@metamask/profile-sync-controller 30.0.0 → 31.0.0

package/dist/controllers/authentication/AuthenticationController.mjs

@@ -1,592 +0,0 @@
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var _AuthenticationController_instances, _AuthenticationController_metametrics, _AuthenticationController_auth, _AuthenticationController_config, _AuthenticationController_isUnlocked, _AuthenticationController_profilePairingRequestEpoch, _AuthenticationController_keyringController, _AuthenticationController_getLoginResponseFromState, _AuthenticationController_setLoginResponseToState, _AuthenticationController_assertIsUnlocked, _AuthenticationController_getHdKeyringEntropySourceIds, _AuthenticationController_getPrimaryEntropySourceId, _AuthenticationController_getLoginTag, _AuthenticationController_getLoginIdentifierType, _AuthenticationController_resolveSocialIdentifierType, _AuthenticationController_identifierTypeFromSeedlessState, _AuthenticationController_trySocialPairing, _AuthenticationController_clearNeedsSocialPairing, _AuthenticationController_tryClearNeedsProfilePairing, _AuthenticationController_doPair, _AuthenticationController_pairSrpProfiles, _AuthenticationController_propagateCanonical, _AuthenticationController_getCanonicalProfileId, _AuthenticationController_invalidateSrpSession, _AuthenticationController_getHdKeyringSeed, _AuthenticationController_getPublicKey, _AuthenticationController__signMessageCache, _AuthenticationController_scopedCacheKey, _AuthenticationController_signMessage;
-import { BaseController } from "@metamask/base-controller";
-import { assertMessageStartsWithMetamask, AuthType, Env, JwtBearerAuth, PairConflictError } from "../../sdk/index.mjs";
-import { getHdKeyringEntropySourceIds, getPrimaryHdKeyringEntropySourceId } from "../../shared/utils/entropy-source.mjs";
-import { getHdKeyringSeed } from "../../shared/utils/hd-keyring-seed.mjs";
-import { getMessageSigningPublicKey, signMessageWithMessageSigningKey } from "../../shared/utils/message-signing.mjs";
-const controllerName = 'AuthenticationController';
-export const defaultState = {
-    isSignedIn: false,
-    needsProfilePairing: true,
-    needsSocialPairing: true,
-};
-const metadata = {
-    isSignedIn: {
-        includeInStateLogs: true,
-        persist: true,
-        includeInDebugSnapshot: true,
-        usedInUi: true,
-    },
-    needsProfilePairing: {
-        includeInStateLogs: true,
-        persist: true,
-        includeInDebugSnapshot: true,
-        usedInUi: true,
-    },
-    needsSocialPairing: {
-        includeInStateLogs: true,
-        persist: true,
-        includeInDebugSnapshot: true,
-        usedInUi: true,
-    },
-    srpSessionData: {
-        // Remove access token from state logs
-        includeInStateLogs: (srpSessionData) => {
-            // Unreachable branch, included just to fix a type error for the case where this property is
-            // unset. The type gets collapsed to include `| undefined` even though `undefined` is never
-            // set here, because we don't yet use `exactOptionalPropertyTypes`.
-            // TODO: Remove branch after enabling `exactOptionalPropertyTypes`
-            // ref: https://github.com/MetaMask/core/issues/6565
-            if (srpSessionData === null || srpSessionData === undefined) {
-                return null;
-            }
-            return Object.entries(srpSessionData).reduce((sanitizedSrpSessionData, [key, value]) => {
-                const { accessToken: _unused, ...tokenWithoutAccessToken } = value.token;
-                sanitizedSrpSessionData[key] = {
-                    ...value,
-                    token: tokenWithoutAccessToken,
-                };
-                return sanitizedSrpSessionData;
-            }, {});
-        },
-        persist: true,
-        includeInDebugSnapshot: false,
-        usedInUi: true,
-    },
-};
-const MESSENGER_EXPOSED_METHODS = [
-    'performSignIn',
-    'performSignOut',
-    'getBearerToken',
-    'getSessionProfile',
-    'refreshCanonicalProfileId',
-    'getUserProfileLineage',
-    'getCustomerServiceToken',
-    'isSignedIn',
-    'requestProfilePairing',
-];
-/**
- * Controller that enables authentication for restricted endpoints.
- * Used for Backup & Sync, Notifications, and other services.
