feat: update toprf-secure-backup sdk to 0.2.0

.github/CODEOWNERS

@@ -71,6 +71,9 @@
 ## Wallet UX Team
 /packages/announcement-controller      @MetaMask/wallet-ux
 
+## Web3Auth Team
+/packages/seedless-onboarding-controller @MetaMask/web3auth
+
 ## Joint team ownership
 /packages/eth-json-rpc-provider        @MetaMask/wallet-api-platform-engineers @MetaMask/wallet-framework-engineers
 /packages/json-rpc-engine              @MetaMask/wallet-api-platform-engineers @MetaMask/wallet-framework-engineers
@@ -148,3 +151,5 @@
 /packages/bridge-status-controller/CHANGELOG.md         @MetaMask/swaps-engineers @MetaMask/wallet-framework-engineers
 /packages/app-metadata-controller/package.json        @MetaMask/mobile-platform @MetaMask/wallet-framework-engineers
 /packages/app-metadata-controller/CHANGELOG.md        @MetaMask/mobile-platform @MetaMask/wallet-framework-engineers
+/packages/seedless-onboarding-controller/package.json @MetaMask/web3auth @MetaMask/wallet-framework-engineers
+/packages/seedless-onboarding-controller/CHANGELOG.md @MetaMask/web3auth @MetaMask/wallet-framework-engineers

README.md

@@ -62,6 +62,7 @@ Each package in this repository has its own README where you can find installati
 - [`@metamask/rate-limit-controller`](packages/rate-limit-controller)
 - [`@metamask/remote-feature-flag-controller`](packages/remote-feature-flag-controller)
 - [`@metamask/sample-controllers`](packages/sample-controllers)
+- [`@metamask/seedless-onboarding-controller`](packages/seedless-onboarding-controller)
 - [`@metamask/selected-network-controller`](packages/selected-network-controller)
 - [`@metamask/signature-controller`](packages/signature-controller)
 - [`@metamask/token-search-discovery-controller`](packages/token-search-discovery-controller)
@@ -118,6 +119,7 @@ linkStyle default opacity:0.5
   rate_limit_controller(["@metamask/rate-limit-controller"]);
   remote_feature_flag_controller(["@metamask/remote-feature-flag-controller"]);
   sample_controllers(["@metamask/sample-controllers"]);
+  seedless_onboarding_controller(["@metamask/seedless-onboarding-controller"]);
   selected_network_controller(["@metamask/selected-network-controller"]);
   signature_controller(["@metamask/signature-controller"]);
   token_search_discovery_controller(["@metamask/token-search-discovery-controller"]);

eslint-warning-thresholds.json

@@ -452,6 +452,12 @@
   "packages/remote-feature-flag-controller/src/utils/user-segmentation-utils.ts": {
     "jsdoc/tag-lines": 2
   },
+  "packages/seedless-onboarding-controller/src/errors.ts": {
+    "@typescript-eslint/no-unsafe-enum-comparison": 1
+  },
+  "packages/seedless-onboarding-controller/jest.environment.js": {
+    "n/no-unsupported-features/node-builtins": 1
+  },
   "packages/selected-network-controller/src/SelectedNetworkController.ts": {
     "@typescript-eslint/prefer-readonly": 1,
     "prettier/prettier": 6

packages/seedless-onboarding-controller/CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- Initial implementation of the seedless onboarding controller. ([#5874](https://github.com/MetaMask/core/pull/5874))
+  - Authenticate OAuth user using the seedless onboarding flow and determine if the user is already registered or not
+  - Create a new Toprf key and backup seed phrase
+  - Add a new seed phrase backup to the metadata store
+  - Add array of new seed phrase backups to the metadata store in batch (useful in multi-srp flow)
+  - Fetch seed phrase metadata from the metadata store
+  - Update the password of the seedless onboarding flow
+- Support multi SRP sync using social login. ([#5875](https://github.com/MetaMask/core/pull/5875))
+  - Update Metadata to support multiple types of secrets (SRP, PrivateKey).
+  - Add `Controller Lock` which will sync with `Keyring Lock`.
+  - Updated `VaultEncryptor` type in constructor args and is compulsory to provided relevant encryptor to constructor.
+  - Added new non-persisted states, `encryptionKey` and `encryptionSalt` to decrypt the vault when password is not available.
+  - Update `password` param in `fetchAllSeedPhrases` method to optional. If password is not provided, `cached EncryptionKey` will be used.
+- Password sync features implementation. ([#5877](https://github.com/MetaMask/core/pull/5877))
+  - checkIsPasswordOutdated to check current password is outdated compare to global password
+  - Add password outdated check to add SRPs / change password
+  - recover old password using latest global password
+  - sync latest global password to reset vault to use latest password and persist latest auth pubkey
+- Updated `toprf-secure-backup` to `0.3.0`. ([#5880](https://github.com/MetaMask/core/pull/5880))
+  - added an optional constructor param, `topfKeyDeriver` to assist the `Key derivation` in `toprf-seucre-backup` sdk and adds an additinal security
+  - added new state value, `recoveryRatelimitCache` to the controller to parse the `RecoveryError` correctly and synchroize the error data (numberOfAttempts) across multiple devices.
+
+[Unreleased]: https://github.com/MetaMask/core/

packages/seedless-onboarding-controller/LICENSE

@@ -0,0 +1,20 @@
+MIT License
+
+Copyright (c) 2025 MetaMask
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

packages/seedless-onboarding-controller/README.md

@@ -0,0 +1,15 @@
+# `@metamask/seedless-onboarding-controller`
+
+Backup and rehydrate SRP(s) using social login and password
+
+## Installation
+
+`yarn add @metamask/seedless-onboarding-controller`
+
+or
+
+`npm install @metamask/seedless-onboarding-controller`
+
+## Contributing
+
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/core#readme).

