?? undefined);
     }
     throw new ErrorClass(`${errorPrefix}: ${responseMessage}`);
 }
-const NONCE_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/nonce`;
+const NONCE_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/nonce`;
 exports.NONCE_URL = NONCE_URL;
-const PAIR_IDENTIFIERS = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/identifiers/pair`;
+const PAIR_IDENTIFIERS = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/identifiers/pair`;
 exports.PAIR_IDENTIFIERS = PAIR_IDENTIFIERS;
-const OIDC_TOKEN_URL = (env) => `${(0, env_1.getEnvUrls)(env).oidcApiUrl}/oauth2/token`;
+const OIDC_TOKEN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).oidcApiUrl}/oauth2/token`;
 exports.OIDC_TOKEN_URL = OIDC_TOKEN_URL;
-const SRP_LOGIN_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/srp/login`;
+const SRP_LOGIN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/srp/login`;
 exports.SRP_LOGIN_URL = SRP_LOGIN_URL;
-const SIWE_LOGIN_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/siwe/login`;
+const SIWE_LOGIN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/siwe/login`;
 exports.SIWE_LOGIN_URL = SIWE_LOGIN_URL;
-const PAIR_PROFILES_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/pair`;
+const PAIR_PROFILES_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/pair`;
 exports.PAIR_PROFILES_URL = PAIR_PROFILES_URL;
-const PROFILE_LINEAGE_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/lineage`;
+const PAIR_SOCIAL_IDENTIFIER_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/pair/identifier`;
+exports.PAIR_SOCIAL_IDENTIFIER_URL = PAIR_SOCIAL_IDENTIFIER_URL;
+const PROFILE_LINEAGE_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/lineage`;
 exports.PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL;
-const CUSTOMER_SERVICE_TOKEN_URL = (env) => `${(0, env_1.getEnvUrls)(env).authApiUrl}/api/v2/customer-service/token`;
+const CUSTOMER_SERVICE_TOKEN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/customer-service/token`;
 exports.CUSTOMER_SERVICE_TOKEN_URL = CUSTOMER_SERVICE_TOKEN_URL;
 const getAuthenticationUrl = (authType, env) => {
     switch (authType) {
-        case types_1.AuthType.SRP:
+        case types_js_1.AuthType.SRP:
             return (0, exports.SRP_LOGIN_URL)(env);
-        case types_1.AuthType.SiWE:
+        case types_js_1.AuthType.SiWE:
             return (0, exports.SIWE_LOGIN_URL)(env);
         /* istanbul ignore next */
         default:
-            throw new errors_1.ValidationError(`Invalid AuthType: ${authType} - unable to create Auth URL`);
+            throw new errors_js_1.ValidationError(`Invalid AuthType: ${authType} - unable to create Auth URL`);
     }
 };
 const parseProfileAliases = (raw) => {
@@ -161,12 +163,12 @@ async function pairIdentifiers(nonce, logins, accessToken, env) {
             }),
         });
         if (!response.ok) {
-            return await throwServiceError(response, 'Failed to pair identifiers', errors_1.PairError);
+            return await throwServiceError(response, 'Failed to pair identifiers', errors_js_1.PairError);
         }
         return undefined;
     }
     catch (error) {
-        return await throwServiceError(error, 'Failed to pair identifiers', errors_1.PairError);
+        return await throwServiceError(error, 'Failed to pair identifiers', errors_js_1.PairError);
     }
 }
 exports.pairIdentifiers = pairIdentifiers;
@@ -193,10 +195,10 @@ async function pairProfiles(accessTokens, authAccessToken, env) {
             }),
         });
         if (!response.ok) {
-            return await throwServiceError(response, 'Failed to pair profiles', errors_1.PairError);
+            return await throwServiceError(response, 'Failed to pair profiles', errors_js_1.PairError);
         }
         const pairResponse = await response.json();
-        (0, validate_pair_response_1.validatePairResponse)(pairResponse);
+        (0, validate_pair_response_js_1.validatePairResponse)(pairResponse);
         return {
             profile: {
                 identifierId: pairResponse.profile.identifier_id,
@@ -208,10 +210,51 @@ async function pairProfiles(accessTokens, authAccessToken, env) {
         };
     }
     catch (error) {
-        return await throwServiceError(error, 'Failed to pair profiles', errors_1.PairError);
+        return await throwServiceError(error, 'Failed to pair profiles', errors_js_1.PairError);
     }
 }
 exports.pairProfiles = pairProfiles;
+/**
+ * Attach a Google/Apple/Telegram social identifier to the profile that
+ * owns `authAccessToken` (`POST /api/v2/profile/pair/identifier`).
+ *
+ * `email` is omitted from the body when undefined. 409 Conflict throws
+ * {@link PairConflictError} so callers can treat it as terminal. The
+ * response body (new token + profile) is not consumed: a 2xx status is the
+ * only success signal.
+ *
+ * @param params - Social identifier type, social JWT, and optional email
+ * @param authAccessToken - Bearer token of the canonical (primary SRP) profile
+ * @param env - server environment
+ */
+async function pairSocialIdentifier(params, authAccessToken, env) {
+    const pairUrl = new URL((0, exports.PAIR_SOCIAL_IDENTIFIER_URL)(env));
+    const errorPrefix = 'Failed to pair social identifier';
+    try {
+        const response = await fetch(pairUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${authAccessToken}`,
+            },
+            body: JSON.stringify({
+                identifier_type: params.identifierType,
+                social_jwt: params.socialJwt,
+                ...(params.email === undefined ? {} : { email: params.email }),
+            }),
+        });
+        if (!response.ok) {
+            if (response.status === constants_js_1.HTTP_STATUS_CODES.CONFLICT) {
+                await throwServiceError(response, errorPrefix, errors_js_1.PairConflictError);
+            }
+            await throwServiceError(response, errorPrefix, errors_js_1.PairError);
+        }
+    }
+    catch (error) {
+        await throwServiceError(error, errorPrefix, errors_js_1.PairError);
+    }
+}
+exports.pairSocialIdentifier = pairSocialIdentifier;
 /**
  * Service to Get Nonce for JWT Bearer Flow
  *
@@ -225,7 +268,7 @@ async function getNonce(id, env) {
     try {
         const nonceResponse = await fetch(nonceUrl.toString());
         if (!nonceResponse.ok) {
-            return await throwServiceError(nonceResponse, 'Failed to get nonce', errors_1.NonceRetrievalError);
+            return await throwServiceError(nonceResponse, 'Failed to get nonce', errors_js_1.NonceRetrievalError);
         }
         const nonceJson = await nonceResponse.json();
         return {
@@ -235,7 +278,7 @@ async function getNonce(id, env) {
         };
     }
     catch (error) {
-        return await throwServiceError(error, 'Failed to get nonce', errors_1.NonceRetrievalError);
+        return await throwServiceError(error, 'Failed to get nonce', errors_js_1.NonceRetrievalError);
     }
 }
 exports.getNonce = getNonce;
@@ -254,7 +297,7 @@ async function authorizeOIDC(jwtToken, env, platform) {
     };
     const urlEncodedBody = new URLSearchParams();
     urlEncodedBody.append('grant_type', grantType);
-    urlEncodedBody.append('client_id', (0, env_1.getOidcClientId)(env, platform));
+    urlEncodedBody.append('client_id', (0, env_js_1.getOidcClientId)(env, platform));
     urlEncodedBody.append('assertion', jwtToken);
     try {
         const response = await fetch((0, exports.OIDC_TOKEN_URL)(env), {
@@ -263,7 +306,7 @@ async function authorizeOIDC(jwtToken, env, platform) {
             body: urlEncodedBody.toString(),
         });
         if (!response.ok) {
-            return await throwServiceError(response, 'Failed to get access token', errors_1.SignInError);
+            return await throwServiceError(response, 'Failed to get access token', errors_js_1.SignInError);
         }
         const accessTokenResponse = await response.json();
         return {
@@ -273,7 +316,7 @@ async function authorizeOIDC(jwtToken, env, platform) {
         };
     }
     catch (error) {
-        return await throwServiceError(error, 'Failed to get access token', errors_1.SignInError);
+        return await throwServiceError(error, 'Failed to get access token', errors_js_1.SignInError);
     }
 }
 exports.authorizeOIDC = authorizeOIDC;
@@ -285,16 +328,18 @@ exports.authorizeOIDC = authorizeOIDC;
  * @param authType - authentication type/flow used
  * @param env - server environment
  * @param metametrics - optional metametrics
+ * @param identifierType - login identifier type included in metametrics
+ *   (defaults to `SRP` when metametrics is present)
  * @returns Authentication Token
  */
-async function authenticate(rawMessage, signature, authType, env, metametrics) {
+async function authenticate(rawMessage, signature, authType, env, metametrics, identifierType = 'SRP') {
     const authenticationUrl = getAuthenticationUrl(authType, env);
     try {
         const response = await fetch(authenticationUrl, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                ...(authType === types_1.AuthType.SRP
+                ...(authType === types_js_1.AuthType.SRP
                     ? { 'X-MetaMask-Profile-Pairing': 'enabled' }
                     : {}),
             },
@@ -307,13 +352,14 @@ async function authenticate(rawMessage, signature, authType, env, metametrics) {