- */
-export class AuthenticationController extends BaseController {
-    constructor({ messenger, state, config, metametrics, }) {
-        super({
-            messenger,
-            metadata,
-            name: controllerName,
-            state: { ...defaultState, ...state },
-        });
-        _AuthenticationController_instances.add(this);
-        _AuthenticationController_metametrics.set(this, void 0);
-        _AuthenticationController_auth.set(this, void 0);
-        _AuthenticationController_config.set(this, {
-            env: Env.PRD,
-            isSocialPairingEnabled: () => false,
-        });
-        _AuthenticationController_isUnlocked.set(this, false);
-        // Bumped by `requestProfilePairing`. `performSignIn` snapshots this
-        // before its first await; if it changes mid-flight we must NOT clear
-        // `needsProfilePairing` (the rearm signal wins).
-        _AuthenticationController_profilePairingRequestEpoch.set(this, 0);
-        _AuthenticationController_keyringController.set(this, {
-            setupLockedStateSubscriptions: () => {
-                const { isUnlocked } = this.messenger.call('KeyringController:getState');
-                __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, isUnlocked, "f");
-                this.messenger.subscribe('KeyringController:unlock', () => {
-                    __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, true, "f");
-                });
-                this.messenger.subscribe('KeyringController:lock', () => {
-                    __classPrivateFieldSet(this, _AuthenticationController_isUnlocked, false, "f");
-                });
-            },
-        });
-        _AuthenticationController__signMessageCache.set(this, {});
-        if (!metametrics) {
-            throw new Error('`metametrics` field is required');
-        }
-        __classPrivateFieldSet(this, _AuthenticationController_config, {
-            ...__classPrivateFieldGet(this, _AuthenticationController_config, "f"),
-            ...config,
-            isSocialPairingEnabled: config?.isSocialPairingEnabled ?? __classPrivateFieldGet(this, _AuthenticationController_config, "f").isSocialPairingEnabled,
-        }, "f");
-        __classPrivateFieldSet(this, _AuthenticationController_metametrics, metametrics, "f");
-        __classPrivateFieldSet(this, _AuthenticationController_auth, new JwtBearerAuth({
-            env: __classPrivateFieldGet(this, _AuthenticationController_config, "f").env,
-            platform: metametrics.agent,
-            type: AuthType.SRP,
-        }, {
-            storage: {
-                getLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginResponseFromState).bind(this),
-                setLoginResponse: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_setLoginResponseToState).bind(this),
-            },
-            signing: {
-                getIdentifier: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPublicKey).bind(this),
-                signMessage: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_signMessage).bind(this),
-            },
-            getLoginTag: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginTag).bind(this),
-            getLoginIdentifierType: __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getLoginIdentifierType).bind(this),
-            metametrics: __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f"),
-        }), "f");
-        __classPrivateFieldGet(this, _AuthenticationController_keyringController, "f").setupLockedStateSubscriptions();
-        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
-    }
-    async performSignIn() {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'performSignIn');
-        const epochAtStart = __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f");
-        const entropySourceIds = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringEntropySourceIds).call(this);
-        const accessTokens = [];
-        // We iterate sequentially in order to be sure that the first entry
-        // is the primary SRP LoginResponse.
-        for (const entropySourceId of entropySourceIds) {
-            const accessToken = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(entropySourceId);
-            accessTokens.push(accessToken);
-        }
-        if (entropySourceIds.length < 2) {
-            // Single-SRP wallet: nothing to pair.
-            __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
-        }
-        else {
-            // Pair failures must not break sign-in; the gate stays `true` for retry.
-            try {
-                await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_doPair).call(this, accessTokens, epochAtStart);
-            }
-            catch {
-                // noop
-            }
-        }
-        try {
-            await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_trySocialPairing).call(this, accessTokens[0]);
-        }
-        catch {
-            // noop
-        }
-        return accessTokens;
-    }
-    /**
-     * Marks profile pairing as needed. Clients call this when the SRP set
-     * changes (e.g. a new keyring was added) so the next auto-sign-in cycle
-     * re-runs `performSignIn` and re-pairs.
-     */
-    requestProfilePairing() {
-        __classPrivateFieldSet(this, _AuthenticationController_profilePairingRequestEpoch, __classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") + 1, "f");
-        if (!this.state.needsProfilePairing) {
-            this.update((state) => {
-                state.needsProfilePairing = true;
-            });
-        }
-    }
-    performSignOut() {
-        this.update((state) => {
-            state.isSignedIn = false;
-            state.srpSessionData = undefined;
-        });
-    }
-    /**
-     * Returns a bearer token for the specified SRP, logging in if needed.
