@metamask/profile-sync-controller 30.0.0 → 32.0.0

package/dist/sdk/authentication-jwt-bearer/services.cjs

@@ -1,443 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getCustomerServiceToken = exports.getUserProfileLineage = exports.authenticate = exports.authorizeOIDC = exports.getNonce = exports.pairSocialIdentifier = exports.pairProfiles = exports.pairIdentifiers = exports.CUSTOMER_SERVICE_TOKEN_URL = exports.PROFILE_LINEAGE_URL = exports.PAIR_SOCIAL_IDENTIFIER_URL = exports.PAIR_PROFILES_URL = exports.SIWE_LOGIN_URL = exports.SRP_LOGIN_URL = exports.OIDC_TOKEN_URL = exports.PAIR_IDENTIFIERS = exports.NONCE_URL = void 0;
-const env_js_1 = require("../../shared/env.cjs");
-const constants_js_1 = require("../constants.cjs");
-const errors_js_1 = require("../errors.cjs");
-const validate_pair_response_js_1 = require("../utils/validate-pair-response.cjs");
-const types_js_1 = require("./types.cjs");
-/**
- * Parse Retry-After header into milliseconds if possible.
- * Supports seconds or HTTP-date formats.
- *
- * @param retryAfterHeader - The Retry-After header value (seconds or HTTP-date)
- * @returns The retry delay in milliseconds, or null if parsing fails
- */
-function parseRetryAfter(retryAfterHeader) {
-    if (!retryAfterHeader) {
-        return null;
-    }
-    const seconds = Number(retryAfterHeader);
-    if (!Number.isNaN(seconds)) {
-        return seconds * 1000;
-    }
-    const date = Date.parse(retryAfterHeader);
-    if (!Number.isNaN(date)) {
-        const diff = date - Date.now();
-        return diff > 0 ? diff : null;
-    }
-    return null;
-}
-/**
- * Extracts error details from a Response object.
- *
- * @param response - The HTTP response object
- * @returns Formatted error message with HTTP status and response body
- */
-async function getResponseErrorMessage(response) {
-    const { status } = response;
-    const clonedResponse = response.clone();
-    let message = 'Unknown error';
-    let error = 'unknown';
-    try {
-        const responseBody = (await response.json());
-        message =
-            'message' in responseBody
-                ? responseBody.message
-                : responseBody.error_description;
-        error = responseBody.error ?? 'unknown';
-    }
-    catch {
-        try {
-            const textContent = await clonedResponse.text();
-            message = textContent
-                ? textContent.slice(0, 150)
-                : 'Non-JSON error response';
-            error = 'non_json_response';
-        }
-        catch {
-            message = 'Unable to parse error response';
-            error = 'unparseable_response';
-        }
-    }
-    return `HTTP ${status} - ${message} (error: ${error})`;
-}
-/**
- * Type guard to check if an object is a Response-like object.
- *
- * @param obj - The object to check
- * @returns True if the object is a Response-like object, false otherwise
- */
-const isErrorResponse = (obj) => typeof obj === 'object' &&
-    obj !== null &&
-    'status' in obj &&
-    'headers' in obj;
-/**
- * Throws a domain-specific error for service failures.
- * Handles both HTTP error responses and regular errors (network failures, etc.).
- * For HTTP 429, throws RateLimitedError with Retry-After header parsing.
- *
- * @param error - The error (Response object or caught error)
- * @param errorPrefix - Context prefix for the error message
- * @param ErrorClass - The domain-specific error class to throw
- * @throws RateLimitedError for 429, otherwise ErrorClass
- */
-async function throwServiceError(error, errorPrefix, ErrorClass) {
-    // Re-throw RateLimitedError or matching ErrorClass as-is (don't double-wrap)
-    if (error instanceof errors_js_1.RateLimitedError || error instanceof ErrorClass) {
-        throw error;
-    }
-    // Not a Response-like object - handle as regular error
-    if (!isErrorResponse(error)) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        throw new ErrorClass(`${errorPrefix}: ${errorMessage}`);
-    }
-    // Handle HTTP error response
-    const response = error;
-    const { status } = response;
-    const responseMessage = await getResponseErrorMessage(response);
-    if (status === constants_js_1.HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
-        const retryAfterHeader = response.headers.get('Retry-After');
-        const retryAfterMs = parseRetryAfter(retryAfterHeader);
-        throw new errors_js_1.RateLimitedError(`${errorPrefix}: ${responseMessage}`, retryAfterMs ?? undefined);
-    }
-    throw new ErrorClass(`${errorPrefix}: ${responseMessage}`);
-}
-const NONCE_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/nonce`;
-exports.NONCE_URL = NONCE_URL;
-const PAIR_IDENTIFIERS = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/identifiers/pair`;
-exports.PAIR_IDENTIFIERS = PAIR_IDENTIFIERS;
-const OIDC_TOKEN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).oidcApiUrl}/oauth2/token`;
-exports.OIDC_TOKEN_URL = OIDC_TOKEN_URL;
-const SRP_LOGIN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/srp/login`;
-exports.SRP_LOGIN_URL = SRP_LOGIN_URL;
-const SIWE_LOGIN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/siwe/login`;
-exports.SIWE_LOGIN_URL = SIWE_LOGIN_URL;
-const PAIR_PROFILES_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/pair`;
-exports.PAIR_PROFILES_URL = PAIR_PROFILES_URL;
-const PAIR_SOCIAL_IDENTIFIER_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/pair/identifier`;
-exports.PAIR_SOCIAL_IDENTIFIER_URL = PAIR_SOCIAL_IDENTIFIER_URL;
-const PROFILE_LINEAGE_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/profile/lineage`;
-exports.PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL;
-const CUSTOMER_SERVICE_TOKEN_URL = (env) => `${(0, env_js_1.getEnvUrls)(env).authApiUrl}/api/v2/customer-service/token`;
-exports.CUSTOMER_SERVICE_TOKEN_URL = CUSTOMER_SERVICE_TOKEN_URL;
-const getAuthenticationUrl = (authType, env) => {
-    switch (authType) {
-        case types_js_1.AuthType.SRP:
-            return (0, exports.SRP_LOGIN_URL)(env);
-        case types_js_1.AuthType.SiWE:
-            return (0, exports.SIWE_LOGIN_URL)(env);
-        /* istanbul ignore next */
-        default:
-            throw new errors_js_1.ValidationError(`Invalid AuthType: ${authType} - unable to create Auth URL`);
-    }
-};
-const parseProfileAliases = (raw) => {
-    return raw.map((alias) => ({
-        aliasProfileId: alias.alias_profile_id,
-        canonicalProfileId: alias.canonical_profile_id,
-        identifierIds: alias.identifier_ids ?? [],
-    }));
-};
-/**
- * Pair multiple identifiers under a single profile
- *
- * @param nonce - session nonce
- * @param logins - pairing request payload
- * @param accessToken - JWT access token used to access protected resources
- * @param env - server environment
- * @returns void.
