@metamask-previews/kyc-controller 0.0.0-preview-823dcff → 0.0.0-preview-e57e5c3dc

package/dist/ukyc/testToken.cjs

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mintUkycTestToken = void 0;
+const utils_1 = require("@noble/hashes/utils");
+const constants_js_1 = require("./constants.cjs");
+const deriveClientMaterial_js_1 = require("./deriveClientMaterial.cjs");
+const storageAccessToken_js_1 = require("./storageAccessToken.cjs");
+/**
+ * Mints ready-to-use UKYC `storage_access_token`s for testing UKYC Storage.
+ *
+ * This composes the same pure functions the MetaMask client uses in production
+ * (`deriveClientMaterial` + `signStorageAccessToken`), so a third party such as
+ * idOS can produce a valid, signed token without deriving one on-device. No
+ * server "fills in" the `signing_public_key`: it is derived from a
+ * `local_user_secret` the caller controls and registered on first write, so
+ * reusing the same secret yields a stable `storage_id` and controlling key.
+ */
+/** Default token lifetime when `expiresAt` is not supplied (4 hours). */
+const DEFAULT_TOKEN_LIFETIME_MS = 4 * 60 * 60 * 1000;
+/**
+ * Resolves the caller-supplied secret into raw bytes, generating a random one
+ * when none is provided.
+ *
+ * @param secret - Raw 32 bytes, a hex string, or undefined for a random secret.
+ * @returns The `local_user_secret` bytes.
+ */
+function resolveLocalUserSecret(secret) {
+    if (secret === undefined) {
+        return (0, utils_1.randomBytes)(constants_js_1.UKYC_LOCAL_USER_SECRET_SIZE_BYTES);
+    }
+    return typeof secret === 'string' ? (0, utils_1.hexToBytes)(secret) : secret;
+}
+/**
+ * Mints a signed UKYC `storage_access_token` for testing.
+ *
+ * @param params - See {@link MintUkycTestTokenParams}.
+ * @returns The token, its `Authorization` header, and the derived identifiers.
+ */
+function mintUkycTestToken(params = {}) {
+    const { operations = ['read'], presenter, sessionId, issuedAt = new Date(), expiresAt = new Date(issuedAt.getTime() + DEFAULT_TOKEN_LIFETIME_MS), } = params;
+    const localUserSecret = resolveLocalUserSecret(params.localUserSecret);
+    const material = (0, deriveClientMaterial_js_1.deriveClientMaterial)(localUserSecret);
+    const token = (0, storageAccessToken_js_1.signStorageAccessToken)({
+        material,
+        operations,
+        presenter,
+        sessionId,
+        issuedAt,
+        expiresAt,
+    });
+    const { storageId, signingPublicKey } = (0, deriveClientMaterial_js_1.encodeClientMaterial)(material);
+    return {
+        localUserSecret: (0, utils_1.bytesToHex)(localUserSecret),
+        storageId,
+        signingPublicKey,
+        token,
+        authorizationHeader: `${constants_js_1.UKYC_CAPABILITY_AUTH_SCHEME} ${(0, storageAccessToken_js_1.encodeStorageAccessTokenForHeader)(token)}`,
+    };
+}
+exports.mintUkycTestToken = mintUkycTestToken;
+//# sourceMappingURL=testToken.cjs.map

