@metamask/profile-sync-controller 29.0.0 → 30.0.0

package/dist/controllers/authentication/AuthenticationController.mjs

@@ -9,14 +9,17 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_cachedPrimaryEntropySourceId, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_snapGetPublicKey, _AuthenticationController_snapGetAllPublicKeys, _AuthenticationController__snapSignMessageCache, _AuthenticationController_snapSignMessage;
+var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getHdKeyringEntropySourceIds, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_identifierTypeFromSeedlessState, _AuthenticationController_trySocialPairing, _AuthenticationController_clearNeedsSocialPairing, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_getHdKeyringSeed, _AuthenticationController_getPublicKey, _AuthenticationController__signMessageCache, _AuthenticationController_scopedCacheKey, _AuthenticationController_signMessage;
 import { BaseController } from "@metamask/base-controller";
-import { assertMessageStartsWithMetamask, AuthType, Env, JwtBearerAuth } from "../../sdk/index.mjs";
-import { createSnapPublicKeyRequest, createSnapAllPublicKeysRequest, createSnapSignMessageRequest } from "./auth-snap-requests.mjs";
+import { assertMessageStartsWithMetamask, AuthType, Env, JwtBearerAuth, PairConflictError } from "../../sdk/index.mjs";
+import { getHdKeyringEntropySourceIds, getPrimaryHdKeyringEntropySourceId } from "../../shared/utils/entropy-source.mjs";
+import { getHdKeyringSeed } from "../../shared/utils/hd-keyring-seed.mjs";
+import { getMessageSigningPublicKey, signMessageWithMessageSigningKey } from "../../shared/utils/message-signing.mjs";
 const controllerName = 'AuthenticationController';
 export const defaultState = {
     isSignedIn: false,
     needsProfilePairing: true,
+    needsSocialPairing: true,
 };
 const metadata = {
     isSignedIn: {
@@ -31,6 +34,12 @@ const metadata = {
         includeInDebugSnapshot: true,
         usedInUi: true,
     },
+    needsSocialPairing: {
+        includeInStateLogs: true,
+        persist: true,
+        includeInDebugSnapshot: true,
+        usedInUi: true,
+    },
     srpSessionData: {
         // Remove access token from state logs
         includeInStateLogs: (srpSessionData) => {
@@ -84,9 +93,9 @@ export class AuthenticationController extends BaseController {
         _AuthenticationController_auth.set(this, void 0);
         _AuthenticationController_config.set(this, {
             env: Env.PRD,
+            isSocialPairingEnabled: () => false,
         });
         _AuthenticationController_isUnlocked.set(this, false);
-        _AuthenticationController_cachedPrimaryEntropySourceId.set(this, void 0);
         // Bumped by `requestProfilePairing`. `performSignIn` snapshots this
         // before its first await; if it changes mid-flight we must NOT clear
         // `needsProfilePairing` (the rearm signal wins).
@@ -103,13 +112,14 @@ export class AuthenticationController extends BaseController {
                 });
             },
         });
-        _AuthenticationController__snapSignMessageCache.set(this, {});
+        _AuthenticationController__signMessageCache.set(this, {});
         if (!metametrics) {
             throw new Error('`metametrics` field is required');
         }
         __classPrivateFieldSet(this, _AuthenticationController_config, {
             ...__classPrivateFieldGet(this, _AuthenticationController_config, "f"),
             ...config,
+            isSocialPairingEnabled: config?.isSocialPairingEnabled ?? __classPrivateFieldGet(this, _AuthenticationController_config, "f").isSocialPairingEnabled,
         }, "f");
         __classPrivateFieldSet(this, _AuthenticationController_metametrics, metametrics, "f");
         __classPrivateFieldSet(this, _AuthenticationController_auth, new JwtBearerAuth({
@@ -122,8 +132,8 @@ export class AuthenticationController extends BaseController {
                 setLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_setLoginResponseToState).bind(this),
             },
             signing: {
-                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetPublicKey).bind(this),
-                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapSignMessage).bind(this),
+                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPublicKey).bind(this),
+                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_signMessage).bind(this),
             },
             getLoginTag: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginTag).bind(this),
             getLoginIdentifierType: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginIdentifierType).bind(this),
@@ -135,15 +145,15 @@ export class AuthenticationController extends BaseController {
     async performSignIn() {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'performSignIn');
         const epochAtStart = __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f");
-        const allPublicKeys = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetAllPublicKeys).call(this);
+        const entropySourceIds = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringEntropySourceIds).call(this);
         const accessTokens = [];
         // We iterate sequentially in order to be sure that the first entry
         // is the primary SRP LoginResponse.
