@metamask/profile-sync-controller 28.3.0 → 30.0.0

package/dist/shared/utils/entropy-source.d.cts

@@ -0,0 +1,22 @@
+import type { KeyringObject } from "@metamask/keyring-controller";
+/**
+ * Reads HD keyring entropy source IDs (metadata IDs) from KeyringController
+ * keyrings, primary first. Returns an empty array when none are available
+ * (e.g. the wallet is locked, where `keyrings` is cleared).
+ *
+ * @param keyrings - Keyrings from `KeyringController:getState`.
+ * @returns The HD keyring metadata IDs, primary first.
+ */
+export declare function getHdKeyringEntropySourceIds(keyrings: KeyringObject[] | null | undefined): string[];
+/**
+ * Resolves the primary SRP's entropy source ID (the first HD keyring's
+ * metadata ID). The ID is randomly regenerated whenever the vault is
+ * recreated (e.g. on restore).
+ *
+ * @param keyrings - Keyrings from `KeyringController:getState`.
+ * @returns The primary HD keyring metadata ID.
+ * @throws If no HD keyring is available; callers must only resolve while
+ * the wallet is unlocked.
+ */
+export declare function getPrimaryHdKeyringEntropySourceId(keyrings: KeyringObject[] | null | undefined): string;
+//# sourceMappingURL=entropy-source.d.cts.map

package/dist/shared/utils/entropy-source.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy-source.d.cts","sourceRoot":"","sources":["../../../src/shared/utils/entropy-source.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,qCAAqC;AAElE;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,GAAG,SAAS,GAC3C,MAAM,EAAE,CAIV;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,GAAG,SAAS,GAC3C,MAAM,CAQR"}

package/dist/shared/utils/entropy-source.d.mts

@@ -0,0 +1,22 @@
+import type { KeyringObject } from "@metamask/keyring-controller";
+/**
+ * Reads HD keyring entropy source IDs (metadata IDs) from KeyringController
+ * keyrings, primary first. Returns an empty array when none are available
+ * (e.g. the wallet is locked, where `keyrings` is cleared).
+ *
+ * @param keyrings - Keyrings from `KeyringController:getState`.
+ * @returns The HD keyring metadata IDs, primary first.
+ */
+export declare function getHdKeyringEntropySourceIds(keyrings: KeyringObject[] | null | undefined): string[];
+/**
+ * Resolves the primary SRP's entropy source ID (the first HD keyring's
+ * metadata ID). The ID is randomly regenerated whenever the vault is
+ * recreated (e.g. on restore).
+ *
+ * @param keyrings - Keyrings from `KeyringController:getState`.
+ * @returns The primary HD keyring metadata ID.
+ * @throws If no HD keyring is available; callers must only resolve while
+ * the wallet is unlocked.
+ */
+export declare function getPrimaryHdKeyringEntropySourceId(keyrings: KeyringObject[] | null | undefined): string;
+//# sourceMappingURL=entropy-source.d.mts.map

package/dist/shared/utils/entropy-source.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy-source.d.mts","sourceRoot":"","sources":["../../../src/shared/utils/entropy-source.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,qCAAqC;AAElE;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,GAAG,SAAS,GAC3C,MAAM,EAAE,CAIV;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAI,GAAG,SAAS,GAC3C,MAAM,CAQR"}

package/dist/shared/utils/entropy-source.mjs

@@ -0,0 +1,32 @@
+import { KeyringTypes } from "@metamask/keyring-controller";
+/**
+ * Reads HD keyring entropy source IDs (metadata IDs) from KeyringController
+ * keyrings, primary first. Returns an empty array when none are available
+ * (e.g. the wallet is locked, where `keyrings` is cleared).
+ *
+ * @param keyrings - Keyrings from `KeyringController:getState`.
+ * @returns The HD keyring metadata IDs, primary first.
+ */
+export function getHdKeyringEntropySourceIds(keyrings) {
+    return (keyrings ?? [])
+        .filter((keyring) => keyring.type === KeyringTypes.hd.toString())
+        .map((keyring) => keyring.metadata.id);
+}
+/**
+ * Resolves the primary SRP's entropy source ID (the first HD keyring's
+ * metadata ID). The ID is randomly regenerated whenever the vault is
+ * recreated (e.g. on restore).
+ *
+ * @param keyrings - Keyrings from `KeyringController:getState`.
+ * @returns The primary HD keyring metadata ID.
+ * @throws If no HD keyring is available; callers must only resolve while
+ * the wallet is unlocked.
+ */
+export function getPrimaryHdKeyringEntropySourceId(keyrings) {
+    const [primaryEntropySourceId] = getHdKeyringEntropySourceIds(keyrings);
+    if (!primaryEntropySourceId) {
+        throw new Error('getPrimaryHdKeyringEntropySourceId - no HD keyring available');
+    }
+    return primaryEntropySourceId;
+}
+//# sourceMappingURL=entropy-source.mjs.map

