@metamask/profile-sync-controller 32.3.1 → 34.0.0

package/CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [34.0.0]
+
+### Changed
+
+- Open the verification session on enrollment and let the server set its lifetime ([#10653](https://github.com/MetaMask/core/pull/10653))
+  - `completeCredentialEnrollment` opens a verification session with the assertion `POST /api/v2/mfa/enroll/complete` returns for the new credential, replacing any earlier one, so no separate verification is needed right after enrolling. If the token exchange fails, the enrollment still succeeds and the earlier session is kept
+  - `SRPJwtBearerAuth.completeMfaEnrollment` and `JwtBearerAuth.completeMfaEnrollment` return that assertion
+  - The session lasts for the token's `expires_in`, measured on the device clock, instead of at most 15 minutes
+- Replace JS AES implementation with `@metamask/cryptography` ([#10621](https://github.com/MetaMask/core/pull/10621))
+- Bump `immer` from `^9.0.21` to `^11.1.18` ([#10382](https://github.com/MetaMask/core/pull/10382))
+
+### Removed
+
+- **BREAKING:** Remove `VERIFICATION_SESSION_TTL_MS`, as the server now sets the verification session lifetime ([#10653](https://github.com/MetaMask/core/pull/10653))
+
+### Fixed
+
+- Coalesce overlapping `performSignIn` calls so only one sign-in runs at a time ([#10646](https://github.com/MetaMask/core/pull/10646))
+- Rely on `@metamask/key-tree` crypto implementation for HMAC-SHA-512 instead of hardcoded `noble` implementation ([#10424](https://github.com/MetaMask/core/pull/10424))
+  - `@metamask/key-tree` uses WebCrypto API if available and fallback to `noble` otherwise.
+  - One note, we expect the platform to provide a fully-compliant WebCrypto (`crypto.subtle`) implementation for this to work (`@metamask/key-tree` detection is global and not "per crypto functions").
+
+## [33.0.0]
+
+### Changed
+
+- **BREAKING:** Rename MFA "step-up" to "credential verification", matching the authentication API's `verify` endpoints ([#10432](https://github.com/MetaMask/core/pull/10432), [#10460](https://github.com/MetaMask/core/pull/10460))
+  - Methods and messenger actions: `beginStepUp` → `beginCredentialVerification`, `completeStepUp` → `completeCredentialVerification`, `getElevatedProfileToken` → `getVerificationToken`, `clearStepUpSession` → `clearVerificationSession`
+  - Constant: `STEP_UP_SESSION_TTL_MS` → `VERIFICATION_SESSION_TTL_MS`
+  - State: `stepUpSessionExpiresAt` is removed; call `getVerificationToken()` to check for a live verification session
+  - Types: `ElevatedProfileToken` → `VerificationToken`, `GetElevatedTokenRequest` → `GetVerificationTokenRequest`, and `StepUp` becomes `Verification` in `BeginStepUpRequest`, `CompleteStepUpRequest`, `StepUpChallenge`, `StepUpProof` and `MfaStepUpAssertion`
+  - Error: `ElevatedTokenInvalidError` (`elevated_token_invalid`) → `VerificationTokenInvalidError` (`verification_token_invalid`)
+  - Trace spans: `MFA Step-Up Begin` / `Complete` → `MFA Verification Begin` / `Complete`
+- **BREAKING:** Accept MFA data as the server sends it ([#10432](https://github.com/MetaMask/core/pull/10432))
+  - `email_otp` credentials without an address are kept: `EnrolledCredential.email` is now optional
+  - Verification tokens are accepted with any `amr` method name and any `aal`: `claims.amr` is widened and `claims.aal` is removed, since the server enforces assurance levels
+- Let one verification cover a whole setup flow ([#10432](https://github.com/MetaMask/core/pull/10432))
+  - The verification session lasts as long as its token, up to 15 minutes instead of 1
+  - Enrolling a credential no longer ends the session
+  - `beginCredentialEnrollment` only uses a session younger than 2 minutes (`ENROLLMENT_MAX_SESSION_AGE_MS`), or than its new `maxSessionAgeMs` option
+- Bump `@metamask/seedless-onboarding-controller` from `^11.0.0` to `^11.0.1`. ([#10433](https://github.com/MetaMask/core/pull/10433))
+
 ## [32.3.1]
 
 ### Changed
@@ -19,7 +61,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Support AAL2-gated MFA enrollment and sync the MFA SDK with the latest authentication API spec ([#10374](https://github.com/MetaMask/core/pull/10374))
   - `beginMfaEnrollment` accepts an `accessToken` option so enrollment can begin with an elevated token
-  - `AuthenticationController.beginCredentialEnrollment` sends the elevated token while a step-up session is live, since enrolling additional credentials requires AAL2
+  - `AuthenticationController.beginCredentialEnrollment` sends the verification token while a step-up session is live, since enrolling additional credentials requires AAL2
   - Add the `email_socially_verified`, `multi_primary_srp` and `aal2_required` MFA error codes, a `StepUpRequiredError` class, and support for the `retry_after_seconds` error field when computing `retryAfterMs`
 - Add `pairedIdentifierIds` to `UserProfile` in `srpSessionData`, set from the login response and, on the primary SRP session, from the SRP and social pairing responses, so clients can tell whether a profile has been socially paired ([#10394](https://github.com/MetaMask/core/pull/10394))
 
