@metamask/profile-sync-controller 29.0.0 → 31.0.0

package/dist/sdk/user-storage.js

@@ -0,0 +1,364 @@
+import { SHARED_SALT } from '../shared/encryption/constants.js';
+import encryption, { createSHA256Hash } from '../shared/encryption/index.js';
+import { getEnvUrls } from '../shared/env.js';
+import { createEntryPath } from '../shared/storage-schema.js';
+import { NotFoundError, UserStorageError } from './errors.js';
+export const STORAGE_URL = (env, encryptedPath) => `${getEnvUrls(env).userStorageApiUrl}/api/v1/userstorage/${encryptedPath}`;
+export class UserStorage {
+    config;
+    options;
+    env;
+    constructor(config, options) {
+        this.env = config.env;
+        this.config = config;
+        this.options = options;
+    }
+    async setItem(path, value, options) {
+        await this.#upsertUserStorage(path, value, options);
+    }
+    async batchSetItems(path, values, options) {
+        await this.#batchUpsertUserStorage(path, values, options);
+    }
+    async getItem(path, options) {
+        return this.#getUserStorage(path, options);
+    }
+    async getAllFeatureItems(path, options) {
+        return this.#getUserStorageAllFeatureEntries(path, options);
+    }
+    async deleteItem(path, options) {
+        return this.#deleteUserStorage(path, options);
+    }
+    async deleteAllFeatureItems(path, options) {
+        return this.#deleteUserStorageAllFeatureEntries(path, options);
+    }
+    async batchDeleteItems(path, values, options) {
+        return this.#batchDeleteUserStorage(path, values, options);
+    }
+    async getStorageKey(entropySourceId) {
+        const userProfile = await this.config.auth.getUserProfile(entropySourceId);
+        const message = `metamask:${userProfile.profileId}`;
+        const storageKey = await this.options.storage?.getStorageKey(message, entropySourceId);
+        if (storageKey) {
+            return storageKey;
+        }
+        const storageKeySignature = await this.config.auth.signMessage(message, entropySourceId);
+        const hashedStorageKeySignature = createSHA256Hash(storageKeySignature);
+        await this.options.storage?.setStorageKey(message, hashedStorageKeySignature, entropySourceId);
+        return hashedStorageKeySignature;
+    }
+    async #upsertUserStorage(path, data, options) {
+        const entropySourceId = options?.entropySourceId;
+        try {
+            const headers = await this.#getAuthorizationHeader(entropySourceId);
+            const profileScopeHeader = await this.#getProfileScopeHeader(entropySourceId, options?.useCanonicalScope);
+            const storageKey = await this.getStorageKey(entropySourceId);
+            const encryptedData = await encryption.encryptString(data, storageKey, options?.nativeScryptCrypto);
+            const encryptedPath = createEntryPath(path, storageKey);
+            const url = new URL(STORAGE_URL(this.env, encryptedPath));
+            const response = await fetch(url.toString(), {
+                method: 'PUT',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                    ...profileScopeHeader,
+                },
+                body: JSON.stringify({ data: encryptedData }),
+            });
+            if (!response.ok) {
+                const responseBody = await response.json().catch(() => ({
+                    message: 'unknown',
+                    error: 'unknown',
+                }));
+                throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+            }
+        }
+        catch (e) {
+            /* istanbul ignore next */
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+            throw new UserStorageError(`failed to upsert user storage for path '${path}'. ${errorMessage}`);
+        }
+    }
+    async #batchUpsertUserStorage(path, data, options) {
+        const entropySourceId = options?.entropySourceId;
+        try {
+            if (!data.length) {
+                return;
+            }
+            const headers = await this.#getAuthorizationHeader(entropySourceId);
+            const profileScopeHeader = await this.#getProfileScopeHeader(entropySourceId, options?.useCanonicalScope);
+            const storageKey = await this.getStorageKey(entropySourceId);
+            const encryptedData = await Promise.all(data.map(async (d) => {
+                return [
+                    this.#createEntryKey(d[0], storageKey),
+                    await encryption.encryptString(d[1], storageKey, options?.nativeScryptCrypto),
+                ];
+            }));
+            const url = new URL(STORAGE_URL(this.env, path));
+            const response = await fetch(url.toString(), {
+                method: 'PUT',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                    ...profileScopeHeader,
+                },
+                body: JSON.stringify({ data: Object.fromEntries(encryptedData) }),
+            });
+            if (!response.ok) {
+                const responseBody = await response.json().catch(() => ({
+                    message: 'unknown',
+                    error: 'unknown',
+                }));
+                throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+            }
+        }
+        catch (e) {
+            /* istanbul ignore next */
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+            throw new UserStorageError(`failed to batch upsert user storage for path '${path}'. ${errorMessage}`);
+        }
+    }
+    async #batchUpsertUserStorageWithAlreadyHashedAndEncryptedEntries(path, encryptedData, entropySourceId, useCanonicalScope) {
+        try {
+            const headers = await this.#getAuthorizationHeader(entropySourceId);
+            const profileScopeHeader = await this.#getProfileScopeHeader(entropySourceId, useCanonicalScope);
+            const url = new URL(STORAGE_URL(this.env, path));
+            const response = await fetch(url.toString(), {
+                method: 'PUT',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                    ...profileScopeHeader,
+                },
+                body: JSON.stringify({ data: Object.fromEntries(encryptedData) }),
+            });
+            // istanbul ignore next
+            if (!response.ok) {
+                const responseBody = await response.json().catch(() => ({
+                    message: 'unknown',
+                    error: 'unknown',
+                }));
+                throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+            }
+        }
+        catch (e) {
+            /* istanbul ignore next */
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+            // istanbul ignore next
+            throw new UserStorageError(`failed to batch upsert user storage for path '${path}'. ${errorMessage}`);
+        }
+    }
+    async #getUserStorage(path, options) {
+        const entropySourceId = options?.entropySourceId;
+        try {
+            const headers = await this.#getAuthorizationHeader(entropySourceId);
+            const storageKey = await this.getStorageKey(entropySourceId);
+            const encryptedPath = createEntryPath(path, storageKey);
+            const url = new URL(STORAGE_URL(this.env, encryptedPath));
+            const response = await fetch(url.toString(), {
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                },
+            });
+            if (response.status === 404) {
+                return null;
+            }
+            if (!response.ok) {
+                const responseBody = (await response.json());
+                throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+            }
+            const userStorage = await response.json();
+            const encryptedData = userStorage?.Data ?? null;
+            if (!encryptedData) {
+                return null;
+            }
+            const decryptedData = await encryption.decryptString(encryptedData, storageKey, options?.nativeScryptCrypto);
+            // Re-encrypt the entry if it was encrypted with a random salt
+            const salt = encryption.getSalt(encryptedData);
+            if (salt.toString() !== SHARED_SALT.toString()) {
+                await this.#upsertUserStorage(path, decryptedData, options);
+            }
+            return decryptedData;
+        }
+        catch (e) {
+            /* istanbul ignore next */
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+            throw new UserStorageError(`failed to get user storage for path '${path}'. ${errorMessage}`);
+        }
+    }
+    async #getUserStorageAllFeatureEntries(path, options) {
+        const entropySourceId = options?.entropySourceId;
+        try {
+            const headers = await this.#getAuthorizationHeader(entropySourceId);
+            const profileScopeHeader = await this.#getProfileScopeHeader(entropySourceId, options?.useCanonicalScope);
+            const storageKey = await this.getStorageKey(entropySourceId);
+            const url = new URL(STORAGE_URL(this.env, path));
+            const response = await fetch(url.toString(), {
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                    ...profileScopeHeader,
+                },
+            });
+            if (response.status === 404) {
+                return null;
+            }
+            if (!response.ok) {
+                const responseBody = (await response.json());
+                throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+            }
+            const userStorage = await response.json();
+            if (!Array.isArray(userStorage)) {
+                return null;
+            }
+            const decryptedData = [];
+            const reEncryptedEntries = [];
+            for (const entry of userStorage) {
+                if (!entry.Data) {
+                    continue;
+                }
+                try {
+                    const data = await encryption.decryptString(entry.Data, storageKey, options?.nativeScryptCrypto);
+                    decryptedData.push(data);
+                    // Re-encrypt the entry was encrypted with a random salt
+                    const salt = encryption.getSalt(entry.Data);
+                    if (salt.toString() !== SHARED_SALT.toString()) {
+                        reEncryptedEntries.push([
+                            entry.HashedKey,
+                            await encryption.encryptString(data, storageKey, options?.nativeScryptCrypto),
+                        ]);
+                    }
+                }
+                catch {
+                    // do nothing
+                }
+            }
+            // Re-upload the re-encrypted entries
+            if (reEncryptedEntries.length) {
+                await this.#batchUpsertUserStorageWithAlreadyHashedAndEncryptedEntries(path, reEncryptedEntries, entropySourceId, options?.useCanonicalScope);
+            }
+            return decryptedData;
+        }
+        catch (e) {
+            /* istanbul ignore next */
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+            throw new UserStorageError(`failed to get user storage for path '${path}'. ${errorMessage}`);
+        }
+    }
+    async #deleteUserStorage(path, options) {
+        const entropySourceId = options?.entropySourceId;
+        try {
+            const headers = await this.#getAuthorizationHeader(entropySourceId);
+            const storageKey = await this.getStorageKey(entropySourceId);
+            const encryptedPath = createEntryPath(path, storageKey);
+            const url = new URL(STORAGE_URL(this.env, encryptedPath));
+            const response = await fetch(url.toString(), {
+                method: 'DELETE',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                },
+            });
+            if (response.status === 404) {
+                throw new NotFoundError(`feature/key set not found for path '${path}'.`);
+            }
+            if (!response.ok) {
+                const responseBody = (await response.json());
+                throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+            }
+        }
+        catch (e) {
+            if (e instanceof NotFoundError) {
+                throw e;
+            }
+            /* istanbul ignore next */
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+            throw new UserStorageError(`failed to delete user storage for path '${path}'. ${errorMessage}`);
+        }
+    }
+    async #deleteUserStorageAllFeatureEntries(path, options) {
+        try {
+            const entropySourceId = options?.entropySourceId;
+            const headers = await this.#getAuthorizationHeader(entropySourceId);
+            const profileScopeHeader = await this.#getProfileScopeHeader(entropySourceId, options?.useCanonicalScope);
+            const url = new URL(STORAGE_URL(this.env, path));
+            const response = await fetch(url.toString(), {
+                method: 'DELETE',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                    ...profileScopeHeader,
+                },
+            });
+            if (response.status === 404) {
+                throw new NotFoundError(`feature not found for path '${path}'.`);
+            }
+            if (!response.ok) {
+                const responseBody = (await response.json());
+                throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+            }
+        }
+        catch (e) {
+            if (e instanceof NotFoundError) {
+                throw e;
+            }
+            /* istanbul ignore next */
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+            throw new UserStorageError(`failed to delete user storage for path '${path}'. ${errorMessage}`);
+        }
+    }
+    async #batchDeleteUserStorage(path, keysToDelete, options) {
+        try {
+            if (!keysToDelete.length) {
+                return;
+            }
+            const entropySourceId = options?.entropySourceId;
+            const headers = await this.#getAuthorizationHeader(entropySourceId);
+            const storageKey = await this.getStorageKey(entropySourceId);
+            const rawEntryKeys = keysToDelete.map((d) => this.#createEntryKey(d, storageKey));
+            const url = new URL(STORAGE_URL(this.env, path));
+            const response = await fetch(url.toString(), {
+                method: 'PUT',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...headers,
+                },
+                body: JSON.stringify({ batch_delete: rawEntryKeys }),
+            });
+            if (!response.ok) {
+                const responseBody = await response.json().catch(() => ({
+                    message: 'unknown',
+                    error: 'unknown',
+                }));
+                throw new Error(`HTTP error message: ${responseBody.message}, error: ${responseBody.error}`);
+            }
+        }
+        catch (e) {
+            /* istanbul ignore next */
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e ?? '');
+            throw new UserStorageError(`failed to batch delete user storage for path '${path}'. ${errorMessage}`);
+        }
+    }
+    #createEntryKey(key, storageKey) {
+        return createSHA256Hash(key + storageKey);
+    }
+    async #getAuthorizationHeader(entropySourceId) {
+        const accessToken = await this.config.auth.getAccessToken(entropySourceId);
+        return { Authorization: `Bearer ${accessToken}` };
+    }
+    async #getProfileScopeHeader(entropySourceId, useCanonicalScope) {
+        if (useCanonicalScope) {
+            return {};
+        }
+        const profile = await this.config.auth.getUserProfile(entropySourceId);
+        if (profile.profileId !== profile.canonicalProfileId) {
+            // After SRP pairing the JWT `sub` is the canonical profile id, but
+            // user storage data is still keyed by the original per-SRP profileId.
+            // The `x-profile-id` header tells the backend to scope reads/writes to
+            // that alias partition until ADR 0005 migrates storage keys to canonical.
+            return { 'x-profile-id': profile.profileId };
+        }
+        return {};
+    }
+}
+//# sourceMappingURL=user-storage.js.map