                             metametrics_id: await metametrics.getMetaMetricsId(),
                             agent: metametrics.agent,
                             app_version: await metametrics.getAppVersion?.(),
+                            identifier_type: identifierType,
                         },
                     }
                     : {}),
             }),
         });
         if (!response.ok) {
-            return await throwServiceError(response, `Failed to login with ${authType}`, errors_1.SignInError);
+            return await throwServiceError(response, `Failed to login with ${authType}`, errors_js_1.SignInError);
         }
         const loginResponse = await response.json();
         return {
@@ -329,7 +375,7 @@ async function authenticate(rawMessage, signature, authType, env, metametrics) {
         };
     }
     catch (error) {
-        return await throwServiceError(error, `Failed to login with ${authType}`, errors_1.SignInError);
+        return await throwServiceError(error, `Failed to login with ${authType}`, errors_js_1.SignInError);
     }
 }
 exports.authenticate = authenticate;
@@ -350,13 +396,13 @@ async function getUserProfileLineage(env, accessToken) {
             },
         });
         if (!response.ok) {
-            return await throwServiceError(response, 'Failed to get profile lineage', errors_1.SignInError);
+            return await throwServiceError(response, 'Failed to get profile lineage', errors_js_1.SignInError);
         }
         const profileJson = await response.json();
         return profileJson;
     }
     catch (error) {
-        return await throwServiceError(error, 'Failed to get profile lineage', errors_1.SignInError);
+        return await throwServiceError(error, 'Failed to get profile lineage', errors_js_1.SignInError);
     }
 }
 exports.getUserProfileLineage = getUserProfileLineage;
@@ -381,16 +427,16 @@ async function getCustomerServiceToken(env, accessToken) {
             },
         });
         if (!response.ok) {
-            return await throwServiceError(response, 'Failed to get customer service token', errors_1.SignInError);
+            return await throwServiceError(response, 'Failed to get customer service token', errors_js_1.SignInError);
         }
         const tokenResponse = await response.json();
         if (typeof tokenResponse?.access_token !== 'string') {
-            throw new errors_1.SignInError('Failed to get customer service token: missing access_token');
+            throw new errors_js_1.SignInError('Failed to get customer service token: missing access_token');
         }
         return tokenResponse.access_token;
     }
     catch (error) {
-        return await throwServiceError(error, 'Failed to get customer service token', errors_1.SignInError);
+        return await throwServiceError(error, 'Failed to get customer service token', errors_js_1.SignInError);
     }
 }
 exports.getCustomerServiceToken = getCustomerServiceToken;

package/dist/sdk/authentication-jwt-bearer/services.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"services.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":";;;AACA,8CAA+D;AAE/D,gDAAiD;AACjD,0CAMmB;AACnB,gFAAuE;AAQvE,uCAAmC;AAEnC;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,gBAA+B;IACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;IAExC,IAAI,OAAO,GAAG,eAAe,CAAC;IAC9B,IAAI,KAAK,GAAG,SAAS,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGK,CAAC;QAEjD,OAAO;YACL,SAAS,IAAI,YAAY;gBACvB,CAAC,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;QACrC,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;YAChD,OAAO,GAAG,WAAW;gBACnB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC3B,CAAC,CAAC,yBAAyB,CAAC;YAC9B,KAAK,GAAG,mBAAmB,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,gCAAgC,CAAC;YAC3C,KAAK,GAAG,sBAAsB,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,MAAM,MAAM,OAAO,YAAY,KAAK,GAAG,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAmB,EAAE,CACxD,OAAO,GAAG,KAAK,QAAQ;IACvB,GAAG,KAAK,IAAI;IACZ,QAAQ,IAAI,GAAG;IACf,SAAS,IAAI,GAAG,CAAC;AAEnB;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,WAAmB,EACnB,UAA0C;IAE1C,6EAA6E;IAC7E,IAAI,KAAK,YAAY,yBAAgB,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,YAAY,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,eAAe,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAEhE,IAAI,MAAM,KAAK,6BAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,IAAI,yBAAgB,CACxB,GAAG,WAAW,KAAK,eAAe,EAAE,EACpC,YAAY,IAAI,SAAS,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,eAAe,EAAE,CAAC,CAAC;AAC7D,CAAC;AAEM,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC5C,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AADlC,QAAA,SAAS,aACyB;AAExC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACnD,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,0BAA0B,CAAC;AAD7C,QAAA,gBAAgB,oBAC6B;AAEnD,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AADlC,QAAA,cAAc,kBACoB;AAExC,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAU,EAAE,CAChD,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,mBAAmB,CAAC;AADtC,QAAA,aAAa,iBACyB;AAE5C,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AADvC,QAAA,cAAc,kBACyB;AAE7C,MAAM,iBAAiB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACpD,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,sBAAsB,CAAC;AADzC,QAAA,iBAAiB,qBACwB;AAE/C,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AAD5C,QAAA,mBAAmB,uBACyB;AAElD,MAAM,0BAA0B,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC7D,GAAG,IAAA,gBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,gCAAgC,CAAC;AADnD,QAAA,0BAA0B,8BACyB;AAEhE,MAAM,oBAAoB,GAAG,CAAC,QAAkB,EAAE,GAAQ,EAAU,EAAE;IACpE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,gBAAQ,CAAC,GAAG;YACf,OAAO,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,gBAAQ,CAAC,IAAI;YAChB,OAAO,IAAA,sBAAc,EAAC,GAAG,CAAC,CAAC;QAC7B,0BAA0B;QAC1B;YACE,MAAM,IAAI,wBAAe,CACvB,qBAAqB,QAAkB,8BAA8B,CACtE,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AAiBF,MAAM,mBAAmB,GAAG,CAAC,GAAsB,EAAkB,EAAE;IACrE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzB,cAAc,EAAE,KAAK,CAAC,gBAAgB;QACtC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB;QAC9C,aAAa,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACI,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,MAAqB,EACrB,WAAmB,EACnB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAA,wBAAgB,EAAC,GAAG,CAAC,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,MAAM;aACP,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,4BAA4B,EAC5B,kBAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,4BAA4B,EAC5B,kBAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AApCD,0CAoCC;AAOD;;;;;;;;GAQG;AACI,KAAK,UAAU,YAAY,CAChC,YAAsB,EACtB,eAAuB,EACvB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAA,yBAAiB,EAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,eAAe,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,YAAY;aACnB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,yBAAyB,EACzB,kBAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,IAAA,6CAAoB,EAAC,YAAY,CAAC,CAAC;QAEnC,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa;gBAChD,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE;gBACxD,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU;gBAC1C,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU;aACpD;YACD,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,EAAE,kBAAS,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AA1CD,oCA0CC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,QAAQ,CAAC,EAAU,EAAE,GAAQ;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAA,iBAAS,EAAC,GAAG,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,MAAM,iBAAiB,CAC5B,aAAa,EACb,qBAAqB,EACrB,4BAAmB,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,SAAS,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,qBAAqB,EACrB,4BAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AA3BD,4BA2BC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,GAAQ,EACR,QAAkB;IAElB,MAAM,SAAS,GAAG,6CAA6C,CAAC;IAChE,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,mCAAmC;KACpD,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7C,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,IAAA,qBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAA,sBAAc,EAAC,GAAG,CAAC,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,4BAA4B,EAC5B,oBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,WAAW,EAAE,mBAAmB,CAAC,YAAY;YAC7C,SAAS,EAAE,mBAAmB,CAAC,UAAU;YACzC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,4BAA4B,EAC5B,oBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA3CD,sCA2CC;AAQD;;;;;;;;;GASG;AACI,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,SAAiB,EACjB,QAAkB,EAClB,GAAQ,EACR,WAA6B;IAE7B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,QAAQ,KAAK,gBAAQ,CAAC,GAAG;oBAC3B,CAAC,CAAC,EAAE,4BAA4B,EAAE,SAAS,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,WAAW,EAAE,UAAU;gBACvB,GAAG,CAAC,WAAW;oBACb,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,cAAc,EAAE,MAAM,WAAW,CAAC,gBAAgB,EAAE;4BACpD,KAAK,EAAE,WAAW,CAAC,KAAK;4BACxB,WAAW,EAAE,MAAM,WAAW,CAAC,aAAa,EAAE,EAAE;yBACjD;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,wBAAwB,QAAQ,EAAE,EAClC,oBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,SAAS,EAAE,aAAa,CAAC,UAAU;YACnC,OAAO,EAAE;gBACP,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa;gBACjD,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc;gBACnD,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;gBAC3C,kBAAkB,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;aACrD;YACD,cAAc,EAAE,mBAAmB,CAAC,aAAa,CAAC,eAAe,IAAI,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,wBAAwB,QAAQ,EAAE,EAClC,oBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA7DD,oCA6DC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,GAAQ,EACR,WAAmB;IAEnB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,IAAA,2BAAmB,EAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,+BAA+B,EAC/B,oBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAuB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,+BAA+B,EAC/B,oBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA/BD,sDA+BC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,WAAmB;IAEnB,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,IAAA,kCAA0B,EAAC,GAAG,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,sCAAsC,EACtC,oBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,oBAAW,CACnB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,sCAAsC,EACtC,oBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AApCD,0DAoCC","sourcesContent":["import