@metamask/profile-sync-controller 29.0.0 → 31.0.0

package/dist/controllers/authentication/AuthenticationController.d.cts

@@ -1,131 +0,0 @@
-import { BaseController } from "@metamask/base-controller";
-import type { ControllerGetStateAction, ControllerStateChangeEvent } from "@metamask/base-controller";
-import type { KeyringControllerGetStateAction, KeyringControllerLockEvent, KeyringControllerUnlockEvent } from "@metamask/keyring-controller";
-import type { Messenger } from "@metamask/messenger";
-import type { SeedlessOnboardingControllerGetStateAction } from "@metamask/seedless-onboarding-controller";
-import type { SnapControllerHandleRequestAction } from "@metamask/snaps-controllers";
-import type { LoginResponse, ProfileAlias, UserProfile, UserProfileLineage } from "../../sdk/index.cjs";
-import { Env } from "../../sdk/index.cjs";
-import type { MetaMetricsAuth } from "../../shared/types/services.cjs";
-import { AuthenticationControllerMethodActions } from "./AuthenticationController-method-action-types.cjs";
-declare const controllerName = "AuthenticationController";
-export type AuthenticationControllerState = {
-    isSignedIn: boolean;
-    srpSessionData?: Record<string, LoginResponse>;
-    /**
-     * Client gate for profile pairing. Defaults to `true` (fresh install /
-     * upgrade), set to `false` after a successful `performSignIn` pair, set
-     * back to `true` via `requestProfilePairing()` when the SRP set changes,
-     * and left `true` on pair failure so the next state shift retries.
-     *
-     * Optional in the type so partial-state selectors stay assignable to
-     * `AuthenticationControllerState`. The controller seeds it via
-     * `defaultState` at construction; consumers should read `undefined` as
-     * `true` to mirror that runtime default.
-     */
-    needsProfilePairing?: boolean;
-};
-export declare const defaultState: AuthenticationControllerState;
-type ControllerConfig = {
-    env: Env;
-};
-export type Actions = AuthenticationControllerGetStateAction | AuthenticationControllerMethodActions;
-export type AuthenticationControllerGetStateAction = ControllerGetStateAction<typeof controllerName, AuthenticationControllerState>;
-export type AuthenticationControllerStateChangeEvent = ControllerStateChangeEvent<typeof controllerName, AuthenticationControllerState>;
-export type ProfileSignInInfo = {
-    profileId: string;
-    profileAliases: ProfileAlias[];
-    profileIdChanged: boolean;
-};
-export type AuthenticationControllerProfileSignInEvent = {
-    type: `${typeof controllerName}:profileSignIn`;
-    payload: [ProfileSignInInfo];
-};
-export type Events = AuthenticationControllerStateChangeEvent | AuthenticationControllerProfileSignInEvent;
-type AllowedActions = KeyringControllerGetStateAction | SnapControllerHandleRequestAction | SeedlessOnboardingControllerGetStateAction;
-type AllowedEvents = KeyringControllerLockEvent | KeyringControllerUnlockEvent;
-export type AuthenticationControllerMessenger = Messenger<typeof controllerName, Actions | AllowedActions, Events | AllowedEvents>;
-/**
- * Controller that enables authentication for restricted endpoints.
- * Used for Backup & Sync, Notifications, and other services.
- */
-export declare class AuthenticationController extends BaseController<typeof controllerName, AuthenticationControllerState, AuthenticationControllerMessenger> {
-    #private;
-    constructor({ messenger, state, config, metametrics, }: {
-        messenger: AuthenticationControllerMessenger;
-        state?: AuthenticationControllerState;
-        config?: Partial<ControllerConfig>;
-        /**
-         * Not using the Messaging System as we
-         * do not want to tie this strictly to extension
-         */
-        metametrics: MetaMetricsAuth;
-    });
-    performSignIn(): Promise<string[]>;
-    /**
-     * Marks profile pairing as needed. Clients call this when the SRP set
-     * changes (e.g. a new keyring was added) so the next auto-sign-in cycle
-     * re-runs `performSignIn` and re-pairs.