package/dist/sdk/user-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-storage.js","sourceRoot":"","sources":["../../src/sdk/user-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAChE,OAAO,UAAU,EAAE,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAO9C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAQ,EAAE,aAAqB,EAAE,EAAE,CAC7D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,iBAAiB,uBAAuB,aAAa,EAAE,CAAC;AA8C7E,MAAM,OAAO,WAAW;IACZ,MAAM,CAAoB;IAE7B,OAAO,CAAqB;IAEzB,GAAG,CAAM;IAEnB,YAAY,MAAyB,EAAE,OAA2B;QAChE,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAA6C,EAC7C,KAAa,EACb,OAAkC;QAElC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,IAAmC,EACnC,MAAgD,EAChD,OAAkC;QAElC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAA6C,EAC7C,OAAkC;QAElC,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAmC,EACnC,OAAkC;QAElC,OAAO,IAAI,CAAC,gCAAgC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU,CACd,IAA6C,EAC7C,OAAkC;QAElC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,IAAmC,EACnC,OAAkC;QAElC,OAAO,IAAI,CAAC,mCAAmC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,IAAmC,EACnC,MAAsC,EACtC,OAAkC;QAElC,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,eAAwB;QAC1C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,YAAY,WAAW,CAAC,SAAS,EAAW,CAAC;QAE7D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAC1D,OAAO,EACP,eAAe,CAChB,CAAC;QACF,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAC5D,OAAO,EACP,eAAe,CAChB,CAAC;QACF,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CACvC,OAAO,EACP,yBAAyB,EACzB,eAAe,CAChB,CAAC;QACF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAA6C,EAC7C,IAAY,EACZ,OAAkC;QAElC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;YACpE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC1D,eAAe,EACf,OAAO,EAAE,iBAAiB,CAC3B,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,aAAa,CAClD,IAAI,EACJ,UAAU,EACV,OAAO,EAAE,kBAAkB,CAC5B,CAAC;YACF,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAExD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;YAE1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;oBACV,GAAG,kBAAkB;iBACtB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;aAC9C,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAiB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACpE,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;gBACJ,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0BAA0B;YAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,IAAI,gBAAgB,CACxB,2CAA2C,IAAI,MAAM,YAAY,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,IAA2C,EAC3C,IAAwB,EACxB,OAAkC;QAElC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QACjD,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;YACpE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC1D,eAAe,EACf,OAAO,EAAE,iBAAiB,CAC3B,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YAE7D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,OAAO;oBACL,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC;oBACtC,MAAM,UAAU,CAAC,aAAa,CAC5B,CAAC,CAAC,CAAC,CAAC,EACJ,UAAU,EACV,OAAO,EAAE,kBAAkB,CAC5B;iBACF,CAAC;YACJ,CAAC,CAAC,CACH,CAAC;YAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAEjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;oBACV,GAAG,kBAAkB;iBACtB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAiB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACpE,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;gBACJ,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0BAA0B;YAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,IAAI,gBAAgB,CACxB,iDAAiD,IAAI,MAAM,YAAY,EAAE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,2DAA2D,CAC/D,IAA2C,EAC3C,aAAiC,EACjC,eAAwB,EACxB,iBAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;YACpE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC1D,eAAe,EACf,iBAAiB,CAClB,CAAC;YAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAEjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;oBACV,GAAG,kBAAkB;iBACtB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;YAEH,uBAAuB;YACvB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAiB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACpE,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;gBACJ,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0BAA0B;YAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,uBAAuB;YACvB,MAAM,IAAI,gBAAgB,CACxB,iDAAiD,IAAI,MAAM,YAAY,EAAE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,IAA6C,EAC7C,OAAkC;QAElC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAExD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;YAE1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;iBACX;aACF,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,aAAa,GAAG,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;YAEhD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,aAAa,CAClD,aAAa,EACb,UAAU,EACV,OAAO,EAAE,kBAAkB,CAC5B,CAAC;YAEF,8DAA8D;YAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0BAA0B;YAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAE3D,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,IAAI,MAAM,YAAY,EAAE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gCAAgC,CACpC,IAA2C,EAC3C,OAAkC;QAElC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;YACpE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC1D,eAAe,EACf,OAAO,EAAE,iBAAiB,CAC3B,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YAE7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAEjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;oBACV,GAAG,kBAAkB;iBACtB;aACF,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GACf,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAExB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,aAAa,GAAa,EAAE,CAAC;YACnC,MAAM,kBAAkB,GAAuB,EAAE,CAAC;YAElD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBAChB,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,aAAa,CACzC,KAAK,CAAC,IAAI,EACV,UAAU,EACV,OAAO,EAAE,kBAAkB,CAC5B,CAAC;oBACF,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAEzB,wDAAwD;oBACxD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC5C,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC;wBAC/C,kBAAkB,CAAC,IAAI,CAAC;4BACtB,KAAK,CAAC,SAAS;4BACf,MAAM,UAAU,CAAC,aAAa,CAC5B,IAAI,EACJ,UAAU,EACV,OAAO,EAAE,kBAAkB,CAC5B;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa;gBACf,CAAC;YACH,CAAC;YAED,qCAAqC;YACrC,IAAI,kBAAkB,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,2DAA2D,CACpE,IAAI,EACJ,kBAAkB,EAClB,eAAe,EACf,OAAO,EAAE,iBAAiB,CAC3B,CAAC;YACJ,CAAC;YAED,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0BAA0B;YAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAE3D,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,IAAI,MAAM,YAAY,EAAE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAA6C,EAC7C,OAAkC;QAElC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAExD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;YAE1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;iBACX;aACF,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,aAAa,CACrB,uCAAuC,IAAI,IAAI,CAChD,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;gBAC/B,MAAM,CAAC,CAAC;YACV,CAAC;YAED,0BAA0B;YAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAE3D,MAAM,IAAI,gBAAgB,CACxB,2CAA2C,IAAI,MAAM,YAAY,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mCAAmC,CACvC,IAA2C,EAC3C,OAAkC;QAElC,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;YACpE,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC1D,eAAe,EACf,OAAO,EAAE,iBAAiB,CAC3B,CAAC;YAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAEjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;oBACV,GAAG,kBAAkB;iBACtB;aACF,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,aAAa,CAAC,+BAA+B,IAAI,IAAI,CAAC,CAAC;YACnE,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;gBAC/B,MAAM,CAAC,CAAC;YACV,CAAC;YAED,0BAA0B;YAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAE3D,MAAM,IAAI,gBAAgB,CACxB,2CAA2C,IAAI,MAAM,YAAY,EAAE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,IAA2C,EAC3C,YAAsB,EACtB,OAAkC;QAElC,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;YACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;YAE7D,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,UAAU,CAAC,CACpC,CAAC;YAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAEjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,OAAO;iBACX;gBAED,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;aACrD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAiB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACpE,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC,CAAC;gBACJ,MAAM,IAAI,KAAK,CACb,uBAAuB,YAAY,CAAC,OAAO,YAAY,YAAY,CAAC,KAAK,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0BAA0B;YAC1B,MAAM,YAAY,GAChB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,IAAI,gBAAgB,CACxB,iDAAiD,IAAI,MAAM,YAAY,EAAE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,eAAe,CAAC,GAAW,EAAE,UAAkB;QAC7C,OAAO,gBAAgB,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,eAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC3E,OAAO,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,eAAwB,EACxB,iBAA2B;QAE3B,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACrD,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,0EAA0E;YAC1E,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF","sourcesContent":["import { SHARED_SALT } from '../shared/encryption/constants.js';\nimport encryption, { createSHA256Hash } from '../shared/encryption/index.js';\nimport type { Env } from '../shared/env.js';\nimport { getEnvUrls } from '../shared/env.js';\nimport type {\n  UserStorageGenericFeatureKey,\n  UserStorageGenericFeatureName,\n  UserStorageGenericPathWithFeatureAndKey,\n  UserStorageGenericPathWithFeatureOnly,\n} from '../shared/storage-schema.js';\nimport { createEntryPath } from '../shared/storage-schema.js';\nimport type { NativeScrypt } from '../shared/types/encryption.js';\nimport type { IBaseAuth } from './authentication-jwt-bearer/types.js';\nimport { NotFoundError, UserStorageError } from './errors.js';\n\nexport const STORAGE_URL = (env: Env, encryptedPath: string) =>\n  `${getEnvUrls(env).userStorageApiUrl}/api/v1/userstorage/${encryptedPath}`;\n\nexport type UserStorageConfig = {\n  env: Env;\n  auth: Pick<IBaseAuth, 'getAccessToken' | 'getUserProfile' | 'signMessage'>;\n};\n\nexport type StorageOptions = {\n  getStorageKey: (\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ) => Promise<string | null>;\n  setStorageKey: (\n    message: `metamask:${string}`,\n    val: string,\n    entropySourceId?: string,\n  ) => Promise<void>;\n};\n\nexport type UserStorageOptions = {\n  storage?: StorageOptions;\n};\n\nexport type GetUserStorageAllFeatureEntriesResponse = {\n  HashedKey: string;\n\n  Data: string;\n}[];\n\nexport type UserStorageMethodOptions = {\n  nativeScryptCrypto?: NativeScrypt;\n  entropySourceId?: string;\n  /**\n   * When true, skip the `x-profile-id` header on feature-scoped requests,\n   * letting the server default to the JWT `sub` (canonical profile ID).\n   * Useful during canonical storage migration (ADR 0005) to read/verify\n   * data stored under the canonical key.\n   */\n  useCanonicalScope?: boolean;\n};\n\ntype ErrorMessage = {\n  message: string;\n  error: string;\n};\n\nexport class UserStorage {\n  protected config: UserStorageConfig;\n\n  public options: UserStorageOptions;\n\n  protected env: Env;\n\n  constructor(config: UserStorageConfig, options: UserStorageOptions) {\n    this.env = config.env;\n    this.config = config;\n    this.options = options;\n  }\n\n  async setItem(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    value: string,\n    options?: UserStorageMethodOptions,\n  ): Promise<void> {\n    await this.#upsertUserStorage(path, value, options);\n  }\n\n  async batchSetItems(\n    path: UserStorageGenericFeatureName,\n    values: [UserStorageGenericFeatureKey, string][],\n    options?: UserStorageMethodOptions,\n  ) {\n    await this.#batchUpsertUserStorage(path, values, options);\n  }\n\n  async getItem(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    options?: UserStorageMethodOptions,\n  ): Promise<string | null> {\n    return this.#getUserStorage(path, options);\n  }\n\n  async getAllFeatureItems(\n    path: UserStorageGenericFeatureName,\n    options?: UserStorageMethodOptions,\n  ): Promise<string[] | null> {\n    return this.#getUserStorageAllFeatureEntries(path, options);\n  }\n\n  async deleteItem(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    options?: UserStorageMethodOptions,\n  ): Promise<void> {\n    return this.#deleteUserStorage(path, options);\n  }\n\n  async deleteAllFeatureItems(\n    path: UserStorageGenericFeatureName,\n    options?: UserStorageMethodOptions,\n  ): Promise<void> {\n    return this.#deleteUserStorageAllFeatureEntries(path, options);\n  }\n\n  async batchDeleteItems(\n    path: UserStorageGenericFeatureName,\n    values: UserStorageGenericFeatureKey[],\n    options?: UserStorageMethodOptions,\n  ) {\n    return this.#batchDeleteUserStorage(path, values, options);\n  }\n\n  async getStorageKey(entropySourceId?: string): Promise<string> {\n    const userProfile = await this.config.auth.getUserProfile(entropySourceId);\n    const message = `metamask:${userProfile.profileId}` as const;\n\n    const storageKey = await this.options.storage?.getStorageKey(\n      message,\n      entropySourceId,\n    );\n    if (storageKey) {\n      return storageKey;\n    }\n\n    const storageKeySignature = await this.config.auth.signMessage(\n      message,\n      entropySourceId,\n    );\n    const hashedStorageKeySignature = createSHA256Hash(storageKeySignature);\n    await this.options.storage?.setStorageKey(\n      message,\n      hashedStorageKeySignature,\n      entropySourceId,\n    );\n    return hashedStorageKeySignature;\n  }\n\n  async #upsertUserStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    data: string,\n    options?: UserStorageMethodOptions,\n  ): Promise<void> {\n    const entropySourceId = options?.entropySourceId;\n    try {\n      const headers = await this.#getAuthorizationHeader(entropySourceId);\n      const profileScopeHeader = await this.#getProfileScopeHeader(\n        entropySourceId,\n        options?.useCanonicalScope,\n      );\n      const storageKey = await this.getStorageKey(entropySourceId);\n      const encryptedData = await encryption.encryptString(\n        data,\n        storageKey,\n        options?.nativeScryptCrypto,\n      );\n      const encryptedPath = createEntryPath(path, storageKey);\n\n      const url = new URL(STORAGE_URL(this.env, encryptedPath));\n\n      const response = await fetch(url.toString(), {\n        method: 'PUT',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n          ...profileScopeHeader,\n        },\n        body: JSON.stringify({ data: encryptedData }),\n      });\n\n      if (!response.ok) {\n        const responseBody: ErrorMessage = await response.json().catch(() => ({\n          message: 'unknown',\n          error: 'unknown',\n        }));\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n      throw new UserStorageError(\n        `failed to upsert user storage for path '${path}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #batchUpsertUserStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    data: [string, string][],\n    options?: UserStorageMethodOptions,\n  ): Promise<void> {\n    const entropySourceId = options?.entropySourceId;\n    try {\n      if (!data.length) {\n        return;\n      }\n\n      const headers = await this.#getAuthorizationHeader(entropySourceId);\n      const profileScopeHeader = await this.#getProfileScopeHeader(\n        entropySourceId,\n        options?.useCanonicalScope,\n      );\n      const storageKey = await this.getStorageKey(entropySourceId);\n\n      const encryptedData = await Promise.all(\n        data.map(async (d) => {\n          return [\n            this.#createEntryKey(d[0], storageKey),\n            await encryption.encryptString(\n              d[1],\n              storageKey,\n              options?.nativeScryptCrypto,\n            ),\n          ];\n        }),\n      );\n\n      const url = new URL(STORAGE_URL(this.env, path));\n\n      const response = await fetch(url.toString(), {\n        method: 'PUT',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n          ...profileScopeHeader,\n        },\n        body: JSON.stringify({ data: Object.fromEntries(encryptedData) }),\n      });\n\n      if (!response.ok) {\n        const responseBody: ErrorMessage = await response.json().catch(() => ({\n          message: 'unknown',\n          error: 'unknown',\n        }));\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n      throw new UserStorageError(\n        `failed to batch upsert user storage for path '${path}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #batchUpsertUserStorageWithAlreadyHashedAndEncryptedEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    encryptedData: [string, string][],\n    entropySourceId?: string,\n    useCanonicalScope?: boolean,\n  ): Promise<void> {\n    try {\n      const headers = await this.#getAuthorizationHeader(entropySourceId);\n      const profileScopeHeader = await this.#getProfileScopeHeader(\n        entropySourceId,\n        useCanonicalScope,\n      );\n\n      const url = new URL(STORAGE_URL(this.env, path));\n\n      const response = await fetch(url.toString(), {\n        method: 'PUT',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n          ...profileScopeHeader,\n        },\n        body: JSON.stringify({ data: Object.fromEntries(encryptedData) }),\n      });\n\n      // istanbul ignore next\n      if (!response.ok) {\n        const responseBody: ErrorMessage = await response.json().catch(() => ({\n          message: 'unknown',\n          error: 'unknown',\n        }));\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n      // istanbul ignore next\n      throw new UserStorageError(\n        `failed to batch upsert user storage for path '${path}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #getUserStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    options?: UserStorageMethodOptions,\n  ): Promise<string | null> {\n    const entropySourceId = options?.entropySourceId;\n    try {\n      const headers = await this.