@metamask/profile-sync-controller 32.1.1 → 32.3.0

package/dist/sdk/errors.js

@@ -1,4 +1,183 @@
 import { HTTP_STATUS_CODES } from './constants.js';
+import { asRecord } from './utils/as-record.js';
+/**
+ * Base error for MFA operations.
+ *
+ * The machine-readable code is an enumerable own property so it survives
+ * JSON-RPC error serialization.
+ */
+export class MfaError extends Error {
+    mfaCode;
+    status;
+    retryAfterMs;
+    constructor(mfaCode, message, options) {
+        super(`MFA[${mfaCode}]: ${message}`);
+        this.name = 'MfaError';
+        this.mfaCode = mfaCode;
+        this.status = options?.status;
+        this.retryAfterMs = options?.retryAfterMs;
+    }
+}
+/**
+ * The credential cannot be enrolled because an equivalent one already exists:
+ * `email_already_enrolled` (this profile already has a verified email),
+ * `email_socially_verified` (the email is verified through a social login), or
+ * `credential_already_enrolled` (the email or passkey is enrolled on another
+ * profile; the profiles must be paired or the credential removed).
+ */
+export class CredentialAlreadyEnrolledError extends MfaError {
+    constructor(code, message, status = HTTP_STATUS_CODES.CONFLICT) {
+        super(code, message, { status });
+        this.name = 'CredentialAlreadyEnrolledError';
+    }
+}
+/**
+ * The profile already has MFA credentials, so enrolling another requires an
+ * `aal:2` access token; the client must complete a step-up and retry with the
+ * same flow.
+ */
+export class StepUpRequiredError extends MfaError {
+    constructor(message, status = HTTP_STATUS_CODES.FORBIDDEN) {
+        super('aal2_required', message, { status });
+        this.name = 'StepUpRequiredError';
+    }
+}
+export class CredentialNotEnrolledError extends MfaError {
+    constructor(message, status = HTTP_STATUS_CODES.CONFLICT) {
+        super('credential_not_enrolled', message, { status });
+        this.name = 'CredentialNotEnrolledError';
+    }
+}
+/**
+ * The begin/complete flow is stale or unknown; the client must restart it.
+ */
+export class MfaFlowExpiredError extends MfaError {
+    constructor(code, message, status) {
+        super(code, message, { status });
+        this.name = 'MfaFlowExpiredError';
+    }
+}
+/**
+ * The profile has no identity-provider record yet. Not a stale flow: the
+ * user must enroll a first credential before verifying.
+ */
+export class MfaIdentityMissingError extends MfaError {
+    constructor(message, status = HTTP_STATUS_CODES.CONFLICT) {
+        super('mfa_identity_missing', message, { status });
+        this.name = 'MfaIdentityMissingError';
+    }
+}
+export class MfaVerificationFailedError extends MfaError {
+    constructor(code, message, status) {
+        super(code, message, { status });
+        this.name = 'MfaVerificationFailedError';
+    }
+}
+export class TooManyAttemptsError extends MfaError {
+    constructor(message, status) {
+        super('too_many_attempts', message, { status });
+        this.name = 'TooManyAttemptsError';
+    }
+}
+export class MaxPasskeysReachedError extends MfaError {
+    constructor(message, status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY) {
+        super('max_passkeys_reached', message, { status });
+        this.name = 'MaxPasskeysReachedError';
+    }
+}
+export class MaxIdentifiersReachedError extends MfaError {
+    constructor(message, status = HTTP_STATUS_CODES.CONFLICT) {
+        super('max_identifiers_reached', message, { status });
+        this.name = 'MaxIdentifiersReachedError';
+    }
+}
+export class OtpResendCooldownError extends MfaError {
+    constructor(message, retryAfterMs, status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
+        super('otp_resend_cooldown', message, { status, retryAfterMs });
+        this.name = 'OtpResendCooldownError';
+    }
+}
+/**
+ * A 429 without an MFA-specific code: generic throttling, not an OTP resend
+ * cooldown.
+ */
+export class MfaRateLimitedError extends MfaError {
+    constructor(message, retryAfterMs, status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS) {
+        super('rate_limited', message, { status, retryAfterMs });
+        this.name = 'MfaRateLimitedError';
+    }
+}
+/**
+ * The identity provider or the network is unreachable. Safe to retry.
+ * `status` is only set when the service answered.
+ */
+export class MfaUnavailableError extends MfaError {
+    constructor(message, status) {
+        super('kratos_unavailable', message, { status });
+        this.name = 'MfaUnavailableError';
+    }
+}
+export class ElevatedTokenInvalidError extends MfaError {
+    constructor(message) {
+        super('elevated_token_invalid', message);
+        this.name = 'ElevatedTokenInvalidError';
+    }
+}
+/**
+ * Gets an MFA code from direct, serialized, or message-only errors.
+ *
+ * @param error - Value to inspect.
+ * @returns The stable code, if present.
+ */
+export function getMfaErrorCode(error) {
+    const direct = asRecord(error);
+    if (typeof direct?.mfaCode === 'string') {
+        return direct.mfaCode;
+    }
+    const data = asRecord(direct?.data);
+    const cause = asRecord(data?.cause);
+    if (typeof cause?.mfaCode === 'string') {
+        return cause.mfaCode;
+    }
+    const messages = [direct?.message, cause?.message];
+    for (const message of messages) {
+        if (typeof message === 'string') {
+            const match = /^MFA\[([^\]]+)\]:/u.exec(message);
+            if (match?.[1]) {
+                return match[1];
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Checks whether a value carries an MFA error code.
+ *
+ * @param error - Value to inspect.
+ * @param codes - Optional codes to match.
+ * @returns Whether the value is an MFA error with a requested code.
+ */
+export function isMfaError(error, ...codes) {
+    const code = getMfaErrorCode(error);
+    return code !== undefined && (codes.length === 0 || codes.includes(code));
+}
+/**
+ * Gets a retry delay from direct or serialized MFA errors.
+ *
+ * @param error - Value to inspect.
+ * @returns Retry delay in milliseconds, if present.
+ */
+export function getMfaRetryAfterMs(error) {
+    const direct = asRecord(error);
+    if (typeof direct?.retryAfterMs === 'number') {
+        return direct.retryAfterMs;
+    }
+    const data = asRecord(direct?.data);
+    const cause = asRecord(data?.cause);
+    return typeof cause?.retryAfterMs === 'number'
+        ? cause.retryAfterMs
+        : undefined;
+}
 export class NonceRetrievalError extends Error {
     constructor(message) {
         super(message);