package/dist/shared/utils/entropy-source.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entropy-source.mjs","sourceRoot":"","sources":["../../../src/shared/utils/entropy-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,qCAAqC;AAG5D;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAA4C;IAE5C,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC;SAChE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAA4C;IAE5C,MAAM,CAAC,sBAAsB,CAAC,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC","sourcesContent":["import { KeyringTypes } from '@metamask/keyring-controller';\nimport type { KeyringObject } from '@metamask/keyring-controller';\n\n/**\n * Reads HD keyring entropy source IDs (metadata IDs) from KeyringController\n * keyrings, primary first. Returns an empty array when none are available\n * (e.g. the wallet is locked, where `keyrings` is cleared).\n *\n * @param keyrings - Keyrings from `KeyringController:getState`.\n * @returns The HD keyring metadata IDs, primary first.\n */\nexport function getHdKeyringEntropySourceIds(\n  keyrings: KeyringObject[] | null | undefined,\n): string[] {\n  return (keyrings ?? [])\n    .filter((keyring) => keyring.type === KeyringTypes.hd.toString())\n    .map((keyring) => keyring.metadata.id);\n}\n\n/**\n * Resolves the primary SRP's entropy source ID (the first HD keyring's\n * metadata ID). The ID is randomly regenerated whenever the vault is\n * recreated (e.g. on restore).\n *\n * @param keyrings - Keyrings from `KeyringController:getState`.\n * @returns The primary HD keyring metadata ID.\n * @throws If no HD keyring is available; callers must only resolve while\n * the wallet is unlocked.\n */\nexport function getPrimaryHdKeyringEntropySourceId(\n  keyrings: KeyringObject[] | null | undefined,\n): string {\n  const [primaryEntropySourceId] = getHdKeyringEntropySourceIds(keyrings);\n  if (!primaryEntropySourceId) {\n    throw new Error(\n      'getPrimaryHdKeyringEntropySourceId - no HD keyring available',\n    );\n  }\n  return primaryEntropySourceId;\n}\n"]}

package/dist/shared/utils/hd-keyring-seed.cjs

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getHdKeyringSeed = void 0;
+/**
+ * HD keyring seed access for native SIP-6 message signing.
+ *
+ * This mirrors `@metamask/snaps-rpc-methods` `getMnemonicSeed` (when called
+ * with an entropy source id):
+ * `KeyringController:withKeyringV2Unsafe` → assert HD → return `keyring.seed`.
+ *
+ * Those helpers are not a public export of snaps-rpc-methods, so this thin wrapper lives here.
+ *
+ * @see https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts
+ */
+/**
+ * V2 HD keyring type (`KeyringType.Hd`). The template type keeps the literal
+ * aligned with `@metamask/keyring-api/v2` without a runtime dependency.
+ */
+const HD_KEYRING_TYPE = 'hd';
+const ENTROPY_SOURCE_NOT_FOUND_ERROR = 'Entropy source not found or is not an HD keyring.';
+/**
+ * Reads the BIP-39 seed for an HD keyring entropy source via
+ * `KeyringController:withKeyringV2Unsafe`.
+ *
+ * Equivalent to snaps-rpc-methods `getMnemonicSeed(messenger, source)` for a
+ * concrete entropy source id.
+ *
+ * @param messenger - Messenger that can call `withKeyringV2Unsafe`.
+ * @param entropySourceId - Keyring metadata ID (SIP-30 entropy source).
+ * @returns The HD keyring seed.
+ * @throws If the keyring is missing or is not an HD keyring with a seed.
+ */
+async function getHdKeyringSeed(messenger, entropySourceId) {
+    try {
+        const keyringData = (await messenger.call('KeyringController:withKeyringV2Unsafe', { id: entropySourceId }, async ({ keyring }) => {
+            const hdKeyring = keyring;
+            return { type: hdKeyring.type, seed: hdKeyring.seed };
+        }));
+        if (keyringData.type !== HD_KEYRING_TYPE || !keyringData.seed) {
+            throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);
+        }
+        return keyringData.seed;
+    }
+    catch {
+        throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);
+    }
+}
+exports.getHdKeyringSeed = getHdKeyringSeed;
+//# sourceMappingURL=hd-keyring-seed.cjs.map

package/dist/shared/utils/hd-keyring-seed.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"hd-keyring-seed.cjs","sourceRoot":"","sources":["../../../src/shared/utils/hd-keyring-seed.ts"],"names":[],"mappings":";;;AAKA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAwB,IAAI,CAAC;AAElD,MAAM,8BAA8B,GAClC,mDAAmD,CAAC;AAiBtD;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,gBAAgB,CACpC,SAAuC,EACvC,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CACvC,uCAAuC,EACvC,EAAE,EAAE,EAAE,eAAe,EAAE,EACvB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACpB,MAAM,SAAS,GAAG,OAAoB,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC,CACF,CAA+C,CAAC;QAEjD,IAAI,WAAW,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,WAAW,CAAC,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAtBD,4CAsBC","sourcesContent":["import type { HdKeyring } from '@metamask/eth-hd-keyring/v2';\nimport type { KeyringType } from '@metamask/keyring-api/v2';\nimport type { KeyringControllerWithKeyringV2UnsafeAction } from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\n\n/**\n * HD keyring seed access for native SIP-6 message signing.\n *\n * This mirrors `@metamask/snaps-rpc-methods` `getMnemonicSeed` (when called\n * with an entropy source id):\n * `KeyringController:withKeyringV2Unsafe` → assert HD → return `keyring.seed`.\n *\n * Those helpers are not a public export of snaps-rpc-methods, so this thin wrapper lives here.\n *\n * @see https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts\n */\n\n/**\n * V2 HD keyring type (`KeyringType.Hd`). The template type keeps the literal\n * aligned with `@metamask/keyring-api/v2` without a runtime dependency.\n */\nconst HD_KEYRING_TYPE: `${KeyringType.Hd}` = 'hd';\n\nconst ENTROPY_SOURCE_NOT_FOUND_ERROR =\n  'Entropy source not found or is not an HD keyring.';\n\n/**\n * Structural messenger shape for `withKeyringV2Unsafe`.\n *\n * Not `Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>` because\n * `Messenger` is invariant in its action union — Auth / UserStorage messengers\n * (which allow additional actions) are not assignable to that narrow type.\n */\ntype MessengerWithKeyringV2Unsafe = {\n  call: (\n    ...args: Parameters<\n      Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>['call']\n    >\n  ) => unknown;\n};\n\n/**\n * Reads the BIP-39 seed for an HD keyring entropy source via\n * `KeyringController:withKeyringV2Unsafe`.\n *\n * Equivalent to snaps-rpc-methods `getMnemonicSeed(messenger, source)` for a\n * concrete entropy source id.\n *\n * @param messenger - Messenger that can call `withKeyringV2Unsafe`.\n * @param entropySourceId - Keyring metadata ID (SIP-30 entropy source).\n * @returns The HD keyring seed.\n * @throws If the keyring is missing or is not an HD keyring with a seed.\n */\nexport async function getHdKeyringSeed(\n  messenger: MessengerWithKeyringV2Unsafe,\n  entropySourceId: string,\n): Promise<Uint8Array> {\n  try {\n    const keyringData = (await messenger.call(\n      'KeyringController:withKeyringV2Unsafe',\n      { id: entropySourceId },\n      async ({ keyring }) => {\n        const hdKeyring = keyring as HdKeyring;\n        return { type: hdKeyring.type, seed: hdKeyring.seed };\n      },\n    )) as { type: string; seed?: Uint8Array | null };\n\n    if (keyringData.type !== HD_KEYRING_TYPE || !keyringData.seed) {\n      throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);\n    }\n\n    return keyringData.seed;\n  } catch {\n    throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);\n  }\n}\n"]}