-        for (const [entropySourceId] of allPublicKeys) {
+        for (const entropySourceId of entropySourceIds) {
             const accessToken = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(entropySourceId);
             accessTokens.push(accessToken);
         }
-        if (allPublicKeys.length < 2) {
+        if (entropySourceIds.length < 2) {
             // Single-SRP wallet: nothing to pair.
             __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
         }
@@ -156,6 +166,12 @@ export class AuthenticationController extends BaseController {
                 // noop
             }
         }
+        try {
+            await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_trySocialPairing).call(this, accessTokens[0]);
+        }
+        catch {
+            // noop
+        }
         return accessTokens;
     }
     /**
@@ -172,7 +188,6 @@ export class AuthenticationController extends BaseController {
         }
     }
     performSignOut() {
-        __classPrivateFieldSet(this, _AuthenticationController_cachedPrimaryEntropySourceId, undefined, "f");
         this.update((state) => {
             state.isSignedIn = false;
             state.srpSessionData = undefined;
@@ -191,7 +206,7 @@ export class AuthenticationController extends BaseController {
      */
     async getBearerToken(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getBearerToken');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(resolvedId);
     }
     /**
@@ -209,7 +224,7 @@ export class AuthenticationController extends BaseController {
      */
     async getSessionProfile(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getSessionProfile');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfile(resolvedId);
     }
     /**
@@ -230,10 +245,10 @@ export class AuthenticationController extends BaseController {
      */
     async refreshCanonicalProfileId() {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'refreshCanonicalProfileId');
-        const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+        const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_invalidateSrpSession).call(this, primaryEntropySourceId);
         await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(primaryEntropySourceId);
-        const canonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+        const canonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
         if (!canonical) {
             throw new Error('refreshCanonicalProfileId - Unable to resolve canonical profile ID');
         }
@@ -242,7 +257,7 @@ export class AuthenticationController extends BaseController {
     }
     async getUserProfileLineage(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getUserProfileLineage');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
     }
     /**
@@ -258,21 +273,21 @@ export class AuthenticationController extends BaseController {
      */
     async getCustomerServiceToken(entropySourceId) {
         __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
         return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
     }
     isSignedIn() {
         return this.state.isSignedIn;
     }
 }
-_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_cachedPrimaryEntropySourceId = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__snapSignMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
-    const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__signMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     if (!this.state.srpSessionData?.[resolvedId]) {
         return null;
     }
     return this.state.srpSessionData[resolvedId];
 }, _AuthenticationController_setLoginResponseToState = async function _AuthenticationController_setLoginResponseToState(loginResponse, entropySourceId) {
-    const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     const metaMetricsId = await __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f").getMetaMetricsId();
     this.update((state) => {
         state.isSignedIn = true;
@@ -291,20 +306,12 @@ _AuthenticationController_metametrics = new WeakMap(), _AuthenticationController
     if (!__classPrivateFieldGet(this, _AuthenticationController_isUnlocked, "f")) {
         throw new Error(`${methodName} - unable to proceed, wallet is locked`);
     }
-}, _AuthenticationController_getPrimaryEntropySourceId = async function _AuthenticationController_getPrimaryEntropySourceId() {
-    if (__classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f")) {
-        return __classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f");
-    }
-    const allPublicKeys = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetAllPublicKeys).call(this);
-    if (allPublicKeys.length === 0) {
-        throw new Error('#getPrimaryEntropySourceId - No entropy sources found from snap');
-    }
-    const primaryId = allPublicKeys[0][0];
-    if (!primaryId) {
-        throw new Error('#getPrimaryEntropySourceId - Primary entropy source ID is undefined');
-    }
-    __classPrivateFieldSet(this, _AuthenticationController_cachedPrimaryEntropySourceId, primaryId, "f");
-    return __classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f");
+}, _AuthenticationController_getHdKeyringEntropySourceIds = function _AuthenticationController_getHdKeyringEntropySourceIds() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return getHdKeyringEntropySourceIds(keyrings);
+}, _AuthenticationController_getPrimaryEntropySourceId = function _AuthenticationController_getPrimaryEntropySourceId() {
+    const { keyrings } = this.messenger.call('KeyringController:getState');
+    return getPrimaryHdKeyringEntropySourceId(keyrings);
 }, _AuthenticationController_getLoginTag = 
 /**
  * Resolves the SRP login tag for `raw_message`.