-     *
-     * When called without `entropySourceId`, returns the primary (first) SRP's
-     * access token, which is effectively the canonical
-     * profile's token that can be used by alias-aware consumers for cross-SRP
-     * operations.
-     *
-     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
-     * @returns The OIDC access token.
-     */
-    async getBearerToken(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getBearerToken');
-        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(resolvedId);
-    }
-    /**
-     * Returns the cached session profile, logging in if no session exists.
-     *
-     * The returned `canonicalProfileId` reflects the value from the most recent
-     * login or pairing. In the rare event where a canonical changed because of
-     * a pairing that happened on another device, the cached value may be stale
-     * until the next login. For guaranteed freshness, call
-     * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.
-     *
-     * @param entropySourceId - The entropy source ID used to derive the key,
-     * when multiple sources are available (Multi-SRP).
-     * @returns profile for the session.
-     */
-    async getSessionProfile(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getSessionProfile');
-        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfile(resolvedId);
-    }
-    /**
-     * Forces a fresh retrieval of the canonical profile ID from the server
-     * and propagates it to all cached SRP sessions.
-     *
-     * This method invalidates the primary SRP's cached session and forces a
-     * re-login. Use it before operations that require a guaranteed-fresh
-     * canonical (e.g. storage key derivation for Accounts ADR 0005). For
-     * best-effort reads, use
-     * `getSessionProfile().canonicalProfileId` instead.
-     *
-     * Only the primary SRP is re-logged-in regardless of how many SRPs exist —
-     * the server returns the current canonical for the entire pairing group
-     * from any single SRP login.
-     *
-     * @returns The refreshed canonical profile ID.
-     */
-    async refreshCanonicalProfileId() {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'refreshCanonicalProfileId');
-        const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_invalidateSrpSession).call(this, primaryEntropySourceId);
-        await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getAccessToken(primaryEntropySourceId);
-        const canonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-        if (!canonical) {
-            throw new Error('refreshCanonicalProfileId - Unable to resolve canonical profile ID');
-        }
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_propagateCanonical).call(this, canonical);
-        return canonical;
-    }
-    async getUserProfileLineage(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getUserProfileLineage');
-        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getUserProfileLineage(resolvedId);
-    }
-    /**
-     * Returns a Customer Service specific access token for the specified SRP,
-     * logging in if needed.
-     *
-     * Exchanges the OIDC access token for a short-lived token scoped to the
-     * customer-service audience. Customer Service tooling consumes this token to
-     * identify and authenticate the user.
-     *
-     * @param entropySourceId - The entropy source ID. Omit for the primary SRP.
-     * @returns The customer-service access token.
-     */
-    async getCustomerServiceToken(entropySourceId) {
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, 'getCustomerServiceToken');
-        const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-        return await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").getCustomerServiceToken(resolvedId);
-    }
-    isSignedIn() {
-        return this.state.isSignedIn;
-    }
-}
-_AuthenticationController_metametrics = new WeakMap(), _AuthenticationController_auth = new WeakMap(), _AuthenticationController_config = new WeakMap(), _AuthenticationController_isUnlocked = new WeakMap(), _AuthenticationController_profilePairingRequestEpoch = new WeakMap(), _AuthenticationController_keyringController = new WeakMap(), _AuthenticationController__signMessageCache = new WeakMap(), _AuthenticationController_instances = new WeakSet(), _AuthenticationController_getLoginResponseFromState = async function _AuthenticationController_getLoginResponseFromState(entropySourceId) {
-    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    if (!this.state.srpSessionData?.[resolvedId]) {
-        return null;
-    }
-    return this.state.srpSessionData[resolvedId];
-}, _AuthenticationController_setLoginResponseToState = async function _AuthenticationController_setLoginResponseToState(loginResponse, entropySourceId) {
-    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    const metaMetricsId = await __classPrivateFieldGet(this, _AuthenticationController_metametrics, "f").getMetaMetricsId();
-    this.update((state) => {
-        state.isSignedIn = true;
-        if (!state.srpSessionData) {
-            state.srpSessionData = {};
-        }
-        state.srpSessionData[resolvedId] = {
-            ...loginResponse,
-            profile: {
-                ...loginResponse.profile,
-                metaMetricsId,
-            },
-        };
-    });
-}, _AuthenticationController_assertIsUnlocked = function _AuthenticationController_assertIsUnlocked(methodName) {
-    if (!__classPrivateFieldGet(this, _AuthenticationController_isUnlocked, "f")) {
-        throw new Error(`${methodName} - unable to proceed, wallet is locked`);
-    }
-}, _AuthenticationController_getHdKeyringEntropySourceIds = function _AuthenticationController_getHdKeyringEntropySourceIds() {
-    const { keyrings } = this.messenger.call('KeyringController:getState');
-    return getHdKeyringEntropySourceIds(keyrings);
-}, _AuthenticationController_getPrimaryEntropySourceId = function _AuthenticationController_getPrimaryEntropySourceId() {
-    const { keyrings } = this.messenger.call('KeyringController:getState');
-    return getPrimaryHdKeyringEntropySourceId(keyrings);
-}, _AuthenticationController_getLoginTag = 
-/**
- * Resolves the SRP login tag for `raw_message`.