package/dist/shared/utils/hd-keyring-seed.d.cts

@@ -0,0 +1,27 @@
+import type { KeyringControllerWithKeyringV2UnsafeAction } from "@metamask/keyring-controller";
+import type { Messenger } from "@metamask/messenger";
+/**
+ * Structural messenger shape for `withKeyringV2Unsafe`.
+ *
+ * Not `Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>` because
+ * `Messenger` is invariant in its action union — Auth / UserStorage messengers
+ * (which allow additional actions) are not assignable to that narrow type.
+ */
+type MessengerWithKeyringV2Unsafe = {
+    call: (...args: Parameters<Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>['call']>) => unknown;
+};
+/**
+ * Reads the BIP-39 seed for an HD keyring entropy source via
+ * `KeyringController:withKeyringV2Unsafe`.
+ *
+ * Equivalent to snaps-rpc-methods `getMnemonicSeed(messenger, source)` for a
+ * concrete entropy source id.
+ *
+ * @param messenger - Messenger that can call `withKeyringV2Unsafe`.
+ * @param entropySourceId - Keyring metadata ID (SIP-30 entropy source).
+ * @returns The HD keyring seed.
+ * @throws If the keyring is missing or is not an HD keyring with a seed.
+ */
+export declare function getHdKeyringSeed(messenger: MessengerWithKeyringV2Unsafe, entropySourceId: string): Promise<Uint8Array>;
+export {};
+//# sourceMappingURL=hd-keyring-seed.d.cts.map

package/dist/shared/utils/hd-keyring-seed.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hd-keyring-seed.d.cts","sourceRoot":"","sources":["../../../src/shared/utils/hd-keyring-seed.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,0CAA0C,EAAE,qCAAqC;AAC/F,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AAuBrD;;;;;;GAMG;AACH,KAAK,4BAA4B,GAAG;IAClC,IAAI,EAAE,CACJ,GAAG,IAAI,EAAE,UAAU,CACjB,SAAS,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC,MAAM,CAAC,CACtE,KACE,OAAO,CAAC;CACd,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,4BAA4B,EACvC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAmBrB"}

package/dist/shared/utils/hd-keyring-seed.d.mts

@@ -0,0 +1,27 @@
+import type { KeyringControllerWithKeyringV2UnsafeAction } from "@metamask/keyring-controller";
+import type { Messenger } from "@metamask/messenger";
+/**
+ * Structural messenger shape for `withKeyringV2Unsafe`.
+ *
+ * Not `Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>` because
+ * `Messenger` is invariant in its action union — Auth / UserStorage messengers
+ * (which allow additional actions) are not assignable to that narrow type.
+ */
+type MessengerWithKeyringV2Unsafe = {
+    call: (...args: Parameters<Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>['call']>) => unknown;
+};
+/**
+ * Reads the BIP-39 seed for an HD keyring entropy source via
+ * `KeyringController:withKeyringV2Unsafe`.
+ *
+ * Equivalent to snaps-rpc-methods `getMnemonicSeed(messenger, source)` for a
+ * concrete entropy source id.
+ *
+ * @param messenger - Messenger that can call `withKeyringV2Unsafe`.
+ * @param entropySourceId - Keyring metadata ID (SIP-30 entropy source).
+ * @returns The HD keyring seed.
+ * @throws If the keyring is missing or is not an HD keyring with a seed.
+ */
+export declare function getHdKeyringSeed(messenger: MessengerWithKeyringV2Unsafe, entropySourceId: string): Promise<Uint8Array>;
+export {};
+//# sourceMappingURL=hd-keyring-seed.d.mts.map

package/dist/shared/utils/hd-keyring-seed.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hd-keyring-seed.d.mts","sourceRoot":"","sources":["../../../src/shared/utils/hd-keyring-seed.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,0CAA0C,EAAE,qCAAqC;AAC/F,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AAuBrD;;;;;;GAMG;AACH,KAAK,4BAA4B,GAAG;IAClC,IAAI,EAAE,CACJ,GAAG,IAAI,EAAE,UAAU,CACjB,SAAS,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC,MAAM,CAAC,CACtE,KACE,OAAO,CAAC;CACd,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,4BAA4B,EACvC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAmBrB"}