@@ -316,7 +323,7 @@ _AuthenticationController_metametrics = new WeakMap(), _AuthenticationController
  * @returns The login tag to append to the signed message.
  */
 async function _AuthenticationController_getLoginTag(entropySourceId) {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     const resolvedId = entropySourceId ?? primaryEntropySourceId;
     return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';
 }, _AuthenticationController_getLoginIdentifierType = 
@@ -339,7 +346,7 @@ async function _AuthenticationController_getLoginTag(entropySourceId) {
  * @returns The login identifier type.
  */
 async function _AuthenticationController_getLoginIdentifierType(entropySourceId) {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     const resolvedId = entropySourceId ?? primaryEntropySourceId;
     // Social vault authConnection is only associated with the primary source.
     if (resolvedId !== primaryEntropySourceId) {
@@ -348,26 +355,118 @@ async function _AuthenticationController_getLoginIdentifierType(entropySourceId)
     return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_resolveSocialIdentifierType).call(this);
 }, _AuthenticationController_resolveSocialIdentifierType = function _AuthenticationController_resolveSocialIdentifierType() {
     try {
-        const { vault, authConnection } = this.messenger.call('SeedlessOnboardingController:getState');
-        if (vault === null || vault === undefined) {
+        return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_identifierTypeFromSeedlessState).call(this, this.messenger.call('SeedlessOnboardingController:getState'));
+    }
+    catch {
+        return 'SRP';
+    }
+}, _AuthenticationController_identifierTypeFromSeedlessState = function _AuthenticationController_identifierTypeFromSeedlessState(state) {
+    if (state.vault === null || state.vault === undefined) {
+        return 'SRP';
+    }
+    // Match provider strings from SeedlessOnboarding state rather than
+    // importing AuthConnection — a value import would load that package
+    // (and its heavy deps) whenever this controller is imported.
+    switch (state.authConnection) {
+        case 'google':
+            return 'GOOGLE';
+        case 'apple':
+            return 'APPLE';
+        case 'telegram':
+            return 'TELEGRAM';
+        default:
             return 'SRP';
+    }
+}, _AuthenticationController_trySocialPairing = 
+/**
+ * Attaches a Google/Apple/Telegram social identifier to the primary SRP
+ * profile via `POST /api/v2/profile/pair/identifier`.
+ *
+ * Runs only when `isSocialPairingEnabled()` is true and
+ * `needsSocialPairing` is not `false` (`undefined` is treated as true).
+ * No social provider (`authConnection` unset) → clear the flag (nothing
+ * to pair). Social provider set but vault missing → skip (onboarding
+ * still in flight). Google without email → skip (API requires it).
+ * Telegram never sends `email` (the field holds a display name, not an
+ * address). Missing social JWT → skip. 409 Conflict → clear the flag
+ * (identifier already owned; retry is pointless). Other errors
+ * propagate so the caller can swallow them and leave the flag set for
+ * retry.
+ *
+ * @param primaryAccessToken - Primary SRP OIDC access token used as the
+ * Bearer credential. The profile associated with this JWT becomes the
+ * canonical owner of the social identifier.