- *
- * - `primary` for the first HD entropy source
- * - `secondary` for any other entropy source
- *
- * @param entropySourceId - Entropy source for this login attempt.
- * @returns The login tag to append to the signed message.
- */
-async function _AuthenticationController_getLoginTag(entropySourceId) {
-    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    const resolvedId = entropySourceId ?? primaryEntropySourceId;
-    return resolvedId === primaryEntropySourceId ? 'primary' : 'secondary';
-}, _AuthenticationController_getLoginIdentifierType = 
-/**
- * Resolves metametrics `identifier_type` for `/srp/login`
- * (`SRP` | `GOOGLE` | `APPLE` | `TELEGRAM`).
- *
- * This is the auth method for the entropy source, independent of
- * {@link SrpLoginTag} (`primary` / `secondary`).
- *
- * SeedlessOnboarding currently exposes a single vault-level
- * `authConnection`, which always backs the primary entropy source. Non-
- * primary sources therefore return `SRP`. If social identities become
- * per-entropy later, resolve from that metadata instead of assuming
- * primary === social.
- *
- * Soft-fails to `SRP` when SeedlessOnboarding is not registered.
- *
- * @param entropySourceId - Entropy source for this login attempt.
- * @returns The login identifier type.
- */
-async function _AuthenticationController_getLoginIdentifierType(entropySourceId) {
-    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    const resolvedId = entropySourceId ?? primaryEntropySourceId;
-    // Social vault authConnection is only associated with the primary source.
-    if (resolvedId !== primaryEntropySourceId) {
-        return 'SRP';
-    }
-    return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_resolveSocialIdentifierType).call(this);
-}, _AuthenticationController_resolveSocialIdentifierType = function _AuthenticationController_resolveSocialIdentifierType() {
-    try {
-        return __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_identifierTypeFromSeedlessState).call(this, this.messenger.call('SeedlessOnboardingController:getState'));
-    }
-    catch {
-        return 'SRP';
-    }
-}, _AuthenticationController_identifierTypeFromSeedlessState = function _AuthenticationController_identifierTypeFromSeedlessState(state) {
-    if (state.vault === null || state.vault === undefined) {
-        return 'SRP';
-    }
-    // Match provider strings from SeedlessOnboarding state rather than
-    // importing AuthConnection — a value import would load that package
-    // (and its heavy deps) whenever this controller is imported.
-    switch (state.authConnection) {
-        case 'google':
-            return 'GOOGLE';
-        case 'apple':
-            return 'APPLE';
-        case 'telegram':
-            return 'TELEGRAM';
-        default:
-            return 'SRP';
-    }
-}, _AuthenticationController_trySocialPairing = 
-/**
- * Attaches a Google/Apple/Telegram social identifier to the primary SRP
- * profile via `POST /api/v2/profile/pair/identifier`.
- *
- * Runs only when `isSocialPairingEnabled()` is true and
- * `needsSocialPairing` is not `false` (`undefined` is treated as true).
- * No social provider (`authConnection` unset) → clear the flag (nothing
- * to pair). Social provider set but vault missing → skip (onboarding
- * still in flight). Google without email → skip (API requires it).
- * Telegram never sends `email` (the field holds a display name, not an
- * address). Missing social JWT → skip. 409 Conflict → clear the flag
- * (identifier already owned; retry is pointless). Other errors
- * propagate so the caller can swallow them and leave the flag set for
- * retry.