@@ -1000,7 +1042,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial release
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@32.3.1...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@34.0.0...HEAD
+[34.0.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@33.0.0...@metamask/profile-sync-controller@34.0.0
+[33.0.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@32.3.1...@metamask/profile-sync-controller@33.0.0
 [32.3.1]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@32.3.0...@metamask/profile-sync-controller@32.3.1
 [32.3.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@32.2.0...@metamask/profile-sync-controller@32.3.0
 [32.2.0]: https://github.com/MetaMask/core/compare/@metamask/profile-sync-controller@32.1.1...@metamask/profile-sync-controller@32.2.0

package/README.md

@@ -45,23 +45,38 @@ import { ... } from '@metamask/profile-sync-controller/user-storage/mocks'
 ## Multi-factor authentication
 
 `AuthenticationController` exposes UI-independent primitives for passkey and
-email OTP enrollment and step-up verification:
+email OTP enrollment and verification:
 
 - `refreshEnrolledCredentials()` refreshes the in-memory credential list.
 - `beginCredentialEnrollment()` and `completeCredentialEnrollment()` surround
-  a client-owned passkey ceremony or email-code screen. Beginning enrollment
-  of a second or later credential requires an elevated session:
-  `beginCredentialEnrollment()` sends the elevated token while one is live,
-  and the server otherwise rejects it with `aal2_required`, so clients should
-  step up and retry.
-- `beginStepUp()` and `completeStepUp()` verify an enrolled credential and
-  return an elevated profile token.
-- `getElevatedProfileToken()` reuses a live elevated session when it satisfies
-  the caller's freshness requirement; `clearStepUpSession()` clears it.
+  a client-owned passkey ceremony or email-code screen. Once the profile has a
+  credential that proves AAL2, the server requires an AAL2 token to begin
+  enrolling another one: `beginCredentialEnrollment()` sends the verification
+  token only while a session younger than `ENROLLMENT_MAX_SESSION_AGE_MS`
+  (2 minutes) is live, and the server otherwise rejects it with
+  `aal2_required`, so clients should verify an existing credential and retry.
+  The controller never inspects the token's assurance level; the server
+  decides. A setup flow that proved a factor itself can pass
+  `maxSessionAgeMs` (for example, the time since the flow started) so chained
+  enrollments reuse that proof. `completeCredentialEnrollment()` opens a
+  verification session with the assertion the server returns for the new
+  credential (replacing any earlier one), so no separate verification is
+  needed right after enrolling.
+- `beginCredentialVerification()` and `completeCredentialVerification()`
+  verify an enrolled credential and return a verification token.
+- `getVerificationToken()` reuses a live verification session when it satisfies
+  the caller's freshness requirement; `clearVerificationSession()` clears it. The
+  session lasts as long as the server says the token does (`expires_in`,
+  measured from when it was obtained) and ends on lock, sign-out, reset, or a
+  rejected base session. It is
+  a low-level read: features should go through the client MFA kit
+  (`verifyOrEnroll`), which reuses a matching session without showing any
+  screen. Read it directly only from code that cannot show UI, and treat `null`
+  as "let the UI layer ask".
 
 Clients must retain the challenge `flowId`, perform the platform ceremony, and
 send the resulting proof to the matching completion method. OTP codes,
-passkey results, and elevated tokens are never persisted in controller state.
+passkey results, and verification tokens are never persisted in controller state.
 