package/dist/shared/utils/hd-keyring-seed.mjs

@@ -0,0 +1,45 @@
+/**
+ * HD keyring seed access for native SIP-6 message signing.
+ *
+ * This mirrors `@metamask/snaps-rpc-methods` `getMnemonicSeed` (when called
+ * with an entropy source id):
+ * `KeyringController:withKeyringV2Unsafe` → assert HD → return `keyring.seed`.
+ *
+ * Those helpers are not a public export of snaps-rpc-methods, so this thin wrapper lives here.
+ *
+ * @see https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts
+ */
+/**
+ * V2 HD keyring type (`KeyringType.Hd`). The template type keeps the literal
+ * aligned with `@metamask/keyring-api/v2` without a runtime dependency.
+ */
+const HD_KEYRING_TYPE = 'hd';
+const ENTROPY_SOURCE_NOT_FOUND_ERROR = 'Entropy source not found or is not an HD keyring.';
+/**
+ * Reads the BIP-39 seed for an HD keyring entropy source via
+ * `KeyringController:withKeyringV2Unsafe`.
+ *
+ * Equivalent to snaps-rpc-methods `getMnemonicSeed(messenger, source)` for a
+ * concrete entropy source id.
+ *
+ * @param messenger - Messenger that can call `withKeyringV2Unsafe`.
+ * @param entropySourceId - Keyring metadata ID (SIP-30 entropy source).
+ * @returns The HD keyring seed.
+ * @throws If the keyring is missing or is not an HD keyring with a seed.
+ */
+export async function getHdKeyringSeed(messenger, entropySourceId) {
+    try {
+        const keyringData = (await messenger.call('KeyringController:withKeyringV2Unsafe', { id: entropySourceId }, async ({ keyring }) => {
+            const hdKeyring = keyring;
+            return { type: hdKeyring.type, seed: hdKeyring.seed };
+        }));
+        if (keyringData.type !== HD_KEYRING_TYPE || !keyringData.seed) {
+            throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);
+        }
+        return keyringData.seed;
+    }
+    catch {
+        throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);
+    }
+}
+//# sourceMappingURL=hd-keyring-seed.mjs.map

package/dist/shared/utils/hd-keyring-seed.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"hd-keyring-seed.mjs","sourceRoot":"","sources":["../../../src/shared/utils/hd-keyring-seed.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAwB,IAAI,CAAC;AAElD,MAAM,8BAA8B,GAClC,mDAAmD,CAAC;AAiBtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAuC,EACvC,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CACvC,uCAAuC,EACvC,EAAE,EAAE,EAAE,eAAe,EAAE,EACvB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACpB,MAAM,SAAS,GAAG,OAAoB,CAAC;YACvC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC,CACF,CAA+C,CAAC;QAEjD,IAAI,WAAW,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,WAAW,CAAC,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC","sourcesContent":["import type { HdKeyring } from '@metamask/eth-hd-keyring/v2';\nimport type { KeyringType } from '@metamask/keyring-api/v2';\nimport type { KeyringControllerWithKeyringV2UnsafeAction } from '@metamask/keyring-controller';\nimport type { Messenger } from '@metamask/messenger';\n\n/**\n * HD keyring seed access for native SIP-6 message signing.\n *\n * This mirrors `@metamask/snaps-rpc-methods` `getMnemonicSeed` (when called\n * with an entropy source id):\n * `KeyringController:withKeyringV2Unsafe` → assert HD → return `keyring.seed`.\n *\n * Those helpers are not a public export of snaps-rpc-methods, so this thin wrapper lives here.\n *\n * @see https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts\n */\n\n/**\n * V2 HD keyring type (`KeyringType.Hd`). The template type keeps the literal\n * aligned with `@metamask/keyring-api/v2` without a runtime dependency.\n */\nconst HD_KEYRING_TYPE: `${KeyringType.Hd}` = 'hd';\n\nconst ENTROPY_SOURCE_NOT_FOUND_ERROR =\n  'Entropy source not found or is not an HD keyring.';\n\n/**\n * Structural messenger shape for `withKeyringV2Unsafe`.\n *\n * Not `Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>` because\n * `Messenger` is invariant in its action union — Auth / UserStorage messengers\n * (which allow additional actions) are not assignable to that narrow type.\n */\ntype MessengerWithKeyringV2Unsafe = {\n  call: (\n    ...args: Parameters<\n      Messenger<string, KeyringControllerWithKeyringV2UnsafeAction>['call']\n    >\n  ) => unknown;\n};\n\n/**\n * Reads the BIP-39 seed for an HD keyring entropy source via\n * `KeyringController:withKeyringV2Unsafe`.\n *\n * Equivalent to snaps-rpc-methods `getMnemonicSeed(messenger, source)` for a\n * concrete entropy source id.\n *\n * @param messenger - Messenger that can call `withKeyringV2Unsafe`.\n * @param entropySourceId - Keyring metadata ID (SIP-30 entropy source).\n * @returns The HD keyring seed.\n * @throws If the keyring is missing or is not an HD keyring with a seed.\n */\nexport async function getHdKeyringSeed(\n  messenger: MessengerWithKeyringV2Unsafe,\n  entropySourceId: string,\n): Promise<Uint8Array> {\n  try {\n    const keyringData = (await messenger.call(\n      'KeyringController:withKeyringV2Unsafe',\n      { id: entropySourceId },\n      async ({ keyring }) => {\n        const hdKeyring = keyring as HdKeyring;\n        return { type: hdKeyring.type, seed: hdKeyring.seed };\n      },\n    )) as { type: string; seed?: Uint8Array | null };\n\n    if (keyringData.type !== HD_KEYRING_TYPE || !keyringData.seed) {\n      throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);\n    }\n\n    return keyringData.seed;\n  } catch {\n    throw new Error(ENTROPY_SOURCE_NOT_FOUND_ERROR);\n  }\n}\n"]}