package/dist/sdk/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IACrC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;IAE7C,YAAY,CAAU;IAE/B,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAU;QAChC,OAAO,CACL,CAAC,YAAY,gBAAgB;YAC7B,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpB,CAAC,KAAK,IAAI;gBACV,QAAQ,IAAI,CAAC;gBACb,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,CAAC,CACpD,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { HTTP_STATUS_CODES } from './constants.js';\n\nexport class NonceRetrievalError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NonceRetrievalError';\n  }\n}\n\nexport class SignInError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignInError';\n  }\n}\n\nexport class PairError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/profile/pair/identifier` returns 409 Conflict:\n * the social identifier already belongs to another canonical profile.\n * Retrying the same request cannot succeed.\n */\nexport class PairConflictError extends PairError {\n  readonly status = HTTP_STATUS_CODES.CONFLICT;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairConflictError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/oidc/token` returns 422: this profile has no\n * verified email on record. Consumers should send the user through email\n * OTP (or Google pair) and retry.\n */\nexport class EmailRequiredError extends Error {\n  readonly status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'EmailRequiredError';\n  }\n}\n\nexport class UserStorageError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UserStorageError';\n  }\n}\n\nexport class ValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UnsupportedAuthTypeError';\n  }\n}\n\nexport class NotFoundError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class RateLimitedError extends Error {\n  readonly status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS;\n\n  readonly retryAfterMs?: number;\n\n  constructor(message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = 'RateLimitedError';\n    this.retryAfterMs = retryAfterMs;\n  }\n\n  /**\n   * Check if an unknown error is a rate limit error (429 status).\n   *\n   * @param e - The error to check\n   * @returns True if the error is a rate limit error\n   */\n  static isRateLimitError(e: unknown): e is RateLimitedError {\n    return (\n      e instanceof RateLimitedError ||\n      (typeof e === 'object' &&\n        e !== null &&\n        'status' in e &&\n        e.status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS)\n    );\n  }\n}\n"]}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/sdk/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,OAAO,CAAyB;IAEhC,MAAM,CAAU;IAEhB,YAAY,CAAU;IAE/B,YACE,OAA+B,EAC/B,OAAe,EACf,OAAoD;QAEpD,KAAK,CAAC,OAAO,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,8BAA+B,SAAQ,QAAQ;IAC1D,YACE,IAG6B,EAC7B,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAEnC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,SAAS;QAC/D,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,IAAqC,EACrC,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YACE,IAAkE,EAClE,OAAe,EACf,MAAe;QAEf,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YACE,OAAe,EACf,MAAM,GAAG,iBAAiB,CAAC,oBAAoB;QAE/C,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,QAAQ;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,iBAAiB,CAAC,QAAQ;QAC9D,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,QAAQ;IAClD,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YACE,OAAe,EACf,YAAqB,EACrB,MAAM,GAAG,iBAAiB,CAAC,iBAAiB;QAE5C,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,QAAQ;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc;IAEd,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,KAAc,EACd,GAAG,KAA+B;IAElC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,YAAY,KAAK,QAAQ;QAC5C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IACrC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAE7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,GAAG,iBAAiB,CAAC,oBAAoB,CAAC;IAEzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;IAE7C,YAAY,CAAU;IAE/B,YAAY,OAAe,EAAE,YAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAU;QAChC,OAAO,CACL,CAAC,YAAY,gBAAgB;YAC7B,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpB,CAAC,KAAK,IAAI;gBACV,QAAQ,IAAI,CAAC;gBACb,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,iBAAiB,CAAC,CACpD,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { MfaErrorCode } from './authentication-jwt-bearer/mfa/types.js';\nimport { HTTP_STATUS_CODES } from './constants.js';\nimport { asRecord } from './utils/as-record.js';\n\ntype ExtensibleMfaErrorCode = MfaErrorCode | (string & {});\n\n/**\n * Base error for MFA operations.\n *\n * The machine-readable code is an enumerable own property so it survives\n * JSON-RPC error serialization.\n */\nexport class MfaError extends Error {\n  readonly mfaCode: ExtensibleMfaErrorCode;\n\n  readonly status?: number;\n\n  readonly retryAfterMs?: number;\n\n  constructor(\n    mfaCode: ExtensibleMfaErrorCode,\n    message: string,\n    options?: { status?: number; retryAfterMs?: number },\n  ) {\n    super(`MFA[${mfaCode}]: ${message}`);\n    this.name = 'MfaError';\n    this.mfaCode = mfaCode;\n    this.status = options?.status;\n    this.retryAfterMs = options?.retryAfterMs;\n  }\n}\n\n/**\n * The credential cannot be enrolled because an equivalent one already exists:\n * `email_already_enrolled` (this profile already has a verified email),\n * `email_socially_verified` (the email is verified through a social login), or\n * `credential_already_enrolled` (the email or passkey is enrolled on another\n * profile; the profiles must be paired or the credential removed).\n */\nexport class CredentialAlreadyEnrolledError extends MfaError {\n  constructor(\n    code:\n      | 'credential_already_enrolled'\n      | 'email_already_enrolled'\n      | 'email_socially_verified',\n    message: string,\n    status = HTTP_STATUS_CODES.CONFLICT,\n  ) {\n    super(code, message, { status });\n    this.name = 'CredentialAlreadyEnrolledError';\n  }\n}\n\n/**\n * The profile already has MFA credentials, so enrolling another requires an\n * `aal:2` access token; the client must complete a step-up and retry with the\n * same flow.\n */\nexport class StepUpRequiredError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.FORBIDDEN) {\n    super('aal2_required', message, { status });\n    this.name = 'StepUpRequiredError';\n  }\n}\n\nexport class CredentialNotEnrolledError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('credential_not_enrolled', message, { status });\n    this.name = 'CredentialNotEnrolledError';\n  }\n}\n\n/**\n * The begin/complete flow is stale or unknown; the client must restart it.\n */\nexport class MfaFlowExpiredError extends MfaError {\n  constructor(\n    code: 'flow_expired' | 'invalid_flow',\n    message: string,\n    status?: number,\n  ) {\n    super(code, message, { status });\n    this.name = 'MfaFlowExpiredError';\n  }\n}\n\n/**\n * The profile has no identity-provider record yet. Not a stale flow: the\n * user must enroll a first credential before verifying.\n */\nexport class MfaIdentityMissingError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('mfa_identity_missing', message, { status });\n    this.name = 'MfaIdentityMissingError';\n  }\n}\n\nexport class MfaVerificationFailedError extends MfaError {\n  constructor(\n    code: 'invalid_code' | 'invalid_attestation' | 'invalid_assertion',\n    message: string,\n    status?: number,\n  ) {\n    super(code, message, { status });\n    this.name = 'MfaVerificationFailedError';\n  }\n}\n\nexport class TooManyAttemptsError extends MfaError {\n  constructor(message: string, status?: number) {\n    super('too_many_attempts', message, { status });\n    this.name = 'TooManyAttemptsError';\n  }\n}\n\nexport class MaxPasskeysReachedError extends MfaError {\n  constructor(\n    message: string,\n    status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY,\n  ) {\n    super('max_passkeys_reached', message, { status });\n    this.name = 'MaxPasskeysReachedError';\n  }\n}\n\nexport class MaxIdentifiersReachedError extends MfaError {\n  constructor(message: string, status = HTTP_STATUS_CODES.CONFLICT) {\n    super('max_identifiers_reached', message, { status });\n    this.name = 'MaxIdentifiersReachedError';\n  }\n}\n\nexport class OtpResendCooldownError extends MfaError {\n  constructor(\n    message: string,\n    retryAfterMs?: number,\n    status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n  ) {\n    super('otp_resend_cooldown', message, { status, retryAfterMs });\n    this.name = 'OtpResendCooldownError';\n  }\n}\n\n/**\n * A 429 without an MFA-specific code: generic throttling, not an OTP resend\n * cooldown.\n */\nexport class MfaRateLimitedError extends MfaError {\n  constructor(\n    message: string,\n    retryAfterMs?: number,\n    status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS,\n  ) {\n    super('rate_limited', message, { status, retryAfterMs });\n    this.name = 'MfaRateLimitedError';\n  }\n}\n\n/**\n * The identity provider or the network is unreachable. Safe to retry.\n * `status` is only set when the service answered.\n */\nexport class MfaUnavailableError extends MfaError {\n  constructor(message: string, status?: number) {\n    super('kratos_unavailable', message, { status });\n    this.name = 'MfaUnavailableError';\n  }\n}\n\nexport class ElevatedTokenInvalidError extends MfaError {\n  constructor(message: string) {\n    super('elevated_token_invalid', message);\n    this.name = 'ElevatedTokenInvalidError';\n  }\n}\n\n/**\n * Gets an MFA code from direct, serialized, or message-only errors.\n *\n * @param error - Value to inspect.\n * @returns The stable code, if present.\n */\nexport function getMfaErrorCode(\n  error: unknown,\n): ExtensibleMfaErrorCode | undefined {\n  const direct = asRecord(error);\n  if (typeof direct?.mfaCode === 'string') {\n    return direct.mfaCode;\n  }\n\n  const data = asRecord(direct?.data);\n  const cause = asRecord(data?.cause);\n  if (typeof cause?.mfaCode === 'string') {\n    return cause.mfaCode;\n  }\n\n  const messages = [direct?.message, cause?.message];\n  for (const message of messages) {\n    if (typeof message === 'string') {\n      const match = /^MFA\\[([^\\]]+)\\]:/u.exec(message);\n      if (match?.[1]) {\n        return match[1];\n      }\n    }\n  }\n  return undefined;\n}\n\n/**\n * Checks whether a value carries an MFA error code.\n *\n * @param error - Value to inspect.\n * @param codes - Optional codes to match.\n * @returns Whether the value is an MFA error with a requested code.\n */\nexport function isMfaError(\n  error: unknown,\n  ...codes: ExtensibleMfaErrorCode[]\n): boolean {\n  const code = getMfaErrorCode(error);\n  return code !== undefined && (codes.length === 0 || codes.includes(code));\n}\n\n/**\n * Gets a retry delay from direct or serialized MFA errors.\n *\n * @param error - Value to inspect.\n * @returns Retry delay in milliseconds, if present.\n */\nexport function getMfaRetryAfterMs(error: unknown): number | undefined {\n  const direct = asRecord(error);\n  if (typeof direct?.retryAfterMs === 'number') {\n    return direct.retryAfterMs;\n  }\n  const data = asRecord(direct?.data);\n  const cause = asRecord(data?.cause);\n  return typeof cause?.retryAfterMs === 'number'\n    ? cause.retryAfterMs\n    : undefined;\n}\n\nexport class NonceRetrievalError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NonceRetrievalError';\n  }\n}\n\nexport class SignInError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignInError';\n  }\n}\n\nexport class PairError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/profile/pair/identifier` returns 409 Conflict:\n * the social identifier already belongs to another canonical profile.\n * Retrying the same request cannot succeed.\n */\nexport class PairConflictError extends PairError {\n  readonly status = HTTP_STATUS_CODES.CONFLICT;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'PairConflictError';\n  }\n}\n\n/**\n * Thrown when `POST /api/v2/oidc/token` returns 422: this profile has no\n * verified email on record. Consumers should send the user through email\n * OTP (or Google pair) and retry.\n */\nexport class EmailRequiredError extends Error {\n  readonly status = HTTP_STATUS_CODES.UNPROCESSABLE_ENTITY;\n\n  constructor(message: string) {\n    super(message);\n    this.name = 'EmailRequiredError';\n  }\n}\n\nexport class UserStorageError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UserStorageError';\n  }\n}\n\nexport class ValidationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class UnsupportedAuthTypeError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'UnsupportedAuthTypeError';\n  }\n}\n\nexport class NotFoundError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'NotFoundError';\n  }\n}\n\nexport class RateLimitedError extends Error {\n  readonly status = HTTP_STATUS_CODES.TOO_MANY_REQUESTS;\n\n  readonly retryAfterMs?: number;\n\n  constructor(message: string, retryAfterMs?: number) {\n    super(message);\n    this.name = 'RateLimitedError';\n    this.retryAfterMs = retryAfterMs;\n  }\n\n  /**\n   * Check if an unknown error is a rate limit error (429 status).\n   *\n   * @param e - The error to check\n   * @returns True if the error is a rate limit error\n   */\n  static isRateLimitError(e: unknown): e is RateLimitedError {\n    return (\n      e instanceof RateLimitedError ||\n      (typeof e === 'object' &&\n        e !== null &&\n        'status' in e &&\n        e.status === HTTP_STATUS_CODES.TOO_MANY_REQUESTS)\n    );\n  }\n}\n"]}