 ## Contributing
 

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts

@@ -38,6 +38,11 @@ export type AuthenticationControllerBeginCredentialEnrollmentAction = {
 /**
  * Completes credential enrollment and refreshes the credential cache.
  *
+ * The server returns an assertion for the new credential, which opens a
+ * verification session like `completeCredentialVerification`, replacing
+ * any earlier one. If that exchange fails, the earlier session is kept:
+ * the credential is enrolled either way.
+ *
  * A cache-refresh failure does not undo successful enrollment. Email
  * enrollment invalidates the primary SRP session *after* refresh so the
  * credentials call can reuse the still-valid access token; the next token
@@ -54,46 +59,55 @@ export type AuthenticationControllerCompleteCredentialEnrollmentAction = {
     handler: AuthenticationController['completeCredentialEnrollment'];
 };
 /**
- * Begins step-up verification with an enrolled credential.
+ * Begins verification with an enrolled credential.
  *
  * @param request - Credential type and trace reason.
  * @returns A challenge for the client-owned ceremony.
  */
-export type AuthenticationControllerBeginStepUpAction = {
-    type: `AuthenticationController:beginStepUp`;
-    handler: AuthenticationController['beginStepUp'];
+export type AuthenticationControllerBeginCredentialVerificationAction = {
+    type: `AuthenticationController:beginCredentialVerification`;
+    handler: AuthenticationController['beginCredentialVerification'];
 };
 /**
- * Completes step-up verification and opens a short-lived elevated session.
+ * Completes verification and opens a short-lived verification session.
  *
- * The AAL2 assertion returned by the MFA service is exchanged at Hydra for
- * an elevated access token, whose claims are checked before the session
- * opens. The token itself never enters controller state.
+ * The assertion returned by the MFA service is exchanged at Hydra for an
+ * access token. Its assurance level is not checked: the services receiving
+ * the token enforce their own requirements. The token itself never enters
+ * controller state.
  *
  * @param request - Flow identifier, platform or email proof, and trace reason.
- * @returns The elevated profile access token.
+ * @returns The verification token.
  */
-export type AuthenticationControllerCompleteStepUpAction = {
-    type: `AuthenticationController:completeStepUp`;
-    handler: AuthenticationController['completeStepUp'];
+export type AuthenticationControllerCompleteCredentialVerificationAction = {
+    type: `AuthenticationController:completeCredentialVerification`;
+    handler: AuthenticationController['completeCredentialVerification'];
 };
 /**
- * Returns the active elevated token when it meets the requested freshness.
+ * Returns the active verification token when it meets the requested
+ * freshness.
+ *
+ * Low-level: features should go through the client MFA kit
+ * (`verifyOrEnroll`), which reuses a matching session without showing any
+ * screen and checks which method proved it. Read the token directly only
+ * from code that cannot show UI, and treat `null` as "let the UI layer
+ * ask".
  *
  * @param request - Optional maximum session age in milliseconds, measured
  * from when the token was obtained. Zero always requires a new ceremony.
- * @returns A live elevated token, or null when no reusable session exists.
+ * @returns A live verification token, or null when no reusable session
+ * exists.
  */
-export type AuthenticationControllerGetElevatedProfileTokenAction = {
-    type: `AuthenticationController:getElevatedProfileToken`;
-    handler: AuthenticationController['getElevatedProfileToken'];
+export type AuthenticationControllerGetVerificationTokenAction = {
+    type: `AuthenticationController:getVerificationToken`;
+    handler: AuthenticationController['getVerificationToken'];
 };
 /**
- * Clears the in-memory elevated session and its expiration timer.
+ * Clears every in-memory verification session and its expiration timer.
  */
-export type AuthenticationControllerClearStepUpSessionAction = {
-    type: `AuthenticationController:clearStepUpSession`;
-    handler: AuthenticationController['clearStepUpSession'];
+export type AuthenticationControllerClearVerificationSessionAction = {
+    type: `AuthenticationController:clearVerificationSession`;
+    handler: AuthenticationController['clearVerificationSession'];