type { Env, Platform } from '../../shared/env';\nimport { getEnvUrls, getOidcClientId } from '../../shared/env';\nimport type { MetaMetricsAuth } from '../../shared/types/services';\nimport { HTTP_STATUS_CODES } from '../constants';\nimport {\n NonceRetrievalError,\n PairError,\n SignInError,\n ValidationError,\n RateLimitedError,\n} from '../errors';\nimport { validatePairResponse } from '../utils/validate-pair-response';\nimport type {\n AccessToken,\n ErrorMessage,\n ProfileAlias,\n UserProfile,\n UserProfileLineage,\n} from './types';\nimport { AuthType } from './types';\n\n/*\n Parse Retry-After header into milliseconds if possible.\n * Supports seconds or HTTP-date formats.\n \n @param retryAfterHeader - The Retry-After header value (seconds or HTTP-date)\n * @returns The retry delay in milliseconds, or null if parsing fails\n /\nfunction parseRetryAfter(retryAfterHeader: string \| null): number \| null {\n if (!retryAfterHeader) {\n return null;\n }\n const seconds = Number(retryAfterHeader);\n if (!Number.isNaN(seconds)) {\n return seconds 1000;\n }\n const date = Date.parse(retryAfterHeader);\n if (!Number.isNaN(date)) {\n const diff = date - Date.now();\n return diff > 0 ? diff : null;\n }\n return null;\n}\n\n/*\n Extracts error details from a Response object.\n \n @param response - The HTTP response object\n * @returns Formatted error message with HTTP status and response body\n /\nasync function getResponseErrorMessage(response: Response): Promise<string> {\n const { status } = response;\n const clonedResponse = response.clone();\n\n let message = 'Unknown error';\n let error = 'unknown';\n\n try {\n const responseBody = (await response.json()) as\n \| ErrorMessage\n // eslint-disable-next-line @typescript-eslint/naming-convention\n \| { error_description: string; error: string };\n\n message =\n 'message' in responseBody\n ? responseBody.message\n : responseBody.error_description;\n error = responseBody.error ?? 'unknown';\n } catch {\n try {\n const textContent = await clonedResponse.text();\n message = textContent\n ? textContent.slice(0, 150)\n : 'Non-JSON error response';\n error = 'non_json_response';\n } catch {\n message = 'Unable to parse error response';\n error = 'unparseable_response';\n }\n }\n\n return `HTTP ${status} - ${message} (error: ${error})`;\n}\n\n/\n Type guard to check if an object is a Response-like object.\n \n @param obj - The object to check\n * @returns True if the object is a Response-like object, false otherwise\n /\nconst isErrorResponse = (obj: unknown): obj is Response =>\n typeof obj === 'object' &&\n obj !== null &&\n 'status' in obj &&\n 'headers' in obj;\n\n/\n Throws a domain-specific error for service failures.\n * Handles both HTTP error responses and regular errors (network failures, etc.).\n * For HTTP 429, throws RateLimitedError with Retry-After header parsing.\n \n @param error - The error (Response object or caught error)\n * @param errorPrefix - Context prefix for the error message\n * @param ErrorClass - The domain-specific error class to throw\n * @throws RateLimitedError for 429, otherwise ErrorClass\n /\nasync function throwServiceError(\n error: unknown,\n errorPrefix: string,\n ErrorClass: new (message: string) => Error,\n): Promise<never> {\n // Re-throw RateLimitedError or matching ErrorClass as-is (don't double-wrap)\n if (error instanceof RateLimitedError \|\| error instanceof ErrorClass) {\n throw error;\n }\n\n // Not a Response-like object - handle as regular error\n if (!isErrorResponse(error)) {\n const errorMessage = error instanceof Error ? error.message : String(error);\n throw new ErrorClass(`${errorPrefix}: ${errorMessage}`);\n }\n\n // Handle HTTP error response\n const response = error;\n const { status } = response;\n const responseMessage = await getResponseErrorMessage(response);\n\n if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n const retryAfterHeader = response.headers.get('Retry-After');\n const retryAfterMs = parseRetryAfter(retryAfterHeader);\n throw new RateLimitedError(\n `${errorPrefix}: ${responseMessage}`,\n retryAfterMs ?? undefined,\n );\n }\n\n throw new ErrorClass(`${errorPrefix}: ${responseMessage}`);\n}\n\nexport const NONCE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/nonce`;\n\nexport const PAIR_IDENTIFIERS = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/identifiers/pair`;\n\nexport const OIDC_TOKEN_URL = (env: Env): string =>\n `${getEnvUrls(env).oidcApiUrl}/oauth2/token`;\n\nexport const SRP_LOGIN_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/srp/login`;\n\nexport const SIWE_LOGIN_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/siwe/login`;\n\nexport const PAIR_PROFILES_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/profile/pair`;\n\nexport const PROFILE_LINEAGE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/profile/lineage`;\n\nexport const CUSTOMER_SERVICE_TOKEN_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/customer-service/token`;\n\nconst getAuthenticationUrl = (authType: AuthType, env: Env): string => {\n switch (authType) {\n case AuthType.SRP:\n return SRP_LOGIN_URL(env);\n case AuthType.SiWE:\n return SIWE_LOGIN_URL(env);\n / istanbul ignore next /\n default:\n throw new ValidationError(\n `Invalid AuthType: ${authType as number} - unable to create Auth URL`,\n );\n }\n};\n\ntype NonceResponse = {\n nonce: string;\n identifier: string;\n expiresIn: number;\n};\n\ntype RawProfileAlias = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n alias_profile_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n canonical_profile_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n identifier_ids: { id: string; type: string }[];\n};\n\nconst parseProfileAliases = (raw: RawProfileAlias[]): ProfileAlias[] => {\n return raw.map((alias) => ({\n aliasProfileId: alias.alias_profile_id,\n canonicalProfileId: alias.canonical_profile_id,\n identifierIds: alias.identifier_ids ?? [],\n }));\n};\n\ntype PairRequest = {\n signature: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n raw_message: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n encrypted_storage_key: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n identifier_type: 'SIWE' \| 'SRP';\n};\n\n/\n Pair multiple identifiers under a single profile\n \n @param nonce - session nonce\n * @param logins - pairing request payload\n * @param accessToken - JWT access token used to access protected resources\n * @param env - server environment\n * @returns void.\n /\nexport async function pairIdentifiers(\n nonce: string,\n logins: PairRequest[],\n accessToken: string,\n env: Env,\n): Promise<void> {\n const pairUrl = new URL(PAIR_IDENTIFIERS(env));\n\n try {\n const response = await fetch(pairUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${accessToken}`,\n },\n body: JSON.stringify({\n nonce,\n logins,\n }),\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to pair identifiers',\n PairError,\n );\n }\n return undefined;\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to pair identifiers',\n PairError,\n );\n }\n}\n\nexport type PairProfilesResponse = {\n profile: UserProfile;\n profileAliases: ProfileAlias[];\n};\n\n/\n Pair multiple profiles using their OIDC access tokens.\n * Idempotent — calling with already-paired tokens is a no-op.\n \n @param accessTokens - Two or more OIDC access tokens to pair\n * @param authAccessToken - A valid access token for the Authorization header\n * @param env - server environment\n * @returns The pair response containing the canonical profile and aliases\n /\nexport async function pairProfiles(\n accessTokens: string[],\n authAccessToken: string,\n env: Env,\n): Promise<PairProfilesResponse> {\n const pairUrl = new URL(PAIR_PROFILES_URL(env));\n\n try {\n const response = await fetch(pairUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${authAccessToken}`,\n },\n body: JSON.stringify({\n jwts: accessTokens,\n }),\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to pair profiles',\n PairError,\n );\n }\n\n const pairResponse: unknown = await response.json();\n validatePairResponse(pairResponse);\n\n return {\n profile: {\n identifierId: pairResponse.profile.identifier_id,\n metaMetricsId: pairResponse.profile.metametrics_id ?? '',\n profileId: pairResponse.profile.profile_id,\n canonicalProfileId: pairResponse.profile.profile_id,\n },\n profileAliases: parseProfileAliases(pairResponse.profile_aliases ?? []),\n };\n } catch (error) {\n return await throwServiceError(error, 'Failed to pair profiles', PairError);\n }\n}\n\n/\n Service to Get Nonce for JWT Bearer Flow\n \n @param id - identifier ID\n * @param env - server environment\n * @returns the nonce.