package/dist/ukyc/testToken.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"testToken.cjs","sourceRoot":"","sources":["../../src/ukyc/testToken.ts"],"names":[],"mappings":";;;AAAA,+CAA0E;AAE1E,kDAGwB;AACxB,wEAGmC;AACnC,oEAGiC;AAOjC;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6CrD;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,MAA4B;IAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAA,mBAAW,EAAC,gDAAiC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,kBAAU,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,SAAkC,EAAE;IAEpC,MAAM,EACJ,UAAU,GAAG,CAAC,MAAM,CAAC,EACrB,SAAS,EACT,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,EACrB,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,yBAAyB,CAAC,GACrE,GAAG,MAAM,CAAC;IAEX,MAAM,eAAe,GAAG,sBAAsB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAA,8CAAoB,EAAC,eAAe,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,IAAA,8CAAsB,EAAC;QACnC,QAAQ;QACR,UAAU;QACV,SAAS;QACT,SAAS;QACT,QAAQ;QACR,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,IAAA,8CAAoB,EAAC,QAAQ,CAAC,CAAC;IAEvE,OAAO;QACL,eAAe,EAAE,IAAA,kBAAU,EAAC,eAAe,CAAC;QAC5C,SAAS;QACT,gBAAgB;QAChB,KAAK;QACL,mBAAmB,EAAE,GAAG,0CAA2B,IAAI,IAAA,yDAAiC,EACtF,KAAK,CACN,EAAE;KACJ,CAAC;AACJ,CAAC;AAlCD,8CAkCC","sourcesContent":["import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';\n\nimport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_LOCAL_USER_SECRET_SIZE_BYTES,\n} from './constants.js';\nimport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './deriveClientMaterial.js';\nimport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './storageAccessToken.js';\nimport type {\n  UkycStorageAccessToken,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './storageAccessToken.js';\n\n/**\n * Mints ready-to-use UKYC `storage_access_token`s for testing UKYC Storage.\n *\n * This composes the same pure functions the MetaMask client uses in production\n * (`deriveClientMaterial` + `signStorageAccessToken`), so a third party such as\n * idOS can produce a valid, signed token without deriving one on-device. No\n * server \"fills in\" the `signing_public_key`: it is derived from a\n * `local_user_secret` the caller controls and registered on first write, so\n * reusing the same secret yields a stable `storage_id` and controlling key.\n */\n\n/** Default token lifetime when `expiresAt` is not supplied (4 hours). */\nconst DEFAULT_TOKEN_LIFETIME_MS = 4 * 60 * 60 * 1000;\n\n/**\n * Inputs for {@link mintUkycTestToken}. All fields are optional; the only value\n * a caller usually pins is `localUserSecret`, so `storage_id` and the signing\n * key stay stable across runs.\n */\nexport type MintUkycTestTokenParams = {\n  /**\n   * The root `local_user_secret`, as raw 32 bytes or a hex string. When omitted\n   * a fresh random secret is generated (returned in the result so it can be\n   * reused).\n   */\n  localUserSecret?: Uint8Array | string;\n  /** Operations the token authorizes. Defaults to `['read']`. */\n  operations?: UkycStorageOperation[];\n  /** Who will present the token. Defaults to `client`. */\n  presenter?: UkycTokenPresenter;\n  /** UKYC session id. Required when `presenter` is `idos-relay`. */\n  sessionId?: string;\n  /** Token issue time. Defaults to now. */\n  issuedAt?: Date;\n  /** Token expiry. Defaults to `issuedAt` + 4 hours. */\n  expiresAt?: Date;\n};\n\n/**\n * The minted token plus everything needed to exercise UKYC Storage with it.\n */\nexport type MintedUkycTestToken = {\n  /** The `local_user_secret` used, hex-encoded, so the caller can reuse it. */\n  localUserSecret: string;\n  /** base64url `storage_id` — use it as the `{storage_id}` path segment. */\n  storageId: string;\n  /** base64url `signing_public_key` registered on first write. */\n  signingPublicKey: string;\n  /** The signed token envelope (payload + signature). */\n  token: UkycStorageAccessToken;\n  /**\n   * The full `Authorization` header value, e.g.\n   * `AccessToken <base64url(envelope)>`, ready to send to UKYC Storage.\n   */\n  authorizationHeader: string;\n};\n\n/**\n * Resolves the caller-supplied secret into raw bytes, generating a random one\n * when none is provided.\n *\n * @param secret - Raw 32 bytes, a hex string, or undefined for a random secret.\n * @returns The `local_user_secret` bytes.\n */\nfunction resolveLocalUserSecret(secret?: Uint8Array | string): Uint8Array {\n  if (secret === undefined) {\n    return randomBytes(UKYC_LOCAL_USER_SECRET_SIZE_BYTES);\n  }\n  return typeof secret === 'string' ? hexToBytes(secret) : secret;\n}\n\n/**\n * Mints a signed UKYC `storage_access_token` for testing.\n *\n * @param params - See {@link MintUkycTestTokenParams}.\n * @returns The token, its `Authorization` header, and the derived identifiers.\n */\nexport function mintUkycTestToken(\n  params: MintUkycTestTokenParams = {},\n): MintedUkycTestToken {\n  const {\n    operations = ['read'],\n    presenter,\n    sessionId,\n    issuedAt = new Date(),\n    expiresAt = new Date(issuedAt.getTime() + DEFAULT_TOKEN_LIFETIME_MS),\n  } = params;\n\n  const localUserSecret = resolveLocalUserSecret(params.localUserSecret);\n  const material = deriveClientMaterial(localUserSecret);\n\n  const token = signStorageAccessToken({\n    material,\n    operations,\n    presenter,\n    sessionId,\n    issuedAt,\n    expiresAt,\n  });\n\n  const { storageId, signingPublicKey } = encodeClientMaterial(material);\n\n  return {\n    localUserSecret: bytesToHex(localUserSecret),\n    storageId,\n    signingPublicKey,\n    token,\n    authorizationHeader: `${UKYC_CAPABILITY_AUTH_SCHEME} ${encodeStorageAccessTokenForHeader(\n      token,\n    )}`,\n  };\n}\n"]}

package/dist/ukyc/testToken.d.cts

@@ -0,0 +1,50 @@
+import type { UkycStorageAccessToken, UkycStorageOperation, UkycTokenPresenter } from "./storageAccessToken.cjs";
+/**
+ * Inputs for {@link mintUkycTestToken}. All fields are optional; the only value
+ * a caller usually pins is `localUserSecret`, so `storage_id` and the signing
+ * key stay stable across runs.
+ */
+export type MintUkycTestTokenParams = {
+    /**
+     * The root `local_user_secret`, as raw 32 bytes or a hex string. When omitted
+     * a fresh random secret is generated (returned in the result so it can be
+     * reused).
+     */
+    localUserSecret?: Uint8Array | string;
+    /** Operations the token authorizes. Defaults to `['read']`. */
+    operations?: UkycStorageOperation[];
+    /** Who will present the token. Defaults to `client`. */
+    presenter?: UkycTokenPresenter;
+    /** UKYC session id. Required when `presenter` is `idos-relay`. */
+    sessionId?: string;
+    /** Token issue time. Defaults to now. */
+    issuedAt?: Date;
+    /** Token expiry. Defaults to `issuedAt` + 4 hours. */
+    expiresAt?: Date;
+};
+/**
+ * The minted token plus everything needed to exercise UKYC Storage with it.
+ */
+export type MintedUkycTestToken = {
+    /** The `local_user_secret` used, hex-encoded, so the caller can reuse it. */
+    localUserSecret: string;
+    /** base64url `storage_id` — use it as the `{storage_id}` path segment. */
+    storageId: string;
+    /** base64url `signing_public_key` registered on first write. */
+    signingPublicKey: string;
+    /** The signed token envelope (payload + signature). */
+    token: UkycStorageAccessToken;
+    /**
+     * The full `Authorization` header value, e.g.
+     * `AccessToken <base64url(envelope)>`, ready to send to UKYC Storage.
+     */
+    authorizationHeader: string;
+};
+/**
+ * Mints a signed UKYC `storage_access_token` for testing.
+ *
+ * @param params - See {@link MintUkycTestTokenParams}.
+ * @returns The token, its `Authorization` header, and the derived identifiers.
+ */
+export declare function mintUkycTestToken(params?: MintUkycTestTokenParams): MintedUkycTestToken;
+//# sourceMappingURL=testToken.d.cts.map

package/dist/ukyc/testToken.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testToken.d.cts","sourceRoot":"","sources":["../../src/ukyc/testToken.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EACnB,iCAAgC;AAgBjC;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACtC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACpC,wDAAwD;IACxD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,sDAAsD;IACtD,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,EAAE,sBAAsB,CAAC;IAC9B;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAgBF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,uBAA4B,GACnC,mBAAmB,CAgCrB"}