#getAuthorizationHeader(entropySourceId);\n      const storageKey = await this.getStorageKey(entropySourceId);\n      const encryptedPath = createEntryPath(path, storageKey);\n\n      const url = new URL(STORAGE_URL(this.env, encryptedPath));\n\n      const response = await fetch(url.toString(), {\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n      });\n\n      if (response.status === 404) {\n        return null;\n      }\n\n      if (!response.ok) {\n        const responseBody = (await response.json()) as ErrorMessage;\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n\n      const userStorage = await response.json();\n      const encryptedData = userStorage?.Data ?? null;\n\n      if (!encryptedData) {\n        return null;\n      }\n\n      const decryptedData = await encryption.decryptString(\n        encryptedData,\n        storageKey,\n        options?.nativeScryptCrypto,\n      );\n\n      // Re-encrypt the entry if it was encrypted with a random salt\n      const salt = encryption.getSalt(encryptedData);\n      if (salt.toString() !== SHARED_SALT.toString()) {\n        await this.#upsertUserStorage(path, decryptedData, options);\n      }\n\n      return decryptedData;\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n\n      throw new UserStorageError(\n        `failed to get user storage for path '${path}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #getUserStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    options?: UserStorageMethodOptions,\n  ): Promise<string[] | null> {\n    const entropySourceId = options?.entropySourceId;\n    try {\n      const headers = await this.#getAuthorizationHeader(entropySourceId);\n      const profileScopeHeader = await this.#getProfileScopeHeader(\n        entropySourceId,\n        options?.useCanonicalScope,\n      );\n      const storageKey = await this.getStorageKey(entropySourceId);\n\n      const url = new URL(STORAGE_URL(this.env, path));\n\n      const response = await fetch(url.toString(), {\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n          ...profileScopeHeader,\n        },\n      });\n\n      if (response.status === 404) {\n        return null;\n      }\n\n      if (!response.ok) {\n        const responseBody = (await response.json()) as ErrorMessage;\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n\n      const userStorage: GetUserStorageAllFeatureEntriesResponse | null =\n        await response.json();\n\n      if (!Array.isArray(userStorage)) {\n        return null;\n      }\n\n      const decryptedData: string[] = [];\n      const reEncryptedEntries: [string, string][] = [];\n\n      for (const entry of userStorage) {\n        if (!entry.Data) {\n          continue;\n        }\n\n        try {\n          const data = await encryption.decryptString(\n            entry.Data,\n            storageKey,\n            options?.nativeScryptCrypto,\n          );\n          decryptedData.push(data);\n\n          // Re-encrypt the entry was encrypted with a random salt\n          const salt = encryption.getSalt(entry.Data);\n          if (salt.toString() !== SHARED_SALT.toString()) {\n            reEncryptedEntries.push([\n              entry.HashedKey,\n              await encryption.encryptString(\n                data,\n                storageKey,\n                options?.nativeScryptCrypto,\n              ),\n            ]);\n          }\n        } catch {\n          // do nothing\n        }\n      }\n\n      // Re-upload the re-encrypted entries\n      if (reEncryptedEntries.length) {\n        await this.#batchUpsertUserStorageWithAlreadyHashedAndEncryptedEntries(\n          path,\n          reEncryptedEntries,\n          entropySourceId,\n          options?.useCanonicalScope,\n        );\n      }\n\n      return decryptedData;\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n\n      throw new UserStorageError(\n        `failed to get user storage for path '${path}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #deleteUserStorage(\n    path: UserStorageGenericPathWithFeatureAndKey,\n    options?: UserStorageMethodOptions,\n  ): Promise<void> {\n    const entropySourceId = options?.entropySourceId;\n    try {\n      const headers = await this.#getAuthorizationHeader(entropySourceId);\n      const storageKey = await this.getStorageKey(entropySourceId);\n      const encryptedPath = createEntryPath(path, storageKey);\n\n      const url = new URL(STORAGE_URL(this.env, encryptedPath));\n\n      const response = await fetch(url.toString(), {\n        method: 'DELETE',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n      });\n\n      if (response.status === 404) {\n        throw new NotFoundError(\n          `feature/key set not found for path '${path}'.`,\n        );\n      }\n\n      if (!response.ok) {\n        const responseBody = (await response.json()) as ErrorMessage;\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      if (e instanceof NotFoundError) {\n        throw e;\n      }\n\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n\n      throw new UserStorageError(\n        `failed to delete user storage for path '${path}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #deleteUserStorageAllFeatureEntries(\n    path: UserStorageGenericPathWithFeatureOnly,\n    options?: UserStorageMethodOptions,\n  ): Promise<void> {\n    try {\n      const entropySourceId = options?.entropySourceId;\n      const headers = await this.#getAuthorizationHeader(entropySourceId);\n      const profileScopeHeader = await this.#getProfileScopeHeader(\n        entropySourceId,\n        options?.useCanonicalScope,\n      );\n\n      const url = new URL(STORAGE_URL(this.env, path));\n\n      const response = await fetch(url.toString(), {\n        method: 'DELETE',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n          ...profileScopeHeader,\n        },\n      });\n\n      if (response.status === 404) {\n        throw new NotFoundError(`feature not found for path '${path}'.`);\n      }\n\n      if (!response.ok) {\n        const responseBody = (await response.json()) as ErrorMessage;\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      if (e instanceof NotFoundError) {\n        throw e;\n      }\n\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n\n      throw new UserStorageError(\n        `failed to delete user storage for path '${path}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  async #batchDeleteUserStorage(\n    path: UserStorageGenericPathWithFeatureOnly,\n    keysToDelete: string[],\n    options?: UserStorageMethodOptions,\n  ): Promise<void> {\n    try {\n      if (!keysToDelete.length) {\n        return;\n      }\n\n      const entropySourceId = options?.entropySourceId;\n      const headers = await this.#getAuthorizationHeader(entropySourceId);\n      const storageKey = await this.getStorageKey(entropySourceId);\n\n      const rawEntryKeys = keysToDelete.map((d) =>\n        this.#createEntryKey(d, storageKey),\n      );\n\n      const url = new URL(STORAGE_URL(this.env, path));\n\n      const response = await fetch(url.toString(), {\n        method: 'PUT',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n\n        body: JSON.stringify({ batch_delete: rawEntryKeys }),\n      });\n\n      if (!response.ok) {\n        const responseBody: ErrorMessage = await response.json().catch(() => ({\n          message: 'unknown',\n          error: 'unknown',\n        }));\n        throw new Error(\n          `HTTP error message: ${responseBody.message}, error: ${responseBody.error}`,\n        );\n      }\n    } catch (e) {\n      /* istanbul ignore next */\n      const errorMessage =\n        e instanceof Error ? e.message : JSON.stringify(e ?? '');\n      throw new UserStorageError(\n        `failed to batch delete user storage for path '${path}'. ${errorMessage}`,\n      );\n    }\n  }\n\n  #createEntryKey(key: string, storageKey: string): string {\n    return createSHA256Hash(key + storageKey);\n  }\n\n  async #getAuthorizationHeader(\n    entropySourceId?: string,\n  ): Promise<{ Authorization: string }> {\n    const accessToken = await this.config.auth.getAccessToken(entropySourceId);\n    return { Authorization: `Bearer ${accessToken}` };\n  }\n\n  async #getProfileScopeHeader(\n    entropySourceId?: string,\n    useCanonicalScope?: boolean,\n  ): Promise<Record<string, string>> {\n    if (useCanonicalScope) {\n      return {};\n    }\n    const profile = await this.config.auth.getUserProfile(entropySourceId);\n    if (profile.profileId !== profile.canonicalProfileId) {\n      // After SRP pairing the JWT `sub` is the canonical profile id, but\n      // user storage data is still keyed by the original per-SRP profileId.\n      // The `x-profile-id` header tells the backend to scope reads/writes to\n      // that alias partition until ADR 0005 migrates storage keys to canonical.\n      return { 'x-profile-id': profile.profileId };\n    }\n    return {};\n  }\n}\n"]}