package/dist/shared/utils/message-signing.cjs

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signMessageWithMessageSigningKey = exports.getMessageSigningPublicKey = exports.deriveMessageSigningPrivateKey = exports.deriveSip6PrivateKey = exports.MESSAGE_SIGNING_SNAP_ID = void 0;
+const key_tree_1 = require("@metamask/key-tree");
+const utils_1 = require("@metamask/utils");
+const secp256k1_1 = require("@noble/curves/secp256k1");
+const hmac_1 = require("@noble/hashes/hmac");
+const sha2_1 = require("@noble/hashes/sha2");
+const sha3_1 = require("@noble/hashes/sha3");
+/**
+ * Native SIP-6 message-signing helpers for AuthenticationController /
+ * UserStorageController.
+ *
+ * These are intentional copies of the message-signing snap crypto path so auth
+ * and user-storage can derive/sign without booting
+ * `npm:@metamask/message-signing-snap`. Behavior must stay byte-identical to:
+ *
+ * - SIP-6 derivation:
+ *   `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` /
+ *   `getEntropyDerivationPath` / `getDerivationPathArray`
+ *   (https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts)
+ * - Magic constant:
+ *   `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`
+ * - Pubkey + `metamask:…` signing:
+ *   `@metamask/message-signing-snap` `getPublicEntropyKey` /
+ *   `signMessageWithEntropyKey`
+ *   (https://github.com/MetaMask/message-signing-snap/blob/main/src/entropy-keys.ts)
+ *
+ * `deriveEntropyFromSeed` is not a public export of
+ * `@metamask/snaps-rpc-methods` today (and no core package depends on that
+ * package), so the SIP-6 math is vendored here rather than imported.
+ */
+/**
+ * Snap ID used as the SIP-6 `input` so derived keys match
+ * `@metamask/message-signing-snap` (`snap_getEntropy` origin).
+ */
+exports.MESSAGE_SIGNING_SNAP_ID = 'npm:@metamask/message-signing-snap';
+/**
+ * Copy of `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`
+ * (`0xd36e6170 - 0x80000000`).
+ *
+ * @see https://metamask.github.io/SIPs/SIPS/sip-6
+ */
+const SIP_6_MAGIC_VALUE = `1399742832'`;
+const HARDENED_VALUE = 0x80000000;
+/**
+ * HMAC-SHA-512 for `@metamask/key-tree`.
+ *
+ * Passed into `SLIP10Node.fromSeed` so SIP-6 never uses Web Crypto.
+ * `@metamask/key-tree` treats any `crypto.subtle` as complete and then HMAC
+ * via `importKey` / `sign`. React Native only implements `digest`; its
+ * SubtleCrypto cannot HMAC. Noble HMAC is byte-identical without SubtleCrypto.
+ */
+const NOBLE_HMAC_SHA512 = {
+    hmacSha512: async (key, data) => (0, hmac_1.hmac)(sha2_1.sha512, key, data),
+};
+/**
+ * Copy of `@metamask/snaps-rpc-methods` `getDerivationPathArray`.
+ *
+ * Maps a 32-byte hash to eight hardened BIP-32 indices for `@metamask/key-tree`.
+ *
+ * @param hash - 32-byte hash.
+ * @returns Hardened BIP-32 path nodes.
+ */
+function getDerivationPathArray(hash) {
+    const array = [];
+    const view = (0, utils_1.createDataView)(hash);
+    for (let index = 0; index < 8; index++) {
+        const uint32 = view.getUint32(index * 4);
+        // eslint-disable-next-line no-bitwise
+        const pathIndex = (uint32 | HARDENED_VALUE) >>> 0;
+        array.push(`bip32:${pathIndex - HARDENED_VALUE}'`);
+    }
+    return array;
+}
+/**
+ * Copy of `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` (SIP-6),
+ * returning raw private-key bytes instead of a `0x`-prefixed hex string.
+ *
+ * @param options - Derivation options.
+ * @param options.seed - BIP-39 mnemonic seed.
+ * @param options.input - SIP-6 input (snap ID for `snap_getEntropy`).
+ * @param options.salt - Optional salt. Internal auth uses `''`.
+ * @returns 32-byte private key.
+ */
+async function deriveSip6PrivateKey({ seed, input, salt = '', }) {
+    const hash = (0, sha3_1.keccak_256)((0, utils_1.concatBytes)([(0, utils_1.stringToBytes)(input), (0, sha3_1.keccak_256)((0, utils_1.stringToBytes)(salt))]));
+    const computedDerivationPath = getDerivationPathArray(hash);
+    const { privateKey } = await key_tree_1.SLIP10Node.fromSeed({
+        derivationPath: [
+            seed,
+            `bip32:${SIP_6_MAGIC_VALUE}`,
+            ...computedDerivationPath,
+        ],
+        curve: 'secp256k1',
+    }, NOBLE_HMAC_SHA512);
+    (0, utils_1.assert)(privateKey, 'Failed to derive SIP-6 entropy.');
+    return (0, utils_1.hexToBytes)(privateKey);
+}
+exports.deriveSip6PrivateKey = deriveSip6PrivateKey;
+/**
+ * Derives the message-signing private key via SIP-6, matching
+ * `snap_getEntropy` for the message-signing snap with empty salt
+ * (internal `metamask` origin).
+ *
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns 32-byte private key.
+ */
+async function deriveMessageSigningPrivateKey(seed, salt = '') {
+    return deriveSip6PrivateKey({
+        seed,
+        input: exports.MESSAGE_SIGNING_SNAP_ID,
+        salt,
+    });
+}
+exports.deriveMessageSigningPrivateKey = deriveMessageSigningPrivateKey;
+/**
+ * Copy of message-signing-snap `getPublicEntropyKey`: secp256k1 pubkey hex
+ * for the SIP-6 message-signing private key.
+ *
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns Public key hex with `0x` prefix.
+ */
+async function getMessageSigningPublicKey(seed, salt = '') {
+    const privateKey = await deriveMessageSigningPrivateKey(seed, salt);
+    return (0, utils_1.bytesToHex)(secp256k1_1.secp256k1.getPublicKey(privateKey));
+}
+exports.getMessageSigningPublicKey = getMessageSigningPublicKey;
+/**
+ * Copy of message-signing-snap `signMessageWithEntropyKey`: sha256(message)
+ * then compact secp256k1 signature.
+ *
+ * @param message - Message to sign (must be validated by the caller).
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns Compact secp256k1 signature hex with `0x` prefix.
+ */
+async function signMessageWithMessageSigningKey(message, seed, salt = '') {
+    const privateKey = await deriveMessageSigningPrivateKey(seed, salt);
+    const digest = (0, sha2_1.sha256)(message);
+    const signature = secp256k1_1.secp256k1.sign(digest, privateKey);
+    return `0x${signature.toCompactHex()}`;
+}
+exports.signMessageWithMessageSigningKey = signMessageWithMessageSigningKey;
+//# sourceMappingURL=message-signing.cjs.map

