@metamask/profile-sync-controller 29.0.0 → 30.0.0

package/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [30.0.0]
+
+### Added
+
+- **BREAKING:** Add social identifier pairing after SRP sign-in (`POST /api/v2/profile/pair/identifier`) ([#10128](https://github.com/MetaMask/core/pull/10128))
+  - Add `needsSocialPairing?: boolean` to state (defaults `true`; cleared on success or 409 Conflict; left `true` on other failures so the next `performSignIn` retries; cleared without an API call when the user never logged in with a social provider). If `authConnection` is set but the seedless vault is not written yet, the flag stays `true` so onboarding-in-flight sign-ins can retry. Optional in the type so partial-state selectors stay assignable; treat `undefined` as `true`.
+  - Add optional `isSocialPairingEnabled` config callback (defaults to `() => false`). When it returns `true`, Google/Apple/Telegram seedless users are paired after SRP login and profile pairing. Telegram never sends `email` (clients store a display name there).
+  - Use `SeedlessOnboardingController:getAccessToken` to fetch the social JWT (refreshed when expired).
+  - Add `pairSocialIdentifier` to `JwtBearerAuth` / `SRPJwtBearerAuth` and `PairConflictError` for 409 Conflict.
+
+### Changed
+
+- **BREAKING:** Derive auth and user-storage message-signing keys natively via SIP-6 from HD keyring seeds instead of calling `@metamask/message-signing-snap` through `SnapController`. `AuthenticationController` and `UserStorageController` now require `KeyringController:withKeyringV2Unsafe` and no longer call `SnapController:handleRequest`. The message-signing snap remains for Portfolio / external origins ([#9824](https://github.com/MetaMask/core/pull/9824))
+  - Derive native SIP-6 keys with `@noble/hashes` HMAC-SHA-512 instead of Web Crypto, so auth works on React Native, whose SubtleCrypto cannot HMAC.
+- Resolve HD entropy source IDs from `KeyringController` instead of the message-signing snap (`getBearerToken` primary ID, `performSignIn` SRP enumeration) ([#9794](https://github.com/MetaMask/core/pull/9794))
+- Bump `@metamask/keyring-controller` from `^27.1.0` to `^27.1.1` ([#9791](https://github.com/MetaMask/core/pull/9791))
+- Add `@metamask/key-tree` and `@noble/curves`; remove unused `@metamask/snaps-controllers`, `@metamask/snaps-sdk`, and `@metamask/snaps-utils` dependencies ([#9824](https://github.com/MetaMask/core/pull/9824))
+- Bump `@metamask/utils` from `^11.11.0` to `^11.12.0` ([#10076](https://github.com/MetaMask/core/pull/10076))
+
 ## [29.0.0]
 
 ### Changed
@@ -905,7 +924,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial release
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@29.0.0...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@30.0.0...HEAD
+[30.0.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@29.0.0...@metamask/profile-sync-controller@30.0.0
 [29.0.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@28.3.0...@metamask/profile-sync-controller@29.0.0
 [28.3.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@28.2.0...@metamask/profile-sync-controller@28.3.0
 [28.2.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@28.1.1...@metamask/profile-sync-controller@28.2.0

package/dist/controllers/authentication/AuthenticationController.cjs

@@ -10,16 +10,19 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_cachedPrimaryEntropySourceId, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_snapGetPublicKey, _AuthenticationController_snapGetAllPublicKeys, _AuthenticationController__snapSignMessageCache, _AuthenticationController_snapSignMessage;
+var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getHdKeyringEntropySourceIds, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_identifierTypeFromSeedlessState, _AuthenticationController_trySocialPairing, _AuthenticationController_clearNeedsSocialPairing, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_getHdKeyringSeed, _AuthenticationController_getPublicKey, _AuthenticationController__signMessageCache, _AuthenticationController_scopedCacheKey, _AuthenticationController_signMessage;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthenticationController = exports.defaultState = void 0;
 const base_controller_1 = require("@metamask/base-controller");
 const index_js_1 = require("../../sdk/index.cjs");
-const auth_snap_requests_js_1 = require("./auth-snap-requests.cjs");