package/dist/sdk/utils/{eip-6963-metamask-provider.d.cts → eip-6963-metamask-provider.d.ts}

@@ -1,4 +1,4 @@
-import type { Eip1193Provider } from "ethers";
+import type { Eip1193Provider } from 'ethers';
 export type AnnounceProviderEventDetail = {
     info?: {
         rdns?: string;
@@ -22,4 +22,4 @@ type MetaMaskClientType = 'any' | MetamaskClientRdnsKey;
  */
 export declare function getMetaMaskProviderEIP6963(type?: MetaMaskClientType): Promise<Eip1193Provider | null>;
 export {};
-//# sourceMappingURL=eip-6963-metamask-provider.d.cts.map
+//# sourceMappingURL=eip-6963-metamask-provider.d.ts.map

package/dist/sdk/utils/eip-6963-metamask-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip-6963-metamask-provider.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/eip-6963-metamask-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAG9C,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,2BAA2B,CAAC,CAAC;AAE7E,eAAO,MAAM,mBAAmB;IAC9B,IAAI;IACJ,KAAK;IACL,aAAa;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAErE,KAAK,kBAAkB,GAAG,KAAK,GAAG,qBAAqB,CAAC;AAKxD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,GAAE,kBAA0B,GAC/B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA2DjC"}

package/dist/sdk/utils/{eip-6963-metamask-provider.mjs → eip-6963-metamask-provider.js}