package/dist/shared/utils/message-signing.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-signing.cjs","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":";;;AACA,iDAAgD;AAChD,2CAOyB;AACzB,uDAAoD;AACpD,6CAA0C;AAC1C,6CAAoD;AACpD,6CAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;GAGG;AACU,QAAA,uBAAuB,GAAG,oCAAoC,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,aAA6B,CAAC;AAExD,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG;IACxB,UAAU,EAAE,KAAK,EAAE,GAAe,EAAE,IAAgB,EAAuB,EAAE,CAC3E,IAAA,WAAI,EAAC,aAAM,EAAE,GAAG,EAAE,IAAI,CAAC;CAC1B,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAAgB;IAC9C,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,sBAAc,EAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,sCAAsC;QACtC,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,GAAG,cAAc,GAAY,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,oBAAoB,CAAC,EACzC,IAAI,EACJ,KAAK,EACL,IAAI,GAAG,EAAE,GAKV;IACC,MAAM,IAAI,GAAG,IAAA,iBAAS,EACpB,IAAA,mBAAW,EAAC,CAAC,IAAA,qBAAa,EAAC,KAAK,CAAC,EAAE,IAAA,iBAAS,EAAC,IAAA,qBAAa,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;IACF,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE5D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,qBAAU,CAAC,QAAQ,CAC9C;QACE,cAAc,EAAE;YACd,IAAI;YACJ,SAAS,iBAAiB,EAAE;YAC5B,GAAG,sBAAsB;SAC1B;QACD,KAAK,EAAE,WAAW;KACnB,EACD,iBAAiB,CAClB,CAAC;IAEF,IAAA,cAAM,EAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IACtD,OAAO,IAAA,kBAAU,EAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AA5BD,oDA4BC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,8BAA8B,CAClD,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,OAAO,oBAAoB,CAAC;QAC1B,IAAI;QACJ,KAAK,EAAE,+BAAuB;QAC9B,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AATD,wEASC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,0BAA0B,CAC9C,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,OAAO,IAAA,kBAAU,EAAC,qBAAS,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;AACxD,CAAC;AAND,gEAMC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,gCAAgC,CACpD,OAAe,EACf,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAA,aAAM,EAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,qBAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrD,OAAO,KAAK,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;AACzC,CAAC;AATD,4EASC","sourcesContent":["import type { HardenedBIP32Node } from '@metamask/key-tree';\nimport { SLIP10Node } from '@metamask/key-tree';\nimport {\n  assert,\n  bytesToHex,\n  concatBytes,\n  createDataView,\n  hexToBytes,\n  stringToBytes,\n} from '@metamask/utils';\nimport { secp256k1 } from '@noble/curves/secp256k1';\nimport { hmac } from '@noble/hashes/hmac';\nimport { sha256, sha512 } from '@noble/hashes/sha2';\nimport { keccak_256 as keccak256 } from '@noble/hashes/sha3';\n\n/**\n * Native SIP-6 message-signing helpers for AuthenticationController /\n * UserStorageController.\n *\n * These are intentional copies of the message-signing snap crypto path so auth\n * and user-storage can derive/sign without booting\n * `npm:@metamask/message-signing-snap`. Behavior must stay byte-identical to:\n *\n * - SIP-6 derivation:\n *   `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` /\n *   `getEntropyDerivationPath` / `getDerivationPathArray`\n *   (https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts)\n * - Magic constant:\n *   `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`\n * - Pubkey + `metamask:…` signing:\n *   `@metamask/message-signing-snap` `getPublicEntropyKey` /\n *   `signMessageWithEntropyKey`\n *   (https://github.com/MetaMask/message-signing-snap/blob/main/src/entropy-keys.ts)\n *\n * `deriveEntropyFromSeed` is not a public export of\n * `@metamask/snaps-rpc-methods` today (and no core package depends on that\n * package), so the SIP-6 math is vendored here rather than imported.\n */\n\n/**\n * Snap ID used as the SIP-6 `input` so derived keys match\n * `@metamask/message-signing-snap` (`snap_getEntropy` origin).\n */\nexport const MESSAGE_SIGNING_SNAP_ID = 'npm:@metamask/message-signing-snap';\n\n/**\n * Copy of `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`\n * (`0xd36e6170 - 0x80000000`).