+const entropy_source_js_1 = require("../../shared/utils/entropy-source.cjs");
+const hd_keyring_seed_js_1 = require("../../shared/utils/hd-keyring-seed.cjs");
+const message_signing_js_1 = require("../../shared/utils/message-signing.cjs");
 const controllerName = 'AuthenticationController';
 exports.defaultState = {
     isSignedIn: false,
     needsProfilePairing: true,
+    needsSocialPairing: true,
 };
 const metadata = {
     isSignedIn: {
@@ -34,6 +37,12 @@ const metadata = {
         includeInDebugSnapshot: true,
         usedInUi: true,
     },
+    needsSocialPairing: {
+        includeInStateLogs: true,
+        persist: true,
+        includeInDebugSnapshot: true,
+        usedInUi: true,
+    },
     srpSessionData: {
         // Remove access token from state logs
         includeInStateLogs: (srpSessionData) => {
@@ -87,9 +96,9 @@ class AuthenticationController extends base_controller_1.BaseController {
         _AuthenticationController_auth.set(this, void 0);
         _AuthenticationController_config.set(this, {
             env: index_js_1.Env.PRD,
+            isSocialPairingEnabled: () => false,
         });
         _AuthenticationController_isUnlocked.set(this, false);
-        _AuthenticationController_cachedPrimaryEntropySourceId.set(this, void 0);
         // Bumped by `requestProfilePairing`. `performSignIn` snapshots this
         // before its first await; if it changes mid-flight we must NOT clear
         // `needsProfilePairing` (the rearm signal wins).
@@ -106,13 +115,14 @@ class AuthenticationController extends base_controller_1.BaseController {
                 });
             },
         });
-        _AuthenticationController__snapSignMessageCache.set(this, {});
+        _AuthenticationController__signMessageCache.set(this, {});
         if (!metametrics) {
             throw new Error('`metametrics` field is required');
         }
         __classPrivateFieldSet(this, _AuthenticationController_config, {
             ...__classPrivateFieldGet(this, _AuthenticationController_config, "f"),
             ...config,
+            isSocialPairingEnabled: config?.isSocialPairingEnabled ?? __classPrivateFieldGet(this, _AuthenticationController_config, "f").isSocialPairingEnabled,
         }, "f");
         __classPrivateFieldSet(this, _AuthenticationController_metametrics, metametrics, "f");
         __classPrivateFieldSet(this, _AuthenticationController_auth, new index_js_1.JwtBearerAuth({
@@ -125,8 +135,8 @@ class AuthenticationController extends base_controller_1.BaseController {
                 setLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_setLoginResponseToState).bind(this),
             },
             signing: {
-                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetPublicKey).bind(this),
-                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapSignMessage).bind(this),
+                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPublicKey).bind(this),
+                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_signMessage).bind(this),
             },
             getLoginTag: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginTag).bind(this),
             getLoginIdentifierType: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginIdentifierType).bind(this),
@@ -138,15 +148,15 @@ class AuthenticationController extends base_controller_1.BaseController {
     async performSignIn() {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'performSignIn');
         const epochAtStart = __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f");
-        const allPublicKeys = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetAllPublicKeys).call(this);
+        const entropySourceIds = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringEntropySourceIds).call(this);
         const accessTokens = [];
         // We iterate sequentially in order to be sure that the first entry
         // is the primary SRP LoginResponse.
-        for (const [entropySourceId] of allPublicKeys) {
+        for (const entropySourceId of entropySourceIds) {
             const accessToken = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(entropySourceId);
             accessTokens.push(accessToken);
         }
-        if (allPublicKeys.length < 2) {
+        if (entropySourceIds.length < 2) {
             // Single-SRP wallet: nothing to pair.