 };
 export type AuthenticationControllerPerformSignOutAction = {
     type: `AuthenticationController:performSignOut`;
@@ -202,5 +216,5 @@ export type AuthenticationControllerIsSignedInAction = {
 /**
  * Union of all AuthenticationController action types.
  */
-export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerRefreshEnrolledCredentialsAction | AuthenticationControllerBeginCredentialEnrollmentAction | AuthenticationControllerCompleteCredentialEnrollmentAction | AuthenticationControllerBeginStepUpAction | AuthenticationControllerCompleteStepUpAction | AuthenticationControllerGetElevatedProfileTokenAction | AuthenticationControllerClearStepUpSessionAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerClearStateAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerGetPartnerIdentityTokenAction | AuthenticationControllerIsSignedInAction;
+export type AuthenticationControllerMethodActions = AuthenticationControllerPerformSignInAction | AuthenticationControllerRequestProfilePairingAction | AuthenticationControllerRefreshEnrolledCredentialsAction | AuthenticationControllerBeginCredentialEnrollmentAction | AuthenticationControllerCompleteCredentialEnrollmentAction | AuthenticationControllerBeginCredentialVerificationAction | AuthenticationControllerCompleteCredentialVerificationAction | AuthenticationControllerGetVerificationTokenAction | AuthenticationControllerClearVerificationSessionAction | AuthenticationControllerPerformSignOutAction | AuthenticationControllerClearStateAction | AuthenticationControllerGetBearerTokenAction | AuthenticationControllerGetSessionProfileAction | AuthenticationControllerRefreshCanonicalProfileIdAction | AuthenticationControllerGetUserProfileLineageAction | AuthenticationControllerGetCustomerServiceTokenAction | AuthenticationControllerGetPartnerIdentityTokenAction | AuthenticationControllerIsSignedInAction;
 //# sourceMappingURL=AuthenticationController-method-action-types.d.ts.map

package/dist/controllers/authentication/AuthenticationController-method-action-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;CACjE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yCAAyC,GAAG;IACtD,IAAI,EAAE,sCAAsC,CAAC;IAC7C,OAAO,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAC;CAClD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,wDAAwD,GACxD,uDAAuD,GACvD,0DAA0D,GAC1D,yCAAyC,GACzC,4CAA4C,GAC5C,qDAAqD,GACrD,gDAAgD,GAChD,4CAA4C,GAC5C,wCAAwC,GACxC,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,qDAAqD,GACrD,wCAAwC,CAAC"}
+{"version":3,"file":"AuthenticationController-method-action-types.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,wBAAwB,CAAC,eAAe,CAAC,CAAC;CACpD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wDAAwD,GAAG;IACrE,IAAI,EAAE,qDAAqD,CAAC;IAC5D,OAAO,EAAE,wBAAwB,CAAC,4BAA4B,CAAC,CAAC;CACjE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,0DAA0D,GAAG;IACvE,IAAI,EAAE,uDAAuD,CAAC;IAC9D,OAAO,EAAE,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;CACnE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,yDAAyD,GAAG;IACtE,IAAI,EAAE,sDAAsD,CAAC;IAC7D,OAAO,EAAE,wBAAwB,CAAC,6BAA6B,CAAC,CAAC;CAClE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4DAA4D,GAAG;IACzE,IAAI,EAAE,yDAAyD,CAAC;IAChE,OAAO,EAAE,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;CACrE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,kDAAkD,GAAG;IAC/D,IAAI,EAAE,+CAA+C,CAAC;IACtD,OAAO,EAAE,wBAAwB,CAAC,sBAAsB,CAAC,CAAC;CAC3D,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sDAAsD,GAAG;IACnE,IAAI,EAAE,mDAAmD,CAAC;IAC1D,OAAO,EAAE,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,+CAA+C,GAAG;IAC5D,IAAI,EAAE,4CAA4C,CAAC;IACnD,OAAO,EAAE,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;CACxD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,uDAAuD,GAAG;IACpE,IAAI,EAAE,oDAAoD,CAAC;IAC3D,OAAO,EAAE,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,mDAAmD,GAAG;IAChE,IAAI,EAAE,gDAAgD,CAAC;IACvD,OAAO,EAAE,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;CAC5D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qDAAqD,GAAG;IAClE,IAAI,EAAE,kDAAkD,CAAC;IACzD,OAAO,EAAE,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qCAAqC,GAC7C,2CAA2C,GAC3C,mDAAmD,GACnD,wDAAwD,GACxD,uDAAuD,GACvD,0DAA0D,GAC1D,yDAAyD,GACzD,4DAA4D,GAC5D,kDAAkD,GAClD,sDAAsD,GACtD,4CAA4C,GAC5C,wCAAwC,GACxC,4CAA4C,GAC5C,+CAA+C,GAC/C,uDAAuD,GACvD,mDAAmD,GACnD,qDAAqD,GACrD,qDAAqD,GACrD,wCAAwC,CAAC"}