-     */
-    requestProfilePairing(): void;
-    performSignOut(): void;
-    /**
-     * Returns a bearer token for the specified SRP, logging in if needed.
-     *
-     * When called without `entropySourceId`, returns the primary (first) SRP's
-     * access token, which is effectively the canonical
-     * profile's token that can be used by alias-aware consumers for cross-SRP
-     * operations.
-     *
-     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
-     * @returns The OIDC access token.
-     */
-    getBearerToken(entropySourceId?: string): Promise<string>;
-    /**
-     * Returns the cached session profile, logging in if no session exists.
-     *
-     * The returned `canonicalProfileId` reflects the value from the most recent
-     * login or pairing. In the rare event where a canonical changed because of
-     * a pairing that happened on another device, the cached value may be stale
-     * until the next login. For guaranteed freshness, call
-     * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.
-     *
-     * @param entropySourceId - The entropy source ID used to derive the key,
-     * when multiple sources are available (Multi-SRP).
-     * @returns profile for the session.
-     */
-    getSessionProfile(entropySourceId?: string): Promise<UserProfile>;
-    /**
-     * Forces a fresh retrieval of the canonical profile ID from the server
-     * and propagates it to all cached SRP sessions.
-     *
-     * This method invalidates the primary SRP's cached session and forces a
-     * re-login. Use it before operations that require a guaranteed-fresh
-     * canonical (e.g. storage key derivation for Accounts ADR 0005). For
-     * best-effort reads, use
-     * `getSessionProfile().canonicalProfileId` instead.
-     *
-     * Only the primary SRP is re-logged-in regardless of how many SRPs exist —
-     * the server returns the current canonical for the entire pairing group
-     * from any single SRP login.
-     *
-     * @returns The refreshed canonical profile ID.
-     */
-    refreshCanonicalProfileId(): Promise<string>;
-    getUserProfileLineage(entropySourceId?: string): Promise<UserProfileLineage>;
-    /**
-     * Returns a Customer Service specific access token for the specified SRP,
-     * logging in if needed.
-     *
-     * Exchanges the OIDC access token for a short-lived token scoped to the
-     * customer-service audience. Customer Service tooling consumes this token to
-     * identify and authenticate the user.
-     *
-     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
-     * @returns The customer-service access token.
-     */
-    getCustomerServiceToken(entropySourceId?: string): Promise<string>;
-    isSignedIn(): boolean;
-}
-export {};
-//# sourceMappingURL=AuthenticationController.d.cts.map

package/dist/controllers/authentication/AuthenticationController.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthenticationController.d.cts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC7B,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EAAE,0CAA0C,EAAE,iDAAiD;AAC3G,OAAO,KAAK,EAAE,iCAAiC,EAAE,oCAAoC;AAGrF,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAGZ,WAAW,EACX,kBAAkB,EACnB,4BAA2B;AAC5B,OAAO,EAGL,GAAG,EAEJ,4BAA2B;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAMtE,OAAO,EAAE,qCAAqC,EAAE,2DAA0D;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAG1B,CAAC;AA4CF,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAcF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,iCAAiC,GACjC,0CAA0C,CAAC;AAE/C,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;gBAiCa,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;KAC9B;IAkMY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA6B/C;;;;OAIG;IACI,qBAAqB,IAAI,IAAI;IA8G7B,cAAc,IAAI,IAAI;IAQ7B;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtE;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC;IAOvB;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC;IA8B5C,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAO9B;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAOX,UAAU,IAAI,OAAO;CAqE7B"}