package/dist/sdk/index.d.ts

@@ -1,4 +1,7 @@
 export * from './authentication.js';
+export { MFA_CREDENTIAL_TYPES } from './authentication-jwt-bearer/mfa/types.js';
+export type { MfaCredentialType, MfaCredentialStatus, MfaErrorCode, EnrolledCredential, TokenReason, EnrollmentChallenge, EnrollmentProof, StepUpChallenge, StepUpProof, ElevatedProfileToken, BeginEnrollmentRequest, CompleteEnrollmentRequest, BeginStepUpRequest, CompleteStepUpRequest, GetElevatedTokenRequest, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, AuthenticationResponseJSON, } from './authentication-jwt-bearer/mfa/types.js';
+export type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';
 export * from './user-storage.js';
 export * from './errors.js';
 export * from './utils/messaging-signing-snap-requests.js';

package/dist/sdk/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAClD,YAAY,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACtF,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC"}

package/dist/sdk/index.js

@@ -1,4 +1,5 @@
 export * from './authentication.js';
+export { MFA_CREDENTIAL_TYPES } from './authentication-jwt-bearer/mfa/types.js';
 export * from './user-storage.js';
 export * from './errors.js';
 export * from './utils/messaging-signing-snap-requests.js';

package/dist/sdk/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC","sourcesContent":["export * from './authentication.js';\nexport * from './user-storage.js';\nexport * from './errors.js';\nexport * from './utils/messaging-signing-snap-requests.js';\nexport * from '../shared/encryption/index.js';\nexport * from '../shared/env.js';\nexport * from '../shared/storage-schema.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sdk/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAuBhF,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC","sourcesContent":["export * from './authentication.js';\nexport { MFA_CREDENTIAL_TYPES } from './authentication-jwt-bearer/mfa/types.js';\nexport type {\n  MfaCredentialType,\n  MfaCredentialStatus,\n  MfaErrorCode,\n  EnrolledCredential,\n  TokenReason,\n  EnrollmentChallenge,\n  EnrollmentProof,\n  StepUpChallenge,\n  StepUpProof,\n  ElevatedProfileToken,\n  BeginEnrollmentRequest,\n  CompleteEnrollmentRequest,\n  BeginStepUpRequest,\n  CompleteStepUpRequest,\n  GetElevatedTokenRequest,\n  PublicKeyCredentialCreationOptionsJSON,\n  PublicKeyCredentialRequestOptionsJSON,\n  RegistrationResponseJSON,\n  AuthenticationResponseJSON,\n} from './authentication-jwt-bearer/mfa/types.js';\nexport type { MfaStepUpAssertion } from './authentication-jwt-bearer/mfa/services.js';\nexport * from './user-storage.js';\nexport * from './errors.js';\nexport * from './utils/messaging-signing-snap-requests.js';\nexport * from '../shared/encryption/index.js';\nexport * from '../shared/env.js';\nexport * from '../shared/storage-schema.js';\n"]}