- */
-async function pairIdentifiers(nonce, logins, accessToken, env) {
-    const pairUrl = new URL((0, exports.PAIR_IDENTIFIERS)(env));
-    try {
-        const response = await fetch(pairUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${accessToken}`,
-            },
-            body: JSON.stringify({
-                nonce,
-                logins,
-            }),
-        });
-        if (!response.ok) {
-            return await throwServiceError(response, 'Failed to pair identifiers', errors_js_1.PairError);
-        }
-        return undefined;
-    }
-    catch (error) {
-        return await throwServiceError(error, 'Failed to pair identifiers', errors_js_1.PairError);
-    }
-}
-exports.pairIdentifiers = pairIdentifiers;
-/**
- * Pair multiple profiles using their OIDC access tokens.
- * Idempotent — calling with already-paired tokens is a no-op.
- *
- * @param accessTokens - Two or more OIDC access tokens to pair
- * @param authAccessToken - A valid access token for the Authorization header
- * @param env - server environment
- * @returns The pair response containing the canonical profile and aliases
- */
-async function pairProfiles(accessTokens, authAccessToken, env) {
-    const pairUrl = new URL((0, exports.PAIR_PROFILES_URL)(env));
-    try {
-        const response = await fetch(pairUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${authAccessToken}`,
-            },
-            body: JSON.stringify({
-                jwts: accessTokens,
-            }),
-        });
-        if (!response.ok) {
-            return await throwServiceError(response, 'Failed to pair profiles', errors_js_1.PairError);
-        }
-        const pairResponse = await response.json();
-        (0, validate_pair_response_js_1.validatePairResponse)(pairResponse);
-        return {
-            profile: {
-                identifierId: pairResponse.profile.identifier_id,
-                metaMetricsId: pairResponse.profile.metametrics_id ?? '',
-                profileId: pairResponse.profile.profile_id,
-                canonicalProfileId: pairResponse.profile.profile_id,
-            },
-            profileAliases: parseProfileAliases(pairResponse.profile_aliases ?? []),
-        };
-    }
-    catch (error) {
-        return await throwServiceError(error, 'Failed to pair profiles', errors_js_1.PairError);
-    }
-}
-exports.pairProfiles = pairProfiles;
-/**
- * Attach a Google/Apple/Telegram social identifier to the profile that
- * owns `authAccessToken` (`POST /api/v2/profile/pair/identifier`).
- *
- * `email` is omitted from the body when undefined. 409 Conflict throws
- * {@link PairConflictError} so callers can treat it as terminal. The
- * response body (new token + profile) is not consumed: a 2xx status is the
- * only success signal.
- *
- * @param params - Social identifier type, social JWT, and optional email
- * @param authAccessToken - Bearer token of the canonical (primary SRP) profile
- * @param env - server environment
- */
-async function pairSocialIdentifier(params, authAccessToken, env) {
-    const pairUrl = new URL((0, exports.PAIR_SOCIAL_IDENTIFIER_URL)(env));
-    const errorPrefix = 'Failed to pair social identifier';
-    try {
-        const response = await fetch(pairUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${authAccessToken}`,
-            },
-            body: JSON.stringify({
-                identifier_type: params.identifierType,
-                social_jwt: params.socialJwt,
-                ...(params.email === undefined ? {} : { email: params.email }),
-            }),
-        });
-        if (!response.ok) {
-            if (response.status === constants_js_1.HTTP_STATUS_CODES.CONFLICT) {
-                await throwServiceError(response, errorPrefix, errors_js_1.PairConflictError);
-            }
-            await throwServiceError(response, errorPrefix, errors_js_1.PairError);
-        }
-    }
-    catch (error) {
-        await throwServiceError(error, errorPrefix, errors_js_1.PairError);
-    }
-}
-exports.pairSocialIdentifier = pairSocialIdentifier;
-/**
- * Service to Get Nonce for JWT Bearer Flow
- *
- * @param id - identifier ID
- * @param env - server environment
- * @returns the nonce.
- */
-async function getNonce(id, env) {
-    const nonceUrl = new URL((0, exports.NONCE_URL)(env));
-    nonceUrl.searchParams.set('identifier', id);
-    try {
-        const nonceResponse = await fetch(nonceUrl.toString());
-        if (!nonceResponse.ok) {
-            return await throwServiceError(nonceResponse, 'Failed to get nonce', errors_js_1.NonceRetrievalError);
-        }
-        const nonceJson = await nonceResponse.json();
-        return {
-            nonce: nonceJson.nonce,
-            identifier: nonceJson.identifier,
-            expiresIn: nonceJson.expires_in,
-        };
-    }
-    catch (error) {
-        return await throwServiceError(error, 'Failed to get nonce', errors_js_1.NonceRetrievalError);
-    }
-}
-exports.getNonce = getNonce;
-/**
- * Service to Authorize And perform OIDC Flow to get the Access Token
- *
- * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)
- * @param env - server environment
- * @param platform - SDK platform
- * @returns Access Token from Authorization server
- */
-async function authorizeOIDC(jwtToken, env, platform) {
-    const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
-    const headers = {
-        'Content-Type': 'application/x-www-form-urlencoded',
-    };
-    const urlEncodedBody = new URLSearchParams();
-    urlEncodedBody.append('grant_type', grantType);
-    urlEncodedBody.append('client_id', (0, env_js_1.getOidcClientId)(env, platform));
-    urlEncodedBody.append('assertion', jwtToken);
-    try {
-        const response = await fetch((0, exports.OIDC_TOKEN_URL)(env), {
-            method: 'POST',
-            headers,
-            body: urlEncodedBody.toString(),
-        });
-        if (!response.ok) {
-            return await throwServiceError(response, 'Failed to get access token', errors_js_1.SignInError);
-        }
-        const accessTokenResponse = await response.json();
-        return {
-            accessToken: accessTokenResponse.access_token,
-            expiresIn: accessTokenResponse.expires_in,
-            obtainedAt: Date.now(),
-        };
-    }
-    catch (error) {
-        return await throwServiceError(error, 'Failed to get access token', errors_js_1.SignInError);
-    }
-}
-exports.authorizeOIDC = authorizeOIDC;
-/**
- * Service to Authenticate/Login a user via SIWE or SRP derived key.