package/dist/controllers/authentication/AuthenticationController.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthenticationController.d.mts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC7B,qCAAqC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EAAE,0CAA0C,EAAE,iDAAiD;AAC3G,OAAO,KAAK,EAAE,iCAAiC,EAAE,oCAAoC;AAGrF,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAGZ,WAAW,EACX,kBAAkB,EACnB,4BAA2B;AAC5B,OAAO,EAGL,GAAG,EAEJ,4BAA2B;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAMtE,OAAO,EAAE,qCAAqC,EAAE,2DAA0D;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAG1B,CAAC;AA4CF,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAcF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,iCAAiC,GACjC,0CAA0C,CAAC;AAE/C,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;gBAiCa,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,GACZ,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;KAC9B;IAkMY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA6B/C;;;;OAIG;IACI,qBAAqB,IAAI,IAAI;IA8G7B,cAAc,IAAI,IAAI;IAQ7B;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtE;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC;IAOvB;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC;IA8B5C,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC;IAO9B;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC;IAOX,UAAU,IAAI,OAAO;CAqE7B"}

package/dist/controllers/authentication/AuthenticationController.mjs

@@ -1,497 +0,0 @@
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_cachedPrimaryEntropySourceId, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_snapGetPublicKey, _AuthenticationController_snapGetAllPublicKeys, _AuthenticationController__snapSignMessageCache, _AuthenticationController_snapSignMessage;
-import { BaseController } from "@metamask/base-controller";
-import { assertMessageStartsWithMetamask, AuthType, Env, JwtBearerAuth } from "../../sdk/index.mjs";
-import { createSnapPublicKeyRequest, createSnapAllPublicKeysRequest, createSnapSignMessageRequest } from "./auth-snap-requests.mjs";
-const controllerName = 'AuthenticationController';
-export const defaultState = {
-    isSignedIn: false,
-    needsProfilePairing: true,
-};
-const metadata = {
-    isSignedIn: {
-        includeInStateLogs: true,
-        persist: true,
-        includeInDebugSnapshot: true,
-        usedInUi: true,
-    },
-    needsProfilePairing: {
-        includeInStateLogs: true,
-        persist: true,
-        includeInDebugSnapshot: true,
-        usedInUi: true,
-    },
-    srpSessionData: {
-        // Remove access token from state logs
-        includeInStateLogs: (srpSessionData) => {
-            // Unreachable branch, included just to fix a type error for the case where this property is
-            // unset. The type gets collapsed to include `| undefined` even though `undefined` is never
-            // set here, because we don't yet use `exactOptionalPropertyTypes`.
-            // TODO: Remove branch after enabling `exactOptionalPropertyTypes`
-            // ref: https://github.com/MetaMask/core/issues/6565
-            if (srpSessionData === null || srpSessionData === undefined) {
-                return null;
-            }
-            return Object.entries(srpSessionData).reduce((sanitizedSrpSessionData, [key, value]) => {
-                const { accessToken: _unused, ...tokenWithoutAccessToken } = value.token;
-                sanitizedSrpSessionData[key] = {
-                    ...value,
-                    token: tokenWithoutAccessToken,
-                };
-                return sanitizedSrpSessionData;
-            }, {});
-        },
-        persist: true,
-        includeInDebugSnapshot: false,
-        usedInUi: true,
-    },
-};
-const MESSENGER_EXPOSED_METHODS = [
-    'performSignIn',
-    'performSignOut',
-    'getBearerToken',
-    'getSessionProfile',
-    'refreshCanonicalProfileId',
-    'getUserProfileLineage',
-    'getCustomerServiceToken',
-    'isSignedIn',
-    'requestProfilePairing',
-];
-/**
- * Controller that enables authentication for restricted endpoints.
- * Used for Backup & Sync, Notifications, and other services.
- */
-export class AuthenticationController extends BaseController {
-    constructor({ messenger, state, config, metametrics, }) {
-        super({
-            messenger,
-            metadata,
-            name: controllerName,
-            state: { ...defaultState, ...state },
-        });
-        _AuthenticationController_instances.add(this);
-        _AuthenticationController_metametrics.set(this, void 0);
-        _AuthenticationController_auth.set(this, void 0);
-        _AuthenticationController_config.set(this, {
-            env: Env.PRD,
-        });
-        _AuthenticationController_isUnlocked.set(this, false);
-        _AuthenticationController_cachedPrimaryEntropySourceId.set(this, void 0);
-        // Bumped by `requestProfilePairing`. `performSignIn` snapshots this
-        // before its first await; if it changes mid-flight we must NOT clear
-        // `needsProfilePairing` (the rearm signal wins).