package/dist/ukyc/testToken.d.mts

@@ -0,0 +1,50 @@
+import type { UkycStorageAccessToken, UkycStorageOperation, UkycTokenPresenter } from "./storageAccessToken.mjs";
+/**
+ * Inputs for {@link mintUkycTestToken}. All fields are optional; the only value
+ * a caller usually pins is `localUserSecret`, so `storage_id` and the signing
+ * key stay stable across runs.
+ */
+export type MintUkycTestTokenParams = {
+    /**
+     * The root `local_user_secret`, as raw 32 bytes or a hex string. When omitted
+     * a fresh random secret is generated (returned in the result so it can be
+     * reused).
+     */
+    localUserSecret?: Uint8Array | string;
+    /** Operations the token authorizes. Defaults to `['read']`. */
+    operations?: UkycStorageOperation[];
+    /** Who will present the token. Defaults to `client`. */
+    presenter?: UkycTokenPresenter;
+    /** UKYC session id. Required when `presenter` is `idos-relay`. */
+    sessionId?: string;
+    /** Token issue time. Defaults to now. */
+    issuedAt?: Date;
+    /** Token expiry. Defaults to `issuedAt` + 4 hours. */
+    expiresAt?: Date;
+};
+/**
+ * The minted token plus everything needed to exercise UKYC Storage with it.
+ */
+export type MintedUkycTestToken = {
+    /** The `local_user_secret` used, hex-encoded, so the caller can reuse it. */
+    localUserSecret: string;
+    /** base64url `storage_id` — use it as the `{storage_id}` path segment. */
+    storageId: string;
+    /** base64url `signing_public_key` registered on first write. */
+    signingPublicKey: string;
+    /** The signed token envelope (payload + signature). */
+    token: UkycStorageAccessToken;
+    /**
+     * The full `Authorization` header value, e.g.
+     * `AccessToken <base64url(envelope)>`, ready to send to UKYC Storage.
+     */
+    authorizationHeader: string;
+};
+/**
+ * Mints a signed UKYC `storage_access_token` for testing.
+ *
+ * @param params - See {@link MintUkycTestTokenParams}.
+ * @returns The token, its `Authorization` header, and the derived identifiers.
+ */
+export declare function mintUkycTestToken(params?: MintUkycTestTokenParams): MintedUkycTestToken;
+//# sourceMappingURL=testToken.d.mts.map

package/dist/ukyc/testToken.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testToken.d.mts","sourceRoot":"","sources":["../../src/ukyc/testToken.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EACnB,iCAAgC;AAgBjC;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACtC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACpC,wDAAwD;IACxD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,sDAAsD;IACtD,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,EAAE,sBAAsB,CAAC;IAC9B;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAgBF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,uBAA4B,GACnC,mBAAmB,CAgCrB"}

package/dist/ukyc/testToken.mjs

@@ -0,0 +1,57 @@
+import { bytesToHex, hexToBytes, randomBytes } from "@noble/hashes/utils";
+import { UKYC_CAPABILITY_AUTH_SCHEME, UKYC_LOCAL_USER_SECRET_SIZE_BYTES } from "./constants.mjs";
+import { deriveClientMaterial, encodeClientMaterial } from "./deriveClientMaterial.mjs";
+import { encodeStorageAccessTokenForHeader, signStorageAccessToken } from "./storageAccessToken.mjs";
+/**
+ * Mints ready-to-use UKYC `storage_access_token`s for testing UKYC Storage.
+ *
+ * This composes the same pure functions the MetaMask client uses in production
+ * (`deriveClientMaterial` + `signStorageAccessToken`), so a third party such as
+ * idOS can produce a valid, signed token without deriving one on-device. No
+ * server "fills in" the `signing_public_key`: it is derived from a
+ * `local_user_secret` the caller controls and registered on first write, so
+ * reusing the same secret yields a stable `storage_id` and controlling key.
+ */
+/** Default token lifetime when `expiresAt` is not supplied (4 hours). */
+const DEFAULT_TOKEN_LIFETIME_MS = 4 * 60 * 60 * 1000;
+/**
+ * Resolves the caller-supplied secret into raw bytes, generating a random one
+ * when none is provided.
+ *
+ * @param secret - Raw 32 bytes, a hex string, or undefined for a random secret.
+ * @returns The `local_user_secret` bytes.
+ */
+function resolveLocalUserSecret(secret) {
+    if (secret === undefined) {
+        return randomBytes(UKYC_LOCAL_USER_SECRET_SIZE_BYTES);
+    }
+    return typeof secret === 'string' ? hexToBytes(secret) : secret;
+}
+/**
+ * Mints a signed UKYC `storage_access_token` for testing.
+ *
+ * @param params - See {@link MintUkycTestTokenParams}.
+ * @returns The token, its `Authorization` header, and the derived identifiers.
+ */
+export function mintUkycTestToken(params = {}) {
+    const { operations = ['read'], presenter, sessionId, issuedAt = new Date(), expiresAt = new Date(issuedAt.getTime() + DEFAULT_TOKEN_LIFETIME_MS), } = params;
+    const localUserSecret = resolveLocalUserSecret(params.localUserSecret);
+    const material = deriveClientMaterial(localUserSecret);
+    const token = signStorageAccessToken({
+        material,
+        operations,
+        presenter,
+        sessionId,
+        issuedAt,
+        expiresAt,
+    });
+    const { storageId, signingPublicKey } = encodeClientMaterial(material);
+    return {
+        localUserSecret: bytesToHex(localUserSecret),
+        storageId,
+        signingPublicKey,
+        token,
+        authorizationHeader: `${UKYC_CAPABILITY_AUTH_SCHEME} ${encodeStorageAccessTokenForHeader(token)}`,
+    };
+}
+//# sourceMappingURL=testToken.mjs.map