- *
- * @param rawMessage - raw message for validation when authenticating
- * @param signature - signed raw message
- * @param authType - authentication type/flow used
- * @param env - server environment
- * @param metametrics - optional metametrics
- * @param identifierType - login identifier type included in metametrics
- *   (defaults to `SRP` when metametrics is present)
- * @returns Authentication Token
- */
-async function authenticate(rawMessage, signature, authType, env, metametrics, identifierType = 'SRP') {
-    const authenticationUrl = getAuthenticationUrl(authType, env);
-    try {
-        const response = await fetch(authenticationUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                ...(authType === types_js_1.AuthType.SRP
-                    ? { 'X-MetaMask-Profile-Pairing': 'enabled' }
-                    : {}),
-            },
-            body: JSON.stringify({
-                signature,
-                raw_message: rawMessage,
-                ...(metametrics
-                    ? {
-                        metametrics: {
-                            metametrics_id: await metametrics.getMetaMetricsId(),
-                            agent: metametrics.agent,
-                            app_version: await metametrics.getAppVersion?.(),
-                            identifier_type: identifierType,
-                        },
-                    }
-                    : {}),
-            }),
-        });
-        if (!response.ok) {
-            return await throwServiceError(response, `Failed to login with ${authType}`, errors_js_1.SignInError);
-        }
-        const loginResponse = await response.json();
-        return {
-            token: loginResponse.token,
-            expiresIn: loginResponse.expires_in,
-            profile: {
-                identifierId: loginResponse.profile.identifier_id,
-                metaMetricsId: loginResponse.profile.metametrics_id,
-                profileId: loginResponse.profile.profile_id,
-                canonicalProfileId: loginResponse.profile.profile_id,
-            },
-            profileAliases: parseProfileAliases(loginResponse.profile_aliases ?? []),
-        };
-    }
-    catch (error) {
-        return await throwServiceError(error, `Failed to login with ${authType}`, errors_js_1.SignInError);
-    }
-}
-exports.authenticate = authenticate;
-/**
- * Service to get the Profile Lineage
- *
- * @param env - server environment
- * @param accessToken - JWT access token used to access protected resources
- * @returns Profile Lineage information.
- */
-async function getUserProfileLineage(env, accessToken) {
-    const profileLineageUrl = new URL((0, exports.PROFILE_LINEAGE_URL)(env));
-    try {
-        const response = await fetch(profileLineageUrl, {
-            method: 'GET',
-            headers: {
-                Authorization: `Bearer ${accessToken}`,
-            },
-        });
-        if (!response.ok) {
-            return await throwServiceError(response, 'Failed to get profile lineage', errors_js_1.SignInError);
-        }
-        const profileJson = await response.json();
-        return profileJson;
-    }
-    catch (error) {
-        return await throwServiceError(error, 'Failed to get profile lineage', errors_js_1.SignInError);
-    }
-}
-exports.getUserProfileLineage = getUserProfileLineage;
-/**
- * Service to get a Customer Service specific access token.
- *
- * Exchanges a valid OIDC access token for a short-lived token scoped to the
- * customer-service audience, which Customer Service tooling consumes to
- * identify and authenticate the user.
- *
- * @param env - server environment
- * @param accessToken - JWT access token used to access protected resources
- * @returns The customer-service access token.
- */
-async function getCustomerServiceToken(env, accessToken) {
-    const customerServiceTokenUrl = new URL((0, exports.CUSTOMER_SERVICE_TOKEN_URL)(env));
-    try {
-        const response = await fetch(customerServiceTokenUrl, {
-            method: 'POST',
-            headers: {
-                Authorization: `Bearer ${accessToken}`,
-            },
-        });
-        if (!response.ok) {
-            return await throwServiceError(response, 'Failed to get customer service token', errors_js_1.SignInError);
-        }
-        const tokenResponse = await response.json();
-        if (typeof tokenResponse?.access_token !== 'string') {
-            throw new errors_js_1.SignInError('Failed to get customer service token: missing access_token');
-        }
-        return tokenResponse.access_token;
-    }
-    catch (error) {
-        return await throwServiceError(error, 'Failed to get customer service token', errors_js_1.SignInError);
-    }
-}
-exports.getCustomerServiceToken = getCustomerServiceToken;
-//# sourceMappingURL=services.cjs.map

package/dist/sdk/authentication-jwt-bearer/services.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"services.d.cts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,6BAA4B;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAWtE,OAAO,KAAK,EACV,WAAW,EAEX,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,WAAW,EACX,kBAAkB,EACnB,oBAAmB;AACpB,OAAO,EAAE,QAAQ,EAAE,oBAAmB;AAwHtC,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,MACS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG,MACa,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,KAAG,MACS,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,iBAAiB,QAAS,GAAG,KAAG,MACQ,CAAC;AAEtD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACU,CAAC;AAEjE,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACS,CAAC;AAgBhE,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmBF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,oBAAoB,CAAC,CAsC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CA2B3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AACF;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,WAAW,CAAC,EAAE,eAAe,EAC7B,cAAc,GAAE,mBAA2B,GAC1C,OAAO,CAAC,cAAc,CAAC,CAwDzB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAiCjB"}

package/dist/sdk/authentication-jwt-bearer/services.d.mts

@@ -1,120 +0,0 @@
-import type { Env, Platform } from "../../shared/env.mjs";
-import type { MetaMetricsAuth } from "../../shared/types/services.mjs";
-import type { AccessToken, LoginIdentifierType, PairSocialIdentifierParams, ProfileAlias, UserProfile, UserProfileLineage } from "./types.mjs";
-import { AuthType } from "./types.mjs";
-export declare const NONCE_URL: (env: Env) => string;
-export declare const PAIR_IDENTIFIERS: (env: Env) => string;
-export declare const OIDC_TOKEN_URL: (env: Env) => string;
-export declare const SRP_LOGIN_URL: (env: Env) => string;
-export declare const SIWE_LOGIN_URL: (env: Env) => string;
-export declare const PAIR_PROFILES_URL: (env: Env) => string;
-export declare const PAIR_SOCIAL_IDENTIFIER_URL: (env: Env) => string;
-export declare const PROFILE_LINEAGE_URL: (env: Env) => string;
-export declare const CUSTOMER_SERVICE_TOKEN_URL: (env: Env) => string;
-type NonceResponse = {
-    nonce: string;
-    identifier: string;
-    expiresIn: number;
-};
-type PairRequest = {
-    signature: string;
-    raw_message: string;
-    encrypted_storage_key: string;
-    identifier_type: 'SIWE' | 'SRP';
-};
-/**
- * Pair multiple identifiers under a single profile
- *
- * @param nonce - session nonce
- * @param logins - pairing request payload
- * @param accessToken - JWT access token used to access protected resources
- * @param env - server environment
- * @returns void.