@@ -63,4 +63,4 @@ export function getMetaMaskProviderEIP6963(type = 'any') {
         }, 100);
     });
 }
-//# sourceMappingURL=eip-6963-metamask-provider.mjs.map
+//# sourceMappingURL=eip-6963-metamask-provider.js.map

package/dist/sdk/utils/eip-6963-metamask-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eip-6963-metamask-provider.js","sourceRoot":"","sources":["../../../src/sdk/utils/eip-6963-metamask-provider.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,mBAAmB;IAC1B,aAAa,EAAE,iBAAiB;CACjC,CAAC;AAMF,oFAAoF;AACpF,MAAM,aAAa,GAAyD,EAAE,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAAI,GAAuB,KAAK;IAEhC,OAAO,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,IAAI,KAAK,KAAK,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,cAAc,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAkD,EAAE,CAAC;QAEpE,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAE,EAAE;YAC7C,MAAM,UAAU,GAAG,KAAiD,CAAC;YACrE,MAAM,cAAc,GAAG,UAAU,EAAE,MAAM,CAAC;YAC1C,IAAI,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC3D,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI;oBAChC,QAAQ,EAAE,cAAc,EAAE,QAAQ;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;QACzE,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAE3D;;;WAGG;QACH,UAAU,CAAC,GAAG,EAAE;YACd,2BAA2B;YAC3B,MAAM,CAAC,mBAAmB,CACxB,0BAA0B,EAC1B,mBAAmB,CACpB,CAAC;YAEF,IAAI,QAAgC,CAAC;YACrC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,qCAAqC;gBACrC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBAC3D,QAAQ;oBACN,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ;wBACjE,IAAI,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBAC/C,QAAQ;oBACN,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;YACrE,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,aAAa,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;YACjC,CAAC;YACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\n// We can isolate and create a metamask function/closure\nexport type AnnounceProviderEventDetail = {\n  info?: { rdns?: string };\n  provider?: Eip1193Provider;\n};\nexport type AnnounceProviderEvent = CustomEvent<AnnounceProviderEventDetail>;\n\nexport const metamaskClientsRdns = {\n  main: 'io.metamask',\n  flask: 'io.metamask.flask',\n  institutional: 'io.metamask.mmi',\n};\n\nexport type MetamaskClientRdnsKey = keyof typeof metamaskClientsRdns;\n\ntype MetaMaskClientType = 'any' | MetamaskClientRdnsKey;\n\n// Cache, as when the function is recalled, we can reuse instead of continue waiting\nconst providerCache: Partial<Record<MetaMaskClientType, Eip1193Provider>> = {};\n\n/**\n * This uses EIP6963 to find all metamask accounts and returns the first matching provider\n * the consumer requests (main, flask, institutional, or any)\n *\n * @param type - the MetaMask Wallet type (main, flask, institutional, or any)\n * @returns a ethers provider so you can make requests to that specific wallet\n */\nexport function getMetaMaskProviderEIP6963(\n  type: MetaMaskClientType = 'any',\n): Promise<Eip1193Provider | null> {\n  return new Promise<Eip1193Provider | null>((resolve) => {\n    if (type !== 'any' && metamaskClientsRdns[type] === undefined) {\n      resolve(null);\n      return;\n    }\n\n    const cachedProvider = providerCache[type];\n    if (cachedProvider) {\n      resolve(cachedProvider);\n      return;\n    }\n\n    const providers: { rdns: string; provider: Eip1193Provider }[] = [];\n\n    const handleProviderEvent = (event: unknown) => {\n      const typedEvent = event as CustomEvent<AnnounceProviderEventDetail>;\n      const providerDetail = typedEvent?.detail;\n      if (providerDetail?.provider && providerDetail?.info?.rdns) {\n        providers.push({\n          rdns: providerDetail?.info?.rdns,\n          provider: providerDetail?.provider,\n        });\n      }\n    };\n\n    window.addEventListener('eip6963:announceProvider', handleProviderEvent);\n    window.dispatchEvent(new Event('eip6963:requestProvider'));\n\n    /**\n     * It may take some time for the events to be emitted from the different wallets.\n     * So waiting a small period of time before we use the collected events.\n     */\n    setTimeout(() => {\n      // remove attached listener\n      window.removeEventListener(\n        'eip6963:announceProvider',\n        handleProviderEvent,\n      );\n\n      let provider: Eip1193Provider | null;\n      if (type === 'any') {\n        // return the first MM client we find\n        const metamaskClients = Object.values(metamaskClientsRdns);\n        provider =\n          providers.find((p) => metamaskClients.includes(p.rdns))?.provider ??\n          null;\n      } else {\n        const metamaskRdns = metamaskClientsRdns[type];\n        provider =\n          providers.find((p) => p.rdns === metamaskRdns)?.provider ?? null;\n      }\n\n      if (provider) {\n        providerCache[type] = provider;\n      }\n      return resolve(provider);\n    }, 100);\n  });\n}\n"]}

package/dist/sdk/utils/{messaging-signing-snap-requests.d.mts → messaging-signing-snap-requests.d.ts}

@@ -1,4 +1,4 @@
-import type { Eip1193Provider } from "ethers";
+import type { Eip1193Provider } from 'ethers';
 export type Snap = {
     permissionName: string;
     id: string;
@@ -38,4 +38,4 @@ export declare const MESSAGE_SIGNING_SNAP: {
  * @param message - The message to check.
  */
 export declare function assertMessageStartsWithMetamask(message: string): asserts message is `metamask:${string}`;
-//# sourceMappingURL=messaging-signing-snap-requests.d.mts.map
+//# sourceMappingURL=messaging-signing-snap-requests.d.ts.map

package/dist/sdk/utils/messaging-signing-snap-requests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messaging-signing-snap-requests.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/messaging-signing-snap-requests.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAE9C,MAAM,MAAM,IAAI,GAAG;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAEpD,eAAO,MAAM,WAAW,uCAAuC,CAAC;AAEhE;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5E;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,eAAO,MAAM,oBAAoB;IACzB,YAAY,WAAW,eAAe,oBAAoB,MAAM;IAehE,WAAW,WACL,eAAe,WAChB,YAAY,MAAM,EAAE,oBACX,MAAM;CAkB3B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,IAAI,YAAY,MAAM,EAAE,CAIzC"}

package/dist/sdk/utils/{messaging-signing-snap-requests.mjs → messaging-signing-snap-requests.js}