+ */
+async function _AuthenticationController_trySocialPairing(primaryAccessToken) {
+    if (!__classPrivateFieldGet(this, _AuthenticationController_config, "f").isSocialPairingEnabled() ||
+        this.state.needsSocialPairing === false ||
+        !primaryAccessToken) {
+        return;
+    }
+    let seedlessState;
+    try {
+        seedlessState = this.messenger.call('SeedlessOnboardingController:getState');
+    }
+    catch {
+        // Controller missing or getState failed — retry next performSignIn.
+        return;
+    }
+    // `SRP` here does not describe the vault: it is the mapping's "no social
+    // identity" result, returned when there is no seedless vault or the
+    // provider is unrecognised. In both cases there is nothing to pair.
+    const identifierType = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_identifierTypeFromSeedlessState).call(this, seedlessState);
+    if (identifierType === 'SRP') {
+        const { vault, authConnection } = seedlessState;
+        // Vault not written yet but a social provider is already known —
+        // onboarding is still in flight. Do not clear; retry next sign-in.
+        if ((vault === null || vault === undefined) && Boolean(authConnection)) {
+            return;
         }
-        // Match provider strings from SeedlessOnboarding state rather than
-        // importing AuthConnection — a value import would load that package
-        // (and its heavy deps) whenever this controller is imported.
-        switch (authConnection) {
-            case 'google':
-                return 'GOOGLE';
-            case 'apple':
-                return 'APPLE';
-            case 'telegram':
-                return 'TELEGRAM';
-            default:
-                return 'SRP';
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+        return;
+    }
+    // Email policy follows the API contract: GOOGLE requires `email` (400
+    // without it), APPLE accepts it optionally, TELEGRAM must not send it
+    // (clients store a display name in `socialLoginEmail` for Telegram).
+    // Clients request the `email` scope for Google, so a missing value is a
+    // defensive case rather than an expected one; returning here leaves
+    // `needsSocialPairing` set so the next sign-in retries instead of
+    // sending a request that would fail.
+    const { socialLoginEmail } = seedlessState;
+    let email;
+    if (identifierType === 'GOOGLE') {
+        if (!socialLoginEmail) {
+            return;
         }
+        email = socialLoginEmail;
     }
-    catch {
-        return 'SRP';
+    else if (identifierType === 'APPLE') {
+        email = socialLoginEmail;
+    }
+    const socialJwt = await this.messenger.call('SeedlessOnboardingController:getAccessToken');
+    if (socialJwt === undefined || socialJwt === '') {
+        return;
+    }
+    try {
+        await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").pairSocialIdentifier({
+            identifierType,
+            socialJwt,
+            ...(email ? { email } : {}),
+        }, primaryAccessToken);
+        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+    }
+    catch (error) {
+        if (error instanceof PairConflictError) {
+            __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
+            return;
+        }
+        throw error;
+    }
+}, _AuthenticationController_clearNeedsSocialPairing = function _AuthenticationController_clearNeedsSocialPairing() {
+    if (this.state.needsSocialPairing !== false) {
+        this.update((state) => {
+            state.needsSocialPairing = false;
+        });
     }
 }, _AuthenticationController_tryClearNeedsProfilePairing = function _AuthenticationController_tryClearNeedsProfilePairing(epochAtStart) {
     if (__classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") !== epochAtStart) {
@@ -391,9 +490,9 @@ async function _AuthenticationController_getLoginIdentifierType(entropySourceId)
  * pair API call was in-flight.
  */
 async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
-    const previousCanonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+    const previousCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
     const profileAliases = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_pairSrpProfiles).call(this, accessTokens);
-    const newCanonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
+    const newCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
     // If somehow we cannot compute the new canonical profile ID after pairing,
     // we just return now and do not update the `needsProfilePairing` flag.
     if (!newCanonical) {
@@ -429,18 +528,8 @@ async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
             }
         }
     });
-}, _AuthenticationController_getCanonicalProfileId = 
-/**
- * Returns the canonical profile id from the primary SRP's cached session.
- * Returns `null` when no session exists yet for the primary SRP.