- */
-export declare function pairIdentifiers(nonce: string, logins: PairRequest[], accessToken: string, env: Env): Promise<void>;
-export type PairProfilesResponse = {
-    profile: UserProfile;
-    profileAliases: ProfileAlias[];
-};
-/**
- * Pair multiple profiles using their OIDC access tokens.
- * Idempotent — calling with already-paired tokens is a no-op.
- *
- * @param accessTokens - Two or more OIDC access tokens to pair
- * @param authAccessToken - A valid access token for the Authorization header
- * @param env - server environment
- * @returns The pair response containing the canonical profile and aliases
- */
-export declare function pairProfiles(accessTokens: string[], authAccessToken: string, env: Env): Promise<PairProfilesResponse>;
-/**
- * Attach a Google/Apple/Telegram social identifier to the profile that
- * owns `authAccessToken` (`POST /api/v2/profile/pair/identifier`).
- *
- * `email` is omitted from the body when undefined. 409 Conflict throws
- * {@link PairConflictError} so callers can treat it as terminal. The
- * response body (new token + profile) is not consumed: a 2xx status is the
- * only success signal.
- *
- * @param params - Social identifier type, social JWT, and optional email
- * @param authAccessToken - Bearer token of the canonical (primary SRP) profile
- * @param env - server environment
- */
-export declare function pairSocialIdentifier(params: PairSocialIdentifierParams, authAccessToken: string, env: Env): Promise<void>;
-/**
- * Service to Get Nonce for JWT Bearer Flow
- *
- * @param id - identifier ID
- * @param env - server environment
- * @returns the nonce.
- */
-export declare function getNonce(id: string, env: Env): Promise<NonceResponse>;
-/**
- * Service to Authorize And perform OIDC Flow to get the Access Token
- *
- * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)
- * @param env - server environment
- * @param platform - SDK platform
- * @returns Access Token from Authorization server
- */
-export declare function authorizeOIDC(jwtToken: string, env: Env, platform: Platform): Promise<AccessToken>;
-type Authentication = {
-    token: string;
-    expiresIn: number;
-    profile: UserProfile;
-    profileAliases: ProfileAlias[];
-};
-/**
- * Service to Authenticate/Login a user via SIWE or SRP derived key.
- *
- * @param rawMessage - raw message for validation when authenticating
- * @param signature - signed raw message
- * @param authType - authentication type/flow used
- * @param env - server environment
- * @param metametrics - optional metametrics
- * @param identifierType - login identifier type included in metametrics
- *   (defaults to `SRP` when metametrics is present)
- * @returns Authentication Token
- */
-export declare function authenticate(rawMessage: string, signature: string, authType: AuthType, env: Env, metametrics?: MetaMetricsAuth, identifierType?: LoginIdentifierType): Promise<Authentication>;
-/**
- * Service to get the Profile Lineage
- *
- * @param env - server environment
- * @param accessToken - JWT access token used to access protected resources
- * @returns Profile Lineage information.
- */
-export declare function getUserProfileLineage(env: Env, accessToken: string): Promise<UserProfileLineage>;
-/**
- * Service to get a Customer Service specific access token.
- *
- * Exchanges a valid OIDC access token for a short-lived token scoped to the
- * customer-service audience, which Customer Service tooling consumes to
- * identify and authenticate the user.
- *
- * @param env - server environment
- * @param accessToken - JWT access token used to access protected resources
- * @returns The customer-service access token.