-        _AuthenticationController_profilePairingRequestEpoch.set(this, 0);
-        _AuthenticationController_keyringController.set(this, {
-            setupLockedStateSubscriptions: () => {
-                const { isUnlocked } = this.messenger.call('KeyringController:getState');
-                __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, isUnlocked, "f");
-                this.messenger.subscribe('KeyringController:unlock', () => {
-                    __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, true, "f");
-                });
-                this.messenger.subscribe('KeyringController:lock', () => {
-                    __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, false, "f");
-                });
-            },
-        });
-        _AuthenticationController__snapSignMessageCache.set(this, {});
-        if (!metametrics) {
-            throw new Error('`metametrics` field is required');
-        }
-        __classPrivateFieldSet(this, _AuthenticationController_config, {
-            ...__classPrivateFieldGet(this, _AuthenticationController_config, "f"),
-            ...config,
-        }, "f");
-        __classPrivateFieldSet(this, _AuthenticationController_metametrics, metametrics, "f");
-        __classPrivateFieldSet(this, _AuthenticationController_auth, new JwtBearerAuth({
-            env: __classPrivateFieldGet(this, _AuthenticationController_config, "f").env,
-            platform: metametrics.agent,
-            type: AuthType.SRP,
-        }, {
-            storage: {
-                getLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginResponseFromState).bind(this),
-                setLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_setLoginResponseToState).bind(this),
-            },
-            signing: {
-                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetPublicKey).bind(this),
-                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapSignMessage).bind(this),
-            },
-            getLoginTag: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginTag).bind(this),
-            getLoginIdentifierType: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginIdentifierType).bind(this),
-            metametrics: __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f"),
-        }), "f");
-        __classPrivateFieldGet(this, _AuthenticationController_keyringController, "f").setupLockedStateSubscriptions();
-        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
-    }
-    async performSignIn() {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'performSignIn');
-        const epochAtStart = __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f");
-        const allPublicKeys = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetAllPublicKeys).call(this);
-        const accessTokens = [];
-        // We iterate sequentially in order to be sure that the first entry
-        // is the primary SRP LoginResponse.
-        for (const [entropySourceId] of allPublicKeys) {
-            const accessToken = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(entropySourceId);
-            accessTokens.push(accessToken);
-        }
-        if (allPublicKeys.length < 2) {
-            // Single-SRP wallet: nothing to pair.
-            __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
-        }
-        else {
-            // Pair failures must not break sign-in; the gate stays `true` for retry.
-            try {
-                await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_doPair).call(this, accessTokens, epochAtStart);
-            }
-            catch {
-                // noop
-            }
-        }
-        return accessTokens;
-    }
-    /**
-     * Marks profile pairing as needed. Clients call this when the SRP set
-     * changes (e.g. a new keyring was added) so the next auto-sign-in cycle
-     * re-runs `performSignIn` and re-pairs.
-     */
-    requestProfilePairing() {
-        __classPrivateFieldSet(this, _AuthenticationController_profilePairingRequestEpoch, __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") + 1, "f");
-        if (!this.state.needsProfilePairing) {
-            this.update((state) => {
-                state.needsProfilePairing = true;
-            });
-        }
-    }
-    performSignOut() {
-        __classPrivateFieldSet(this, _AuthenticationController_cachedPrimaryEntropySourceId, undefined, "f");
-        this.update((state) => {
-            state.isSignedIn = false;
-            state.srpSessionData = undefined;
-        });
-    }
-    /**
-     * Returns a bearer token for the specified SRP, logging in if needed.
-     *
-     * When called without `entropySourceId`, returns the primary (first) SRP's
-     * access token, which is effectively the canonical
-     * profile's token that can be used by alias-aware consumers for cross-SRP
-     * operations.
-     *
-     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
-     * @returns The OIDC access token.