package/dist/controllers/authentication/AuthenticationController-method-action-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\n/**\n * Refreshes credentials enrolled on the canonical profile.\n *\n * @returns The current supported credentials.\n */\nexport type AuthenticationControllerRefreshEnrolledCredentialsAction = {\n  type: `AuthenticationController:refreshEnrolledCredentials`;\n  handler: AuthenticationController['refreshEnrolledCredentials'];\n};\n\n/**\n * Begins enrollment of a passkey or email OTP credential.\n *\n * @param request - Credential, optional email address, and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialEnrollmentAction = {\n  type: `AuthenticationController:beginCredentialEnrollment`;\n  handler: AuthenticationController['beginCredentialEnrollment'];\n};\n\n/**\n * Completes credential enrollment and refreshes the credential cache.\n *\n * A cache-refresh failure does not undo successful enrollment. Email\n * enrollment invalidates the primary SRP session *after* refresh so the\n * credentials call can reuse the still-valid access token; the next token\n * fetch then includes the newly verified email claim. That invalidation\n * happens even if the session ends mid-request: the enrollment succeeded\n * on the server, so a token cached across a lock must not be reused\n * without the new claim.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The refreshed credentials, or the existing cache if refresh fails.\n */\nexport type AuthenticationControllerCompleteCredentialEnrollmentAction = {\n  type: `AuthenticationController:completeCredentialEnrollment`;\n  handler: AuthenticationController['completeCredentialEnrollment'];\n};\n\n/**\n * Begins step-up verification with an enrolled credential.\n *\n * @param request - Credential type and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginStepUpAction = {\n  type: `AuthenticationController:beginStepUp`;\n  handler: AuthenticationController['beginStepUp'];\n};\n\n/**\n * Completes step-up verification and opens a short-lived elevated session.\n *\n * The AAL2 assertion returned by the MFA service is exchanged at Hydra for\n * an elevated access token, whose claims are checked before the session\n * opens. The token itself never enters controller state.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The elevated profile access token.\n */\nexport type AuthenticationControllerCompleteStepUpAction = {\n  type: `AuthenticationController:completeStepUp`;\n  handler: AuthenticationController['completeStepUp'];\n};\n\n/**\n * Returns the active elevated token when it meets the requested freshness.\n *\n * @param request - Optional maximum session age in milliseconds, measured\n * from when the token was obtained. Zero always requires a new ceremony.\n * @returns A live elevated token, or null when no reusable session exists.\n */\nexport type AuthenticationControllerGetElevatedProfileTokenAction = {\n  type: `AuthenticationController:getElevatedProfileToken`;\n  handler: AuthenticationController['getElevatedProfileToken'];\n};\n\n/**\n * Clears the in-memory elevated session and its expiration timer.\n */\nexport type AuthenticationControllerClearStepUpSessionAction = {\n  type: `AuthenticationController:clearStepUpSession`;\n  handler: AuthenticationController['clearStepUpSession'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Resets the controller to `defaultState`. Clients call this on wallet reset\n * so the next wallet starts unsigned with both pairing gates re-armed.\n */\nexport type AuthenticationControllerClearStateAction = {\n  type: `AuthenticationController:clearState`;\n  handler: AuthenticationController['clearState'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\n/**\n * Mints a partner identity token for the specified SRP, logging in if needed.\n *\n * Calls `POST /api/v2/oidc/token` with the Hydra login bearer and returns\n * the minted `access_token`. Email on live tokens is under JWT `ext`.\n * HTTP 422 throws `EmailRequiredError` when this profile has no\n * verified email.\n *\n * @param claims - Claim names to embed. Only `email` is supported.\n * @param audience - Partner audience (`kyc` or `iron`).\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The partner identity access token.\n */\nexport type AuthenticationControllerGetPartnerIdentityTokenAction = {\n  type: `AuthenticationController:getPartnerIdentityToken`;\n  handler: AuthenticationController['getPartnerIdentityToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerRefreshEnrolledCredentialsAction\n  | AuthenticationControllerBeginCredentialEnrollmentAction\n  | AuthenticationControllerCompleteCredentialEnrollmentAction\n  | AuthenticationControllerBeginStepUpAction\n  | AuthenticationControllerCompleteStepUpAction\n  | AuthenticationControllerGetElevatedProfileTokenAction\n  | AuthenticationControllerClearStepUpSessionAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerClearStateAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerGetPartnerIdentityTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}
+{"version":3,"file":"AuthenticationController-method-action-types.js","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { AuthenticationController } from './AuthenticationController.js';\n\nexport type AuthenticationControllerPerformSignInAction = {\n  type: `AuthenticationController:performSignIn`;\n  handler: AuthenticationController['performSignIn'];\n};\n\n/**\n * Marks profile pairing as needed. Clients call this when the SRP set\n * changes (e.g. a new keyring was added) so the next auto-sign-in cycle\n * re-runs `performSignIn` and re-pairs.\n */\nexport type AuthenticationControllerRequestProfilePairingAction = {\n  type: `AuthenticationController:requestProfilePairing`;\n  handler: AuthenticationController['requestProfilePairing'];\n};\n\n/**\n * Refreshes credentials enrolled on the canonical profile.\n *\n * @returns The current supported credentials.\n */\nexport type AuthenticationControllerRefreshEnrolledCredentialsAction = {\n  type: `AuthenticationController:refreshEnrolledCredentials`;\n  handler: AuthenticationController['refreshEnrolledCredentials'];\n};\n\n/**\n * Begins enrollment of a passkey or email OTP credential.\n *\n * @param request - Credential, optional email address, and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialEnrollmentAction = {\n  type: `AuthenticationController:beginCredentialEnrollment`;\n  handler: AuthenticationController['beginCredentialEnrollment'];\n};\n\n/**\n * Completes credential enrollment and refreshes the credential cache.\n *\n * The server returns an assertion for the new credential, which opens a\n * verification session like `completeCredentialVerification`, replacing\n * any earlier one. If that exchange fails, the earlier session is kept:\n * the credential is enrolled either way.\n *\n * A cache-refresh failure does not undo successful enrollment. Email\n * enrollment invalidates the primary SRP session *after* refresh so the\n * credentials call can reuse the still-valid access token; the next token\n * fetch then includes the newly verified email claim. That invalidation\n * happens even if the session ends mid-request: the enrollment succeeded\n * on the server, so a token cached across a lock must not be reused\n * without the new claim.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The refreshed credentials, or the existing cache if refresh fails.\n */\nexport type AuthenticationControllerCompleteCredentialEnrollmentAction = {\n  type: `AuthenticationController:completeCredentialEnrollment`;\n  handler: AuthenticationController['completeCredentialEnrollment'];\n};\n\n/**\n * Begins verification with an enrolled credential.