package/dist/sdk/mocks/auth.d.ts

@@ -9,6 +9,69 @@ export declare const MOCK_PAIR_SOCIAL_IDENTIFIER_URL: string;
 export declare const MOCK_PROFILE_LINEAGE_URL: string;
 export declare const MOCK_CUSTOMER_SERVICE_TOKEN_URL: string;
 export declare const MOCK_PARTNER_IDENTITY_TOKEN_URL: string;
+export declare const MOCK_MFA_ENROLL_URL: string;
+export declare const MOCK_MFA_ENROLL_COMPLETE_URL: string;
+export declare const MOCK_MFA_VERIFY_URL: string;
+export declare const MOCK_MFA_VERIFY_COMPLETE_URL: string;
+export declare const MOCK_MFA_CREDENTIALS_URL: string;
+export declare const MOCK_MFA_ENROLL_PASSKEY_RESPONSE: {
+    flow_id: string;
+    expires_at: string;
+    passkey_create_data: string;
+};
+export declare const MOCK_MFA_ENROLL_EMAIL_RESPONSE: {
+    flow_id: string;
+    expires_at: string;
+};
+export declare const MOCK_MFA_ENROLL_COMPLETE_RESPONSE: {
+    status: string;
+};
+export declare const MOCK_MFA_VERIFY_PASSKEY_RESPONSE: {
+    flow_id: string;
+    expires_at: string;
+    passkey_request_data: string;
+};
+export declare const MOCK_MFA_VERIFY_EMAIL_RESPONSE: {
+    flow_id: string;
+    expires_at: string;
+};
+export declare const MOCK_MFA_ASSERTION_JWT = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmODgyMjdiZC1iNjE1LTQxYTMtYjBiZS00NjdkZDc4MWE0YWQiLCJhYWwiOjIsImFtciI6InBhc3NrZXkiLCJleHAiOjQxMDI0NDQ4MDB9.signature";
+export declare const MOCK_MFA_VERIFY_COMPLETE_RESPONSE: {
+    token: string;
+    expires_in: number;
+    profile: {
+        profile_id: string;
+        identifier_id: string;
+        identifier_type: string;
+    };
+    profile_aliases: never[];
+};
+export declare const MOCK_MFA_CREDENTIALS_RESPONSE: {
+    credentials: ({
+        credential_type: string;
+        status: string;
+        enrolled_at: string;
+        passkey: {
+            display_name: string;
+            added_at: string;
+        };
+        email?: undefined;
+    } | {
+        passkey?: undefined;
+        credential_type: string;
+        status: string;
+        enrolled_at: string;
+        email: {
+            address: string;
+            verified: boolean;
+        };
+    })[];
+};
+export declare const MOCK_ELEVATED_ACCESS_JWT = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmODgyMjdiZC1iNjE1LTQxYTMtYjBiZS00NjdkZDc4MWE0YWQiLCJhYWwiOjIsImFtciI6WyJwYXNza2V5Il0sImV4cCI6NDEwMjQ0NDgwMH0.signature";
+export declare const MOCK_ELEVATED_ACCESS_TOKEN_RESPONSE: {
+    access_token: string;
+    expires_in: number;
+};
 export declare const MOCK_JWT = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ";
 export declare const MOCK_ACCESS_JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
 export declare const MOCK_NONCE_RESPONSE: {

package/dist/sdk/mocks/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAcpD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,sBAAsB,QAA6B,CAAC;AACjE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AACrE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AAEF,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,sLACyJ,CAAC;AAEtL,eAAO,MAAM,mBAAmB;IAC9B,KAAK;IACL,UAAU;IACV,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;QAIjC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;CAExB,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;QAIhC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;;CAGxB,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,2BAA2B;IACtC,OAAO;QACL,aAAa;QACb,cAAc;QACd,UAAU;;IAEZ,eAAe;CAChB,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;QAG7C,UAAU;QACV,aAAa;QACb,eAAe;QACf,UAAU;;;CAGb,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAqBpD,eAAO,MAAM,cAAc,QAAqB,CAAC;AACjD,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,yBAAyB,QAA4B,CAAC;AACnE,eAAO,MAAM,sBAAsB,QAA6B,CAAC;AACjE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AACrE,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,+BAA+B,QAE3C,CAAC;AACF,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,mBAAmB,QAA0B,CAAC;AAC3D,eAAO,MAAM,4BAA4B,QAAmC,CAAC;AAC7E,eAAO,MAAM,wBAAwB,QAA+B,CAAC;AA6BrE,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,mBAAmB;CACpB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,iCAAiC;IAC5C,MAAM;CACP,CAAC;AAEF,eAAO,MAAM,gCAAgC;IAC3C,OAAO;IACP,UAAU;IACV,oBAAoB;CACrB,CAAC;AAEF,eAAO,MAAM,8BAA8B;IACzC,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,sBAAsB,uKACmI,CAAC;AAEvK,eAAO,MAAM,iCAAiC;;;;QAI1C,UAAU;QACV,aAAa;QAEb,eAAe;;;CAGlB,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;YAOlC,YAAY;YACZ,QAAQ;;;;;;;;;YAQR,OAAO;YACP,QAAQ;;;CAIf,CAAC;AAEF,eAAO,MAAM,wBAAwB,0KACoI,CAAC;AAE1K,eAAO,MAAM,mCAAmC;;;CAG/C,CAAC;AAEF,eAAO,MAAM,QAAQ,upBACioB,CAAC;AAEvpB,eAAO,MAAM,eAAe,sLACyJ,CAAC;AAEtL,eAAO,MAAM,mBAAmB;IAC9B,KAAK;IACL,UAAU;IACV,UAAU;CACX,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;QAIjC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;CAExB,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;QAIhC,UAAU;QACV,cAAc;QACd,aAAa;QAEb,eAAe;QACf,qBAAqB;;;CAGxB,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;CAGpC,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;CAKhD,CAAC;AAEF,eAAO,MAAM,2BAA2B;IACtC,OAAO;QACL,aAAa;QACb,cAAc;QACd,UAAU;;IAEZ,eAAe;CAChB,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;QAG7C,UAAU;QACV,aAAa;QACb,eAAe;QACf,UAAU;;;CAGb,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;CAmB9C,CAAC"}