- *
- * @param primaryAccessToken - Primary SRP OIDC access token used as the
- * Bearer credential. The profile associated with this JWT becomes the
- * canonical owner of the social identifier.
- */
-async function _AuthenticationController_trySocialPairing(primaryAccessToken) {
-    if (!__classPrivateFieldGet(this, _AuthenticationController_config, "f").isSocialPairingEnabled() ||
-        this.state.needsSocialPairing === false ||
-        !primaryAccessToken) {
-        return;
-    }
-    let seedlessState;
-    try {
-        seedlessState = this.messenger.call('SeedlessOnboardingController:getState');
-    }
-    catch {
-        // Controller missing or getState failed — retry next performSignIn.
-        return;
-    }
-    // `SRP` here does not describe the vault: it is the mapping's "no social
-    // identity" result, returned when there is no seedless vault or the
-    // provider is unrecognised. In both cases there is nothing to pair.
-    const identifierType = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_identifierTypeFromSeedlessState).call(this, seedlessState);
-    if (identifierType === 'SRP') {
-        const { vault, authConnection } = seedlessState;
-        // Vault not written yet but a social provider is already known —
-        // onboarding is still in flight. Do not clear; retry next sign-in.
-        if ((vault === null || vault === undefined) && Boolean(authConnection)) {
-            return;
-        }
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
-        return;
-    }
-    // Email policy follows the API contract: GOOGLE requires `email` (400
-    // without it), APPLE accepts it optionally, TELEGRAM must not send it
-    // (clients store a display name in `socialLoginEmail` for Telegram).
-    // Clients request the `email` scope for Google, so a missing value is a
-    // defensive case rather than an expected one; returning here leaves
-    // `needsSocialPairing` set so the next sign-in retries instead of
-    // sending a request that would fail.
-    const { socialLoginEmail } = seedlessState;
-    let email;
-    if (identifierType === 'GOOGLE') {
-        if (!socialLoginEmail) {
-            return;
-        }
-        email = socialLoginEmail;
-    }
-    else if (identifierType === 'APPLE') {
-        email = socialLoginEmail;
-    }
-    const socialJwt = await this.messenger.call('SeedlessOnboardingController:getAccessToken');
-    if (socialJwt === undefined || socialJwt === '') {
-        return;
-    }
-    try {
-        await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").pairSocialIdentifier({
-            identifierType,
-            socialJwt,
-            ...(email ? { email } : {}),
-        }, primaryAccessToken);
-        __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
-    }
-    catch (error) {
-        if (error instanceof PairConflictError) {
-            __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_clearNeedsSocialPairing).call(this);
-            return;
-        }
-        throw error;
-    }
-}, _AuthenticationController_clearNeedsSocialPairing = function _AuthenticationController_clearNeedsSocialPairing() {
-    if (this.state.needsSocialPairing !== false) {
-        this.update((state) => {
-            state.needsSocialPairing = false;
-        });
-    }
-}, _AuthenticationController_tryClearNeedsProfilePairing = function _AuthenticationController_tryClearNeedsProfilePairing(epochAtStart) {
-    if (__classPrivateFieldGet(this, _AuthenticationController_profilePairingRequestEpoch, "f") !== epochAtStart) {
-        return;
-    }
-    if (this.state.needsProfilePairing) {
-        this.update((state) => {
-            state.needsProfilePairing = false;
-        });
-    }
-}, _AuthenticationController_doPair = 
-/**
- * Pairs all SRPs via `POST /profile/pair`, propagates the canonical
- * profile ID, clears `needsProfilePairing`, and emits
- * `AuthenticationController:profileSignIn` when the canonical changes or
- * new aliases are returned. Throws on failure.
- *
- * @param accessTokens - Per-SRP access tokens, primary first.
- * @param epochAtStart - Pairing-request epoch captured by the caller.
- * Used to skip the gate clear if `requestProfilePairing` ran while the
- * pair API call was in-flight.
- */
-async function _AuthenticationController_doPair(accessTokens, epochAtStart) {
-    const previousCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-    const profileAliases = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_pairSrpProfiles).call(this, accessTokens);
-    const newCanonical = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getCanonicalProfileId).call(this);
-    // If somehow we cannot compute the new canonical profile ID after pairing,
-    // we just return now and do not update the `needsProfilePairing` flag.