package/dist/ukyc/testToken.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"testToken.mjs","sourceRoot":"","sources":["../../src/ukyc/testToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,4BAA4B;AAE1E,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,EAClC,wBAAuB;AACxB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,mCAAkC;AACnC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACvB,iCAAgC;AAOjC;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6CrD;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,MAA4B;IAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC,iCAAiC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAkC,EAAE;IAEpC,MAAM,EACJ,UAAU,GAAG,CAAC,MAAM,CAAC,EACrB,SAAS,EACT,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,EACrB,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,yBAAyB,CAAC,GACrE,GAAG,MAAM,CAAC;IAEX,MAAM,eAAe,GAAG,sBAAsB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,sBAAsB,CAAC;QACnC,QAAQ;QACR,UAAU;QACV,SAAS;QACT,SAAS;QACT,QAAQ;QACR,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAEvE,OAAO;QACL,eAAe,EAAE,UAAU,CAAC,eAAe,CAAC;QAC5C,SAAS;QACT,gBAAgB;QAChB,KAAK;QACL,mBAAmB,EAAE,GAAG,2BAA2B,IAAI,iCAAiC,CACtF,KAAK,CACN,EAAE;KACJ,CAAC;AACJ,CAAC","sourcesContent":["import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';\n\nimport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_LOCAL_USER_SECRET_SIZE_BYTES,\n} from './constants.js';\nimport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './deriveClientMaterial.js';\nimport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './storageAccessToken.js';\nimport type {\n  UkycStorageAccessToken,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './storageAccessToken.js';\n\n/**\n * Mints ready-to-use UKYC `storage_access_token`s for testing UKYC Storage.\n *\n * This composes the same pure functions the MetaMask client uses in production\n * (`deriveClientMaterial` + `signStorageAccessToken`), so a third party such as\n * idOS can produce a valid, signed token without deriving one on-device. No\n * server \"fills in\" the `signing_public_key`: it is derived from a\n * `local_user_secret` the caller controls and registered on first write, so\n * reusing the same secret yields a stable `storage_id` and controlling key.\n */\n\n/** Default token lifetime when `expiresAt` is not supplied (4 hours). */\nconst DEFAULT_TOKEN_LIFETIME_MS = 4 * 60 * 60 * 1000;\n\n/**\n * Inputs for {@link mintUkycTestToken}. All fields are optional; the only value\n * a caller usually pins is `localUserSecret`, so `storage_id` and the signing\n * key stay stable across runs.\n */\nexport type MintUkycTestTokenParams = {\n  /**\n   * The root `local_user_secret`, as raw 32 bytes or a hex string. When omitted\n   * a fresh random secret is generated (returned in the result so it can be\n   * reused).\n   */\n  localUserSecret?: Uint8Array | string;\n  /** Operations the token authorizes. Defaults to `['read']`. */\n  operations?: UkycStorageOperation[];\n  /** Who will present the token. Defaults to `client`. */\n  presenter?: UkycTokenPresenter;\n  /** UKYC session id. Required when `presenter` is `idos-relay`. */\n  sessionId?: string;\n  /** Token issue time. Defaults to now. */\n  issuedAt?: Date;\n  /** Token expiry. Defaults to `issuedAt` + 4 hours. */\n  expiresAt?: Date;\n};\n\n/**\n * The minted token plus everything needed to exercise UKYC Storage with it.\n */\nexport type MintedUkycTestToken = {\n  /** The `local_user_secret` used, hex-encoded, so the caller can reuse it. */\n  localUserSecret: string;\n  /** base64url `storage_id` — use it as the `{storage_id}` path segment. */\n  storageId: string;\n  /** base64url `signing_public_key` registered on first write. */\n  signingPublicKey: string;\n  /** The signed token envelope (payload + signature). */\n  token: UkycStorageAccessToken;\n  /**\n   * The full `Authorization` header value, e.g.\n   * `AccessToken <base64url(envelope)>`, ready to send to UKYC Storage.\n   */\n  authorizationHeader: string;\n};\n\n/**\n * Resolves the caller-supplied secret into raw bytes, generating a random one\n * when none is provided.\n *\n * @param secret - Raw 32 bytes, a hex string, or undefined for a random secret.\n * @returns The `local_user_secret` bytes.\n */\nfunction resolveLocalUserSecret(secret?: Uint8Array | string): Uint8Array {\n  if (secret === undefined) {\n    return randomBytes(UKYC_LOCAL_USER_SECRET_SIZE_BYTES);\n  }\n  return typeof secret === 'string' ? hexToBytes(secret) : secret;\n}\n\n/**\n * Mints a signed UKYC `storage_access_token` for testing.\n *\n * @param params - See {@link MintUkycTestTokenParams}.\n * @returns The token, its `Authorization` header, and the derived identifiers.\n */\nexport function mintUkycTestToken(\n  params: MintUkycTestTokenParams = {},\n): MintedUkycTestToken {\n  const {\n    operations = ['read'],\n    presenter,\n    sessionId,\n    issuedAt = new Date(),\n    expiresAt = new Date(issuedAt.getTime() + DEFAULT_TOKEN_LIFETIME_MS),\n  } = params;\n\n  const localUserSecret = resolveLocalUserSecret(params.localUserSecret);\n  const material = deriveClientMaterial(localUserSecret);\n\n  const token = signStorageAccessToken({\n    material,\n    operations,\n    presenter,\n    sessionId,\n    issuedAt,\n    expiresAt,\n  });\n\n  const { storageId, signingPublicKey } = encodeClientMaterial(material);\n\n  return {\n    localUserSecret: bytesToHex(localUserSecret),\n    storageId,\n    signingPublicKey,\n    token,\n    authorizationHeader: `${UKYC_CAPABILITY_AUTH_SCHEME} ${encodeStorageAccessTokenForHeader(\n      token,\n    )}`,\n  };\n}\n"]}