- */
-export declare function getCustomerServiceToken(env: Env, accessToken: string): Promise<string>;
-export {};
-//# sourceMappingURL=services.d.mts.map

package/dist/sdk/authentication-jwt-bearer/services.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"services.d.mts","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,6BAA4B;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,wCAAuC;AAWtE,OAAO,KAAK,EACV,WAAW,EAEX,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,WAAW,EACX,kBAAkB,EACnB,oBAAmB;AACpB,OAAO,EAAE,QAAQ,EAAE,oBAAmB;AAwHtC,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,MACS,CAAC;AAE/C,eAAO,MAAM,gBAAgB,QAAS,GAAG,KAAG,MACa,CAAC;AAE1D,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,aAAa,QAAS,GAAG,KAAG,MACS,CAAC;AAEnD,eAAO,MAAM,cAAc,QAAS,GAAG,KAAG,MACS,CAAC;AAEpD,eAAO,MAAM,iBAAiB,QAAS,GAAG,KAAG,MACQ,CAAC;AAEtD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACU,CAAC;AAEjE,eAAO,MAAM,mBAAmB,QAAS,GAAG,KAAG,MACS,CAAC;AAEzD,eAAO,MAAM,0BAA0B,QAAS,GAAG,KAAG,MACS,CAAC;AAgBhE,KAAK,aAAa,GAAG;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAmBF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,qBAAqB,EAAE,MAAM,CAAC;IAE9B,eAAe,EAAE,MAAM,GAAG,KAAK,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EAAE,EACtB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,oBAAoB,CAAC,CAsC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,EAClC,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CA2B3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED,KAAK,cAAc,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,cAAc,EAAE,YAAY,EAAE,CAAC;CAChC,CAAC;AACF;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,GAAG,EACR,WAAW,CAAC,EAAE,eAAe,EAC7B,cAAc,GAAE,mBAA2B,GAC1C,OAAO,CAAC,cAAc,CAAC,CAwDzB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAiCjB"}

package/dist/sdk/authentication-jwt-bearer/services.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"services.mjs","sourceRoot":"","sources":["../../../src/sdk/authentication-jwt-bearer/services.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,6BAA4B;AAElE,OAAO,EAAE,iBAAiB,EAAE,yBAAwB;AACpD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,eAAe,EACf,gBAAgB,EACjB,sBAAqB;AACtB,OAAO,EAAE,oBAAoB,EAAE,4CAA2C;AAU1E,OAAO,EAAE,QAAQ,EAAE,oBAAmB;AAEtC;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,gBAA+B;IACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;IAExC,IAAI,OAAO,GAAG,eAAe,CAAC;IAC9B,IAAI,KAAK,GAAG,SAAS,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGK,CAAC;QAEjD,OAAO;YACL,SAAS,IAAI,YAAY;gBACvB,CAAC,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;QACrC,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;YAChD,OAAO,GAAG,WAAW;gBACnB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC3B,CAAC,CAAC,yBAAyB,CAAC;YAC9B,KAAK,GAAG,mBAAmB,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,gCAAgC,CAAC;YAC3C,KAAK,GAAG,sBAAsB,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,MAAM,MAAM,OAAO,YAAY,KAAK,GAAG,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,GAAY,EAAmB,EAAE,CACxD,OAAO,GAAG,KAAK,QAAQ;IACvB,GAAG,KAAK,IAAI;IACZ,QAAQ,IAAI,GAAG;IACf,SAAS,IAAI,GAAG,CAAC;AAEnB;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,WAAmB,EACnB,UAA0C;IAE1C,6EAA6E;IAC7E,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,YAAY,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,eAAe,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAEhE,IAAI,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,IAAI,gBAAgB,CACxB,GAAG,WAAW,KAAK,eAAe,EAAE,EACpC,YAAY,IAAI,SAAS,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,KAAK,eAAe,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACnD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,0BAA0B,CAAC;AAE1D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAQ,EAAU,EAAE,CAChD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAQ,EAAU,EAAE,CACjD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAEpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACpD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC7D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,iCAAiC,CAAC;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAQ,EAAU,EAAE,CACtD,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,yBAAyB,CAAC;AAEzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC7D,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,gCAAgC,CAAC;AAEhE,MAAM,oBAAoB,GAAG,CAAC,QAAkB,EAAE,GAAQ,EAAU,EAAE;IACpE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ,CAAC,GAAG;YACf,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,QAAQ,CAAC,IAAI;YAChB,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7B,0BAA0B;QAC1B;YACE,MAAM,IAAI,eAAe,CACvB,qBAAqB,QAAkB,8BAA8B,CACtE,CAAC;IACN,CAAC;AACH,CAAC,CAAC;AAiBF,MAAM,mBAAmB,GAAG,CAAC,GAAsB,EAAkB,EAAE;IACrE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzB,cAAc,EAAE,KAAK,CAAC,gBAAgB;QACtC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB;QAC9C,aAAa,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,MAAqB,EACrB,WAAmB,EACnB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,MAAM;aACP,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,4BAA4B,EAC5B,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,4BAA4B,EAC5B,SAAS,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAsB,EACtB,eAAuB,EACvB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,eAAe,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,YAAY;aACnB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,yBAAyB,EACzB,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAEnC,OAAO;YACL,OAAO,EAAE;gBACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa;gBAChD,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE;gBACxD,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU;gBAC1C,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU;aACpD;YACD,cAAc,EAAE,mBAAmB,CAAC,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,EAAE,SAAS,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAkC,EAClC,eAAuB,EACvB,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,kCAAkC,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,eAAe,EAAE;aAC3C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,eAAe,EAAE,MAAM,CAAC,cAAc;gBACtC,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;aAC/D,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,CAAC,QAAQ,EAAE,CAAC;gBACnD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAU,EAAE,GAAQ;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,MAAM,iBAAiB,CAC5B,aAAa,EACb,qBAAqB,EACrB,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,SAAS,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,qBAAqB,EACrB,mBAAmB,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,GAAQ,EACR,QAAkB;IAElB,MAAM,SAAS,GAAG,6CAA6C,CAAC;IAChE,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,mCAAmC;KACpD,CAAC;IAEF,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;IAC7C,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,4BAA4B,EAC5B,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,WAAW,EAAE,mBAAmB,CAAC,YAAY;YAC7C,SAAS,EAAE,mBAAmB,CAAC,UAAU;YACzC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,4BAA4B,EAC5B,WAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,SAAiB,EACjB,QAAkB,EAClB,GAAQ,EACR,WAA6B,EAC7B,iBAAsC,KAAK;IAE3C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,GAAG;oBAC3B,CAAC,CAAC,EAAE,4BAA4B,EAAE,SAAS,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;aACR;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS;gBACT,WAAW,EAAE,UAAU;gBACvB,GAAG,CAAC,WAAW;oBACb,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,cAAc,EAAE,MAAM,WAAW,CAAC,gBAAgB,EAAE;4BACpD,KAAK,EAAE,WAAW,CAAC,KAAK;4BACxB,WAAW,EAAE,MAAM,WAAW,CAAC,aAAa,EAAE,EAAE;4BAChD,eAAe,EAAE,cAAc;yBAChC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,wBAAwB,QAAQ,EAAE,EAClC,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,SAAS,EAAE,aAAa,CAAC,UAAU;YACnC,OAAO,EAAE;gBACP,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC,aAAa;gBACjD,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc;gBACnD,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;gBAC3C,kBAAkB,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU;aACrD;YACD,cAAc,EAAE,mBAAmB,CAAC,aAAa,CAAC,eAAe,IAAI,EAAE,CAAC;SACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,wBAAwB,QAAQ,EAAE,EAClC,WAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAQ,EACR,WAAmB;IAEnB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,+BAA+B,EAC/B,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAuB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,+BAA+B,EAC/B,WAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAQ,EACR,WAAmB;IAEnB,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,iBAAiB,CAC5B,QAAQ,EACR,sCAAsC,EACtC,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,OAAO,aAAa,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,WAAW,CACnB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,YAAY,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,iBAAiB,CAC5B,KAAK,EACL,sCAAsC,EACtC,WAAW,CACZ,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { Env, Platform } from '../../shared/env.js';\nimport { getEnvUrls, getOidcClientId } from '../../shared/env.js';\nimport type { MetaMetricsAuth } from '../../shared/types/services.js';\nimport { HTTP_STATUS_CODES } from '../constants.js';\nimport {\n  NonceRetrievalError,\n  PairConflictError,\n  PairError,\n  SignInError,\n  ValidationError,\n  RateLimitedError,\n} from '../errors.js';\nimport { validatePairResponse } from '../utils/validate-pair-response.js';\nimport type {\n  AccessToken,\n  ErrorMessage,\n  LoginIdentifierType,\n  PairSocialIdentifierParams,\n  ProfileAlias,\n  UserProfile,\n  UserProfileLineage,\n} from './types.js';\nimport { AuthType } from './types.js';\n\n/**\n * Parse Retry-After header into milliseconds if possible.\n * Supports seconds or HTTP-date formats.\n *\n * @param retryAfterHeader - The Retry-After header value (seconds or HTTP-date)\n * @returns The retry delay in milliseconds, or null if parsing fails\n */\nfunction parseRetryAfter(retryAfterHeader: string | null): number | null {\n  if (!retryAfterHeader) {\n    return null;\n  }\n  const seconds = Number(retryAfterHeader);\n  if (!Number.isNaN(seconds)) {\n    return seconds * 1000;\n  }\n  const date = Date.parse(retryAfterHeader);\n  if (!Number.isNaN(date)) {\n    const diff = date - Date.now();\n    return diff > 0 ? diff : null;\n  }\n  return null;\n}\n\n/**\n * Extracts error details from a Response object.\n *\n * @param response - The HTTP response object\n * @returns Formatted error message with HTTP status and response body\n */\nasync function getResponseErrorMessage(response: Response): Promise<string> {\n  const { status } = response;\n  const clonedResponse = response.clone();\n\n  let message = 'Unknown error';\n  let error = 'unknown';\n\n  try {\n    const responseBody = (await response.json()) as\n      | ErrorMessage\n      // eslint-disable-next-line @typescript-eslint/naming-convention\n      | { error_description: string; error: string };\n\n    message =\n      'message' in responseBody\n        ? responseBody.message\n        : responseBody.error_description;\n    error = responseBody.error ?? 'unknown';\n  } catch {\n    try {\n      const textContent = await clonedResponse.text();\n      message = textContent\n        ? textContent.slice(0, 150)\n        : 'Non-JSON error response';\n      error = 'non_json_response';\n    } catch {\n      message = 'Unable to parse error response';\n      error = 'unparseable_response';\n    }\n  }\n\n  return `HTTP ${status} - ${message} (error: ${error})`;\n}\n\n/**\n * Type guard to check if an object is a Response-like object.\n *\n * @param obj - The object to check\n * @returns True if the object is a Response-like object, false otherwise\n */\nconst isErrorResponse = (obj: unknown): obj is Response =>\n  typeof obj === 'object' &&\n  obj !== null &&\n  'status' in obj &&\n  'headers' in obj;\n\n/**\n * Throws a domain-specific error for service failures.\n * Handles both HTTP error responses and regular errors (network failures, etc.).\n * For HTTP 429, throws RateLimitedError with Retry-After header parsing.\n *\n * @param error - The error (Response object or caught error)\n * @param errorPrefix - Context prefix for the error message\n * @param ErrorClass - The domain-specific error class to throw\n * @throws RateLimitedError for 429, otherwise ErrorClass\n */\nasync function throwServiceError(\n  error: unknown,\n  errorPrefix: string,\n  ErrorClass: new (message: string) => Error,\n): Promise<never> {\n  // Re-throw RateLimitedError or matching ErrorClass as-is (don't double-wrap)\n  if (error instanceof RateLimitedError || error instanceof ErrorClass) {\n    throw error;\n  }\n\n  // Not a Response-like object - handle as regular error\n  if (!isErrorResponse(error)) {\n    const errorMessage = error instanceof Error ? error.message : String(error);\n    throw new ErrorClass(`${errorPrefix}: ${errorMessage}`);\n  }\n\n  // Handle HTTP error response\n  const response = error;\n  const { status } = response;\n  const responseMessage = await getResponseErrorMessage(response);\n\n  if (status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {\n    const retryAfterHeader = response.headers.get('Retry-After');\n    const retryAfterMs = parseRetryAfter(retryAfterHeader);\n    throw new RateLimitedError(\n      `${errorPrefix}: ${responseMessage}`,\n      retryAfterMs ?? undefined,\n    );\n  }\n\n  throw new ErrorClass(`${errorPrefix}: ${responseMessage}`);\n}\n\nexport const