package/dist/sdk/mocks/auth.js

@@ -1,4 +1,5 @@
 import { Env, Platform } from '../../shared/env.js';
+import { MFA_CREDENTIALS_URL, MFA_ENROLL_COMPLETE_URL, MFA_ENROLL_URL, MFA_VERIFY_COMPLETE_URL, MFA_VERIFY_URL, } from '../authentication-jwt-bearer/mfa/services.js';
 import { NONCE_URL, SIWE_LOGIN_URL, SRP_LOGIN_URL, OIDC_TOKEN_URL, PAIR_IDENTIFIERS, PAIR_PROFILES_URL, PAIR_SOCIAL_IDENTIFIER_URL, PROFILE_LINEAGE_URL, CUSTOMER_SERVICE_TOKEN_URL, PARTNER_IDENTITY_TOKEN_URL, } from '../authentication-jwt-bearer/services.js';
 export const MOCK_NONCE_URL = NONCE_URL(Env.PRD);
 export const MOCK_SRP_LOGIN_URL = SRP_LOGIN_URL(Env.PRD);
@@ -10,6 +11,95 @@ export const MOCK_PAIR_SOCIAL_IDENTIFIER_URL = PAIR_SOCIAL_IDENTIFIER_URL(Env.PR
 export const MOCK_PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL(Env.PRD);
 export const MOCK_CUSTOMER_SERVICE_TOKEN_URL = CUSTOMER_SERVICE_TOKEN_URL(Env.PRD);
 export const MOCK_PARTNER_IDENTITY_TOKEN_URL = PARTNER_IDENTITY_TOKEN_URL(Env.PRD);
+export const MOCK_MFA_ENROLL_URL = MFA_ENROLL_URL(Env.PRD);
+export const MOCK_MFA_ENROLL_COMPLETE_URL = MFA_ENROLL_COMPLETE_URL(Env.PRD);
+export const MOCK_MFA_VERIFY_URL = MFA_VERIFY_URL(Env.PRD);
+export const MOCK_MFA_VERIFY_COMPLETE_URL = MFA_VERIFY_COMPLETE_URL(Env.PRD);
+export const MOCK_MFA_CREDENTIALS_URL = MFA_CREDENTIALS_URL(Env.PRD);
+const MOCK_PASSKEY_CREATE_DATA = {
+    publicKey: {
+        rp: {
+            name: 'MetaMask',
+            id: 'authentication.api.cx.metamask.io',
+        },
+        user: {
+            name: 'MetaMask 3f9a1c2b',
+            id: 'cHJvZmlsZS1pZA',
+            displayName: 'MetaMask 3f9a1c2b',
+        },
+        challenge: 'Y3JlYXRlLWNoYWxsZW5nZQ',
+        pubKeyCredParams: [{ type: 'public-key', alg: -7 }],
+        excludeCredentials: [],
+        attestation: 'none',
+    },
+};
+const MOCK_PASSKEY_REQUEST_DATA = {
+    publicKey: {
+        rpId: 'authentication.api.cx.metamask.io',
+        challenge: 'dmVyaWZ5LWNoYWxsZW5nZQ',
+        allowCredentials: [{ type: 'public-key', id: 'Y3JlZGVudGlhbC1pZA' }],
+        userVerification: 'required',
+    },
+};
+export const MOCK_MFA_ENROLL_PASSKEY_RESPONSE = {
+    flow_id: 'enroll-passkey-flow-id',
+    expires_at: '2099-09-07T14:30:00Z',
+    passkey_create_data: JSON.stringify(MOCK_PASSKEY_CREATE_DATA),
+};
+export const MOCK_MFA_ENROLL_EMAIL_RESPONSE = {
+    flow_id: 'enroll-email-flow-id',
+    expires_at: '2099-09-07T14:30:00Z',
+};
+export const MOCK_MFA_ENROLL_COMPLETE_RESPONSE = {
+    status: 'enrolled',
+};
+export const MOCK_MFA_VERIFY_PASSKEY_RESPONSE = {
+    flow_id: 'verify-passkey-flow-id',
+    expires_at: '2099-09-07T14:30:00Z',
+    passkey_request_data: JSON.stringify(MOCK_PASSKEY_REQUEST_DATA),
+};
+export const MOCK_MFA_VERIFY_EMAIL_RESPONSE = {
+    flow_id: 'verify-email-flow-id',
+    expires_at: '2099-09-07T14:30:00Z',
+};
+export const MOCK_MFA_ASSERTION_JWT = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmODgyMjdiZC1iNjE1LTQxYTMtYjBiZS00NjdkZDc4MWE0YWQiLCJhYWwiOjIsImFtciI6InBhc3NrZXkiLCJleHAiOjQxMDI0NDQ4MDB9.signature';
+export const MOCK_MFA_VERIFY_COMPLETE_RESPONSE = {
+    token: MOCK_MFA_ASSERTION_JWT,
+    expires_in: 900,
+    profile: {
+        profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',
+        identifier_id: 'da9a9fc7b09edde9cc23cec9b7e11a71fb0ab4d2ddd8af8af905306f3e1456fb',
+        identifier_type: 'SRP',
+    },
+    profile_aliases: [],
+};
+export const MOCK_MFA_CREDENTIALS_RESPONSE = {
+    credentials: [
+        {
+            credential_type: 'passkey',
+            status: 'active',
+            enrolled_at: '2026-09-15T10:00:00Z',
+            passkey: {
+                display_name: 'MetaMask 3f9a1c2b',
+                added_at: '2026-09-15T10:00:00Z',
+            },
+        },
+        {
+            credential_type: 'email_otp',
+            status: 'pending',
+            enrolled_at: '2026-09-15T10:05:00Z',
+            email: {
+                address: 'user@example.com',
+                verified: false,
+            },
+        },
+    ],
+};
+export const MOCK_ELEVATED_ACCESS_JWT = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmODgyMjdiZC1iNjE1LTQxYTMtYjBiZS00NjdkZDc4MWE0YWQiLCJhYWwiOjIsImFtciI6WyJwYXNza2V5Il0sImV4cCI6NDEwMjQ0NDgwMH0.signature';
+export const MOCK_ELEVATED_ACCESS_TOKEN_RESPONSE = {
+    access_token: MOCK_ELEVATED_ACCESS_JWT,
+    expires_in: 900,
+};
 export const MOCK_JWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';
 export const MOCK_ACCESS_JWT = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
 export const MOCK_NONCE_RESPONSE = {