\n /\nexport async function getNonce(id: string, env: Env): Promise<NonceResponse> {\n const nonceUrl = new URL(NONCE_URL(env));\n nonceUrl.searchParams.set('identifier', id);\n\n try {\n const nonceResponse = await fetch(nonceUrl.toString());\n if (!nonceResponse.ok) {\n return await throwServiceError(\n nonceResponse,\n 'Failed to get nonce',\n NonceRetrievalError,\n );\n }\n\n const nonceJson = await nonceResponse.json();\n return {\n nonce: nonceJson.nonce,\n identifier: nonceJson.identifier,\n expiresIn: nonceJson.expires_in,\n };\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to get nonce',\n NonceRetrievalError,\n );\n }\n}\n\n/\n Service to Authorize And perform OIDC Flow to get the Access Token\n \n @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)\n * @param env - server environment\n * @param platform - SDK platform\n * @returns Access Token from Authorization server\n /\nexport async function authorizeOIDC(\n jwtToken: string,\n env: Env,\n platform: Platform,\n): Promise<AccessToken> {\n const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n const headers = {\n 'Content-Type': 'application/x-www-form-urlencoded',\n };\n\n const urlEncodedBody = new URLSearchParams();\n urlEncodedBody.append('grant_type', grantType);\n urlEncodedBody.append('client_id', getOidcClientId(env, platform));\n urlEncodedBody.append('assertion', jwtToken);\n\n try {\n const response = await fetch(OIDC_TOKEN_URL(env), {\n method: 'POST',\n headers,\n body: urlEncodedBody.toString(),\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to get access token',\n SignInError,\n );\n }\n\n const accessTokenResponse = await response.json();\n return {\n accessToken: accessTokenResponse.access_token,\n expiresIn: accessTokenResponse.expires_in,\n obtainedAt: Date.now(),\n };\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to get access token',\n SignInError,\n );\n }\n}\n\ntype Authentication = {\n token: string;\n expiresIn: number;\n profile: UserProfile;\n profileAliases: ProfileAlias[];\n};\n/\n Service to Authenticate/Login a user via SIWE or SRP derived key.\n \n @param rawMessage - raw message for validation when authenticating\n * @param signature - signed raw message\n * @param authType - authentication type/flow used\n * @param env - server environment\n * @param metametrics - optional metametrics\n * @returns Authentication Token\n /\nexport async function authenticate(\n rawMessage: string,\n signature: string,\n authType: AuthType,\n env: Env,\n metametrics?: MetaMetricsAuth,\n): Promise<Authentication> {\n const authenticationUrl = getAuthenticationUrl(authType, env);\n\n try {\n const response = await fetch(authenticationUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n ...(authType === AuthType.SRP\n ? { 'X-MetaMask-Profile-Pairing': 'enabled' }\n : {}),\n },\n body: JSON.stringify({\n signature,\n raw_message: rawMessage,\n ...(metametrics\n ? {\n metametrics: {\n metametrics_id: await metametrics.getMetaMetricsId(),\n agent: metametrics.agent,\n app_version: await metametrics.getAppVersion?.(),\n },\n }\n : {}),\n }),\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n `Failed to login with ${authType}`,\n SignInError,\n );\n }\n\n const loginResponse = await response.json();\n\n return {\n token: loginResponse.token,\n expiresIn: loginResponse.expires_in,\n profile: {\n identifierId: loginResponse.profile.identifier_id,\n metaMetricsId: loginResponse.profile.metametrics_id,\n profileId: loginResponse.profile.profile_id,\n canonicalProfileId: loginResponse.profile.profile_id,\n },\n profileAliases: parseProfileAliases(loginResponse.profile_aliases ?? []),\n };\n } catch (error) {\n return await throwServiceError(\n error,\n `Failed to login with ${authType}`,\n SignInError,\n );\n }\n}\n\n/\n Service to get the Profile Lineage\n \n @param env - server environment\n * @param accessToken - JWT access token used to access protected resources\n * @returns Profile Lineage information.\n /\nexport async function getUserProfileLineage(\n env: Env,\n accessToken: string,\n): Promise<UserProfileLineage> {\n const profileLineageUrl = new URL(PROFILE_LINEAGE_URL(env));\n\n try {\n const response = await fetch(profileLineageUrl, {\n method: 'GET',\n headers: {\n Authorization: `Bearer ${accessToken}`,\n },\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to get profile lineage',\n SignInError,\n );\n }\n\n const profileJson: UserProfileLineage = await response.json();\n return profileJson;\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to get profile lineage',\n SignInError,\n );\n }\n}\n\n/\n Service to get a Customer Service specific access token.\n \n Exchanges a valid OIDC access token for a short-lived token scoped to the\n * customer-service audience, which Customer Service tooling consumes to\n * identify and authenticate the user.\n \n @param env - server environment\n * @param accessToken - JWT access token used to access protected resources\n * @returns The customer-service access token.\n */\nexport async function getCustomerServiceToken(\n env: Env,\n accessToken: string,\n): Promise<string> {\n const customerServiceTokenUrl = new URL(CUSTOMER_SERVICE_TOKEN_URL(env));\n\n try {\n const response = await fetch(customerServiceTokenUrl, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${accessToken}`,\n },\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to get customer service token',\n SignInError,\n );\n }\n\n const tokenResponse = await response.json();\n if (typeof tokenResponse?.access_token !== 'string') {\n throw new SignInError(\n 'Failed to get customer service token: missing access_token',\n );\n }\n return tokenResponse.access_token;\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to get customer service token',\n SignInError,\n );\n }\n}\n"]}
1	+ {"version":3,"file":"services.cjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":";;;AACA,iDAAkE;AAElE,mDAAoD;AACpD,6CAOsB;AACtB,mFAA0E;AAU1E,0CAAsC;AAEtC;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,gBAA+B;IACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;IAExC,IAAI,OAAO,GAAG,eAAe,CAAC;IAC9B,IAAI,KAAK,GAAG,SAAS,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGK,CAAC;QAEjD,OAAO;YACL,SAAS,IAAI,YAAY;gBACvB,CAAC,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;QACrC,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;YAChD,OAAO,GAAG,WAAW;gBACnB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC3B,CAAC,CAAC,yBAAyB,CAAC;YAC9B,KAAK,GAAG,mBAAmB,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,gCAAgC,CAAC;YAC3C,KAAK,GAAG,sBAAsB,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,MAAM,MAAM,OAAO,YAAY,KAAK,GAAG,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAmB,EAAE,CACxD,OAAO,GAAG,KAAK,QAAQ;IACvB,GAAG,KAAK,IAAI;IACZ,QAAQ,IAAI,GAAG;IACf,SAAS,IAAI,GAAG,CAAC;AAEnB;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,WAAmB,EACnB,UAA0C;IAE1C,6EAA6E;IAC7E,IAAI,KAAK,YAAY,4BAAgB,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,YAAY,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,eAAe,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAEhE,IAAI,MAAM,KAAK,gCAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,IAAI,4BAAgB,CACxB,GAAG,WAAW,KAAK,eAAe,EAAE,EACpC,YAAY,IAAI,SAAS,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,eAAe,EAAE,CAAC,CAAC;AAC7D,CAAC;AAEM,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC5C,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AADlC,QAAA,SAAS,aACyB;AAExC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACnD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,0BAA0B,CAAC;AAD7C,QAAA,gBAAgB,oBAC6B;AAEnD,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AADlC,QAAA,cAAc,kBACoB;AAExC,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAU,EAAE,CAChD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,mBAAmB,CAAC;AADtC,QAAA,aAAa,iBACyB;AAE5C,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AADvC,QAAA,cAAc,kBACyB;AAE7C,MAAM,iBAAiB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACpD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,sBAAsB,CAAC;AADzC,QAAA,iBAAiB,qBACwB;AAE/C,MAAM,0BAA0B,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC7D,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,iCAAiC,CAAC;AADpD,QAAA,0BAA0B,8BAC0B;AAE1D,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AAD5C,QAAA,mBAAmB,uBACyB;AAElD,MAAM,0BAA0B,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC7D,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC,UAAU,gCAAgC,CAAC;AADnD,QAAA,0BAA0B,8BACyB;AAEhE,MAAM,oBAAoB,GAAG,CAAC,QAAkB,EAAE,GAAQ,EAAU,EAAE;IACpE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,mBAAQ,CAAC,GAAG;YACf,OAAO,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,mBAAQ,CAAC,IAAI;YAChB,OAAO,IAAA,sBAAc,EAAC,GAAG,CAAC,CAAC;QAC7B,0BAA0B;QAC1B;YACE,MAAM,IAAI,2BAAe,CACvB,qBAAqB,QAAkB,8BAA8B,CACtE,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AAiBF,MAAM,mBAAmB,GAAG,CAAC,GAAsB,EAAkB,EAAE;IACrE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzB,cAAc,EAAE,KAAK,CAAC,gBAAgB;QACtC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB;QAC9C,aAAa,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACI,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,MAAqB,EACrB,WAAmB,EACnB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAA,wBAAgB,EAAC,GAAG,CAAC,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,MAAM;aACP,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,4BAA4B,EAC5B,qBAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,4BAA4B,EAC5B,qBAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AApCD,0CAoCC;AAOD;;;;;;;;GAQG;AACI,KAAK,UAAU,YAAY,CAChC,YAAsB,EACtB,eAAuB,EACvB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAA,yBAAiB,EAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,eAAe,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,YAAY;aACnB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,yBAAyB,EACzB,qBAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,IAAA,gDAAoB,EAAC,YAAY,CAAC,CAAC;QAEnC,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa;gBAChD,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE;gBACxD,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU;gBAC1C,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU;aACpD;YACD,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,EAAE,qBAAS,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AA1CD,oCA0CC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAAkC,EAClC,eAAuB,EACvB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAA,kCAA0B,EAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,kCAAkC,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,eAAe,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,eAAe,EAAE,MAAM,CAAC,cAAc;gBACtC,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;aAC/D,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,gCAAiB,CAAC,QAAQ,EAAE,CAAC;gBACnD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,6BAAiB,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,qBAAS,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAS,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AA/BD,oDA+BC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,QAAQ,CAAC,EAAU,EAAE,GAAQ;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAA,iBAAS,EAAC,GAAG,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,MAAM,iBAAiB,CAC5B,aAAa,EACb,qBAAqB,EACrB,+BAAmB,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,SAAS,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,qBAAqB,EACrB,+BAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AA3BD,4BA2BC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,GAAQ,EACR,QAAkB;IAElB,MAAM,SAAS,GAAG,6CAA6C,CAAC;IAChE,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,mCAAmC;KACpD,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7C,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAA,sBAAc,EAAC,GAAG,CAAC,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,4BAA4B,EAC5B,uBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,WAAW,EAAE,mBAAmB,CAAC,YAAY;YAC7C,SAAS,EAAE,mBAAmB,CAAC,UAAU;YACzC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,4BAA4B,EAC5B,uBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA3CD,sCA2CC;AAQD;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,SAAiB,EACjB,QAAkB,EAClB,GAAQ,EACR,WAA6B,EAC7B,iBAAsC,KAAK;IAE3C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,QAAQ,KAAK,mBAAQ,CAAC,GAAG;oBAC3B,CAAC,CAAC,EAAE,4BAA4B,EAAE,SAAS,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,WAAW,EAAE,UAAU;gBACvB,GAAG,CAAC,WAAW;oBACb,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,cAAc,EAAE,MAAM,WAAW,CAAC,gBAAgB,EAAE;4BACpD,KAAK,EAAE,WAAW,CAAC,KAAK;4BACxB,WAAW,EAAE,MAAM,WAAW,CAAC,aAAa,EAAE,EAAE;4BAChD,eAAe,EAAE,cAAc;yBAChC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,wBAAwB,QAAQ,EAAE,EAClC,uBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,SAAS,EAAE,aAAa,CAAC,UAAU;YACnC,OAAO,EAAE;gBACP,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa;gBACjD,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc;gBACnD,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;gBAC3C,kBAAkB,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;aACrD;YACD,cAAc,EAAE,mBAAmB,CAAC,aAAa,CAAC,eAAe,IAAI,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,wBAAwB,QAAQ,EAAE,EAClC,uBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA/DD,oCA+DC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,GAAQ,EACR,WAAmB;IAEnB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,IAAA,2BAAmB,EAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,+BAA+B,EAC/B,uBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAuB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,+BAA+B,EAC/B,uBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AA/BD,sDA+BC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,WAAmB;IAEnB,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,IAAA,kCAA0B,EAAC,GAAG,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,sCAAsC,EACtC,uBAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,uBAAW,CACnB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,sCAAsC,EACtC,uBAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AApCD,0DAoCC","sourcesContent":["import type { Env, Platform } from '../../shared/env.js';\nimport { getEnvUrls, getOidcClientId } from '../../shared/env.js';\nimport type { MetaMetricsAuth } from '../../shared/types/services.js';\nimport { HTTP_STATUS_CODES } from '../constants.js';\nimport {\n NonceRetrievalError,\n PairConflictError,\n PairError,\n SignInError,\n ValidationError,\n RateLimitedError,\n} from '../errors.js';\nimport { validatePairResponse } from '../utils/validate-pair-response.js';\nimport type {\n AccessToken,\n ErrorMessage,\n LoginIdentifierType,\n PairSocialIdentifierParams,\n ProfileAlias,\n UserProfile,\n UserProfileLineage,\n} from './types.js';\nimport { AuthType } from './types.js';\n\n/*\n Parse Retry-After header into milliseconds if possible.\n * Supports seconds or HTTP-date formats.\n \n @param retryAfterHeader - The Retry-After header value (seconds or HTTP-date)\n * @returns The retry delay in milliseconds, or null if parsing fails\n /\nfunction parseRetryAfter(retryAfterHeader: string \| null): number \| null {\n if (!retryAfterHeader) {\n return null;\n }\n const seconds = Number(retryAfterHeader);\n if (!Number.isNaN(seconds)) {\n return seconds 1000;\n }\n const date = Date.parse(retryAfterHeader);\n if (!Number.isNaN(date)) {\n const diff = date - Date.now();\n return diff > 0 ? diff : null;\n }\n return null;\n}\n\n/*\n Extracts error details from a Response object.\n \n @param response - The HTTP response object\n * @returns Formatted error message with HTTP status and response body\n /\nasync function getResponseErrorMessage(response: Response): Promise<string> {\n const { status } = response;\n const clonedResponse = response.clone();\n\n let message = 'Unknown error';\n let error = 'unknown';\n\n try {\n const responseBody = (await response.json()) as\n \| ErrorMessage\n // eslint-disable-next-line @typescript-eslint/naming-convention\n \| { error_description: string; error: string };\n\n message =\n 'message' in responseBody\n ? responseBody.message\n : responseBody.error_description;\n error = responseBody.error ?? 'unknown';\n } catch {\n try {\n const textContent = await clonedResponse.text();\n message = textContent\n ? textContent.slice(0, 150)\n : 'Non-JSON error response';\n error = 'non_json_response';\n } catch {\n message = 'Unable to parse error response';\n error = 'unparseable_response';\n }\n }\n\n return `HTTP ${status} - ${message} (error: ${error})`;\n}\n\n/\n Type guard to check if an object is a Response-like object.\n \n @param obj - The object to check\n * @returns True if the object is a Response-like object, false otherwise\n /\nconst isErrorResponse = (obj: unknown): obj is Response =>\n typeof obj === 'object' &&\n obj !== null &&\n 'status' in obj &&\n 'headers' in obj;\n\n/\n Throws a domain-specific error for service failures.\n * Handles both HTTP error responses and regular errors (network failures, etc.).\n * For HTTP 429, throws RateLimitedError with Retry-After header parsing.