NONCE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/nonce`;\n\nexport const PAIR_IDENTIFIERS = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/identifiers/pair`;\n\nexport const OIDC_TOKEN_URL = (env: Env): string =>\n  `${getEnvUrls(env).oidcApiUrl}/oauth2/token`;\n\nexport const SRP_LOGIN_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/srp/login`;\n\nexport const SIWE_LOGIN_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/siwe/login`;\n\nexport const PAIR_PROFILES_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/profile/pair`;\n\nexport const PAIR_SOCIAL_IDENTIFIER_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/profile/pair/identifier`;\n\nexport const PROFILE_LINEAGE_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/profile/lineage`;\n\nexport const CUSTOMER_SERVICE_TOKEN_URL = (env: Env): string =>\n  `${getEnvUrls(env).authApiUrl}/api/v2/customer-service/token`;\n\nconst getAuthenticationUrl = (authType: AuthType, env: Env): string => {\n  switch (authType) {\n    case AuthType.SRP:\n      return SRP_LOGIN_URL(env);\n    case AuthType.SiWE:\n      return SIWE_LOGIN_URL(env);\n    /* istanbul ignore next */\n    default:\n      throw new ValidationError(\n        `Invalid AuthType: ${authType as number} - unable to create Auth URL`,\n      );\n  }\n};\n\ntype NonceResponse = {\n  nonce: string;\n  identifier: string;\n  expiresIn: number;\n};\n\ntype RawProfileAlias = {\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  alias_profile_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  canonical_profile_id: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  identifier_ids: { id: string; type: string }[];\n};\n\nconst parseProfileAliases = (raw: RawProfileAlias[]): ProfileAlias[] => {\n  return raw.map((alias) => ({\n    aliasProfileId: alias.alias_profile_id,\n    canonicalProfileId: alias.canonical_profile_id,\n    identifierIds: alias.identifier_ids ?? [],\n  }));\n};\n\ntype PairRequest = {\n  signature: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  raw_message: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  encrypted_storage_key: string;\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  identifier_type: 'SIWE' | 'SRP';\n};\n\n/**\n * Pair multiple identifiers under a single profile\n *\n * @param nonce - session nonce\n * @param logins - pairing request payload\n * @param accessToken - JWT access token used to access protected resources\n * @param env - server environment\n * @returns void.\n */\nexport async function pairIdentifiers(\n  nonce: string,\n  logins: PairRequest[],\n  accessToken: string,\n  env: Env,\n): Promise<void> {\n  const pairUrl = new URL(PAIR_IDENTIFIERS(env));\n\n  try {\n    const response = await fetch(pairUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${accessToken}`,\n      },\n      body: JSON.stringify({\n        nonce,\n        logins,\n      }),\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to pair identifiers',\n        PairError,\n      );\n    }\n    return undefined;\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to pair identifiers',\n      PairError,\n    );\n  }\n}\n\nexport type PairProfilesResponse = {\n  profile: UserProfile;\n  profileAliases: ProfileAlias[];\n};\n\n/**\n * Pair multiple profiles using their OIDC access tokens.\n * Idempotent — calling with already-paired tokens is a no-op.\n *\n * @param accessTokens - Two or more OIDC access tokens to pair\n * @param authAccessToken - A valid access token for the Authorization header\n * @param env - server environment\n * @returns The pair response containing the canonical profile and aliases\n */\nexport async function pairProfiles(\n  accessTokens: string[],\n  authAccessToken: string,\n  env: Env,\n): Promise<PairProfilesResponse> {\n  const pairUrl = new URL(PAIR_PROFILES_URL(env));\n\n  try {\n    const response = await fetch(pairUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${authAccessToken}`,\n      },\n      body: JSON.stringify({\n        jwts: accessTokens,\n      }),\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to pair profiles',\n        PairError,\n      );\n    }\n\n    const pairResponse: unknown = await response.json();\n    validatePairResponse(pairResponse);\n\n    return {\n      profile: {\n        identifierId: pairResponse.profile.identifier_id,\n        metaMetricsId: pairResponse.profile.metametrics_id ?? '',\n        profileId: pairResponse.profile.profile_id,\n        canonicalProfileId: pairResponse.profile.profile_id,\n      },\n      profileAliases: parseProfileAliases(pairResponse.profile_aliases ?? []),\n    };\n  } catch (error) {\n    return await throwServiceError(error, 'Failed to pair profiles', PairError);\n  }\n}\n\n/**\n * Attach a Google/Apple/Telegram social identifier to the profile that\n * owns `authAccessToken` (`POST /api/v2/profile/pair/identifier`).\n *\n * `email` is omitted from the body when undefined. 409 Conflict throws\n * {@link PairConflictError} so callers can treat it as terminal. The\n * response body (new token + profile) is not consumed: a 2xx status is the\n * only success signal.\n *\n * @param params - Social identifier type, social JWT, and optional email\n * @param authAccessToken - Bearer token of the canonical (primary SRP) profile\n * @param env - server environment\n */\nexport async function pairSocialIdentifier(\n  params: PairSocialIdentifierParams,\n  authAccessToken: string,\n  env: Env,\n): Promise<void> {\n  const pairUrl = new URL(PAIR_SOCIAL_IDENTIFIER_URL(env));\n  const errorPrefix = 'Failed to pair social identifier';\n\n  try {\n    const response = await fetch(pairUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Authorization: `Bearer ${authAccessToken}`,\n      },\n      body: JSON.stringify({\n        identifier_type: params.identifierType,\n        social_jwt: params.socialJwt,\n        ...(params.email === undefined ? {} : { email: params.email }),\n      }),\n    });\n\n    if (!response.ok) {\n      if (response.status === HTTP_STATUS_CODES.CONFLICT) {\n        await throwServiceError(response, errorPrefix, PairConflictError);\n      }\n      await throwServiceError(response, errorPrefix, PairError);\n    }\n  } catch (error) {\n    await throwServiceError(error, errorPrefix, PairError);\n  }\n}\n\n/**\n * Service to Get Nonce for JWT Bearer Flow\n *\n * @param id - identifier ID\n * @param env - server environment\n * @returns the nonce.