package/dist/ukyc/wrapEncryptionKey.cjs

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wrapEncryptionKey = void 0;
+const tweetnacl_1 = require("tweetnacl");
+const encoding_js_1 = require("../encoding.cjs");
+/**
+ * Wraps `keyToWrap` for the UKYC session server.
+ *
+ * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
+ * between our session client private key and the session server public key
+ * returned by `getWrappingKey`.
+ *
+ * @param sessionClientPrivateKey - Our session's X25519 private key.
+ * @param sessionServerPublicKey - The server's X25519 public key (base64url).
+ * @param keyToWrap - The raw symmetric key bytes to encrypt.
+ * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.
+ */
+function wrapEncryptionKey(sessionClientPrivateKey, sessionServerPublicKey, keyToWrap) {
+    const serverPublicKey = (0, encoding_js_1.base64UrlToBytes)(sessionServerPublicKey);
+    const nonce = (0, tweetnacl_1.randomBytes)(tweetnacl_1.box.nonceLength);
+    const encryptedKey = (0, tweetnacl_1.box)(keyToWrap, nonce, serverPublicKey, sessionClientPrivateKey);
+    return {
+        encryptedKey: (0, encoding_js_1.toBase64Url)(encryptedKey),
+        nonce: (0, encoding_js_1.toBase64Url)(nonce),
+    };
+}
+exports.wrapEncryptionKey = wrapEncryptionKey;
+//# sourceMappingURL=wrapEncryptionKey.cjs.map

package/dist/ukyc/wrapEncryptionKey.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapEncryptionKey.cjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;;AAAA,yCAA6C;AAE7C,iDAA+D;AAwB/D;;;;;;;;;;;GAWG;AACH,SAAgB,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,IAAA,8BAAgB,EAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAA,uBAAW,EAAC,eAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAA,eAAG,EACtB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,OAAO;QACL,YAAY,EAAE,IAAA,yBAAW,EAAC,YAAY,CAAC;QACvC,KAAK,EAAE,IAAA,yBAAW,EAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAjBD,8CAiBC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps the `data_encryption_key` for the UKYC session server using NaCl's\n * `crypto_box` (X25519 + XSalsa20-Poly1305) established with the server's\n * per-session wrapping key.\n *\n * Unlike {@link wrapUserKey} (which generates a fresh ephemeral keypair per\n * call), this uses the session client keypair whose public half was already\n * handed to the server via `POST /wrapping-key`. The server therefore already\n * knows our public key and can derive the same shared secret from its session\n * private key, so only `{ encryptedKey, nonce }` need be transmitted.\n */\n\n/**\n * The transmitted portion of a wrapped encryption key: the `crypto_box`\n * ciphertext (which includes the 16-byte Poly1305 auth tag) and the nonce,\n * both unpadded base64url-encoded.\n */\nexport type WrappedEncryptionKeyParts = {\n  encryptedKey: string;\n  nonce: string;\n};\n\n/**\n * Wraps `keyToWrap` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * returned by `getWrappingKey`.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param keyToWrap - The raw symmetric key bytes to encrypt.\n * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  keyToWrap: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const nonce = randomBytes(box.nonceLength);\n  const encryptedKey = box(\n    keyToWrap,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  return {\n    encryptedKey: toBase64Url(encryptedKey),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}

package/dist/ukyc/wrapEncryptionKey.d.cts

@@ -0,0 +1,34 @@
+/**
+ * Wraps the `data_encryption_key` for the UKYC session server using NaCl's
+ * `crypto_box` (X25519 + XSalsa20-Poly1305) established with the server's
+ * per-session wrapping key.
+ *
+ * Unlike {@link wrapUserKey} (which generates a fresh ephemeral keypair per
+ * call), this uses the session client keypair whose public half was already
+ * handed to the server via `POST /wrapping-key`. The server therefore already
+ * knows our public key and can derive the same shared secret from its session
+ * private key, so only `{ encryptedKey, nonce }` need be transmitted.
+ */
+/**
+ * The transmitted portion of a wrapped encryption key: the `crypto_box`
+ * ciphertext (which includes the 16-byte Poly1305 auth tag) and the nonce,
+ * both unpadded base64url-encoded.
+ */
+export type WrappedEncryptionKeyParts = {
+    encryptedKey: string;
+    nonce: string;
+};
+/**
+ * Wraps `keyToWrap` for the UKYC session server.
+ *
+ * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
+ * between our session client private key and the session server public key
+ * returned by `getWrappingKey`.
+ *
+ * @param sessionClientPrivateKey - Our session's X25519 private key.
+ * @param sessionServerPublicKey - The server's X25519 public key (base64url).
+ * @param keyToWrap - The raw symmetric key bytes to encrypt.
+ * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.
+ */
+export declare function wrapEncryptionKey(sessionClientPrivateKey: Uint8Array, sessionServerPublicKey: string, keyToWrap: Uint8Array): WrappedEncryptionKeyParts;
+//# sourceMappingURL=wrapEncryptionKey.d.cts.map

package/dist/ukyc/wrapEncryptionKey.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapEncryptionKey.d.cts","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,uBAAuB,EAAE,UAAU,EACnC,sBAAsB,EAAE,MAAM,EAC9B,SAAS,EAAE,UAAU,GACpB,yBAAyB,CAa3B"}

package/dist/ukyc/wrapEncryptionKey.d.mts

@@ -0,0 +1,34 @@
+/**
+ * Wraps the `data_encryption_key` for the UKYC session server using NaCl's
+ * `crypto_box` (X25519 + XSalsa20-Poly1305) established with the server's
+ * per-session wrapping key.
+ *
+ * Unlike {@link wrapUserKey} (which generates a fresh ephemeral keypair per
+ * call), this uses the session client keypair whose public half was already
+ * handed to the server via `POST /wrapping-key`. The server therefore already
+ * knows our public key and can derive the same shared secret from its session
+ * private key, so only `{ encryptedKey, nonce }` need be transmitted.
+ */
+/**
+ * The transmitted portion of a wrapped encryption key: the `crypto_box`
+ * ciphertext (which includes the 16-byte Poly1305 auth tag) and the nonce,
+ * both unpadded base64url-encoded.
+ */
+export type WrappedEncryptionKeyParts = {
+    encryptedKey: string;
+    nonce: string;
+};
+/**
+ * Wraps `keyToWrap` for the UKYC session server.
+ *
+ * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
+ * between our session client private key and the session server public key
+ * returned by `getWrappingKey`.
+ *
+ * @param sessionClientPrivateKey - Our session's X25519 private key.
+ * @param sessionServerPublicKey - The server's X25519 public key (base64url).
+ * @param keyToWrap - The raw symmetric key bytes to encrypt.
+ * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.
+ */
+export declare function wrapEncryptionKey(sessionClientPrivateKey: Uint8Array, sessionServerPublicKey: string, keyToWrap: Uint8Array): WrappedEncryptionKeyParts;
+//# sourceMappingURL=wrapEncryptionKey.d.mts.map