package/dist/sdk/mocks/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,SAAS,EACT,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAElD,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CACvE,GAAG,CAAC,GAAG,CACR,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CACvE,GAAG,CAAC,GAAG,CACR,CAAC;AACF,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CACvE,GAAG,CAAC,GAAG,CACR,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GACnB,opBAAopB,CAAC;AAEvpB,MAAM,CAAC,MAAM,eAAe,GAC1B,mLAAmL,CAAC;AAEtL,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,4CAA4C;IACxD,UAAU,EAAE,GAAG;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,MAAM;QACvB,qBAAqB,EAAE,iCAAiC;KACzD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,4BAA4B;KACpD;IACD,eAAe,EAAE,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,2BAA2B;IAC1C,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,2BAA2B;IAC1C,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE;QACP,aAAa,EAAE,uBAAuB,CAAC,OAAO,CAAC,aAAa;QAC5D,cAAc,EAAE,uBAAuB,CAAC,OAAO,CAAC,cAAc;QAC9D,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,UAAU;KACvD;IACD,eAAe,EAAE,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sBAAsB;QAClC,aAAa,EAAE,uBAAuB,CAAC,OAAO,CAAC,aAAa;QAC5D,eAAe,EAAE,QAAQ;QACzB,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,UAAU;KACvD;IACD,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,UAAU,EAAE,sCAAsC;IAClD,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE;QACP;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;QACD;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,QAAQ,CAAC,SAAS;YACzB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;KACF;CACF,CAAC","sourcesContent":["import { Env, Platform } from '../../shared/env.js';\nimport {\n  NONCE_URL,\n  SIWE_LOGIN_URL,\n  SRP_LOGIN_URL,\n  OIDC_TOKEN_URL,\n  PAIR_IDENTIFIERS,\n  PAIR_PROFILES_URL,\n  PAIR_SOCIAL_IDENTIFIER_URL,\n  PROFILE_LINEAGE_URL,\n  CUSTOMER_SERVICE_TOKEN_URL,\n  PARTNER_IDENTITY_TOKEN_URL,\n} from '../authentication-jwt-bearer/services.js';\n\nexport const MOCK_NONCE_URL = NONCE_URL(Env.PRD);\nexport const MOCK_SRP_LOGIN_URL = SRP_LOGIN_URL(Env.PRD);\nexport const MOCK_OIDC_TOKEN_URL = OIDC_TOKEN_URL(Env.PRD);\nexport const MOCK_SIWE_LOGIN_URL = SIWE_LOGIN_URL(Env.PRD);\nexport const MOCK_PAIR_IDENTIFIERS_URL = PAIR_IDENTIFIERS(Env.PRD);\nexport const MOCK_PAIR_PROFILES_URL = PAIR_PROFILES_URL(Env.PRD);\nexport const MOCK_PAIR_SOCIAL_IDENTIFIER_URL = PAIR_SOCIAL_IDENTIFIER_URL(\n  Env.PRD,\n);\nexport const MOCK_PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL(Env.PRD);\nexport const MOCK_CUSTOMER_SERVICE_TOKEN_URL = CUSTOMER_SERVICE_TOKEN_URL(\n  Env.PRD,\n);\nexport const MOCK_PARTNER_IDENTITY_TOKEN_URL = PARTNER_IDENTITY_TOKEN_URL(\n  Env.PRD,\n);\n\nexport const MOCK_JWT =\n  'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';\n\nexport const MOCK_ACCESS_JWT =\n  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';\n\nexport const MOCK_NONCE_RESPONSE = {\n  nonce: 'xGMm9SoihEKeAEfV',\n  identifier: '0xd8641601Cb79a94FD872fE42d5b4a067A44a7e88',\n  expires_in: 300,\n};\n\nexport const MOCK_SIWE_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'fa2bbf82-bd9a-4e6b-aabc-9ca0d0319b6e',\n    metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n    identifier_id:\n      'ec9a4e9906836497efad2fd4d4290b34d2c6a2c0d93eb174aa3cd88a133adbaf',\n    identifier_type: 'SIWE',\n    encrypted_storage_key: '2c6a2c0d93eb174aa3cd88a133adbaf',\n  },\n};\n\nexport const MOCK_SRP_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n    metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n    identifier_id:\n      'da9a9fc7b09edde9cc23cec9b7e11a71fb0ab4d2ddd8af8af905306f3e1456fb',\n    identifier_type: 'SRP',\n    encrypted_storage_key: 'd2ddd8af8af905306f3e1456fb',\n  },\n  profile_aliases: [],\n};\n\nexport const MOCK_OIDC_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  expires_in: 3600,\n};\n\nexport const MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  refresh_token: 'ory_rt_mock_refresh_token',\n  expires_in: 3600,\n  token_type: 'bearer',\n};\n\nexport const MOCK_PARTNER_IDENTITY_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  refresh_token: 'ory_rt_mock_refresh_token',\n  expires_in: 3600,\n  token_type: 'bearer',\n};\n\nexport const MOCK_PAIR_PROFILES_RESPONSE = {\n  profile: {\n    identifier_id: MOCK_SRP_LOGIN_RESPONSE.profile.identifier_id,\n    metametrics_id: MOCK_SRP_LOGIN_RESPONSE.profile.metametrics_id,\n    profile_id: MOCK_SRP_LOGIN_RESPONSE.profile.profile_id,\n  },\n  profile_aliases: [],\n};\n\nexport const MOCK_PAIR_SOCIAL_IDENTIFIER_RESPONSE = {\n  expires_in: 3600,\n  profile: {\n    created_at: '2024-01-15T10:30:00Z',\n    identifier_id: MOCK_SRP_LOGIN_RESPONSE.profile.identifier_id,\n    identifier_type: 'GOOGLE',\n    profile_id: MOCK_SRP_LOGIN_RESPONSE.profile.profile_id,\n  },\n  token: MOCK_JWT,\n};\n\nexport const MOCK_USER_PROFILE_LINEAGE_RESPONSE = {\n  profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n  created_at: '2025-10-01T12:00:00Z',\n  lineage: [\n    {\n      metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n      agent: Platform.MOBILE,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 1,\n    },\n    {\n      metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n      agent: Platform.EXTENSION,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 2,\n    },\n  ],\n};\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/sdk/mocks/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,uBAAuB,EACvB,cAAc,GACf,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,SAAS,EACT,cAAc,EACd,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,0CAA0C,CAAC;AAElD,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CACvE,GAAG,CAAC,GAAG,CACR,CAAC;AACF,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CACvE,GAAG,CAAC,GAAG,CACR,CAAC;AACF,MAAM,CAAC,MAAM,+BAA+B,GAAG,0BAA0B,CACvE,GAAG,CAAC,GAAG,CACR,CAAC;AACF,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAErE,MAAM,wBAAwB,GAAG;IAC/B,SAAS,EAAE;QACT,EAAE,EAAE;YACF,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,mCAAmC;SACxC;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,gBAAgB;YACpB,WAAW,EAAE,mBAAmB;SACjC;QACD,SAAS,EAAE,wBAAwB;QACnC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACnD,kBAAkB,EAAE,EAAE;QACtB,WAAW,EAAE,MAAM;KACpB;CACF,CAAC;AAEF,MAAM,yBAAyB,GAAG;IAChC,SAAS,EAAE;QACT,IAAI,EAAE,mCAAmC;QACzC,SAAS,EAAE,wBAAwB;QACnC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC;QACpE,gBAAgB,EAAE,UAAU;KAC7B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,OAAO,EAAE,wBAAwB;IACjC,UAAU,EAAE,sBAAsB;IAClC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC;CAC9D,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,OAAO,EAAE,sBAAsB;IAC/B,UAAU,EAAE,sBAAsB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,MAAM,EAAE,UAAU;CACnB,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,OAAO,EAAE,wBAAwB;IACjC,UAAU,EAAE,sBAAsB;IAClC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC;CAChE,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,OAAO,EAAE,sBAAsB;IAC/B,UAAU,EAAE,sBAAsB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GACjC,oKAAoK,CAAC;AAEvK,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,KAAK,EAAE,sBAAsB;IAC7B,UAAU,EAAE,GAAG;IACf,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,KAAK;KACvB;IACD,eAAe,EAAE,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,WAAW,EAAE;QACX;YACE,eAAe,EAAE,SAAS;YAC1B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,sBAAsB;YACnC,OAAO,EAAE;gBACP,YAAY,EAAE,mBAAmB;gBACjC,QAAQ,EAAE,sBAAsB;aACjC;SACF;QACD;YACE,eAAe,EAAE,WAAW;YAC5B,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,sBAAsB;YACnC,KAAK,EAAE;gBACL,OAAO,EAAE,kBAAkB;gBAC3B,QAAQ,EAAE,KAAK;aAChB;SACF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GACnC,uKAAuK,CAAC;AAE1K,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,YAAY,EAAE,wBAAwB;IACtC,UAAU,EAAE,GAAG;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GACnB,opBAAopB,CAAC;AAEvpB,MAAM,CAAC,MAAM,eAAe,GAC1B,mLAAmL,CAAC;AAEtL,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,kBAAkB;IACzB,UAAU,EAAE,4CAA4C;IACxD,UAAU,EAAE,GAAG;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,MAAM;QACvB,qBAAqB,EAAE,iCAAiC;KACzD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sCAAsC;QAClD,cAAc,EAAE,sCAAsC;QACtD,aAAa,EACX,kEAAkE;QACpE,eAAe,EAAE,KAAK;QACtB,qBAAqB,EAAE,4BAA4B;KACpD;IACD,eAAe,EAAE,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,2BAA2B;IAC1C,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,2BAA2B;IAC1C,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,OAAO,EAAE;QACP,aAAa,EAAE,uBAAuB,CAAC,OAAO,CAAC,aAAa;QAC5D,cAAc,EAAE,uBAAuB,CAAC,OAAO,CAAC,cAAc;QAC9D,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,UAAU;KACvD;IACD,eAAe,EAAE,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE;QACP,UAAU,EAAE,sBAAsB;QAClC,aAAa,EAAE,uBAAuB,CAAC,OAAO,CAAC,aAAa;QAC5D,eAAe,EAAE,QAAQ;QACzB,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,UAAU;KACvD;IACD,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,UAAU,EAAE,sCAAsC;IAClD,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE;QACP;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;QACD;YACE,cAAc,EAAE,sCAAsC;YACtD,KAAK,EAAE,QAAQ,CAAC,SAAS;YACzB,UAAU,EAAE,sBAAsB;YAClC,UAAU,EAAE,sBAAsB;YAClC,OAAO,EAAE,CAAC;SACX;KACF;CACF,CAAC","sourcesContent":["import { Env, Platform } from '../../shared/env.js';\nimport {\n  MFA_CREDENTIALS_URL,\n  MFA_ENROLL_COMPLETE_URL,\n  MFA_ENROLL_URL,\n  MFA_VERIFY_COMPLETE_URL,\n  MFA_VERIFY_URL,\n} from '../authentication-jwt-bearer/mfa/services.js';\nimport {\n  NONCE_URL,\n  SIWE_LOGIN_URL,\n  SRP_LOGIN_URL,\n  OIDC_TOKEN_URL,\n  PAIR_IDENTIFIERS,\n  PAIR_PROFILES_URL,\n  PAIR_SOCIAL_IDENTIFIER_URL,\n  PROFILE_LINEAGE_URL,\n  CUSTOMER_SERVICE_TOKEN_URL,\n  PARTNER_IDENTITY_TOKEN_URL,\n} from '../authentication-jwt-bearer/services.js';\n\nexport const MOCK_NONCE_URL = NONCE_URL(Env.PRD);\nexport const MOCK_SRP_LOGIN_URL = SRP_LOGIN_URL(Env.PRD);\nexport const MOCK_OIDC_TOKEN_URL = OIDC_TOKEN_URL(Env.PRD);\nexport const MOCK_SIWE_LOGIN_URL = SIWE_LOGIN_URL(Env.PRD);\nexport const MOCK_PAIR_IDENTIFIERS_URL = PAIR_IDENTIFIERS(Env.PRD);\nexport const MOCK_PAIR_PROFILES_URL = PAIR_PROFILES_URL(Env.PRD);\nexport const MOCK_PAIR_SOCIAL_IDENTIFIER_URL = PAIR_SOCIAL_IDENTIFIER_URL(\n  Env.PRD,\n);\nexport const MOCK_PROFILE_LINEAGE_URL = PROFILE_LINEAGE_URL(Env.PRD);\nexport const MOCK_CUSTOMER_SERVICE_TOKEN_URL = CUSTOMER_SERVICE_TOKEN_URL(\n  Env.PRD,\n);\nexport const MOCK_PARTNER_IDENTITY_TOKEN_URL = PARTNER_IDENTITY_TOKEN_URL(\n  Env.PRD,\n);\nexport const MOCK_MFA_ENROLL_URL = MFA_ENROLL_URL(Env.PRD);\nexport const MOCK_MFA_ENROLL_COMPLETE_URL = MFA_ENROLL_COMPLETE_URL(Env.PRD);\nexport const MOCK_MFA_VERIFY_URL = MFA_VERIFY_URL(Env.PRD);\nexport const MOCK_MFA_VERIFY_COMPLETE_URL = MFA_VERIFY_COMPLETE_URL(Env.PRD);\nexport const MOCK_MFA_CREDENTIALS_URL = MFA_CREDENTIALS_URL(Env.PRD);\n\nconst MOCK_PASSKEY_CREATE_DATA = {\n  publicKey: {\n    rp: {\n      name: 'MetaMask',\n      id: 'authentication.api.cx.metamask.io',\n    },\n    user: {\n      name: 'MetaMask 3f9a1c2b',\n      id: 'cHJvZmlsZS1pZA',\n      displayName: 'MetaMask 3f9a1c2b',\n    },\n    challenge: 'Y3JlYXRlLWNoYWxsZW5nZQ',\n    pubKeyCredParams: [{ type: 'public-key', alg: -7 }],\n    excludeCredentials: [],\n    attestation: 'none',\n  },\n};\n\nconst MOCK_PASSKEY_REQUEST_DATA = {\n  publicKey: {\n    rpId: 'authentication.api.cx.metamask.io',\n    challenge: 'dmVyaWZ5LWNoYWxsZW5nZQ',\n    allowCredentials: [{ type: 'public-key', id: 'Y3JlZGVudGlhbC1pZA' }],\n    userVerification: 'required',\n  },\n};\n\nexport const MOCK_MFA_ENROLL_PASSKEY_RESPONSE = {\n  flow_id: 'enroll-passkey-flow-id',\n  expires_at: '2099-09-07T14:30:00Z',\n  passkey_create_data: JSON.stringify(MOCK_PASSKEY_CREATE_DATA),\n};\n\nexport const MOCK_MFA_ENROLL_EMAIL_RESPONSE = {\n  flow_id: 'enroll-email-flow-id',\n  expires_at: '2099-09-07T14:30:00Z',\n};\n\nexport const MOCK_MFA_ENROLL_COMPLETE_RESPONSE = {\n  status: 'enrolled',\n};\n\nexport const MOCK_MFA_VERIFY_PASSKEY_RESPONSE = {\n  flow_id: 'verify-passkey-flow-id',\n  expires_at: '2099-09-07T14:30:00Z',\n  passkey_request_data: JSON.stringify(MOCK_PASSKEY_REQUEST_DATA),\n};\n\nexport const MOCK_MFA_VERIFY_EMAIL_RESPONSE = {\n  flow_id: 'verify-email-flow-id',\n  expires_at: '2099-09-07T14:30:00Z',\n};\n\nexport const MOCK_MFA_ASSERTION_JWT =\n  'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmODgyMjdiZC1iNjE1LTQxYTMtYjBiZS00NjdkZDc4MWE0YWQiLCJhYWwiOjIsImFtciI6InBhc3NrZXkiLCJleHAiOjQxMDI0NDQ4MDB9.signature';\n\nexport const MOCK_MFA_VERIFY_COMPLETE_RESPONSE = {\n  token: MOCK_MFA_ASSERTION_JWT,\n  expires_in: 900,\n  profile: {\n    profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n    identifier_id:\n      'da9a9fc7b09edde9cc23cec9b7e11a71fb0ab4d2ddd8af8af905306f3e1456fb',\n    identifier_type: 'SRP',\n  },\n  profile_aliases: [],\n};\n\nexport const MOCK_MFA_CREDENTIALS_RESPONSE = {\n  credentials: [\n    {\n      credential_type: 'passkey',\n      status: 'active',\n      enrolled_at: '2026-09-15T10:00:00Z',\n      passkey: {\n        display_name: 'MetaMask 3f9a1c2b',\n        added_at: '2026-09-15T10:00:00Z',\n      },\n    },\n    {\n      credential_type: 'email_otp',\n      status: 'pending',\n      enrolled_at: '2026-09-15T10:05:00Z',\n      email: {\n        address: 'user@example.com',\n        verified: false,\n      },\n    },\n  ],\n};\n\nexport const MOCK_ELEVATED_ACCESS_JWT =\n  'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJmODgyMjdiZC1iNjE1LTQxYTMtYjBiZS00NjdkZDc4MWE0YWQiLCJhYWwiOjIsImFtciI6WyJwYXNza2V5Il0sImV4cCI6NDEwMjQ0NDgwMH0.signature';\n\nexport const MOCK_ELEVATED_ACCESS_TOKEN_RESPONSE = {\n  access_token: MOCK_ELEVATED_ACCESS_JWT,\n  expires_in: 900,\n};\n\nexport const MOCK_JWT =\n  'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImIwNzE2N2U2LWJjNWUtNDgyZC1hNjRhLWU1MjQ0MjY2MGU3NyJ9.eyJzdWIiOiI1MzE0ODc5YWM2NDU1OGI3OTQ5ZmI4NWIzMjg2ZjZjNjUwODAzYmFiMTY0Y2QyOWNmMmM3YzdmMjMzMWMwZTRlIiwiaWF0IjoxNzA2MTEzMDYyLCJleHAiOjE3NjkxODUwNjMsImlzcyI6ImF1dGgubWV0YW1hc2suaW8iLCJhdWQiOiJwb3J0Zm9saW8ubWV0YW1hc2suaW8ifQ.E5UL6oABNweS8t5a6IBTqTf7NLOJbrhJSmEcsr7kwLp4bGvcENJzACwnsHDkA6PlzfDV09ZhAGU_F3hlS0j-erbY0k0AFR-GAtyS7E9N02D8RgUDz5oDR65CKmzM8JilgFA8UvruJ6OJGogroaOSOqzRES_s8MjHpP47RJ9lXrUesajsbOudXbuksXWg5QmWip6LLvjwr8UUzcJzNQilyIhiEpo4WdzWM4R3VtTwr4rHnWEvtYnYCov1jmI2w3YQ48y0M-3Y9IOO0ov_vlITRrOnR7Y7fRUGLUFmU5msD8mNWRywjQFLHfJJ1yNP5aJ8TkuCK3sC6kcUH335IVvukQ';\n\nexport const MOCK_ACCESS_JWT =\n  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjQxMDI0NDQ4MDB9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';\n\nexport const MOCK_NONCE_RESPONSE = {\n  nonce: 'xGMm9SoihEKeAEfV',\n  identifier: '0xd8641601Cb79a94FD872fE42d5b4a067A44a7e88',\n  expires_in: 300,\n};\n\nexport const MOCK_SIWE_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'fa2bbf82-bd9a-4e6b-aabc-9ca0d0319b6e',\n    metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n    identifier_id:\n      'ec9a4e9906836497efad2fd4d4290b34d2c6a2c0d93eb174aa3cd88a133adbaf',\n    identifier_type: 'SIWE',\n    encrypted_storage_key: '2c6a2c0d93eb174aa3cd88a133adbaf',\n  },\n};\n\nexport const MOCK_SRP_LOGIN_RESPONSE = {\n  token: MOCK_JWT,\n  expires_in: 3600,\n  profile: {\n    profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n    metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n    identifier_id:\n      'da9a9fc7b09edde9cc23cec9b7e11a71fb0ab4d2ddd8af8af905306f3e1456fb',\n    identifier_type: 'SRP',\n    encrypted_storage_key: 'd2ddd8af8af905306f3e1456fb',\n  },\n  profile_aliases: [],\n};\n\nexport const MOCK_OIDC_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  expires_in: 3600,\n};\n\nexport const MOCK_CUSTOMER_SERVICE_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  refresh_token: 'ory_rt_mock_refresh_token',\n  expires_in: 3600,\n  token_type: 'bearer',\n};\n\nexport const MOCK_PARTNER_IDENTITY_TOKEN_RESPONSE = {\n  access_token: MOCK_ACCESS_JWT,\n  refresh_token: 'ory_rt_mock_refresh_token',\n  expires_in: 3600,\n  token_type: 'bearer',\n};\n\nexport const MOCK_PAIR_PROFILES_RESPONSE = {\n  profile: {\n    identifier_id: MOCK_SRP_LOGIN_RESPONSE.profile.identifier_id,\n    metametrics_id: MOCK_SRP_LOGIN_RESPONSE.profile.metametrics_id,\n    profile_id: MOCK_SRP_LOGIN_RESPONSE.profile.profile_id,\n  },\n  profile_aliases: [],\n};\n\nexport const MOCK_PAIR_SOCIAL_IDENTIFIER_RESPONSE = {\n  expires_in: 3600,\n  profile: {\n    created_at: '2024-01-15T10:30:00Z',\n    identifier_id: MOCK_SRP_LOGIN_RESPONSE.profile.identifier_id,\n    identifier_type: 'GOOGLE',\n    profile_id: MOCK_SRP_LOGIN_RESPONSE.profile.profile_id,\n  },\n  token: MOCK_JWT,\n};\n\nexport const MOCK_USER_PROFILE_LINEAGE_RESPONSE = {\n  profile_id: 'f88227bd-b615-41a3-b0be-467dd781a4ad',\n  created_at: '2025-10-01T12:00:00Z',\n  lineage: [\n    {\n      metametrics_id: '561ec651-a844-4b36-a451-04d6eac35740',\n      agent: Platform.MOBILE,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 1,\n    },\n    {\n      metametrics_id: 'de742679-4960-4977-a415-4718b5f8e86c',\n      agent: Platform.EXTENSION,\n      created_at: '2025-10-01T12:00:00Z',\n      updated_at: '2025-10-01T12:00:00Z',\n      counter: 2,\n    },\n  ],\n};\n"]}