\n \n @param error - The error (Response object or caught error)\n * @param errorPrefix - Context prefix for the error message\n * @param ErrorClass - The domain-specific error class to throw\n * @throws RateLimitedError for 429, otherwise ErrorClass\n /\nasync function throwServiceError(\n error: unknown,\n errorPrefix: string,\n ErrorClass: new (message: string) => Error,\n): Promise<never> {\n // Re-throw RateLimitedError or matching ErrorClass as-is (don't double-wrap)\n if (error instanceof RateLimitedError \|\| error instanceof ErrorClass) {\n throw error;\n }\n\n // Not a Response-like object - handle as regular error\n if (!isErrorResponse(error)) {\n const errorMessage = error instanceof Error ? error.message : String(error);\n throw new ErrorClass(`${errorPrefix}: ${errorMessage}`);\n }\n\n // Handle HTTP error response\n const response = error;\n const { status } = response;\n const responseMessage = await getResponseErrorMessage(response);\n\n if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n const retryAfterHeader = response.headers.get('Retry-After');\n const retryAfterMs = parseRetryAfter(retryAfterHeader);\n throw new RateLimitedError(\n `${errorPrefix}: ${responseMessage}`,\n retryAfterMs ?? undefined,\n );\n }\n\n throw new ErrorClass(`${errorPrefix}: ${responseMessage}`);\n}\n\nexport const NONCE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/nonce`;\n\nexport const PAIR_IDENTIFIERS = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/identifiers/pair`;\n\nexport const OIDC_TOKEN_URL = (env: Env): string =>\n `${getEnvUrls(env).oidcApiUrl}/oauth2/token`;\n\nexport const SRP_LOGIN_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/srp/login`;\n\nexport const SIWE_LOGIN_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/siwe/login`;\n\nexport const PAIR_PROFILES_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/profile/pair`;\n\nexport const PAIR_SOCIAL_IDENTIFIER_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/profile/pair/identifier`;\n\nexport const PROFILE_LINEAGE_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/profile/lineage`;\n\nexport const CUSTOMER_SERVICE_TOKEN_URL = (env: Env): string =>\n `${getEnvUrls(env).authApiUrl}/api/v2/customer-service/token`;\n\nconst getAuthenticationUrl = (authType: AuthType, env: Env): string => {\n switch (authType) {\n case AuthType.SRP:\n return SRP_LOGIN_URL(env);\n case AuthType.SiWE:\n return SIWE_LOGIN_URL(env);\n / istanbul ignore next /\n default:\n throw new ValidationError(\n `Invalid AuthType: ${authType as number} - unable to create Auth URL`,\n );\n }\n};\n\ntype NonceResponse = {\n nonce: string;\n identifier: string;\n expiresIn: number;\n};\n\ntype RawProfileAlias = {\n // eslint-disable-next-line @typescript-eslint/naming-convention\n alias_profile_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n canonical_profile_id: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n identifier_ids: { id: string; type: string }[];\n};\n\nconst parseProfileAliases = (raw: RawProfileAlias[]): ProfileAlias[] => {\n return raw.map((alias) => ({\n aliasProfileId: alias.alias_profile_id,\n canonicalProfileId: alias.canonical_profile_id,\n identifierIds: alias.identifier_ids ?? [],\n }));\n};\n\ntype PairRequest = {\n signature: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n raw_message: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n encrypted_storage_key: string;\n // eslint-disable-next-line @typescript-eslint/naming-convention\n identifier_type: 'SIWE' \| 'SRP';\n};\n\n/\n Pair multiple identifiers under a single profile\n \n @param nonce - session nonce\n * @param logins - pairing request payload\n * @param accessToken - JWT access token used to access protected resources\n * @param env - server environment\n * @returns void.\n /\nexport async function pairIdentifiers(\n nonce: string,\n logins: PairRequest[],\n accessToken: string,\n env: Env,\n): Promise<void> {\n const pairUrl = new URL(PAIR_IDENTIFIERS(env));\n\n try {\n const response = await fetch(pairUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${accessToken}`,\n },\n body: JSON.stringify({\n nonce,\n logins,\n }),\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to pair identifiers',\n PairError,\n );\n }\n return undefined;\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to pair identifiers',\n PairError,\n );\n }\n}\n\nexport type PairProfilesResponse = {\n profile: UserProfile;\n profileAliases: ProfileAlias[];\n};\n\n/\n Pair multiple profiles using their OIDC access tokens.\n * Idempotent — calling with already-paired tokens is a no-op.\n \n @param accessTokens - Two or more OIDC access tokens to pair\n * @param authAccessToken - A valid access token for the Authorization header\n * @param env - server environment\n * @returns The pair response containing the canonical profile and aliases\n /\nexport async function pairProfiles(\n accessTokens: string[],\n authAccessToken: string,\n env: Env,\n): Promise<PairProfilesResponse> {\n const pairUrl = new URL(PAIR_PROFILES_URL(env));\n\n try {\n const response = await fetch(pairUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${authAccessToken}`,\n },\n body: JSON.stringify({\n jwts: accessTokens,\n }),\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to pair profiles',\n PairError,\n );\n }\n\n const pairResponse: unknown = await response.json();\n validatePairResponse(pairResponse);\n\n return {\n profile: {\n identifierId: pairResponse.profile.identifier_id,\n metaMetricsId: pairResponse.profile.metametrics_id ?? '',\n profileId: pairResponse.profile.profile_id,\n canonicalProfileId: pairResponse.profile.profile_id,\n },\n profileAliases: parseProfileAliases(pairResponse.profile_aliases ?? []),\n };\n } catch (error) {\n return await throwServiceError(error, 'Failed to pair profiles', PairError);\n }\n}\n\n/\n Attach a Google/Apple/Telegram social identifier to the profile that\n * owns `authAccessToken` (`POST /api/v2/profile/pair/identifier`).\n \n `email` is omitted from the body when undefined. 409 Conflict throws\n * {@link PairConflictError} so callers can treat it as terminal. The\n * response body (new token + profile) is not consumed: a 2xx status is the\n * only success signal.\n \n @param params - Social identifier type, social JWT, and optional email\n * @param authAccessToken - Bearer token of the canonical (primary SRP) profile\n * @param env - server environment\n /\nexport async function pairSocialIdentifier(\n params: PairSocialIdentifierParams,\n authAccessToken: string,\n env: Env,\n): Promise<void> {\n const pairUrl = new URL(PAIR_SOCIAL_IDENTIFIER_URL(env));\n const errorPrefix = 'Failed to pair social identifier';\n\n try {\n const response = await fetch(pairUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Authorization: `Bearer ${authAccessToken}`,\n },\n body: JSON.stringify({\n identifier_type: params.identifierType,\n social_jwt: params.socialJwt,\n ...(params.email === undefined ? {} : { email: params.email }),\n }),\n });\n\n if (!response.ok) {\n if (response.status === HTTP_STATUS_CODES.CONFLICT) {\n await throwServiceError(response, errorPrefix, PairConflictError);\n }\n await throwServiceError(response, errorPrefix, PairError);\n }\n } catch (error) {\n await throwServiceError(error, errorPrefix, PairError);\n }\n}\n\n/\n Service to Get Nonce for JWT Bearer Flow\n \n @param id - identifier ID\n * @param env - server environment\n * @returns the nonce.\n /\nexport async function getNonce(id: string, env: Env): Promise<NonceResponse> {\n const nonceUrl = new URL(NONCE_URL(env));\n nonceUrl.searchParams.set('identifier', id);\n\n try {\n const nonceResponse = await fetch(nonceUrl.toString());\n if (!nonceResponse.ok) {\n return await throwServiceError(\n nonceResponse,\n 'Failed to get nonce',\n NonceRetrievalError,\n );\n }\n\n const nonceJson = await nonceResponse.json();\n return {\n nonce: nonceJson.nonce,\n identifier: nonceJson.identifier,\n expiresIn: nonceJson.expires_in,\n };\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to get nonce',\n NonceRetrievalError,\n );\n }\n}\n\n/\n Service to Authorize And perform OIDC Flow to get the Access Token\n \n @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)\n * @param env - server environment\n * @param platform - SDK platform\n * @returns Access Token from Authorization server\n /\nexport async function authorizeOIDC(\n jwtToken: string,\n env: Env,\n platform: Platform,\n): Promise<AccessToken> {\n const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n const headers = {\n 'Content-Type': 'application/x-www-form-urlencoded',\n };\n\n const urlEncodedBody = new URLSearchParams();\n urlEncodedBody.append('grant_type', grantType);\n urlEncodedBody.append('client_id', getOidcClientId(env, platform));\n urlEncodedBody.append('assertion', jwtToken);\n\n try {\n const response = await fetch(OIDC_TOKEN_URL(env), {\n method: 'POST',\n headers,\n body: urlEncodedBody.toString(),\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to get access token',\n SignInError,\n );\n }\n\n const accessTokenResponse = await response.json();\n return {\n accessToken: accessTokenResponse.access_token,\n expiresIn: accessTokenResponse.expires_in,\n obtainedAt: Date.now(),\n };\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to get access token',\n SignInError,\n );\n }\n}\n\ntype Authentication = {\n token: string;\n expiresIn: number;\n profile: UserProfile;\n profileAliases: ProfileAlias[];\n};\n/\n Service to Authenticate/Login a user via SIWE or SRP derived key.\n \n @param rawMessage - raw message for validation when authenticating\n * @param signature - signed raw message\n * @param authType - authentication type/flow used\n * @param env - server environment\n * @param metametrics - optional metametrics\n * @param identifierType - login identifier type included in metametrics\n * (defaults to `SRP` when metametrics is present)\n * @returns Authentication Token\n /\nexport async function authenticate(\n rawMessage: string,\n signature: string,\n authType: AuthType,\n env: Env,\n metametrics?: MetaMetricsAuth,\n identifierType: LoginIdentifierType = 'SRP',\n): Promise<Authentication> {\n const authenticationUrl = getAuthenticationUrl(authType, env);\n\n try {\n const response = await fetch(authenticationUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n ...(authType === AuthType.SRP\n ? { 'X-MetaMask-Profile-Pairing': 'enabled' }\n : {}),\n },\n body: JSON.stringify({\n signature,\n raw_message: rawMessage,\n ...(metametrics\n ? {\n metametrics: {\n metametrics_id: await metametrics.getMetaMetricsId(),\n agent: metametrics.agent,\n app_version: await metametrics.getAppVersion?.