package/dist/ukyc/wrapEncryptionKey.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapEncryptionKey.d.mts","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,uBAAuB,EAAE,UAAU,EACnC,sBAAsB,EAAE,MAAM,EAC9B,SAAS,EAAE,UAAU,GACpB,yBAAyB,CAa3B"}

package/dist/ukyc/wrapEncryptionKey.mjs

@@ -0,0 +1,25 @@
+import $tweetnacl from "tweetnacl";
+const { randomBytes, box } = $tweetnacl;
+import { base64UrlToBytes, toBase64Url } from "../encoding.mjs";
+/**
+ * Wraps `keyToWrap` for the UKYC session server.
+ *
+ * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
+ * between our session client private key and the session server public key
+ * returned by `getWrappingKey`.
+ *
+ * @param sessionClientPrivateKey - Our session's X25519 private key.
+ * @param sessionServerPublicKey - The server's X25519 public key (base64url).
+ * @param keyToWrap - The raw symmetric key bytes to encrypt.
+ * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.
+ */
+export function wrapEncryptionKey(sessionClientPrivateKey, sessionServerPublicKey, keyToWrap) {
+    const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);
+    const nonce = randomBytes(box.nonceLength);
+    const encryptedKey = box(keyToWrap, nonce, serverPublicKey, sessionClientPrivateKey);
+    return {
+        encryptedKey: toBase64Url(encryptedKey),
+        nonce: toBase64Url(nonce),
+    };
+}
+//# sourceMappingURL=wrapEncryptionKey.mjs.map

package/dist/ukyc/wrapEncryptionKey.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapEncryptionKey.mjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAuB;AAwB/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,GAAG,CACtB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;QACvC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps the `data_encryption_key` for the UKYC session server using NaCl's\n * `crypto_box` (X25519 + XSalsa20-Poly1305) established with the server's\n * per-session wrapping key.\n *\n * Unlike {@link wrapUserKey} (which generates a fresh ephemeral keypair per\n * call), this uses the session client keypair whose public half was already\n * handed to the server via `POST /wrapping-key`. The server therefore already\n * knows our public key and can derive the same shared secret from its session\n * private key, so only `{ encryptedKey, nonce }` need be transmitted.\n */\n\n/**\n * The transmitted portion of a wrapped encryption key: the `crypto_box`\n * ciphertext (which includes the 16-byte Poly1305 auth tag) and the nonce,\n * both unpadded base64url-encoded.\n */\nexport type WrappedEncryptionKeyParts = {\n  encryptedKey: string;\n  nonce: string;\n};\n\n/**\n * Wraps `keyToWrap` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * returned by `getWrappingKey`.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param keyToWrap - The raw symmetric key bytes to encrypt.\n * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  keyToWrap: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const nonce = randomBytes(box.nonceLength);\n  const encryptedKey = box(\n    keyToWrap,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  return {\n    encryptedKey: toBase64Url(encryptedKey),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}

package/dist/ukyc/wrapUserKey.cjs

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wrapUserKey = void 0;
+const utils_1 = require("@metamask/utils");
+const aes_1 = require("@noble/ciphers/aes");
+const ed25519_1 = require("@noble/curves/ed25519");
+const hkdf_1 = require("@noble/hashes/hkdf");
+const sha2_1 = require("@noble/hashes/sha2");
+const utils_2 = require("@noble/hashes/utils");
+const encoding_js_1 = require("../encoding.cjs");
+/**
+ * Wraps (encrypts) a symmetric key so that only the holder of a given X25519
+ * private key can recover it — used to seal the `data_encryption_key` for the
+ * idOS Relay before it is handed to the UKYC API as `wrappedUserKey`.
+ */
+/** X25519 public/private keys and AES-256-GCM keys are all 32 bytes. */
+const X25519_KEY_SIZE_BYTES = 32;
+/** 96-bit IV, the AES-GCM standard nonce size. */
+const IV_SIZE_BYTES = 12;
+/**
+ * Decodes an X25519 public key presented as either hex or base64/base64url.
+ *
+ * @param recipientPublicKey - The recipient's 32-byte X25519 public key.
+ * @returns The raw 32-byte public key.
+ */
+function decodePublicKey(recipientPublicKey) {
+    const isHex = recipientPublicKey.length === X25519_KEY_SIZE_BYTES * 2 &&
+        /^[0-9a-fA-F]+$/u.test(recipientPublicKey);
+    const bytes = isHex
+        ? (0, utils_2.hexToBytes)(recipientPublicKey)
+        : (0, utils_1.base64ToBytes)(recipientPublicKey
+            .replace(/-/gu, '+')
+            .replace(/_/gu, '/')
+            .padEnd(recipientPublicKey.length +
+            ((4 - (recipientPublicKey.length % 4)) % 4), '='));
+    if (bytes.length !== X25519_KEY_SIZE_BYTES) {
+        throw new Error(`UKYC: wrappingPublicKey has unexpected length ${bytes.length}, expected ${X25519_KEY_SIZE_BYTES}.`);
+    }
+    return bytes;
+}
+/**
+ * Wraps `keyToWrap` for the holder of `recipientPublicKey` using an
+ * ephemeral-static ECDH + AES-256-GCM sealed-box scheme:
+ *
+ *   ephemeral = fresh X25519 keypair (one per call)
+ *   shared    = X25519(ephemeralPrivate, recipientPublic)
+ *   aeadKey   = HKDF-SHA256(shared, 32 bytes)
+ *   iv        = 12 random bytes
+ *   ct        = AES-256-GCM(aeadKey, iv).encrypt(keyToWrap)   // ct includes tag
+ *
+ * The recipient reverses it with their private key:
+ *
+ *   shared  = X25519(recipientPrivate, ephemeralPublic)
+ *   aeadKey = HKDF-SHA256(shared, 32 bytes)
+ *   key     = AES-256-GCM(aeadKey, iv).decrypt(ct)
+ *
+ * This mirrors the X25519 + AES-256-GCM/HKDF decryption used for MoonPay
+ * Check/Auth-frame credentials, so both directions share one primitive.
+ *
+ * @param recipientPublicKey - The recipient's X25519 public key (hex or base64).
+ * @param keyToWrap - The raw symmetric key bytes to encrypt (e.g. the
+ * `data_encryption_key`).
+ * @returns Base64url of `ephemeralPublicKey(32) || iv(12) || ciphertext+tag`.
+ */
+function wrapUserKey(recipientPublicKey, keyToWrap) {
+    const recipient = decodePublicKey(recipientPublicKey);
+    const ephemeralPrivateKey = ed25519_1.x25519.utils.randomSecretKey();
+    const ephemeralPublicKey = ed25519_1.x25519.getPublicKey(ephemeralPrivateKey);
+    const shared = ed25519_1.x25519.getSharedSecret(ephemeralPrivateKey, recipient);
+    const aeadKey = (0, hkdf_1.hkdf)(sha2_1.sha256, shared, undefined, undefined, 32);
+    const iv = (0, utils_2.randomBytes)(IV_SIZE_BYTES);
+    const ciphertext = (0, aes_1.gcm)(aeadKey, iv).encrypt(keyToWrap);
+    const blob = new Uint8Array(ephemeralPublicKey.length + iv.length + ciphertext.length);
+    blob.set(ephemeralPublicKey, 0);
+    blob.set(iv, ephemeralPublicKey.length);
+    blob.set(ciphertext, ephemeralPublicKey.length + iv.length);
+    return (0, encoding_js_1.toBase64Url)(blob);
+}
+exports.wrapUserKey = wrapUserKey;
+//# sourceMappingURL=wrapUserKey.cjs.map