\n *\n * @see https://metamask.github.io/SIPs/SIPS/sip-6\n */\nconst SIP_6_MAGIC_VALUE = `1399742832'` as `${number}'`;\n\nconst HARDENED_VALUE = 0x80000000;\n\n/**\n * HMAC-SHA-512 for `@metamask/key-tree`.\n *\n * Passed into `SLIP10Node.fromSeed` so SIP-6 never uses Web Crypto.\n * `@metamask/key-tree` treats any `crypto.subtle` as complete and then HMAC\n * via `importKey` / `sign`. React Native only implements `digest`; its\n * SubtleCrypto cannot HMAC. Noble HMAC is byte-identical without SubtleCrypto.\n */\nconst NOBLE_HMAC_SHA512 = {\n  hmacSha512: async (key: Uint8Array, data: Uint8Array): Promise<Uint8Array> =>\n    hmac(sha512, key, data),\n};\n\n/**\n * Copy of `@metamask/snaps-rpc-methods` `getDerivationPathArray`.\n *\n * Maps a 32-byte hash to eight hardened BIP-32 indices for `@metamask/key-tree`.\n *\n * @param hash - 32-byte hash.\n * @returns Hardened BIP-32 path nodes.\n */\nfunction getDerivationPathArray(hash: Uint8Array): HardenedBIP32Node[] {\n  const array: HardenedBIP32Node[] = [];\n  const view = createDataView(hash);\n\n  for (let index = 0; index < 8; index++) {\n    const uint32 = view.getUint32(index * 4);\n    // eslint-disable-next-line no-bitwise\n    const pathIndex = (uint32 | HARDENED_VALUE) >>> 0;\n    array.push(`bip32:${pathIndex - HARDENED_VALUE}'` as const);\n  }\n\n  return array;\n}\n\n/**\n * Copy of `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` (SIP-6),\n * returning raw private-key bytes instead of a `0x`-prefixed hex string.\n *\n * @param options - Derivation options.\n * @param options.seed - BIP-39 mnemonic seed.\n * @param options.input - SIP-6 input (snap ID for `snap_getEntropy`).\n * @param options.salt - Optional salt. Internal auth uses `''`.\n * @returns 32-byte private key.\n */\nexport async function deriveSip6PrivateKey({\n  seed,\n  input,\n  salt = '',\n}: {\n  seed: Uint8Array;\n  input: string;\n  salt?: string;\n}): Promise<Uint8Array> {\n  const hash = keccak256(\n    concatBytes([stringToBytes(input), keccak256(stringToBytes(salt))]),\n  );\n  const computedDerivationPath = getDerivationPathArray(hash);\n\n  const { privateKey } = await SLIP10Node.fromSeed(\n    {\n      derivationPath: [\n        seed,\n        `bip32:${SIP_6_MAGIC_VALUE}`,\n        ...computedDerivationPath,\n      ],\n      curve: 'secp256k1',\n    },\n    NOBLE_HMAC_SHA512,\n  );\n\n  assert(privateKey, 'Failed to derive SIP-6 entropy.');\n  return hexToBytes(privateKey);\n}\n\n/**\n * Derives the message-signing private key via SIP-6, matching\n * `snap_getEntropy` for the message-signing snap with empty salt\n * (internal `metamask` origin).\n *\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns 32-byte private key.\n */\nexport async function deriveMessageSigningPrivateKey(\n  seed: Uint8Array,\n  salt = '',\n): Promise<Uint8Array> {\n  return deriveSip6PrivateKey({\n    seed,\n    input: MESSAGE_SIGNING_SNAP_ID,\n    salt,\n  });\n}\n\n/**\n * Copy of message-signing-snap `getPublicEntropyKey`: secp256k1 pubkey hex\n * for the SIP-6 message-signing private key.\n *\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns Public key hex with `0x` prefix.\n */\nexport async function getMessageSigningPublicKey(\n  seed: Uint8Array,\n  salt = '',\n): Promise<string> {\n  const privateKey = await deriveMessageSigningPrivateKey(seed, salt);\n  return bytesToHex(secp256k1.getPublicKey(privateKey));\n}\n\n/**\n * Copy of message-signing-snap `signMessageWithEntropyKey`: sha256(message)\n * then compact secp256k1 signature.\n *\n * @param message - Message to sign (must be validated by the caller).\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns Compact secp256k1 signature hex with `0x` prefix.\n */\nexport async function signMessageWithMessageSigningKey(\n  message: string,\n  seed: Uint8Array,\n  salt = '',\n): Promise<string> {\n  const privateKey = await deriveMessageSigningPrivateKey(seed, salt);\n  const digest = sha256(message);\n  const signature = secp256k1.sign(digest, privateKey);\n  return `0x${signature.toCompactHex()}`;\n}\n"]}