@@ -86,4 +86,4 @@ export function assertMessageStartsWithMetamask(message) {
         throw new Error('Message must start with "metamask:"');
     }
 }
-//# sourceMappingURL=messaging-signing-snap-requests.mjs.map
+//# sourceMappingURL=messaging-signing-snap-requests.js.map

package/dist/sdk/utils/messaging-signing-snap-requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messaging-signing-snap-requests.js","sourceRoot":"","sources":["../../../src/sdk/utils/messaging-signing-snap-requests.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,WAAW,GAAG,oCAAoC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAyB;IACzD,MAAM,MAAM,GAAW,MAAM,QAAQ,CAAC,OAAO,CAAC;QAC5C,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE;YACN,CAAC,WAAW,CAAC,EAAE,EAAE;SAClB;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAAyB;IAEzB,MAAM,MAAM,GAAqB,MAAM,QAAQ,CAAC,OAAO,CAAC;QACtD,MAAM,EAAE,iBAAiB;KAC1B,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,KAAK,CAAC,YAAY,CAAC,QAAyB,EAAE,eAAwB;QACpE,MAAM,SAAS,GAAW,MAAM,QAAQ,CAAC,OAAO,CAAC;YAC/C,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE;gBACN,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE;oBACP,MAAM,EAAE,cAAc;oBACtB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5D;aACF;SACF,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,WAAW,CACf,QAAyB,EACzB,OAA6B,EAC7B,eAAwB;QAExB,MAAM,aAAa,GAAW,MAAM,QAAQ,EAAE,OAAO,CAAC;YACpD,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE;gBACN,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE;oBACP,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE;wBACN,OAAO;wBACP,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChD;iBACF;aACF;SACF,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAAe;IAEf,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC","sourcesContent":["import type { Eip1193Provider } from 'ethers';\n\nexport type Snap = {\n  permissionName: string;\n  id: string;\n  version: string;\n  initialPermissions: Record<string, unknown>;\n};\nexport type GetSnapsResponse = Record<string, Snap>;\n\nexport const SNAP_ORIGIN = 'npm:@metamask/message-signing-snap';\n\n/**\n * Requests Connection to the Message Signing Snap\n *\n * @param provider - MetaMask Wallet Provider\n * @returns snap connect result\n */\nexport async function connectSnap(provider: Eip1193Provider): Promise<string> {\n  const result: string = await provider.request({\n    method: 'wallet_requestSnaps',\n    params: {\n      [SNAP_ORIGIN]: {},\n    },\n  });\n\n  return result;\n}\n\n/**\n * Gets Snaps from a MetaMask Wallet\n *\n * @param provider - MetaMask Wallet Provider\n * @returns All currently installed snaps.\n */\nexport async function getSnaps(\n  provider: Eip1193Provider,\n): Promise<GetSnapsResponse> {\n  const result: GetSnapsResponse = await provider.request({\n    method: 'wallet_getSnaps',\n  });\n\n  return result;\n}\n\n/**\n * Check if snap is connected\n *\n * @param provider - MetaMask Wallet Provider\n * @returns if snap is connected\n */\nexport async function isSnapConnected(\n  provider: Eip1193Provider,\n): Promise<boolean> {\n  try {\n    const snaps = await getSnaps(provider);\n    if (!snaps) {\n      return false;\n    }\n    return Object.keys(snaps).includes(SNAP_ORIGIN);\n  } catch (e) {\n    console.error('Failed to determine if snap is connected', e);\n    return false;\n  }\n}\n\nexport const MESSAGE_SIGNING_SNAP = {\n  async getPublicKey(provider: Eip1193Provider, entropySourceId?: string) {\n    const publicKey: string = await provider.request({\n      method: 'wallet_invokeSnap',\n      params: {\n        snapId: SNAP_ORIGIN,\n        request: {\n          method: 'getPublicKey',\n          ...(entropySourceId ? { params: { entropySourceId } } : {}),\n        },\n      },\n    });\n\n    return publicKey;\n  },\n\n  async signMessage(\n    provider: Eip1193Provider,\n    message: `metamask:${string}`,\n    entropySourceId?: string,\n  ) {\n    const signedMessage: string = await provider?.request({\n      method: 'wallet_invokeSnap',\n      params: {\n        snapId: SNAP_ORIGIN,\n        request: {\n          method: 'signMessage',\n          params: {\n            message,\n            ...(entropySourceId ? { entropySourceId } : {}),\n          },\n        },\n      },\n    });\n\n    return signedMessage;\n  },\n};\n\n/**\n * Asserts that a message starts with \"metamask:\"\n *\n * @param message - The message to check.\n */\nexport function assertMessageStartsWithMetamask(\n  message: string,\n): asserts message is `metamask:${string}` {\n  if (!message.startsWith('metamask:')) {\n    throw new Error('Message must start with \"metamask:\"');\n  }\n}\n"]}

package/dist/sdk/utils/{validate-login-response.d.mts → validate-login-response.d.ts}

@@ -1,4 +1,4 @@
-import type { LoginResponse } from "../authentication.mjs";
+import type { LoginResponse } from '../authentication.js';
 /**
  * Validates that the input is a well-formed, non-expired LoginResponse.
  *
@@ -11,4 +11,4 @@ import type { LoginResponse } from "../authentication.mjs";
  * @returns boolean if input is a valid, non-expired LoginResponse
  */
 export declare function validateLoginResponse(input: unknown): input is LoginResponse;
-//# sourceMappingURL=validate-login-response.d.mts.map
+//# sourceMappingURL=validate-login-response.d.ts.map

package/dist/sdk/utils/validate-login-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-login-response.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAgB5E"}

package/dist/sdk/utils/{validate-login-response.mjs → validate-login-response.js}

@@ -42,4 +42,4 @@ function isJwtExpired(token) {
         return true;
     }
 }
-//# sourceMappingURL=validate-login-response.mjs.map
+//# sourceMappingURL=validate-login-response.js.map

package/dist/sdk/utils/validate-login-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-login-response.js","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,YAAY,GAAG,KAAsB,CAAC;IAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { LoginResponse } from '../authentication.js';\n\n/**\n * Validates that the input is a well-formed, non-expired LoginResponse.\n *\n * Checks structural shape (token + profile objects exist) and verifies\n * the JWT access token's `exp` claim is still in the future. This acts\n * as a hard guard against stale cached tokens regardless of client-side\n * TTL tracking (obtainedAt / expiresIn), which can be corrupted.\n *\n * @param input - unknown/untyped input\n * @returns boolean if input is a valid, non-expired LoginResponse\n */\nexport function validateLoginResponse(input: unknown): input is LoginResponse {\n  const assumedInput = input as LoginResponse;\n\n  if (!assumedInput) {\n    return false;\n  }\n\n  if (!assumedInput?.token || !assumedInput?.profile) {\n    return false;\n  }\n\n  if (isJwtExpired(assumedInput.token.accessToken)) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Checks whether a JWT has expired by decoding its `exp` claim.\n *\n * @param token - A JWT string.\n * @returns true if the token is expired or cannot be decoded; false if still valid.\n */\nfunction isJwtExpired(token: string): boolean {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      return true;\n    }\n    const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');\n    const { exp } = JSON.parse(atob(base64));\n    return !Number.isInteger(exp) || exp * 1000 <= Date.now();\n  } catch {\n    return true;\n  }\n}\n"]}

package/dist/sdk/utils/{validate-pair-response.d.cts → validate-pair-response.d.ts}