\n */\nexport async function getNonce(id: string, env: Env): Promise<NonceResponse> {\n  const nonceUrl = new URL(NONCE_URL(env));\n  nonceUrl.searchParams.set('identifier', id);\n\n  try {\n    const nonceResponse = await fetch(nonceUrl.toString());\n    if (!nonceResponse.ok) {\n      return await throwServiceError(\n        nonceResponse,\n        'Failed to get nonce',\n        NonceRetrievalError,\n      );\n    }\n\n    const nonceJson = await nonceResponse.json();\n    return {\n      nonce: nonceJson.nonce,\n      identifier: nonceJson.identifier,\n      expiresIn: nonceJson.expires_in,\n    };\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to get nonce',\n      NonceRetrievalError,\n    );\n  }\n}\n\n/**\n * Service to Authorize And perform OIDC Flow to get the Access Token\n *\n * @param jwtToken - The original token received from Authentication. This is traded for the Access Token. (the authentication token is single-use)\n * @param env - server environment\n * @param platform - SDK platform\n * @returns Access Token from Authorization server\n */\nexport async function authorizeOIDC(\n  jwtToken: string,\n  env: Env,\n  platform: Platform,\n): Promise<AccessToken> {\n  const grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';\n  const headers = {\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n\n  const urlEncodedBody = new URLSearchParams();\n  urlEncodedBody.append('grant_type', grantType);\n  urlEncodedBody.append('client_id', getOidcClientId(env, platform));\n  urlEncodedBody.append('assertion', jwtToken);\n\n  try {\n    const response = await fetch(OIDC_TOKEN_URL(env), {\n      method: 'POST',\n      headers,\n      body: urlEncodedBody.toString(),\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to get access token',\n        SignInError,\n      );\n    }\n\n    const accessTokenResponse = await response.json();\n    return {\n      accessToken: accessTokenResponse.access_token,\n      expiresIn: accessTokenResponse.expires_in,\n      obtainedAt: Date.now(),\n    };\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to get access token',\n      SignInError,\n    );\n  }\n}\n\ntype Authentication = {\n  token: string;\n  expiresIn: number;\n  profile: UserProfile;\n  profileAliases: ProfileAlias[];\n};\n/**\n * Service to Authenticate/Login a user via SIWE or SRP derived key.\n *\n * @param rawMessage - raw message for validation when authenticating\n * @param signature - signed raw message\n * @param authType - authentication type/flow used\n * @param env - server environment\n * @param metametrics - optional metametrics\n * @param identifierType - login identifier type included in metametrics\n *   (defaults to `SRP` when metametrics is present)\n * @returns Authentication Token\n */\nexport async function authenticate(\n  rawMessage: string,\n  signature: string,\n  authType: AuthType,\n  env: Env,\n  metametrics?: MetaMetricsAuth,\n  identifierType: LoginIdentifierType = 'SRP',\n): Promise<Authentication> {\n  const authenticationUrl = getAuthenticationUrl(authType, env);\n\n  try {\n    const response = await fetch(authenticationUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...(authType === AuthType.SRP\n          ? { 'X-MetaMask-Profile-Pairing': 'enabled' }\n          : {}),\n      },\n      body: JSON.stringify({\n        signature,\n        raw_message: rawMessage,\n        ...(metametrics\n          ? {\n              metametrics: {\n                metametrics_id: await metametrics.getMetaMetricsId(),\n                agent: metametrics.agent,\n                app_version: await metametrics.getAppVersion?.(),\n                identifier_type: identifierType,\n              },\n            }\n          : {}),\n      }),\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        `Failed to login with ${authType}`,\n        SignInError,\n      );\n    }\n\n    const loginResponse = await response.json();\n\n    return {\n      token: loginResponse.token,\n      expiresIn: loginResponse.expires_in,\n      profile: {\n        identifierId: loginResponse.profile.identifier_id,\n        metaMetricsId: loginResponse.profile.metametrics_id,\n        profileId: loginResponse.profile.profile_id,\n        canonicalProfileId: loginResponse.profile.profile_id,\n      },\n      profileAliases: parseProfileAliases(loginResponse.profile_aliases ?? []),\n    };\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      `Failed to login with ${authType}`,\n      SignInError,\n    );\n  }\n}\n\n/**\n * Service to get the Profile Lineage\n *\n * @param env - server environment\n * @param accessToken - JWT access token used to access protected resources\n * @returns Profile Lineage information.\n */\nexport async function getUserProfileLineage(\n  env: Env,\n  accessToken: string,\n): Promise<UserProfileLineage> {\n  const profileLineageUrl = new URL(PROFILE_LINEAGE_URL(env));\n\n  try {\n    const response = await fetch(profileLineageUrl, {\n      method: 'GET',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to get profile lineage',\n        SignInError,\n      );\n    }\n\n    const profileJson: UserProfileLineage = await response.json();\n    return profileJson;\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to get profile lineage',\n      SignInError,\n    );\n  }\n}\n\n/**\n * Service to get a Customer Service specific access token.\n *\n * Exchanges a valid OIDC access token for a short-lived token scoped to the\n * customer-service audience, which Customer Service tooling consumes to\n * identify and authenticate the user.\n *\n * @param env - server environment\n * @param accessToken - JWT access token used to access protected resources\n * @returns The customer-service access token.\n */\nexport async function getCustomerServiceToken(\n  env: Env,\n  accessToken: string,\n): Promise<string> {\n  const customerServiceTokenUrl = new URL(CUSTOMER_SERVICE_TOKEN_URL(env));\n\n  try {\n    const response = await fetch(customerServiceTokenUrl, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      return await throwServiceError(\n        response,\n        'Failed to get customer service token',\n        SignInError,\n      );\n    }\n\n    const tokenResponse = await response.json();\n    if (typeof tokenResponse?.access_token !== 'string') {\n      throw new SignInError(\n        'Failed to get customer service token: missing access_token',\n      );\n    }\n    return tokenResponse.access_token;\n  } catch (error) {\n    return await throwServiceError(\n      error,\n      'Failed to get customer service token',\n      SignInError,\n    );\n  }\n}\n"]}

package/dist/sdk/authentication-jwt-bearer/types.cjs

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthType = void 0;
-var AuthType;
-(function (AuthType) {
-    /* sign in using a private key derived from your secret recovery phrase (SRP).
-         Uses message signing snap to perform this operation */
-    AuthType["SRP"] = "SRP";
-    /* sign in with Ethereum */
-    AuthType["SiWE"] = "SiWE";
-})(AuthType || (exports.AuthType = AuthType = {}));
-//# sourceMappingURL=types.cjs.map