package/dist/ukyc/wrapUserKey.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapUserKey.cjs","sourceRoot":"","sources":["../../src/ukyc/wrapUserKey.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,4CAAyC;AACzC,mDAA+C;AAC/C,6CAA0C;AAC1C,6CAA4C;AAC5C,+CAA8D;AAE9D,iDAA6C;AAE7C;;;;GAIG;AAEH,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,kDAAkD;AAClD,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;;;;GAKG;AACH,SAAS,eAAe,CAAC,kBAA0B;IACjD,MAAM,KAAK,GACT,kBAAkB,CAAC,MAAM,KAAK,qBAAqB,GAAG,CAAC;QACvD,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG,KAAK;QACjB,CAAC,CAAC,IAAA,kBAAU,EAAC,kBAAkB,CAAC;QAChC,CAAC,CAAC,IAAA,qBAAa,EACX,kBAAkB;aACf,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,MAAM,CACL,kBAAkB,CAAC,MAAM;YACvB,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAC7C,GAAG,CACJ,CACJ,CAAC;IAEN,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,iDAAiD,KAAK,CAAC,MAAM,cAAc,qBAAqB,GAAG,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,WAAW,CACzB,kBAA0B,EAC1B,SAAqB;IAErB,MAAM,SAAS,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAEtD,MAAM,mBAAmB,GAAG,gBAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IAC3D,MAAM,kBAAkB,GAAG,gBAAM,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAG,gBAAM,CAAC,eAAe,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,aAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAE/D,MAAM,EAAE,GAAG,IAAA,mBAAW,EAAC,aAAa,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAA,SAAG,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,kBAAkB,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAC1D,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAE5D,OAAO,IAAA,yBAAW,EAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAvBD,kCAuBC","sourcesContent":["import { base64ToBytes } from '@metamask/utils';\nimport { gcm } from '@noble/ciphers/aes';\nimport { x25519 } from '@noble/curves/ed25519';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\nimport { hexToBytes, randomBytes } from '@noble/hashes/utils';\n\nimport { toBase64Url } from '../encoding.js';\n\n/**\n * Wraps (encrypts) a symmetric key so that only the holder of a given X25519\n * private key can recover it — used to seal the `data_encryption_key` for the\n * idOS Relay before it is handed to the UKYC API as `wrappedUserKey`.\n */\n\n/** X25519 public/private keys and AES-256-GCM keys are all 32 bytes. */\nconst X25519_KEY_SIZE_BYTES = 32;\n\n/** 96-bit IV, the AES-GCM standard nonce size. */\nconst IV_SIZE_BYTES = 12;\n\n/**\n * Decodes an X25519 public key presented as either hex or base64/base64url.\n *\n * @param recipientPublicKey - The recipient's 32-byte X25519 public key.\n * @returns The raw 32-byte public key.\n */\nfunction decodePublicKey(recipientPublicKey: string): Uint8Array {\n  const isHex =\n    recipientPublicKey.length === X25519_KEY_SIZE_BYTES * 2 &&\n    /^[0-9a-fA-F]+$/u.test(recipientPublicKey);\n\n  const bytes = isHex\n    ? hexToBytes(recipientPublicKey)\n    : base64ToBytes(\n        recipientPublicKey\n          .replace(/-/gu, '+')\n          .replace(/_/gu, '/')\n          .padEnd(\n            recipientPublicKey.length +\n              ((4 - (recipientPublicKey.length % 4)) % 4),\n            '=',\n          ),\n      );\n\n  if (bytes.length !== X25519_KEY_SIZE_BYTES) {\n    throw new Error(\n      `UKYC: wrappingPublicKey has unexpected length ${bytes.length}, expected ${X25519_KEY_SIZE_BYTES}.`,\n    );\n  }\n  return bytes;\n}\n\n/**\n * Wraps `keyToWrap` for the holder of `recipientPublicKey` using an\n * ephemeral-static ECDH + AES-256-GCM sealed-box scheme:\n *\n *   ephemeral = fresh X25519 keypair (one per call)\n *   shared    = X25519(ephemeralPrivate, recipientPublic)\n *   aeadKey   = HKDF-SHA256(shared, 32 bytes)\n *   iv        = 12 random bytes\n *   ct        = AES-256-GCM(aeadKey, iv).encrypt(keyToWrap)   // ct includes tag\n *\n * The recipient reverses it with their private key:\n *\n *   shared  = X25519(recipientPrivate, ephemeralPublic)\n *   aeadKey = HKDF-SHA256(shared, 32 bytes)\n *   key     = AES-256-GCM(aeadKey, iv).decrypt(ct)\n *\n * This mirrors the X25519 + AES-256-GCM/HKDF decryption used for MoonPay\n * Check/Auth-frame credentials, so both directions share one primitive.\n *\n * @param recipientPublicKey - The recipient's X25519 public key (hex or base64).\n * @param keyToWrap - The raw symmetric key bytes to encrypt (e.g. the\n * `data_encryption_key`).\n * @returns Base64url of `ephemeralPublicKey(32) || iv(12) || ciphertext+tag`.\n */\nexport function wrapUserKey(\n  recipientPublicKey: string,\n  keyToWrap: Uint8Array,\n): string {\n  const recipient = decodePublicKey(recipientPublicKey);\n\n  const ephemeralPrivateKey = x25519.utils.randomSecretKey();\n  const ephemeralPublicKey = x25519.getPublicKey(ephemeralPrivateKey);\n\n  const shared = x25519.getSharedSecret(ephemeralPrivateKey, recipient);\n  const aeadKey = hkdf(sha256, shared, undefined, undefined, 32);\n\n  const iv = randomBytes(IV_SIZE_BYTES);\n  const ciphertext = gcm(aeadKey, iv).encrypt(keyToWrap);\n\n  const blob = new Uint8Array(\n    ephemeralPublicKey.length + iv.length + ciphertext.length,\n  );\n  blob.set(ephemeralPublicKey, 0);\n  blob.set(iv, ephemeralPublicKey.length);\n  blob.set(ciphertext, ephemeralPublicKey.length + iv.length);\n\n  return toBase64Url(blob);\n}\n"]}