package/dist/shared/utils/message-signing.d.cts

@@ -0,0 +1,73 @@
+/**
+ * Native SIP-6 message-signing helpers for AuthenticationController /
+ * UserStorageController.
+ *
+ * These are intentional copies of the message-signing snap crypto path so auth
+ * and user-storage can derive/sign without booting
+ * `npm:@metamask/message-signing-snap`. Behavior must stay byte-identical to:
+ *
+ * - SIP-6 derivation:
+ *   `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` /
+ *   `getEntropyDerivationPath` / `getDerivationPathArray`
+ *   (https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts)
+ * - Magic constant:
+ *   `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`
+ * - Pubkey + `metamask:…` signing:
+ *   `@metamask/message-signing-snap` `getPublicEntropyKey` /
+ *   `signMessageWithEntropyKey`
+ *   (https://github.com/MetaMask/message-signing-snap/blob/main/src/entropy-keys.ts)
+ *
+ * `deriveEntropyFromSeed` is not a public export of
+ * `@metamask/snaps-rpc-methods` today (and no core package depends on that
+ * package), so the SIP-6 math is vendored here rather than imported.
+ */
+/**
+ * Snap ID used as the SIP-6 `input` so derived keys match
+ * `@metamask/message-signing-snap` (`snap_getEntropy` origin).
+ */
+export declare const MESSAGE_SIGNING_SNAP_ID = "npm:@metamask/message-signing-snap";
+/**
+ * Copy of `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` (SIP-6),
+ * returning raw private-key bytes instead of a `0x`-prefixed hex string.
+ *
+ * @param options - Derivation options.
+ * @param options.seed - BIP-39 mnemonic seed.
+ * @param options.input - SIP-6 input (snap ID for `snap_getEntropy`).
+ * @param options.salt - Optional salt. Internal auth uses `''`.
+ * @returns 32-byte private key.
+ */
+export declare function deriveSip6PrivateKey({ seed, input, salt, }: {
+    seed: Uint8Array;
+    input: string;
+    salt?: string;
+}): Promise<Uint8Array>;
+/**
+ * Derives the message-signing private key via SIP-6, matching
+ * `snap_getEntropy` for the message-signing snap with empty salt
+ * (internal `metamask` origin).
+ *
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns 32-byte private key.
+ */
+export declare function deriveMessageSigningPrivateKey(seed: Uint8Array, salt?: string): Promise<Uint8Array>;
+/**
+ * Copy of message-signing-snap `getPublicEntropyKey`: secp256k1 pubkey hex
+ * for the SIP-6 message-signing private key.
+ *
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns Public key hex with `0x` prefix.
+ */
+export declare function getMessageSigningPublicKey(seed: Uint8Array, salt?: string): Promise<string>;
+/**
+ * Copy of message-signing-snap `signMessageWithEntropyKey`: sha256(message)
+ * then compact secp256k1 signature.
+ *
+ * @param message - Message to sign (must be validated by the caller).
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns Compact secp256k1 signature hex with `0x` prefix.
+ */
+export declare function signMessageWithMessageSigningKey(message: string, seed: Uint8Array, salt?: string): Promise<string>;
+//# sourceMappingURL=message-signing.d.cts.map

package/dist/shared/utils/message-signing.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-signing.d.cts","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,uCAAuC,CAAC;AA+C5E;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,IAAI,EACJ,KAAK,EACL,IAAS,GACV,EAAE;IACD,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAKjB"}

package/dist/shared/utils/message-signing.d.mts

@@ -0,0 +1,73 @@
+/**
+ * Native SIP-6 message-signing helpers for AuthenticationController /
+ * UserStorageController.
+ *
+ * These are intentional copies of the message-signing snap crypto path so auth
+ * and user-storage can derive/sign without booting
+ * `npm:@metamask/message-signing-snap`. Behavior must stay byte-identical to:
+ *
+ * - SIP-6 derivation:
+ *   `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` /
+ *   `getEntropyDerivationPath` / `getDerivationPathArray`
+ *   (https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts)
+ * - Magic constant:
+ *   `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`
+ * - Pubkey + `metamask:…` signing:
+ *   `@metamask/message-signing-snap` `getPublicEntropyKey` /
+ *   `signMessageWithEntropyKey`
+ *   (https://github.com/MetaMask/message-signing-snap/blob/main/src/entropy-keys.ts)
+ *
+ * `deriveEntropyFromSeed` is not a public export of
+ * `@metamask/snaps-rpc-methods` today (and no core package depends on that
+ * package), so the SIP-6 math is vendored here rather than imported.
+ */
+/**
+ * Snap ID used as the SIP-6 `input` so derived keys match
+ * `@metamask/message-signing-snap` (`snap_getEntropy` origin).
+ */
+export declare const MESSAGE_SIGNING_SNAP_ID = "npm:@metamask/message-signing-snap";
+/**
+ * Copy of `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` (SIP-6),
+ * returning raw private-key bytes instead of a `0x`-prefixed hex string.
+ *
+ * @param options - Derivation options.
+ * @param options.seed - BIP-39 mnemonic seed.
+ * @param options.input - SIP-6 input (snap ID for `snap_getEntropy`).
+ * @param options.salt - Optional salt. Internal auth uses `''`.
+ * @returns 32-byte private key.
+ */
+export declare function deriveSip6PrivateKey({ seed, input, salt, }: {
+    seed: Uint8Array;
+    input: string;
+    salt?: string;
+}): Promise<Uint8Array>;
+/**
+ * Derives the message-signing private key via SIP-6, matching
+ * `snap_getEntropy` for the message-signing snap with empty salt
+ * (internal `metamask` origin).
+ *
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns 32-byte private key.
+ */
+export declare function deriveMessageSigningPrivateKey(seed: Uint8Array, salt?: string): Promise<Uint8Array>;
+/**
+ * Copy of message-signing-snap `getPublicEntropyKey`: secp256k1 pubkey hex
+ * for the SIP-6 message-signing private key.
+ *
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns Public key hex with `0x` prefix.
+ */
+export declare function getMessageSigningPublicKey(seed: Uint8Array, salt?: string): Promise<string>;
+/**
+ * Copy of message-signing-snap `signMessageWithEntropyKey`: sha256(message)
+ * then compact secp256k1 signature.
+ *
+ * @param message - Message to sign (must be validated by the caller).
+ * @param seed - BIP-39 mnemonic seed from an HD keyring.
+ * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.
+ * @returns Compact secp256k1 signature hex with `0x` prefix.
+ */
+export declare function signMessageWithMessageSigningKey(message: string, seed: Uint8Array, salt?: string): Promise<string>;
+//# sourceMappingURL=message-signing.d.mts.map

package/dist/shared/utils/message-signing.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-signing.d.mts","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,uCAAuC,CAAC;AA+C5E;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,IAAI,EACJ,KAAK,EACL,IAAS,GACV,EAAE;IACD,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAKjB"}