(),\n identifier_type: identifierType,\n },\n }\n : {}),\n }),\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n `Failed to login with ${authType}`,\n SignInError,\n );\n }\n\n const loginResponse = await response.json();\n\n return {\n token: loginResponse.token,\n expiresIn: loginResponse.expires_in,\n profile: {\n identifierId: loginResponse.profile.identifier_id,\n metaMetricsId: loginResponse.profile.metametrics_id,\n profileId: loginResponse.profile.profile_id,\n canonicalProfileId: loginResponse.profile.profile_id,\n },\n profileAliases: parseProfileAliases(loginResponse.profile_aliases ?? []),\n };\n } catch (error) {\n return await throwServiceError(\n error,\n `Failed to login with ${authType}`,\n SignInError,\n );\n }\n}\n\n/\n Service to get the Profile Lineage\n \n @param env - server environment\n * @param accessToken - JWT access token used to access protected resources\n * @returns Profile Lineage information.\n /\nexport async function getUserProfileLineage(\n env: Env,\n accessToken: string,\n): Promise<UserProfileLineage> {\n const profileLineageUrl = new URL(PROFILE_LINEAGE_URL(env));\n\n try {\n const response = await fetch(profileLineageUrl, {\n method: 'GET',\n headers: {\n Authorization: `Bearer ${accessToken}`,\n },\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to get profile lineage',\n SignInError,\n );\n }\n\n const profileJson: UserProfileLineage = await response.json();\n return profileJson;\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to get profile lineage',\n SignInError,\n );\n }\n}\n\n/\n Service to get a Customer Service specific access token.\n \n Exchanges a valid OIDC access token for a short-lived token scoped to the\n * customer-service audience, which Customer Service tooling consumes to\n * identify and authenticate the user.\n \n @param env - server environment\n * @param accessToken - JWT access token used to access protected resources\n * @returns The customer-service access token.\n */\nexport async function getCustomerServiceToken(\n env: Env,\n accessToken: string,\n): Promise<string> {\n const customerServiceTokenUrl = new URL(CUSTOMER_SERVICE_TOKEN_URL(env));\n\n try {\n const response = await fetch(customerServiceTokenUrl, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${accessToken}`,\n },\n });\n\n if (!response.ok) {\n return await throwServiceError(\n response,\n 'Failed to get customer service token',\n SignInError,\n );\n }\n\n const tokenResponse = await response.json();\n if (typeof tokenResponse?.access_token !== 'string') {\n throw new SignInError(\n 'Failed to get customer service token: missing access_token',\n );\n }\n return tokenResponse.access_token;\n } catch (error) {\n return await throwServiceError(\n error,\n 'Failed to get customer service token',\n SignInError,\n );\n }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/services.d.cts CHANGED Viewed

@@ -1,6 +1,6 @@
 import type { Env, Platform } from "../../shared/env.cjs";
 import type { MetaMetricsAuth } from "../../shared/types/services.cjs";
-import type { AccessToken, ProfileAlias, UserProfile, UserProfileLineage } from "./types.cjs";
+import type { AccessToken, LoginIdentifierType, PairSocialIdentifierParams, ProfileAlias, UserProfile, UserProfileLineage } from "./types.cjs";
 import { AuthType } from "./types.cjs";
 export declare const NONCE_URL: (env: Env) => string;
 export declare const PAIR_IDENTIFIERS: (env: Env) => string;
@@ -8,6 +8,7 @@ export declare const OIDC_TOKEN_URL: (env: Env) => string;
 export declare const SRP_LOGIN_URL: (env: Env) => string;
 export declare const SIWE_LOGIN_URL: (env: Env) => string;
 export declare const PAIR_PROFILES_URL: (env: Env) => string;
+export declare const PAIR_SOCIAL_IDENTIFIER_URL: (env: Env) => string;
 export declare const PROFILE_LINEAGE_URL: (env: Env) => string;
 export declare const CUSTOMER_SERVICE_TOKEN_URL: (env: Env) => string;
 type NonceResponse = {
@@ -45,6 +46,20 @@ export type PairProfilesResponse = {
  * @returns The pair response containing the canonical profile and aliases
  */
 export declare function pairProfiles(accessTokens: string[], authAccessToken: string, env: Env): Promise<PairProfilesResponse>;
+/**
+ * Attach a Google/Apple/Telegram social identifier to the profile that
+ * owns `authAccessToken` (`POST /api/v2/profile/pair/identifier`).
+ *
+ * `email` is omitted from the body when undefined. 409 Conflict throws
+ * {@link PairConflictError} so callers can treat it as terminal. The
+ * response body (new token + profile) is not consumed: a 2xx status is the
+ * only success signal.
+ *
+ * @param params - Social identifier type, social JWT, and optional email
+ * @param authAccessToken - Bearer token of the canonical (primary SRP) profile
+ * @param env - server environment
+ */
+export declare function pairSocialIdentifier(params: PairSocialIdentifierParams, authAccessToken: string, env: Env): Promise<void>;
 /**
  * Service to Get Nonce for JWT Bearer Flow
  *
@@ -76,9 +91,11 @@ type Authentication = {
  * @param authType - authentication type/flow used
  * @param env - server environment
  * @param metametrics - optional metametrics
+ * @param identifierType - login identifier type included in metametrics
+ *   (defaults to `SRP` when metametrics is present)
  * @returns Authentication Token
  */
-export declare function authenticate(rawMessage: string, signature: string, authType: AuthType, env: Env, metametrics?: MetaMetricsAuth): Promise<Authentication>;
+export declare function authenticate(rawMessage: string, signature: string, authType: AuthType, env: Env, metametrics?: MetaMetricsAuth, identifierType?: LoginIdentifierType): Promise<Authentication>;
 /**
  * Service to get the Profile Lineage
  *

package/dist/sdk/authentication-jwt-bearer/services.d.cts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"services.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,~~6BAAyB~~;~~AAEtD~~,OAAO,KAAK,EAAE,eAAe,EAAE,~~wCAAoC~~;~~AAUnE~~,OAAO,KAAK,EACV,WAAW,EAEX,YAAY,EACZ,WAAW,EACX,kBAAkB,EACnB,~~oBAAgB~~;~~AACjB~~,OAAO,EAAE,QAAQ,EAAE,~~oBAAgB~~;~~AAwHnC~~,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,MACS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG,MACa,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,KAAG,MACS,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,iBAAiB,QAAS,GAAG,KAAG,MACQ,CAAC;AAEtD,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACS,CAAC;AAgBhE,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmBF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,oBAAoB,CAAC,CAsC/B;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CA2B3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AACF~~;;;;;;;;;GASG~~;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,WAAW,CAAC,EAAE,eAAe,~~GAC5B~~,OAAO,CAAC,cAAc,CAAC,~~CAuDzB~~;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAiCjB"}
1	+ {"version":3,"file":"services.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,6BAA4B;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAWtE,OAAO,KAAK,EACV,WAAW,EAEX,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,WAAW,EACX,kBAAkB,EACnB,oBAAmB;AACpB,OAAO,EAAE,QAAQ,EAAE,oBAAmB;AAwHtC,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,MACS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG,MACa,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,KAAG,MACS,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,iBAAiB,QAAS,GAAG,KAAG,MACQ,CAAC;AAEtD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACU,CAAC;AAEjE,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACS,CAAC;AAgBhE,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmBF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,oBAAoB,CAAC,CAsC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CA2B3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AACF;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,WAAW,CAAC,EAAE,eAAe,EAC7B,cAAc,GAAE,mBAA2B,GAC1C,OAAO,CAAC,cAAc,CAAC,CAwDzB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAiCjB"}

package/dist/sdk/authentication-jwt-bearer/services.d.mts CHANGED Viewed

@@ -1,6 +1,6 @@
 import type { Env, Platform } from "../../shared/env.mjs";
 import type { MetaMetricsAuth } from "../../shared/types/services.mjs";
-import type { AccessToken, ProfileAlias, UserProfile, UserProfileLineage } from "./types.mjs";
+import type { AccessToken, LoginIdentifierType, PairSocialIdentifierParams, ProfileAlias, UserProfile, UserProfileLineage } from "./types.mjs";
 import { AuthType } from "./types.mjs";
 export declare const NONCE_URL: (env: Env) => string;
 export declare const PAIR_IDENTIFIERS: (env: Env) => string;
@@ -8,6 +8,7 @@ export declare const OIDC_TOKEN_URL: (env: Env) => string;
 export declare const SRP_LOGIN_URL: (env: Env) => string;
 export declare const SIWE_LOGIN_URL: (env: Env) => string;
 export declare const PAIR_PROFILES_URL: (env: Env) => string;
+export declare const PAIR_SOCIAL_IDENTIFIER_URL: (env: Env) => string;
 export declare const PROFILE_LINEAGE_URL: (env: Env) => string;
 export declare const CUSTOMER_SERVICE_TOKEN_URL: (env: Env) => string;
 type NonceResponse = {
@@ -45,6 +46,20 @@ export type PairProfilesResponse = {
  * @returns The pair response containing the canonical profile and aliases
  */
 export declare function pairProfiles(accessTokens: string[], authAccessToken: string, env: Env): Promise<PairProfilesResponse>;
+/**
+ * Attach a Google/Apple/Telegram social identifier to the profile that
+ * owns `authAccessToken` (`POST /api/v2/profile/pair/identifier`).