- *
- * Always reads from the primary SRP because the canonical is shared across
- * all paired SRPs after `#propagateCanonical`.
- *
- * @returns The canonical profile id, or `null` if unavailable.
- */
-async function _AuthenticationController_getCanonicalProfileId() {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+}, _AuthenticationController_getCanonicalProfileId = function _AuthenticationController_getCanonicalProfileId() {
+    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
     return (this.state.srpSessionData?.[primaryEntropySourceId]?.profile
         ?.canonicalProfileId ?? null);
 }, _AuthenticationController_invalidateSrpSession = function _AuthenticationController_invalidateSrpSession(entropySourceId) {
@@ -453,45 +542,51 @@ async function _AuthenticationController_getCanonicalProfileId() {
             entry.profile.canonicalProfileId = '';
         }
     });
-}, _AuthenticationController_snapGetPublicKey = 
+}, _AuthenticationController_getHdKeyringSeed = 
 /**
- * Returns the auth snap public key.
+ * Reads the BIP-39 seed for an HD entropy source from KeyringController.
  *
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns The snap public key.
+ * @param entropySourceId - Entropy source ID. Defaults to the primary HD
+ * keyring.
+ * @returns The HD keyring seed.
  */
-async function _AuthenticationController_snapGetPublicKey(entropySourceId) {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapGetPublicKey');
-    const result = (await this.messenger.call('SnapController:handleRequest', createSnapPublicKeyRequest(entropySourceId)));
-    return result;
-}, _AuthenticationController_snapGetAllPublicKeys = 
+async function _AuthenticationController_getHdKeyringSeed(entropySourceId) {
+    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
+    return getHdKeyringSeed(this.messenger, resolvedId);
+}, _AuthenticationController_getPublicKey = 
 /**
- * Returns a mapping of entropy source IDs to auth snap public keys.
+ * Returns the message-signing public key via native SIP-6 derivation
+ * (same key as `@metamask/message-signing-snap` with empty salt).
  *
- * @returns A mapping of entropy source IDs to public keys.
+ * @param entropySourceId - The entropy source ID used to derive the key,
+ * when multiple sources are available (Multi-SRP).
+ * @returns The public key hex.
  */
-async function _AuthenticationController_snapGetAllPublicKeys() {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapGetAllPublicKeys');
-    const result = (await this.messenger.call('SnapController:handleRequest', createSnapAllPublicKeysRequest()));
-    return result;
-}, _AuthenticationController_snapSignMessage = 
+async function _AuthenticationController_getPublicKey(entropySourceId) {
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#getPublicKey');
+    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
+    return getMessageSigningPublicKey(seed);
+}, _AuthenticationController_scopedCacheKey = function _AuthenticationController_scopedCacheKey(message, entropySourceId) {
+    return `${entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this)}:${message}`;
+}, _AuthenticationController_signMessage = 
 /**
- * Signs a specific message using an underlying auth snap.
+ * Signs a `metamask:…` message with the native SIP-6 message-signing key.
  *
  * @param message - A specific tagged message to sign.
  * @param entropySourceId - The entropy source ID used to derive the key,
  * when multiple sources are available (Multi-SRP).
- * @returns A Signature created by the snap.
+ * @returns Compact secp256k1 signature hex.
  */
-async function _AuthenticationController_snapSignMessage(message, entropySourceId) {
+async function _AuthenticationController_signMessage(message, entropySourceId) {
     assertMessageStartsWithMetamask(message);
-    if (__classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message]) {
-        return __classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message];
+    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#signMessage');
+    const cacheKey = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_scopedCacheKey).call(this, message, entropySourceId);
+    if (__classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey]) {
+        return __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey];
     }
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapSignMessage');
-    const result = (await this.messenger.call('SnapController:handleRequest', createSnapSignMessageRequest(message, entropySourceId)));
-    __classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message] = result;
+    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
+    const result = await signMessageWithMessageSigningKey(message, seed);
+    __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey] = result;
     return result;
 };
 //# sourceMappingURL=AuthenticationController.mjs.map