             __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
         }
@@ -159,6 +169,12 @@ class AuthenticationController extends base_controller_1.BaseController {
                 // noop
             }
         }
+        try {
+            await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_trySocialPairing).call(this, accessTokens[0]);
+        }
+        catch {
+            // noop
+        }
         return accessTokens;
     }
     /**
@@ -175,7 +191,6 @@ class AuthenticationController extends base_controller_1.BaseController {
         }
     }
     performSignOut() {
-        __classPrivateFieldSet(this, _AuthenticationController_cachedPrimaryEntropySourceId, undefined, "f");
         this.update((state) => {
             state.isSignedIn = false;
             state.srpSessionData = undefined;
@@ -194,7 +209,7 @@ class AuthenticationController extends base_controller_1.BaseController {
      */
     async getBearerToken(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getBearerToken');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(resolvedId);
     }
     /**
@@ -212,7 +227,7 @@ class AuthenticationController extends base_controller_1.BaseController {
      */
     async getSessionProfile(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getSessionProfile');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfile(resolvedId);
     }
     /**
@@ -233,10 +248,10 @@ class AuthenticationController extends base_controller_1.BaseController {
      */
     async refreshCanonicalProfileId() {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'refreshCanonicalProfileId');
-        const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+        const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_invalidateSrpSession).call(this, primaryEntropySourceId);
         await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(primaryEntropySourceId);
-        const canonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+        const canonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
         if (!canonical) {
             throw new Error('refreshCanonicalProfileId - Unable to resolve canonical profile ID');
         }
@@ -245,7 +260,7 @@ class AuthenticationController extends base_controller_1.BaseController {
     }
     async getUserProfileLineage(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getUserProfileLineage');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
     }
     /**
@@ -261,7 +276,7 @@ class AuthenticationController extends base_controller_1.BaseController {
      */
     async getCustomerServiceToken(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
     }
     isSignedIn() {
@@ -269,14 +284,14 @@ class AuthenticationController extends base_controller_1.BaseController {
     }
 }
 exports.AuthenticationController = AuthenticationController;
-_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_cachedPrimaryEntropySourceId = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__snapSignMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
-    const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__signMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     if (!this.state.srpSessionData?.[resolvedId]) {
         return null;
     }
     return this.state.srpSessionData[resolvedId];
 }, _AuthenticationController_setLoginResponseToState = async function _AuthenticationController_setLoginResponseToState(loginResponse, entropySourceId) {
-    const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     const metaMetricsId = await __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f").getMetaMetricsId();
     this.update((state) => {
         state.isSignedIn = true;
@@ -295,20 +310,12 @@ _AuthenticationController_metametrics = new WeakMap(), _AuthenticationController
     if (!__classPrivateFieldGet(this, _AuthenticationController_isUnlocked, "f")) {
         throw new Error(`${methodName} - unable to proceed, wallet is locked`);
     }
-}, _AuthenticationController_getPrimaryEntropySourceId = async function _AuthenticationController_getPrimaryEntropySourceId() {
-    if (__classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f")) {
-        return __classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f");
-    }
-    const allPublicKeys = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetAllPublicKeys).call(this);
-    if (allPublicKeys.length === 0) {
-        throw new Error('#getPrimaryEntropySourceId - No entropy sources found from snap');
-    }
-    const primaryId = allPublicKeys[0][0];
-    if (!primaryId) {
-        throw new Error('#getPrimaryEntropySourceId - Primary entropy source ID is undefined');
-    }
-    __classPrivateFieldSet(this, _AuthenticationController_cachedPrimaryEntropySourceId, primaryId, "f");
-    return __classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f");
+}, _AuthenticationController_getHdKeyringEntropySourceIds = function _AuthenticationController_getHdKeyringEntropySourceIds() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return (0, entropy_source_js_1.getHdKeyringEntropySourceIds)(keyrings);
+}, _AuthenticationController_getPrimaryEntropySourceId = function _AuthenticationController_getPrimaryEntropySourceId() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return (0, entropy_source_js_1.getPrimaryHdKeyringEntropySourceId)(keyrings);
 }, _AuthenticationController_getLoginTag = 
 /**
  * Resolves the SRP login tag for `raw_message`.