-     */
-    async getBearerToken(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getBearerToken');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(resolvedId);
-    }
-    /**
-     * Returns the cached session profile, logging in if no session exists.
-     *
-     * The returned `canonicalProfileId` reflects the value from the most recent
-     * login or pairing. In the rare event where a canonical changed because of
-     * a pairing that happened on another device, the cached value may be stale
-     * until the next login. For guaranteed freshness, call
-     * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.
-     *
-     * @param entropySourceId - The entropy source ID used to derive the key,
-     * when multiple sources are available (Multi-SRP).
-     * @returns profile for the session.
-     */
-    async getSessionProfile(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getSessionProfile');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfile(resolvedId);
-    }
-    /**
-     * Forces a fresh retrieval of the canonical profile ID from the server
-     * and propagates it to all cached SRP sessions.
-     *
-     * This method invalidates the primary SRP's cached session and forces a
-     * re-login. Use it before operations that require a guaranteed-fresh
-     * canonical (e.g. storage key derivation for Accounts ADR 0005). For
-     * best-effort reads, use
-     * `getSessionProfile().canonicalProfileId` instead.
-     *
-     * Only the primary SRP is re-logged-in regardless of how many SRPs exist —
-     * the server returns the current canonical for the entire pairing group
-     * from any single SRP login.
-     *
-     * @returns The refreshed canonical profile ID.
-     */
-    async refreshCanonicalProfileId() {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'refreshCanonicalProfileId');
-        const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_invalidateSrpSession).call(this, primaryEntropySourceId);
-        await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(primaryEntropySourceId);
-        const canonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-        if (!canonical) {
-            throw new Error('refreshCanonicalProfileId - Unable to resolve canonical profile ID');
-        }
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_propagateCanonical).call(this, canonical);
-        return canonical;
-    }
-    async getUserProfileLineage(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getUserProfileLineage');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
-    }
-    /**
-     * Returns a Customer Service specific access token for the specified SRP,
-     * logging in if needed.
-     *
-     * Exchanges the OIDC access token for a short-lived token scoped to the
-     * customer-service audience. Customer Service tooling consumes this token to
-     * identify and authenticate the user.
-     *
-     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
-     * @returns The customer-service access token.
-     */
-    async getCustomerServiceToken(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
-        const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
-    }
-    isSignedIn() {
-        return this.state.isSignedIn;
-    }
-}
-_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_cachedPrimaryEntropySourceId = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__snapSignMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
-    const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
-    if (!this.state.srpSessionData?.[resolvedId]) {
-        return null;
-    }
-    return this.state.srpSessionData[resolvedId];
-}, _AuthenticationController_setLoginResponseToState = async function _AuthenticationController_setLoginResponseToState(loginResponse, entropySourceId) {
-    const resolvedId = entropySourceId ?? (await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this));
-    const metaMetricsId = await __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f").getMetaMetricsId();
-    this.update((state) => {
-        state.isSignedIn = true;
-        if (!state.srpSessionData) {
-            state.srpSessionData = {};
-        }
-        state.srpSessionData[resolvedId] = {
-            ...loginResponse,
-            profile: {
-                ...loginResponse.profile,
-                metaMetricsId,
-            },
-        };
-    });
-}, _AuthenticationController_assertIsUnlocked = function _AuthenticationController_assertIsUnlocked(methodName) {
-    if (!__classPrivateFieldGet(this, _AuthenticationController_isUnlocked, "f")) {
-        throw new Error(`${methodName} - unable to proceed, wallet is locked`);
-    }
-}, _AuthenticationController_getPrimaryEntropySourceId = async function _AuthenticationController_getPrimaryEntropySourceId() {
-    if (__classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f")) {
-        return __classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f");
-    }
-    const allPublicKeys = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_snapGetAllPublicKeys).call(this);
-    if (allPublicKeys.length === 0) {
-        throw new Error('#getPrimaryEntropySourceId - No entropy sources found from snap');
-    }
-    const primaryId = allPublicKeys[0][0];
-    if (!primaryId) {
-        throw new Error('#getPrimaryEntropySourceId - Primary entropy source ID is undefined');
-    }
-    __classPrivateFieldSet(this, _AuthenticationController_cachedPrimaryEntropySourceId, primaryId, "f");
-    return __classPrivateFieldGet(this, _AuthenticationController_cachedPrimaryEntropySourceId, "f");
-}, _AuthenticationController_getLoginTag = 
-/**
- * Resolves the SRP login tag for `raw_message`.