+ *
+ * `email` is omitted from the body when undefined. 409 Conflict throws
+ * {@link PairConflictError} so callers can treat it as terminal. The
+ * response body (new token + profile) is not consumed: a 2xx status is the
+ * only success signal.
+ *
+ * @param params - Social identifier type, social JWT, and optional email
+ * @param authAccessToken - Bearer token of the canonical (primary SRP) profile
+ * @param env - server environment
+ */
+export declare function pairSocialIdentifier(params: PairSocialIdentifierParams, authAccessToken: string, env: Env): Promise<void>;
 /**
  * Service to Get Nonce for JWT Bearer Flow
  *
@@ -76,9 +91,11 @@ type Authentication = {
  * @param authType - authentication type/flow used
  * @param env - server environment
  * @param metametrics - optional metametrics
+ * @param identifierType - login identifier type included in metametrics
+ *   (defaults to `SRP` when metametrics is present)
  * @returns Authentication Token
  */
-export declare function authenticate(rawMessage: string, signature: string, authType: AuthType, env: Env, metametrics?: MetaMetricsAuth): Promise<Authentication>;
+export declare function authenticate(rawMessage: string, signature: string, authType: AuthType, env: Env, metametrics?: MetaMetricsAuth, identifierType?: LoginIdentifierType): Promise<Authentication>;
 /**
  * Service to get the Profile Lineage
  *

package/dist/sdk/authentication-jwt-bearer/services.d.mts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"services.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,~~6BAAyB~~;~~AAEtD~~,OAAO,KAAK,EAAE,eAAe,EAAE,~~wCAAoC~~;~~AAUnE~~,OAAO,KAAK,EACV,WAAW,EAEX,YAAY,EACZ,WAAW,EACX,kBAAkB,EACnB,~~oBAAgB~~;~~AACjB~~,OAAO,EAAE,QAAQ,EAAE,~~oBAAgB~~;~~AAwHnC~~,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,MACS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG,MACa,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,KAAG,MACS,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,iBAAiB,QAAS,GAAG,KAAG,MACQ,CAAC;AAEtD,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACS,CAAC;AAgBhE,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmBF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,oBAAoB,CAAC,CAsC/B;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CA2B3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AACF~~;;;;;;;;;GASG~~;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,WAAW,CAAC,EAAE,eAAe,~~GAC5B~~,OAAO,CAAC,cAAc,CAAC,~~CAuDzB~~;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAiCjB"}
1	+ {"version":3,"file":"services.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,6BAA4B;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAWtE,OAAO,KAAK,EACV,WAAW,EAEX,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,WAAW,EACX,kBAAkB,EACnB,oBAAmB;AACpB,OAAO,EAAE,QAAQ,EAAE,oBAAmB;AAwHtC,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,MACS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG,MACa,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,KAAG,MACS,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,iBAAiB,QAAS,GAAG,KAAG,MACQ,CAAC;AAEtD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACU,CAAC;AAEjE,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACS,CAAC;AAgBhE,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmBF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,oBAAoB,CAAC,CAsC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CA2B3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AACF;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,WAAW,CAAC,EAAE,eAAe,EAC7B,cAAc,GAAE,mBAA2B,GAC1C,OAAO,CAAC,cAAc,CAAC,CAwDzB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAiCjB"}

package/dist/sdk/authentication-jwt-bearer/services.mjs CHANGED Viewed

@@ -1,6 +1,6 @@
 import { getEnvUrls, getOidcClientId } from "../../shared/env.mjs";
 import { HTTP_STATUS_CODES } from "../constants.mjs";
-import { NonceRetrievalError, PairError, SignInError, ValidationError, RateLimitedError } from "../errors.mjs";
+import { NonceRetrievalError, PairConflictError, PairError, SignInError, ValidationError, RateLimitedError } from "../errors.mjs";
 import { validatePairResponse } from "../utils/validate-pair-response.mjs";
 import { AuthType } from "./types.mjs";
 /**
@@ -106,6 +106,7 @@ export const OIDC_TOKEN_URL = (env) => `${getEnvUrls(env).oidcApiUrl}/oauth2/tok
 export const SRP_LOGIN_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/srp/login`;
 export const SIWE_LOGIN_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/siwe/login`;
 export const PAIR_PROFILES_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/profile/pair`;
+export const PAIR_SOCIAL_IDENTIFIER_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/profile/pair/identifier`;
 export const PROFILE_LINEAGE_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/profile/lineage`;
 export const CUSTOMER_SERVICE_TOKEN_URL = (env) => `${getEnvUrls(env).authApiUrl}/api/v2/customer-service/token`;
 const getAuthenticationUrl = (authType, env) => {
@@ -199,6 +200,46 @@ export async function pairProfiles(accessTokens, authAccessToken, env) {
         return await throwServiceError(error, 'Failed to pair profiles', PairError);
     }
 }
+/**
+ * Attach a Google/Apple/Telegram social identifier to the profile that
+ * owns `authAccessToken` (`POST /api/v2/profile/pair/identifier`).
+ *
+ * `email` is omitted from the body when undefined. 409 Conflict throws
+ * {@link PairConflictError} so callers can treat it as terminal. The
+ * response body (new token + profile) is not consumed: a 2xx status is the
+ * only success signal.
+ *
+ * @param params - Social identifier type, social JWT, and optional email
+ * @param authAccessToken - Bearer token of the canonical (primary SRP) profile
+ * @param env - server environment
+ */
+export async function pairSocialIdentifier(params, authAccessToken, env) {
+    const pairUrl = new URL(PAIR_SOCIAL_IDENTIFIER_URL(env));
+    const errorPrefix = 'Failed to pair social identifier';
+    try {
+        const response = await fetch(pairUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${authAccessToken}`,
+            },
+            body: JSON.stringify({
+                identifier_type: params.identifierType,
+                social_jwt: params.socialJwt,
+                ...(params.email === undefined ? {} : { email: params.email }),
+            }),
+        });
+        if (!response.ok) {
+            if (response.status === HTTP_STATUS_CODES.CONFLICT) {
+                await throwServiceError(response, errorPrefix, PairConflictError);
+            }
+            await throwServiceError(response, errorPrefix, PairError);
+        }
+    }
+    catch (error) {
+        await throwServiceError(error, errorPrefix, PairError);
+    }
+}
 /**
  * Service to Get Nonce for JWT Bearer Flow
  *
@@ -270,9 +311,11 @@ export async function authorizeOIDC(jwtToken, env, platform) {
  * @param authType - authentication type/flow used
  * @param env - server environment
  * @param metametrics - optional metametrics
+ * @param identifierType - login identifier type included in metametrics
+ *   (defaults to `SRP` when metametrics is present)
  * @returns Authentication Token
  */
-export async function authenticate(rawMessage, signature, authType, env, metametrics) {
+export async function authenticate(rawMessage, signature, authType, env, metametrics, identifierType = 'SRP') {
     const authenticationUrl = getAuthenticationUrl(authType, env);
     try {
         const response = await fetch(authenticationUrl, {
@@ -292,6 +335,7 @@ export async function authenticate(rawMessage, signature, authType, env, metamet
                             metametrics_id: await metametrics.getMetaMetricsId(),
                             agent: metametrics.agent,
                             app_version: await metametrics.getAppVersion?.(),
+                            identifier_type: identifierType,
                         },
                     }
                     : {}),