@@ -320,7 +327,7 @@ _AuthenticationController_metametrics = new WeakMap(), _AuthenticationController
  * @returns The login tag to append to the signed message.
  */
 async function _AuthenticationController_getLoginTag(entropySourceId) {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     const resolvedId = entropySourceId ?? primaryEntropySourceId;
     return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';
 }, _AuthenticationController_getLoginIdentifierType = 
@@ -343,7 +350,7 @@ async function _AuthenticationController_getLoginTag(entropySourceId) {
  * @returns The login identifier type.
  */
 async function _AuthenticationController_getLoginIdentifierType(entropySourceId) {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     const resolvedId = entropySourceId ?? primaryEntropySourceId;
     // Social vault authConnection is only associated with the primary source.
     if (resolvedId !== primaryEntropySourceId) {
@@ -352,26 +359,118 @@ async function _AuthenticationController_getLoginIdentifierType(entropySourceId)
     return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_resolveSocialIdentifierType).call(this);
 }, _AuthenticationController_resolveSocialIdentifierType = function _AuthenticationController_resolveSocialIdentifierType() {
     try {
-        const { vault, authConnection } = this.messenger.call('SeedlessOnboardingController:getState');
-        if (vault === null || vault === undefined) {
+        return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_identifierTypeFromSeedlessState).call(this, this.messenger.call('SeedlessOnboardingController:getState'));
+    }
+    catch {
+        return 'SRP';
+    }
+}, _AuthenticationController_identifierTypeFromSeedlessState = function _AuthenticationController_identifierTypeFromSeedlessState(state) {
+    if (state.vault === null || state.vault === undefined) {
+        return 'SRP';
+    }
+    // Match provider strings from SeedlessOnboarding state rather than
+    // importing AuthConnection — a value import would load that package
+    // (and its heavy deps) whenever this controller is imported.
+    switch (state.authConnection) {
+        case 'google':
+            return 'GOOGLE';
+        case 'apple':
+            return 'APPLE';
+        case 'telegram':
+            return 'TELEGRAM';
+        default:
             return 'SRP';
+    }
+}, _AuthenticationController_trySocialPairing = 
+/**
+ * Attaches a Google/Apple/Telegram social identifier to the primary SRP
+ * profile via `POST /api/v2/profile/pair/identifier`.
+ *
+ * Runs only when `isSocialPairingEnabled()` is true and
+ * `needsSocialPairing` is not `false` (`undefined` is treated as true).
+ * No social provider (`authConnection` unset) → clear the flag (nothing
+ * to pair). Social provider set but vault missing → skip (onboarding
+ * still in flight). Google without email → skip (API requires it).
+ * Telegram never sends `email` (the field holds a display name, not an
+ * address). Missing social JWT → skip. 409 Conflict → clear the flag
+ * (identifier already owned; retry is pointless). Other errors
+ * propagate so the caller can swallow them and leave the flag set for
+ * retry.
+ *
+ * @param primaryAccessToken - Primary SRP OIDC access token used as the
+ * Bearer credential. The profile associated with this JWT becomes the
+ * canonical owner of the social identifier.
+ */
+async function _AuthenticationController_trySocialPairing(primaryAccessToken) {
+    if (!__classPrivateFieldGet(this, _AuthenticationController_config, "f").isSocialPairingEnabled() ||
+        this.state.needsSocialPairing === false ||
+        !primaryAccessToken) {
+        return;
+    }
+    let seedlessState;
+    try {
+        seedlessState = this.messenger.call('SeedlessOnboardingController:getState');
+    }
+    catch {
+        // Controller missing or getState failed — retry next performSignIn.