- *
- * - `primary` for the first HD entropy source
- * - `secondary` for any other entropy source
- *
- * @param entropySourceId - Entropy source for this login attempt.
- * @returns The login tag to append to the signed message.
- */
-async function _AuthenticationController_getLoginTag(entropySourceId) {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    const resolvedId = entropySourceId ?? primaryEntropySourceId;
-    return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';
-}, _AuthenticationController_getLoginIdentifierType = 
-/**
- * Resolves metametrics `identifier_type` for `/srp/login`
- * (`SRP` | `GOOGLE` | `APPLE` | `TELEGRAM`).
- *
- * This is the auth method for the entropy source, independent of
- * {@link SrpLoginTag} (`primary` / `secondary`).
- *
- * SeedlessOnboarding currently exposes a single vault-level
- * `authConnection`, which always backs the primary entropy source. Non-
- * primary sources therefore return `SRP`. If social identities become
- * per-entropy later, resolve from that metadata instead of assuming
- * primary === social.
- *
- * Soft-fails to `SRP` when SeedlessOnboarding is not registered.
- *
- * @param entropySourceId - Entropy source for this login attempt.
- * @returns The login identifier type.
- */
-async function _AuthenticationController_getLoginIdentifierType(entropySourceId) {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    const resolvedId = entropySourceId ?? primaryEntropySourceId;
-    // Social vault authConnection is only associated with the primary source.
-    if (resolvedId !== primaryEntropySourceId) {
-        return 'SRP';
-    }
-    return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_resolveSocialIdentifierType).call(this);
-}, _AuthenticationController_resolveSocialIdentifierType = function _AuthenticationController_resolveSocialIdentifierType() {
-    try {
-        const { vault, authConnection } = this.messenger.call('SeedlessOnboardingController:getState');
-        if (vault === null || vault === undefined) {
-            return 'SRP';
-        }
-        // Match provider strings from SeedlessOnboarding state rather than
-        // importing AuthConnection — a value import would load that package
-        // (and its heavy deps) whenever this controller is imported.
-        switch (authConnection) {
-            case 'google':
-                return 'GOOGLE';
-            case 'apple':
-                return 'APPLE';
-            case 'telegram':
-                return 'TELEGRAM';
-            default:
-                return 'SRP';
-        }
-    }
-    catch {
-        return 'SRP';
-    }
-}, _AuthenticationController_tryClearNeedsProfilePairing = function _AuthenticationController_tryClearNeedsProfilePairing(epochAtStart) {
-    if (__classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") !== epochAtStart) {
-        return;
-    }
-    if (this.state.needsProfilePairing) {
-        this.update((state) => {
-            state.needsProfilePairing = false;
-        });
-    }
-}, _AuthenticationController_doPair = 
-/**
- * Pairs all SRPs via `POST /profile/pair`, propagates the canonical
- * profile ID, clears `needsProfilePairing`, and emits
- * `AuthenticationController:profileSignIn` when the canonical changes or
- * new aliases are returned. Throws on failure.
- *
- * @param accessTokens - Per-SRP access tokens, primary first.
- * @param epochAtStart - Pairing-request epoch captured by the caller.
- * Used to skip the gate clear if `requestProfilePairing` ran while the
- * pair API call was in-flight.
- */
-async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
-    const previousCanonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-    const profileAliases = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_pairSrpProfiles).call(this, accessTokens);
-    const newCanonical = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-    // If somehow we cannot compute the new canonical profile ID after pairing,
-    // we just return now and do not update the `needsProfilePairing` flag.