package/dist/ukyc/wrapUserKey.d.cts

@@ -0,0 +1,26 @@
+/**
+ * Wraps `keyToWrap` for the holder of `recipientPublicKey` using an
+ * ephemeral-static ECDH + AES-256-GCM sealed-box scheme:
+ *
+ *   ephemeral = fresh X25519 keypair (one per call)
+ *   shared    = X25519(ephemeralPrivate, recipientPublic)
+ *   aeadKey   = HKDF-SHA256(shared, 32 bytes)
+ *   iv        = 12 random bytes
+ *   ct        = AES-256-GCM(aeadKey, iv).encrypt(keyToWrap)   // ct includes tag
+ *
+ * The recipient reverses it with their private key:
+ *
+ *   shared  = X25519(recipientPrivate, ephemeralPublic)
+ *   aeadKey = HKDF-SHA256(shared, 32 bytes)
+ *   key     = AES-256-GCM(aeadKey, iv).decrypt(ct)
+ *
+ * This mirrors the X25519 + AES-256-GCM/HKDF decryption used for MoonPay
+ * Check/Auth-frame credentials, so both directions share one primitive.
+ *
+ * @param recipientPublicKey - The recipient's X25519 public key (hex or base64).
+ * @param keyToWrap - The raw symmetric key bytes to encrypt (e.g. the
+ * `data_encryption_key`).
+ * @returns Base64url of `ephemeralPublicKey(32) || iv(12) || ciphertext+tag`.
+ */
+export declare function wrapUserKey(recipientPublicKey: string, keyToWrap: Uint8Array): string;
+//# sourceMappingURL=wrapUserKey.d.cts.map

package/dist/ukyc/wrapUserKey.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapUserKey.d.cts","sourceRoot":"","sources":["../../src/ukyc/wrapUserKey.ts"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,UAAU,GACpB,MAAM,CAoBR"}

package/dist/ukyc/wrapUserKey.d.mts

@@ -0,0 +1,26 @@
+/**
+ * Wraps `keyToWrap` for the holder of `recipientPublicKey` using an
+ * ephemeral-static ECDH + AES-256-GCM sealed-box scheme:
+ *
+ *   ephemeral = fresh X25519 keypair (one per call)
+ *   shared    = X25519(ephemeralPrivate, recipientPublic)
+ *   aeadKey   = HKDF-SHA256(shared, 32 bytes)
+ *   iv        = 12 random bytes
+ *   ct        = AES-256-GCM(aeadKey, iv).encrypt(keyToWrap)   // ct includes tag
+ *
+ * The recipient reverses it with their private key:
+ *
+ *   shared  = X25519(recipientPrivate, ephemeralPublic)
+ *   aeadKey = HKDF-SHA256(shared, 32 bytes)
+ *   key     = AES-256-GCM(aeadKey, iv).decrypt(ct)
+ *
+ * This mirrors the X25519 + AES-256-GCM/HKDF decryption used for MoonPay
+ * Check/Auth-frame credentials, so both directions share one primitive.
+ *
+ * @param recipientPublicKey - The recipient's X25519 public key (hex or base64).
+ * @param keyToWrap - The raw symmetric key bytes to encrypt (e.g. the
+ * `data_encryption_key`).
+ * @returns Base64url of `ephemeralPublicKey(32) || iv(12) || ciphertext+tag`.
+ */
+export declare function wrapUserKey(recipientPublicKey: string, keyToWrap: Uint8Array): string;
+//# sourceMappingURL=wrapUserKey.d.mts.map

package/dist/ukyc/wrapUserKey.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapUserKey.d.mts","sourceRoot":"","sources":["../../src/ukyc/wrapUserKey.ts"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CACzB,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,UAAU,GACpB,MAAM,CAoBR"}