+        return;
+    }
+    // `SRP` here does not describe the vault: it is the mapping's "no social
+    // identity" result, returned when there is no seedless vault or the
+    // provider is unrecognised. In both cases there is nothing to pair.
+    const identifierType = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_identifierTypeFromSeedlessState).call(this, seedlessState);
+    if (identifierType === 'SRP') {
+        const { vault, authConnection } = seedlessState;
+        // Vault not written yet but a social provider is already known —
+        // onboarding is still in flight. Do not clear; retry next sign-in.
+        if ((vault === null || vault === undefined) && Boolean(authConnection)) {
+            return;
         }
-        // Match provider strings from SeedlessOnboarding state rather than
-        // importing AuthConnection — a value import would load that package
-        // (and its heavy deps) whenever this controller is imported.
-        switch (authConnection) {
-            case 'google':
-                return 'GOOGLE';
-            case 'apple':
-                return 'APPLE';
-            case 'telegram':
-                return 'TELEGRAM';
-            default:
-                return 'SRP';
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+        return;
+    }
+    // Email policy follows the API contract: GOOGLE requires `email` (400
+    // without it), APPLE accepts it optionally, TELEGRAM must not send it
+    // (clients store a display name in `socialLoginEmail` for Telegram).
+    // Clients request the `email` scope for Google, so a missing value is a
+    // defensive case rather than an expected one; returning here leaves
+    // `needsSocialPairing` set so the next sign-in retries instead of
+    // sending a request that would fail.
+    const { socialLoginEmail } = seedlessState;
+    let email;
+    if (identifierType === 'GOOGLE') {
+        if (!socialLoginEmail) {
+            return;
         }
+        email = socialLoginEmail;
     }
-    catch {
-        return 'SRP';
+    else if (identifierType === 'APPLE') {
+        email = socialLoginEmail;
+    }
+    const socialJwt = await this.messenger.call('SeedlessOnboardingController:getAccessToken');
+    if (socialJwt === undefined || socialJwt === '') {
+        return;
+    }
+    try {
+        await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").pairSocialIdentifier({
+            identifierType,
+            socialJwt,
+            ...(email ? { email } : {}),
+        }, primaryAccessToken);
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+    }
+    catch (error) {
+        if (error instanceof index_js_1.PairConflictError) {
+            __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+            return;
+        }
+        throw error;
+    }
+}, _AuthenticationController_clearNeedsSocialPairing = function _AuthenticationController_clearNeedsSocialPairing() {
+    if (this.state.needsSocialPairing !== false) {
+        this.update((state) => {
+            state.needsSocialPairing = false;
+        });
     }
 }, _AuthenticationController_tryClearNeedsProfilePairing = function _AuthenticationController_tryClearNeedsProfilePairing(epochAtStart) {
     if (__classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") !== epochAtStart) {
@@ -395,9 +494,9 @@ async function _AuthenticationController_getLoginIdentifierType(entropySourceId)
  * pair API call was in-flight.
  */
 async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
-    const previousCanonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+    const previousCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
     const profileAliases = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_pairSrpProfiles).call(this, accessTokens);
-    const newCanonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+    const newCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
     // If somehow we cannot compute the new canonical profile ID after pairing,
     // we just return now and do not update the `needsProfilePairing` flag.
     if (!newCanonical) {
@@ -433,18 +532,8 @@ async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
             }
         }
     });
-}, _AuthenticationController_getCanonicalProfileId = 
-/**
- * Returns the canonical profile id from the primary SRP's cached session.
- * Returns `null` when no session exists yet for the primary SRP.
- *
- * Always reads from the primary SRP because the canonical is shared across
- * all paired SRPs after `#propagateCanonical`.
- *
- * @returns The canonical profile id, or `null` if unavailable.