-    if (!newCanonical) {
-        return;
-    }
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
-    const profileIdChanged = previousCanonical !== newCanonical;
-    const shouldEmitProfileSignInEvent = profileIdChanged || profileAliases.length > 0;
-    if (shouldEmitProfileSignInEvent) {
-        this.messenger.publish('AuthenticationController:profileSignIn', {
-            profileId: newCanonical,
-            profileAliases,
-            profileIdChanged,
-        });
-    }
-}, _AuthenticationController_pairSrpProfiles = async function _AuthenticationController_pairSrpProfiles(accessTokens) {
-    if (accessTokens.length < 2) {
-        return [];
-    }
-    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.
-    const { profileAliases, profile: { canonicalProfileId }, } = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").pairSrpProfiles(accessTokens, primaryAccessToken);
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_propagateCanonical).call(this, canonicalProfileId);
-    return profileAliases;
-}, _AuthenticationController_propagateCanonical = function _AuthenticationController_propagateCanonical(canonicalProfileId) {
-    const { srpSessionData } = this.state;
-    if (!srpSessionData) {
-        return;
-    }
-    this.update((state) => {
-        for (const entry of Object.values(state.srpSessionData ?? {})) {
-            if (entry?.profile) {
-                entry.profile.canonicalProfileId = canonicalProfileId;
-            }
-        }
-    });
-}, _AuthenticationController_getCanonicalProfileId = 
-/**
- * Returns the canonical profile id from the primary SRP's cached session.
- * Returns `null` when no session exists yet for the primary SRP.
- *
- * Always reads from the primary SRP because the canonical is shared across
- * all paired SRPs after `#propagateCanonical`.
- *
- * @returns The canonical profile id, or `null` if unavailable.
- */
-async function _AuthenticationController_getCanonicalProfileId() {
-    const primaryEntropySourceId = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    return (this.state.srpSessionData?.[primaryEntropySourceId]?.profile
-        ?.canonicalProfileId ?? null);
-}, _AuthenticationController_invalidateSrpSession = function _AuthenticationController_invalidateSrpSession(entropySourceId) {
-    this.update((state) => {
-        const entry = state.srpSessionData?.[entropySourceId];
-        if (entry?.profile) {
-            // Setting canonicalProfileId to '' forces a re-fetch on the next
-            // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)
-            // treats '' the same as undefined/null — all signal an invalid session.
-            entry.profile.canonicalProfileId = '';
-        }
-    });
-}, _AuthenticationController_snapGetPublicKey = 
-/**
- * Returns the auth snap public key.
- *
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns The snap public key.
- */
-async function _AuthenticationController_snapGetPublicKey(entropySourceId) {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapGetPublicKey');
-    const result = (await this.messenger.call('SnapController:handleRequest', createSnapPublicKeyRequest(entropySourceId)));
-    return result;
-}, _AuthenticationController_snapGetAllPublicKeys = 
-/**
- * Returns a mapping of entropy source IDs to auth snap public keys.
- *
- * @returns A mapping of entropy source IDs to public keys.
- */
-async function _AuthenticationController_snapGetAllPublicKeys() {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapGetAllPublicKeys');
-    const result = (await this.messenger.call('SnapController:handleRequest', createSnapAllPublicKeysRequest()));
-    return result;
-}, _AuthenticationController_snapSignMessage = 
-/**
- * Signs a specific message using an underlying auth snap.
- *
- * @param message - A specific tagged message to sign.
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns A Signature created by the snap.
- */
-async function _AuthenticationController_snapSignMessage(message, entropySourceId) {
-    assertMessageStartsWithMetamask(message);
-    if (__classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message]) {
-        return __classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message];
-    }
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#snapSignMessage');
-    const result = (await this.messenger.call('SnapController:handleRequest', createSnapSignMessageRequest(message, entropySourceId)));
-    __classPrivateFieldGet(this, _AuthenticationController__snapSignMessageCache, "f")[message] = result;
-    return result;
-};
-//# sourceMappingURL=AuthenticationController.mjs.map