\n *\n * @param request - Credential type and trace reason.\n * @returns A challenge for the client-owned ceremony.\n */\nexport type AuthenticationControllerBeginCredentialVerificationAction = {\n  type: `AuthenticationController:beginCredentialVerification`;\n  handler: AuthenticationController['beginCredentialVerification'];\n};\n\n/**\n * Completes verification and opens a short-lived verification session.\n *\n * The assertion returned by the MFA service is exchanged at Hydra for an\n * access token. Its assurance level is not checked: the services receiving\n * the token enforce their own requirements. The token itself never enters\n * controller state.\n *\n * @param request - Flow identifier, platform or email proof, and trace reason.\n * @returns The verification token.\n */\nexport type AuthenticationControllerCompleteCredentialVerificationAction = {\n  type: `AuthenticationController:completeCredentialVerification`;\n  handler: AuthenticationController['completeCredentialVerification'];\n};\n\n/**\n * Returns the active verification token when it meets the requested\n * freshness.\n *\n * Low-level: features should go through the client MFA kit\n * (`verifyOrEnroll`), which reuses a matching session without showing any\n * screen and checks which method proved it. Read the token directly only\n * from code that cannot show UI, and treat `null` as \"let the UI layer\n * ask\".\n *\n * @param request - Optional maximum session age in milliseconds, measured\n * from when the token was obtained. Zero always requires a new ceremony.\n * @returns A live verification token, or null when no reusable session\n * exists.\n */\nexport type AuthenticationControllerGetVerificationTokenAction = {\n  type: `AuthenticationController:getVerificationToken`;\n  handler: AuthenticationController['getVerificationToken'];\n};\n\n/**\n * Clears every in-memory verification session and its expiration timer.\n */\nexport type AuthenticationControllerClearVerificationSessionAction = {\n  type: `AuthenticationController:clearVerificationSession`;\n  handler: AuthenticationController['clearVerificationSession'];\n};\n\nexport type AuthenticationControllerPerformSignOutAction = {\n  type: `AuthenticationController:performSignOut`;\n  handler: AuthenticationController['performSignOut'];\n};\n\n/**\n * Resets the controller to `defaultState`. Clients call this on wallet reset\n * so the next wallet starts unsigned with both pairing gates re-armed.\n */\nexport type AuthenticationControllerClearStateAction = {\n  type: `AuthenticationController:clearState`;\n  handler: AuthenticationController['clearState'];\n};\n\n/**\n * Returns a bearer token for the specified SRP, logging in if needed.\n *\n * When called without `entropySourceId`, returns the primary (first) SRP's\n * access token, which is effectively the canonical\n * profile's token that can be used by alias-aware consumers for cross-SRP\n * operations.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The OIDC access token.\n */\nexport type AuthenticationControllerGetBearerTokenAction = {\n  type: `AuthenticationController:getBearerToken`;\n  handler: AuthenticationController['getBearerToken'];\n};\n\n/**\n * Returns the cached session profile, logging in if no session exists.\n *\n * The returned `canonicalProfileId` reflects the value from the most recent\n * login or pairing. In the rare event where a canonical changed because of\n * a pairing that happened on another device, the cached value may be stale\n * until the next login. For guaranteed freshness, call\n * `refreshCanonicalProfileId()` before reading `canonicalProfileId`.\n *\n * @param entropySourceId - The entropy source ID used to derive the key,\n * when multiple sources are available (Multi-SRP).\n * @returns profile for the session.\n */\nexport type AuthenticationControllerGetSessionProfileAction = {\n  type: `AuthenticationController:getSessionProfile`;\n  handler: AuthenticationController['getSessionProfile'];\n};\n\n/**\n * Forces a fresh retrieval of the canonical profile ID from the server\n * and propagates it to all cached SRP sessions.\n *\n * This method invalidates the primary SRP's cached session and forces a\n * re-login. Use it before operations that require a guaranteed-fresh\n * canonical (e.g. storage key derivation for Accounts ADR 0005). For\n * best-effort reads, use\n * `getSessionProfile().canonicalProfileId` instead.\n *\n * Only the primary SRP is re-logged-in regardless of how many SRPs exist —\n * the server returns the current canonical for the entire pairing group\n * from any single SRP login.\n *\n * @returns The refreshed canonical profile ID.\n */\nexport type AuthenticationControllerRefreshCanonicalProfileIdAction = {\n  type: `AuthenticationController:refreshCanonicalProfileId`;\n  handler: AuthenticationController['refreshCanonicalProfileId'];\n};\n\nexport type AuthenticationControllerGetUserProfileLineageAction = {\n  type: `AuthenticationController:getUserProfileLineage`;\n  handler: AuthenticationController['getUserProfileLineage'];\n};\n\n/**\n * Returns a Customer Service specific access token for the specified SRP,\n * logging in if needed.\n *\n * Exchanges the OIDC access token for a short-lived token scoped to the\n * customer-service audience. Customer Service tooling consumes this token to\n * identify and authenticate the user.\n *\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The customer-service access token.\n */\nexport type AuthenticationControllerGetCustomerServiceTokenAction = {\n  type: `AuthenticationController:getCustomerServiceToken`;\n  handler: AuthenticationController['getCustomerServiceToken'];\n};\n\n/**\n * Mints a partner identity token for the specified SRP, logging in if needed.\n *\n * Calls `POST /api/v2/oidc/token` with the Hydra login bearer and returns\n * the minted `access_token`. Email on live tokens is under JWT `ext`.\n * HTTP 422 throws `EmailRequiredError` when this profile has no\n * verified email.\n *\n * @param claims - Claim names to embed. Only `email` is supported.\n * @param audience - Partner audience (`kyc` or `iron`).\n * @param entropySourceId - The entropy source ID. Omit for the primary SRP.\n * @returns The partner identity access token.\n */\nexport type AuthenticationControllerGetPartnerIdentityTokenAction = {\n  type: `AuthenticationController:getPartnerIdentityToken`;\n  handler: AuthenticationController['getPartnerIdentityToken'];\n};\n\nexport type AuthenticationControllerIsSignedInAction = {\n  type: `AuthenticationController:isSignedIn`;\n  handler: AuthenticationController['isSignedIn'];\n};\n\n/**\n * Union of all AuthenticationController action types.\n */\nexport type AuthenticationControllerMethodActions =\n  | AuthenticationControllerPerformSignInAction\n  | AuthenticationControllerRequestProfilePairingAction\n  | AuthenticationControllerRefreshEnrolledCredentialsAction\n  | AuthenticationControllerBeginCredentialEnrollmentAction\n  | AuthenticationControllerCompleteCredentialEnrollmentAction\n  | AuthenticationControllerBeginCredentialVerificationAction\n  | AuthenticationControllerCompleteCredentialVerificationAction\n  | AuthenticationControllerGetVerificationTokenAction\n  | AuthenticationControllerClearVerificationSessionAction\n  | AuthenticationControllerPerformSignOutAction\n  | AuthenticationControllerClearStateAction\n  | AuthenticationControllerGetBearerTokenAction\n  | AuthenticationControllerGetSessionProfileAction\n  | AuthenticationControllerRefreshCanonicalProfileIdAction\n  | AuthenticationControllerGetUserProfileLineageAction\n  | AuthenticationControllerGetCustomerServiceTokenAction\n  | AuthenticationControllerGetPartnerIdentityTokenAction\n  | AuthenticationControllerIsSignedInAction;\n"]}