packages/seedless-onboarding-controller/jest.config.js

@@ -0,0 +1,29 @@
+/*
+ * For a detailed explanation regarding each configuration property and type check, visit:
+ * https://jestjs.io/docs/configuration
+ */
+
+const merge = require('deepmerge');
+const path = require('path');
+
+const baseConfig = require('../../jest.config.packages');
+
+const displayName = path.basename(__dirname);
+
+module.exports = merge(baseConfig, {
+  // The display name when running multiple projects
+  displayName,
+
+  // An object that configures minimum threshold enforcement for coverage results
+  coverageThreshold: {
+    global: {
+      branches: 100,
+      functions: 100,
+      lines: 100,
+      statements: 100,
+    },
+  },
+
+  // These tests rely on the Crypto API
+  testEnvironment: '<rootDir>/jest.environment.js',
+});

packages/seedless-onboarding-controller/jest.environment.js

@@ -0,0 +1,16 @@
+const NodeEnvironment = require('jest-environment-node');
+
+/**
+ * SeedlessOnboardingController depends on @noble/hashes, which as of 1.7.1 relies on the
+ * Web Crypto API in Node and browsers.
+ */
+class CustomTestEnvironment extends NodeEnvironment {
+  async setup() {
+    await super.setup();
+    if (typeof this.global.crypto === 'undefined') {
+      this.global.crypto = require('crypto').webcrypto;
+    }
+  }
+}
+
+module.exports = CustomTestEnvironment;

packages/seedless-onboarding-controller/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "@metamask/seedless-onboarding-controller",
+  "version": "0.0.0",
+  "description": "Backup and rehydrate SRP(s) using social login and password",
+  "keywords": [
+    "MetaMask",
+    "Ethereum"
+  ],
+  "homepage": "https://github.com/MetaMask/core/tree/main/packages/seedless-onboarding-controller#readme",
+  "bugs": {
+    "url": "https://github.com/MetaMask/core/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/MetaMask/core.git"
+  },
+  "license": "MIT",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.cts",
+  "files": [
+    "dist/"
+  ],
+  "scripts": {
+    "build": "ts-bridge --project tsconfig.build.json --verbose --clean --no-references",
+    "build:docs": "typedoc",
+    "changelog:update": "../../scripts/update-changelog.sh @metamask/seedless-onboarding-controller",
+    "changelog:validate": "../../scripts/validate-changelog.sh @metamask/seedless-onboarding-controller",
+    "publish:preview": "yarn npm publish --tag preview",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest --reporters=jest-silent-reporter",
+    "test:clean": "NODE_OPTIONS=--experimental-vm-modules jest --clearCache",
+    "test:verbose": "NODE_OPTIONS=--experimental-vm-modules jest --verbose",
+    "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch",
+    "since-latest-release": "../../scripts/since-latest-release.sh"
+  },
+  "dependencies": {
+    "@metamask/auth-network-utils": "^0.3.0",
+    "@metamask/base-controller": "^8.0.1",
+    "@metamask/toprf-secure-backup": "^0.3.0",
+    "@metamask/utils": "^11.2.0",
+    "async-mutex": "^0.5.0"
+  },
+  "devDependencies": {
+    "@lavamoat/allow-scripts": "^3.0.4",
+    "@lavamoat/preinstall-always-fail": "^2.1.0",
+    "@metamask/auto-changelog": "^3.4.4",
+    "@metamask/browser-passworder": "^4.3.0",
+    "@metamask/keyring-controller": "^22.0.0",
+    "@noble/ciphers": "^0.5.2",
+    "@noble/curves": "^1.2.0",
+    "@noble/hashes": "^1.4.0",
+    "@types/elliptic": "^6",
+    "@types/jest": "^27.4.1",
+    "deepmerge": "^4.2.2",
+    "jest": "^27.5.1",
+    "jest-environment-node": "^27.5.1",
+    "nock": "^13.3.1",
+    "ts-jest": "^27.1.4",
+    "typedoc": "^0.24.8",
+    "typedoc-plugin-missing-exports": "^2.0.0",
+    "typescript": "~5.2.2"
+  },
+  "peerDependencies": {
+    "@metamask/keyring-controller": "^22.0.0"
+  },
+  "engines": {
+    "node": "^18.18 || >=20"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "lavamoat": {
+    "allowScripts": {
+      "@lavamoat/preinstall-always-fail": false,
+      "@metamask/toprf-secure-backup": true
+    }
+  }
+}