package/dist/sdk/utils/as-record.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Narrows an unknown value to a plain record, for reading optional fields off
+ * untrusted data (parsed JSON, decoded JWT payloads) before it has been
+ * validated against a struct.
+ *
+ * @param value - The value to narrow.
+ * @returns The value as a record, or undefined if it is not an object.
+ */
+export declare function asRecord(value: unknown): Record<string, unknown> | undefined;
+//# sourceMappingURL=as-record.d.ts.map

package/dist/sdk/utils/as-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"as-record.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/as-record.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAI5E"}

package/dist/sdk/utils/as-record.js

@@ -0,0 +1,14 @@
+/**
+ * Narrows an unknown value to a plain record, for reading optional fields off
+ * untrusted data (parsed JSON, decoded JWT payloads) before it has been
+ * validated against a struct.
+ *
+ * @param value - The value to narrow.
+ * @returns The value as a record, or undefined if it is not an object.
+ */
+export function asRecord(value) {
+    return typeof value === 'object' && value !== null
+        ? value
+        : undefined;
+}
+//# sourceMappingURL=as-record.js.map

package/dist/sdk/utils/as-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"as-record.js","sourceRoot":"","sources":["../../../src/sdk/utils/as-record.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Narrows an unknown value to a plain record, for reading optional fields off\n * untrusted data (parsed JSON, decoded JWT payloads) before it has been\n * validated against a struct.\n *\n * @param value - The value to narrow.\n * @returns The value as a record, or undefined if it is not an object.\n */\nexport function asRecord(value: unknown): Record<string, unknown> | undefined {\n  return typeof value === 'object' && value !== null\n    ? (value as Record<string, unknown>)\n    : undefined;\n}\n"]}

package/dist/sdk/utils/jwt.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Decodes a JWT payload without verifying its signature.
+ *
+ * Use this only for inspecting claims on a token received from a trusted
+ * exchange. Signature verification remains the authorization server's
+ * responsibility.
+ *
+ * @param token - JWT to decode.
+ * @returns The parsed payload.
+ * @throws If the token or payload is malformed.
+ */
+export declare function decodeJwtPayload(token: string): unknown;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/sdk/utils/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASvD"}

package/dist/sdk/utils/jwt.js

@@ -0,0 +1,21 @@
+/**
+ * Decodes a JWT payload without verifying its signature.
+ *
+ * Use this only for inspecting claims on a token received from a trusted
+ * exchange. Signature verification remains the authorization server's
+ * responsibility.
+ *
+ * @param token - JWT to decode.
+ * @returns The parsed payload.
+ * @throws If the token or payload is malformed.
+ */
+export function decodeJwtPayload(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3 || !parts[1]) {
+        throw new Error('Invalid JWT');
+    }
+    const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+    return JSON.parse(atob(padded));
+}
+//# sourceMappingURL=jwt.js.map

package/dist/sdk/utils/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/sdk/utils/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAClC,CAAC","sourcesContent":["/**\n * Decodes a JWT payload without verifying its signature.\n *\n * Use this only for inspecting claims on a token received from a trusted\n * exchange. Signature verification remains the authorization server's\n * responsibility.\n *\n * @param token - JWT to decode.\n * @returns The parsed payload.\n * @throws If the token or payload is malformed.\n */\nexport function decodeJwtPayload(token: string): unknown {\n  const parts = token.split('.');\n  if (parts.length !== 3 || !parts[1]) {\n    throw new Error('Invalid JWT');\n  }\n\n  const base64 = parts[1].replace(/-/gu, '+').replace(/_/gu, '/');\n  const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n  return JSON.parse(atob(padded));\n}\n"]}

package/dist/sdk/utils/to-error-message.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Extracts a human-readable message from a caught value.
+ *
+ * @param error - The caught value.
+ * @returns The error's message, or its string form when it is not an Error.
+ */
+export declare function toErrorMessage(error: unknown): string;
+//# sourceMappingURL=to-error-message.d.ts.map

package/dist/sdk/utils/to-error-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-error-message.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/to-error-message.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAErD"}

package/dist/sdk/utils/to-error-message.js

@@ -0,0 +1,10 @@
+/**
+ * Extracts a human-readable message from a caught value.
+ *
+ * @param error - The caught value.
+ * @returns The error's message, or its string form when it is not an Error.
+ */
+export function toErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=to-error-message.js.map

package/dist/sdk/utils/to-error-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-error-message.js","sourceRoot":"","sources":["../../../src/sdk/utils/to-error-message.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC","sourcesContent":["/**\n * Extracts a human-readable message from a caught value.\n *\n * @param error - The caught value.\n * @returns The error's message, or its string form when it is not an Error.\n */\nexport function toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n"]}

package/dist/sdk/utils/validate-login-response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-login-response.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAgB5E"}
+{"version":3,"file":"validate-login-response.d.ts","sourceRoot":"","sources":["../../../src/sdk/utils/validate-login-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG1D;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAgB5E"}