package/dist/controllers/authentication/AuthenticationController.d.ts

@@ -4,7 +4,7 @@ import type { TraceCallback } from '@metamask/controller-utils';
 import type { KeyringControllerGetStateAction, KeyringControllerLockEvent, KeyringControllerUnlockEvent, KeyringControllerWithKeyringV2UnsafeAction } from '@metamask/keyring-controller';
 import type { Messenger } from '@metamask/messenger';
 import type { SeedlessOnboardingControllerGetAccessTokenAction, SeedlessOnboardingControllerGetStateAction } from '@metamask/seedless-onboarding-controller';
-import type { LoginResponse, ProfileAlias, UserProfile, UserProfileLineage, OidcTokenAudience, OidcTokenClaims, BeginEnrollmentRequest, CompleteEnrollmentRequest, EnrolledCredential, EnrollmentChallenge, BeginStepUpRequest, CompleteStepUpRequest, ElevatedProfileToken, GetElevatedTokenRequest, StepUpChallenge } from '../../sdk/index.js';
+import type { LoginResponse, ProfileAlias, UserProfile, UserProfileLineage, OidcTokenAudience, OidcTokenClaims, BeginEnrollmentRequest, CompleteEnrollmentRequest, EnrolledCredential, EnrollmentChallenge, BeginVerificationRequest, CompleteVerificationRequest, VerificationToken, GetVerificationTokenRequest, VerificationChallenge } from '../../sdk/index.js';
 import { Env } from '../../sdk/index.js';
 import type { MetaMetricsAuth } from '../../shared/types/services.js';
 import { AuthenticationControllerMethodActions } from './AuthenticationController-method-action-types.js';
@@ -18,11 +18,6 @@ export type AuthenticationControllerState = {
      * assignable to the controller state type.
      */
     enrolledCredentials?: EnrolledCredential[];
-    /**
-     * Epoch-ms hard expiry of the in-memory elevated session, or undefined when
-     * none is open. Lets UI show "verified" state without holding the token.
-     */
-    stepUpSessionExpiresAt?: number;
     /**
      * Client gate for profile pairing. Defaults to `true` (fresh install /
      * upgrade), set to `false` after a successful `performSignIn` pair, set
@@ -51,11 +46,12 @@ export type AuthenticationControllerState = {
 };
 export declare const defaultState: AuthenticationControllerState;
 /**
- * Lifetime of an elevated session. Deliberately shorter than the
- * elevated token's own `exp` so a fresh ceremony is required per sensitive
- * action window, per the MFA phase-1 specification.
+ * Default maximum age of a verification session that may authorize enrolling a
+ * credential. A session opened for an unrelated operation must not be able to
+ * add a factor long after the fact, while a session proven moments ago (or
+ * during the same setup flow, via `maxSessionAgeMs`) may.
  */
-export declare const STEP_UP_SESSION_TTL_MS = 60000;
+export declare const ENROLLMENT_MAX_SESSION_AGE_MS: number;
 type ControllerConfig = {
     env: Env;
     /**
@@ -121,6 +117,11 @@ export declare class AuthenticationController extends BaseController<typeof cont
     /**
      * Completes credential enrollment and refreshes the credential cache.
      *
+     * The server returns an assertion for the new credential, which opens a
+     * verification session like `completeCredentialVerification`, replacing
+     * any earlier one. If that exchange fails, the earlier session is kept:
+     * the credential is enrolled either way.
+     *
      * A cache-refresh failure does not undo successful enrollment. Email
      * enrollment invalidates the primary SRP session *after* refresh so the
      * credentials call can reuse the still-valid access token; the next token
@@ -134,35 +135,44 @@ export declare class AuthenticationController extends BaseController<typeof cont
      */
     completeCredentialEnrollment(request: CompleteEnrollmentRequest): Promise<EnrolledCredential[]>;
     /**
-     * Begins step-up verification with an enrolled credential.
+     * Begins verification with an enrolled credential.
      *
      * @param request - Credential type and trace reason.
      * @returns A challenge for the client-owned ceremony.
      */
-    beginStepUp(request: BeginStepUpRequest): Promise<StepUpChallenge>;
+    beginCredentialVerification(request: BeginVerificationRequest): Promise<VerificationChallenge>;
     /**
-     * Completes step-up verification and opens a short-lived elevated session.
+     * Completes verification and opens a short-lived verification session.
      *
-     * The AAL2 assertion returned by the MFA service is exchanged at Hydra for
-     * an elevated access token, whose claims are checked before the session
-     * opens. The token itself never enters controller state.
+     * The assertion returned by the MFA service is exchanged at Hydra for an
+     * access token. Its assurance level is not checked: the services receiving
+     * the token enforce their own requirements. The token itself never enters
+     * controller state.
      *
      * @param request - Flow identifier, platform or email proof, and trace reason.
-     * @returns The elevated profile access token.
+     * @returns The verification token.
      */
-    completeStepUp(request: CompleteStepUpRequest): Promise<ElevatedProfileToken>;
+    completeCredentialVerification(request: CompleteVerificationRequest): Promise<VerificationToken>;
     /**
-     * Returns the active elevated token when it meets the requested freshness.
+     * Returns the active verification token when it meets the requested
+     * freshness.
+     *
+     * Low-level: features should go through the client MFA kit
+     * (`verifyOrEnroll`), which reuses a matching session without showing any
+     * screen and checks which method proved it. Read the token directly only
+     * from code that cannot show UI, and treat `null` as "let the UI layer
+     * ask".
      *
      * @param request - Optional maximum session age in milliseconds, measured
      * from when the token was obtained. Zero always requires a new ceremony.
-     * @returns A live elevated token, or null when no reusable session exists.
+     * @returns A live verification token, or null when no reusable session
+     * exists.
      */
-    getElevatedProfileToken(request?: GetElevatedTokenRequest): ElevatedProfileToken | null;
+    getVerificationToken(request?: GetVerificationTokenRequest): VerificationToken | null;
     /**
-     * Clears the in-memory elevated session and its expiration timer.
+     * Clears every in-memory verification session and its expiration timer.
      */
-    clearStepUpSession(): void;
+    clearVerificationSession(): void;
     performSignOut(): void;
     /**
      * Resets the controller to `defaultState`. Clients call this on wallet reset