- */
-async function _AuthenticationController_getCanonicalProfileId() {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+}, _AuthenticationController_getCanonicalProfileId = function _AuthenticationController_getCanonicalProfileId() {
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     return (this.state.srpSessionData?.[primaryEntropySourceId]?.profile
         ?.canonicalProfileId ?? null);
 }, _AuthenticationController_invalidateSrpSession = function _AuthenticationController_invalidateSrpSession(entropySourceId) {
@@ -457,45 +546,51 @@ async function _AuthenticationController_getCanonicalProfileId() {
             entry.profile.canonicalProfileId = '';
         }
     });
-}, _AuthenticationController_snapGetPublicKey = 
+}, _AuthenticationController_getHdKeyringSeed = 
 /**
- * Returns the auth snap public key.
+ * Reads the BIP-39 seed for an HD entropy source from KeyringController.
  *
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns The snap public key.
+ * @param entropySourceId - Entropy source ID. Defaults to the primary HD
+ * keyring.
+ * @returns The HD keyring seed.
  */
-async function _AuthenticationController_snapGetPublicKey(entropySourceId) {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapGetPublicKey');
-    const result = (await this.messenger.call('SnapController:handleRequest', (0, auth_snap_requests_js_1.createSnapPublicKeyRequest)(entropySourceId)));
-    return result;
-}, _AuthenticationController_snapGetAllPublicKeys = 
+async function _AuthenticationController_getHdKeyringSeed(entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    return (0, hd_keyring_seed_js_1.getHdKeyringSeed)(this.messenger, resolvedId);
+}, _AuthenticationController_getPublicKey = 
 /**
- * Returns a mapping of entropy source IDs to auth snap public keys.
+ * Returns the message-signing public key via native SIP-6 derivation
+ * (same key as `@metamask/message-signing-snap` with empty salt).
  *
- * @returns A mapping of entropy source IDs to public keys.
+ * @param entropySourceId - The entropy source ID used to derive the key,
+ * when multiple sources are available (Multi-SRP).
+ * @returns The public key hex.
  */
-async function _AuthenticationController_snapGetAllPublicKeys() {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapGetAllPublicKeys');
-    const result = (await this.messenger.call('SnapController:handleRequest', (0, auth_snap_requests_js_1.createSnapAllPublicKeysRequest)()));
-    return result;
-}, _AuthenticationController_snapSignMessage = 
+async function _AuthenticationController_getPublicKey(entropySourceId) {
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#getPublicKey');
+    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
+    return (0, message_signing_js_1.getMessageSigningPublicKey)(seed);
+}, _AuthenticationController_scopedCacheKey = function _AuthenticationController_scopedCacheKey(message, entropySourceId) {
+    return `${entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this)}:${message}`;
+}, _AuthenticationController_signMessage = 
 /**
- * Signs a specific message using an underlying auth snap.
+ * Signs a `metamask:…` message with the native SIP-6 message-signing key.
  *
  * @param message - A specific tagged message to sign.
  * @param entropySourceId - The entropy source ID used to derive the key,
  * when multiple sources are available (Multi-SRP).
- * @returns A Signature created by the snap.
+ * @returns Compact secp256k1 signature hex.
  */
-async function _AuthenticationController_snapSignMessage(message, entropySourceId) {
+async function _AuthenticationController_signMessage(message, entropySourceId) {
     (0, index_js_1.assertMessageStartsWithMetamask)(message);
-    if (__classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message]) {
-        return __classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message];
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#signMessage');
+    const cacheKey = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_scopedCacheKey).call(this, message, entropySourceId);
+    if (__classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey]) {
+        return __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey];
     }
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapSignMessage');
-    const result = (await this.messenger.call('SnapController:handleRequest', (0, auth_snap_requests_js_1.createSnapSignMessageRequest)(message, entropySourceId)));
-    __classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message] = result;
+    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
+    const result = await (0, message_signing_js_1.signMessageWithMessageSigningKey)(message, seed);
+    __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey] = result;
     return result;
 };
 //# sourceMappingURL=AuthenticationController.cjs.map