-    if (!newCanonical) {
-        return;
-    }
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_tryClearNeedsProfilePairing).call(this, epochAtStart);
-    const profileIdChanged = previousCanonical !== newCanonical;
-    const shouldEmitProfileSignInEvent = profileIdChanged || profileAliases.length > 0;
-    if (shouldEmitProfileSignInEvent) {
-        this.messenger.publish('AuthenticationController:profileSignIn', {
-            profileId: newCanonical,
-            profileAliases,
-            profileIdChanged,
-        });
-    }
-}, _AuthenticationController_pairSrpProfiles = async function _AuthenticationController_pairSrpProfiles(accessTokens) {
-    if (accessTokens.length < 2) {
-        return [];
-    }
-    const primaryAccessToken = accessTokens[0]; // Associated with primary SRP.
-    const { profileAliases, profile: { canonicalProfileId }, } = await __classPrivateFieldGet(this, _AuthenticationController_auth, "f").pairSrpProfiles(accessTokens, primaryAccessToken);
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_propagateCanonical).call(this, canonicalProfileId);
-    return profileAliases;
-}, _AuthenticationController_propagateCanonical = function _AuthenticationController_propagateCanonical(canonicalProfileId) {
-    const { srpSessionData } = this.state;
-    if (!srpSessionData) {
-        return;
-    }
-    this.update((state) => {
-        for (const entry of Object.values(state.srpSessionData ?? {})) {
-            if (entry?.profile) {
-                entry.profile.canonicalProfileId = canonicalProfileId;
-            }
-        }
-    });
-}, _AuthenticationController_getCanonicalProfileId = function _AuthenticationController_getCanonicalProfileId() {
-    const primaryEntropySourceId = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    return (this.state.srpSessionData?.[primaryEntropySourceId]?.profile
-        ?.canonicalProfileId ?? null);
-}, _AuthenticationController_invalidateSrpSession = function _AuthenticationController_invalidateSrpSession(entropySourceId) {
-    this.update((state) => {
-        const entry = state.srpSessionData?.[entropySourceId];
-        if (entry?.profile) {
-            // Setting canonicalProfileId to '' forces a re-fetch on the next
-            // #getAuthSession call. The falsy check (!auth.profile.canonicalProfileId)
-            // treats '' the same as undefined/null — all signal an invalid session.
-            entry.profile.canonicalProfileId = '';
-        }
-    });
-}, _AuthenticationController_getHdKeyringSeed = 
-/**
- * Reads the BIP-39 seed for an HD entropy source from KeyringController.
- *
- * @param entropySourceId - Entropy source ID. Defaults to the primary HD
- * keyring.
- * @returns The HD keyring seed.
- */
-async function _AuthenticationController_getHdKeyringSeed(entropySourceId) {
-    const resolvedId = entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this);
-    return getHdKeyringSeed(this.messenger, resolvedId);
-}, _AuthenticationController_getPublicKey = 
-/**
- * Returns the message-signing public key via native SIP-6 derivation
- * (same key as `@metamask/message-signing-snap` with empty salt).
- *
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns The public key hex.
- */
-async function _AuthenticationController_getPublicKey(entropySourceId) {
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#getPublicKey');
-    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
-    return getMessageSigningPublicKey(seed);
-}, _AuthenticationController_scopedCacheKey = function _AuthenticationController_scopedCacheKey(message, entropySourceId) {
-    return `${entropySourceId ?? __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getPrimaryEntropySourceId).call(this)}:${message}`;
-}, _AuthenticationController_signMessage = 
-/**
- * Signs a `metamask:…` message with the native SIP-6 message-signing key.
- *
- * @param message - A specific tagged message to sign.
- * @param entropySourceId - The entropy source ID used to derive the key,
- * when multiple sources are available (Multi-SRP).
- * @returns Compact secp256k1 signature hex.
- */
-async function _AuthenticationController_signMessage(message, entropySourceId) {
-    assertMessageStartsWithMetamask(message);
-    __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_assertIsUnlocked).call(this, '#signMessage');
-    const cacheKey = __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_scopedCacheKey).call(this, message, entropySourceId);
-    if (__classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey]) {
-        return __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey];
-    }
-    const seed = await __classPrivateFieldGet(this, _AuthenticationController_instances, "m", _AuthenticationController_getHdKeyringSeed).call(this, entropySourceId);
-    const result = await signMessageWithMessageSigningKey(message, seed);
-    __classPrivateFieldGet(this, _AuthenticationController__signMessageCache, "f")[cacheKey] = result;
-    return result;
-};
-//# sourceMappingURL=AuthenticationController.mjs.map