package/dist/controllers/authentication/AuthenticationController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,gDAAgD,EAChD,0CAA0C,EAC3C,MAAM,0CAA0C,CAAC;AAYlD,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAIZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAKJ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAK1B,CAAC;AAyEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC;CACvC,CAAC;AAuBF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,0CAA0C,GAC1C,0CAA0C,GAC1C,gDAAgD,CAAC;AAErD,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;IA0DC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,EACX,KAAK,GACN,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;QAC7B,KAAK,CAAC,EAAE,aAAa,CAAC;KACvB,EAkDA;IAkLY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC9C;IAgHD;;;;OAIG;IACI,qBAAqB,IAAI,IAAI,CAOnC;IA6LD;;;;OAIG;IACU,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+BvE;IAED;;;;;OAKG;IACU,yBAAyB,CACpC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAqB9B;IAED;;;;;;;;;;;;;OAaG;IACU,4BAA4B,CACvC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAyC/B;IAED;;;;;OAKG;IACU,WAAW,CACtB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAiB1B;IAED;;;;;;;;;OASG;IACU,cAAc,CACzB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAyC/B;IAED;;;;;;OAMG;IACI,uBAAuB,CAC5B,OAAO,GAAE,uBAA4B,GACpC,oBAAoB,GAAG,IAAI,CAoB7B;IA0BD;;OAEG;IACI,kBAAkB,IAAI,IAAI,CAWhC;IAoBM,cAAc,IAAI,IAAI,CAQ5B;IAED;;;OAGG;IACI,UAAU,IAAI,IAAI,CAMxB;IAED;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE;IAED;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAItB;IAED;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBxD;IAcY,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAI7B;IAED;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAED;;;;;;;;;;;;OAYG;IACU,uBAAuB,CAClC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAQjB;IAEM,UAAU,IAAI,OAAO,CAE3B;CA8EF"}
+{"version":3,"file":"AuthenticationController.d.ts","sourceRoot":"","sources":["../../../src/controllers/authentication/AuthenticationController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EACV,+BAA+B,EAC/B,0BAA0B,EAC1B,4BAA4B,EAC5B,0CAA0C,EAC3C,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,gDAAgD,EAChD,0CAA0C,EAC3C,MAAM,0CAA0C,CAAC;AAYlD,OAAO,KAAK,EAEV,aAAa,EACb,YAAY,EAIZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAG3B,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,GAAG,EAKJ,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAE1G,QAAA,MAAM,cAAc,6BAA6B,CAAC;AAGlD,MAAM,MAAM,6BAA6B,GAAG;IAC1C,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,6BAK1B,CAAC;AAmEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAa,CAAC;AAaxD,KAAK,gBAAgB,GAAG;IACtB,GAAG,EAAE,GAAG,CAAC;IACT;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC;CACvC,CAAC;AAuBF,MAAM,MAAM,OAAO,GACf,sCAAsC,GACtC,qCAAqC,CAAC;AAE1C,MAAM,MAAM,sCAAsC,GAAG,wBAAwB,CAC3E,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAClD,0BAA0B,CACxB,OAAO,cAAc,EACrB,6BAA6B,CAC9B,CAAC;AAEJ,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,MAAM,GACd,wCAAwC,GACxC,0CAA0C,CAAC;AAG/C,KAAK,cAAc,GACf,+BAA+B,GAC/B,0CAA0C,GAC1C,0CAA0C,GAC1C,gDAAgD,CAAC;AAErD,KAAK,aAAa,GAAG,0BAA0B,GAAG,4BAA4B,CAAC;AAG/E,MAAM,MAAM,iCAAiC,GAAG,SAAS,CACvD,OAAO,cAAc,EACrB,OAAO,GAAG,cAAc,EACxB,MAAM,GAAG,aAAa,CACvB,CAAC;AAEF;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAC1D,OAAO,cAAc,EACrB,6BAA6B,EAC7B,iCAAiC,CAClC;;IA+DC,YAAY,EACV,SAAS,EACT,KAAK,EACL,MAAM,EACN,WAAW,EACX,KAAK,GACN,EAAE;QACD,SAAS,EAAE,iCAAiC,CAAC;QAC7C,KAAK,CAAC,EAAE,6BAA6B,CAAC;QACtC,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACnC;;;WAGG;QACH,WAAW,EAAE,eAAe,CAAC;QAC7B,KAAK,CAAC,EAAE,aAAa,CAAC;KACvB,EAkDA;IAkLY,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAc9C;IAiJD;;;;OAIG;IACI,qBAAqB,IAAI,IAAI,CAOnC;IA8LD;;;;OAIG;IACU,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA+BvE;IAED;;;;;OAKG;IACU,yBAAyB,CACpC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACU,4BAA4B,CACvC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqD/B;IAED;;;;;OAKG;IACU,2BAA2B,CACtC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,qBAAqB,CAAC,CAiBhC;IAED;;;;;;;;;;OAUG;IACU,8BAA8B,CACzC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CA4B5B;IAsDD;;;;;;;;;;;;;;OAcG;IACI,oBAAoB,CACzB,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,GAAG,IAAI,CAoB1B;IAmCD;;OAEG;IACI,wBAAwB,IAAI,IAAI,CAKtC;IAoBM,cAAc,IAAI,IAAI,CAQ5B;IAED;;;OAGG;IACI,UAAU,IAAI,IAAI,CAMxB;IAED;;;;;;;;;;OAUG;IACU,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE;IAED;;;;;;;;;;;;OAYG;IACU,iBAAiB,CAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAItB;IAED;;;;;;;;;;;;;;;OAeG;IACU,yBAAyB,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBxD;IAcY,qBAAqB,CAChC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAI7B;IAED;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAIjB;IAED;;;;;;;;;;;;OAYG;IACU,uBAAuB,CAClC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAQjB;IAEM,UAAU,IAAI,OAAO,CAE3B;CA8EF"}