@@ -23,4 +23,4 @@ export type RawPairResponse = {
  */
 export declare function validatePairResponse(input: unknown): asserts input is RawPairResponse;
 export {};
-//# sourceMappingURL=validate-pair-response.d.cts.map
+//# sourceMappingURL=validate-pair-response.d.ts.map

package/dist/sdk/utils/validate-pair-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-pair-response.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-pair-response.ts"],"names":[],"mappings":"AAEA,KAAK,eAAe,GAAG;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,eAAe,CAAC,EAAE,eAAe,EAAE,CAAC;CACrC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,eAAe,CAwBlC"}

package/dist/sdk/utils/{validate-pair-response.mjs → validate-pair-response.js}

@@ -22,4 +22,4 @@ export function validatePairResponse(input) {
         throw new Error('validatePairResponse: profile.identifier_id is missing or empty');
     }
 }
-//# sourceMappingURL=validate-pair-response.mjs.map
+//# sourceMappingURL=validate-pair-response.js.map

package/dist/sdk/utils/validate-pair-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-pair-response.js","sourceRoot":"","sources":["../../../src/sdk/utils/validate-pair-response.ts"],"names":[],"mappings":"AAAA,yDAAyD;AAiBzD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAG,KAAgC,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAA8C,CAAC;IACvE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/* eslint-disable @typescript-eslint/naming-convention */\n\ntype RawProfileAlias = {\n  alias_profile_id: string;\n  canonical_profile_id: string;\n  identifier_ids: { id: string; type: string }[];\n};\n\nexport type RawPairResponse = {\n  profile: {\n    profile_id: string;\n    identifier_id: string;\n    metametrics_id?: string;\n  };\n  profile_aliases?: RawProfileAlias[];\n};\n\n/**\n * Asserts that the raw API response from the profile pairing endpoint has the\n * expected shape before we attempt to map it into a `PairProfilesResponse`.\n * Throws if the response is malformed.\n *\n * @param input - The raw JSON parsed from the pair endpoint response body.\n */\nexport function validatePairResponse(\n  input: unknown,\n): asserts input is RawPairResponse {\n  if (!input || typeof input !== 'object') {\n    throw new Error('validatePairResponse: input is not an object');\n  }\n\n  const assumed = input as Record<string, unknown>;\n  const profile = assumed.profile as Record<string, unknown> | undefined;\n  if (!profile || typeof profile !== 'object') {\n    throw new Error(\n      'validatePairResponse: profile is missing or not an object',\n    );\n  }\n\n  if (typeof profile.profile_id !== 'string' || !profile.profile_id) {\n    throw new Error(\n      'validatePairResponse: profile.profile_id is missing or empty',\n    );\n  }\n\n  if (typeof profile.identifier_id !== 'string' || !profile.identifier_id) {\n    throw new Error(\n      'validatePairResponse: profile.identifier_id is missing or empty',\n    );\n  }\n}\n"]}

package/dist/shared/encryption/{cache.d.cts → cache.d.ts}

@@ -29,4 +29,4 @@ export declare function getCachedKeyGeneratedWithSharedSalt(hashedPassword: stri
  */
 export declare function setCachedKey(hashedPassword: string, salt: Uint8Array, key: Uint8Array): void;
 export {};
-//# sourceMappingURL=cache.d.cts.map
+//# sourceMappingURL=cache.d.ts.map

package/dist/shared/encryption/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":"AAGA,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAiBF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,GACf,WAAW,GAAG,SAAS,CAazB;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,GACrB,WAAW,GAAG,SAAS,CAczB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,GACd,IAAI,CAeN"}

package/dist/shared/encryption/{cache.mjs → cache.js}

@@ -1,10 +1,10 @@
-import { SHARED_SALT } from "./constants.mjs";
-import { byteArrayToBase64 } from "./utils.mjs";
+import { SHARED_SALT } from './constants.js';
+import { byteArrayToBase64 } from './utils.js';
 const MAX_PASSWORD_CACHES = 100;
 const MAX_SALT_CACHES = 100;
 let inMemCachedKDF = {};
 const getPasswordCache = (hashedPassword) => {
-    inMemCachedKDF[hashedPassword] ?? (inMemCachedKDF[hashedPassword] = new Map());
+    inMemCachedKDF[hashedPassword] ??= new Map();
     return inMemCachedKDF[hashedPassword];
 };
 /**
@@ -68,4 +68,4 @@ export function setCachedKey(hashedPassword, salt, key) {
     }
     cache.set(base64Salt, key);
 }
-//# sourceMappingURL=cache.mjs.map
+//# sourceMappingURL=cache.js.map

package/dist/shared/encryption/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAQ/C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,eAAe,GAAG,GAAG,CAAC;AAQ5B,IAAI,cAAc,GAAyB,EAAE,CAAC;AAC9C,MAAM,gBAAgB,GAAG,CAAC,cAAsB,EAAE,EAAE;IAClD,cAAc,CAAC,cAAc,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;IAC7C,OAAO,cAAc,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAAsB,EACtB,IAAgB;IAEhB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI;QACJ,UAAU;QACV,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB;IAEtB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,UAAU;QACV,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,cAAsB,EACtB,IAAgB,EAChB,GAAe;IAEf,sBAAsB;IACtB,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC7D,cAAc,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE3C,kBAAkB;IAClB,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;QACjC,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC","sourcesContent":["import { SHARED_SALT } from './constants.js';\nimport { byteArrayToBase64 } from './utils.js';\n\ntype CachedEntry = {\n  salt: Uint8Array;\n  base64Salt: string;\n  key: Uint8Array;\n};\n\nconst MAX_PASSWORD_CACHES = 100;\nconst MAX_SALT_CACHES = 100;\n\n/**\n * In-Memory Caching derived keys based from a given salt and password.\n */\ntype PasswordMemCachedKDF = {\n  [hashedPassword: string]: Map<string, Uint8Array>;\n};\nlet inMemCachedKDF: PasswordMemCachedKDF = {};\nconst getPasswordCache = (hashedPassword: string) => {\n  inMemCachedKDF[hashedPassword] ??= new Map();\n  return inMemCachedKDF[hashedPassword];\n};\n\n/**\n * Returns a given cached derived key from a hashed password and salt\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - provide salt to receive cached key\n * @returns cached key\n */\nexport function getCachedKeyBySalt(\n  hashedPassword: string,\n  salt: Uint8Array,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n  const cachedKey = cache.get(base64Salt);\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Gets the cached key that was generated without a salt, if it exists.\n * This is unique per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @returns the cached key\n */\nexport function getCachedKeyGeneratedWithSharedSalt(\n  hashedPassword: string,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(SHARED_SALT);\n  const cachedKey = cache.get(base64Salt);\n\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt: SHARED_SALT,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Sets a key to the in memory cache.\n * We have set an arbitrary size of 10 cached keys per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - salt to set new derived key\n * @param key - derived key we are setting\n */\nexport function setCachedKey(\n  hashedPassword: string,\n  salt: Uint8Array,\n  key: Uint8Array,\n): void {\n  // Max password caches\n  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {\n    inMemCachedKDF = {};\n  }\n\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n\n  // Max salt caches\n  if (cache.size > MAX_SALT_CACHES) {\n    cache.clear();\n  }\n\n  cache.set(base64Salt, key);\n}\n"]}

package/dist/shared/encryption/{constants.d.cts → constants.d.ts}

@@ -4,6 +4,6 @@ export declare const SCRYPT_SALT_SIZE = 16;
 export declare const SCRYPT_N: number;
 export declare const SCRYPT_r = 8;
 export declare const SCRYPT_p = 1;
-export declare const SHARED_SALT: Uint8Array;
+export declare const SHARED_SALT: Uint8Array<ArrayBuffer>;
 export declare const MAX_KDF_PROMISE_CACHE_SIZE = 20;
-//# sourceMappingURL=constants.d.cts.map
+//# sourceMappingURL=constants.d.ts.map