@metamask-previews/kyc-controller 0.0.0-preview-abca9bcea → 0.0.0-preview-ec24abb79

package/dist/ukyc/wrapEncryptionKey.mjs

@@ -7,21 +7,26 @@ import { base64UrlToBytes, toBase64Url } from "../encoding.mjs";
  * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
  * between our session client private key and the session server public key
  * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)
- * returned by `createUkycSession`. The client public key is not embedded in
- * `data`; it was already registered on `createUkycSession`.
+ * returned by `createUkycSession`. The 32-byte client public key is still
+ * prefixed onto `data` so the box is self-describing on the wire.
  *
  * @param sessionClientPrivateKey - Our session's X25519 private key.
  * @param sessionServerPublicKey - The server's X25519 public key (base64url).
  * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`
  * or the encoded `ukyc_capability_token`).
- * @returns The base64url `data` (ciphertext+tag) and `nonce`.
+ * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and
+ * `nonce`.
  */
 export function wrapEncryptionKey(sessionClientPrivateKey, sessionServerPublicKey, plaintext) {
     const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);
+    const { publicKey: clientPublicKey } = box.keyPair.fromSecretKey(sessionClientPrivateKey);
     const nonce = randomBytes(box.nonceLength);
     const ciphertext = box(plaintext, nonce, serverPublicKey, sessionClientPrivateKey);
+    const data = new Uint8Array(clientPublicKey.length + ciphertext.length);
+    data.set(clientPublicKey, 0);
+    data.set(ciphertext, clientPublicKey.length);
     return {
-        data: toBase64Url(ciphertext),
+        data: toBase64Url(data),
         nonce: toBase64Url(nonce),
     };
 }

package/dist/ukyc/wrapEncryptionKey.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"wrapEncryptionKey.mjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAuB;AAuB/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,GAAG,CACpB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC;QAC7B,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps a secret for the UKYC session server using NaCl's `crypto_box`\n * (X25519 + XSalsa20-Poly1305) established with a per-secret wrapping key\n * returned inside an encryption schema from `createUkycSession`.\n *\n * Reuses a session client keypair whose public half is registered on\n * `createUkycSession`. `data` is the ciphertext+tag only; the server already\n * knows the client public key from session creation. Used for both the\n * `data_encryption_key` and the `ukyc_capability_token`.\n */\n\n/**\n * The transmitted portion of a wrapped secret: the `crypto_box` ciphertext\n * (which includes the 16-byte Poly1305 auth tag) and the nonce, both unpadded\n * base64url-encoded. Matches the KYC API `CapabilityAuthorization` wire shape.\n */\nexport type WrappedEncryptionKeyParts = {\n  data: string;\n  nonce: string;\n};\n\n/**\n * Wraps `plaintext` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)\n * returned by `createUkycSession`. The client public key is not embedded in\n * `data`; it was already registered on `createUkycSession`.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`\n * or the encoded `ukyc_capability_token`).\n * @returns The base64url `data` (ciphertext+tag) and `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  plaintext: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const nonce = randomBytes(box.nonceLength);\n  const ciphertext = box(\n    plaintext,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  return {\n    data: toBase64Url(ciphertext),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}
+{"version":3,"file":"wrapEncryptionKey.mjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAuB;AAwB/D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAC9D,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,GAAG,CACpB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;QACvB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps a secret for the UKYC session server using NaCl's `crypto_box`\n * (X25519 + XSalsa20-Poly1305) established with a per-secret wrapping key\n * returned inside an encryption schema from `createUkycSession`.\n *\n * Reuses a session client keypair whose public half is registered on\n * `createUkycSession`. `data` is still `clientPublicKey (32) || ciphertext+tag`\n * so the box can be opened from `{ data, nonce }` alone. Used for both the\n * `data_encryption_key` and the `ukyc_capability_token`.\n */\n\n/**\n * The transmitted portion of a wrapped secret: the sender public key prefixed\n * to the `crypto_box` ciphertext (which includes the 16-byte Poly1305 auth\n * tag), and the nonce, both unpadded base64url-encoded. Matches the KYC API\n * `CapabilityAuthorization` wire shape.\n */\nexport type WrappedEncryptionKeyParts = {\n  data: string;\n  nonce: string;\n};\n\n/**\n * Wraps `plaintext` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)\n * returned by `createUkycSession`. The 32-byte client public key is still\n * prefixed onto `data` so the box is self-describing on the wire.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`\n * or the encoded `ukyc_capability_token`).\n * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and\n * `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  plaintext: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const { publicKey: clientPublicKey } = box.keyPair.fromSecretKey(\n    sessionClientPrivateKey,\n  );\n  const nonce = randomBytes(box.nonceLength);\n  const ciphertext = box(\n    plaintext,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  const data = new Uint8Array(clientPublicKey.length + ciphertext.length);\n  data.set(clientPublicKey, 0);\n  data.set(ciphertext, clientPublicKey.length);\n  return {\n    data: toBase64Url(data),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask-previews/kyc-controller",
-  "version": "0.0.0-preview-abca9bcea",
+  "version": "0.0.0-preview-ec24abb79",
   "description": "Shared KYC / identity verification controller used across MetaMask clients",
   "keywords": [
     "Ethereum",
@@ -64,7 +64,7 @@
     "@metamask/messenger": "^2.0.0",
     "@metamask/profile-sync-controller": "^29.0.0",
     "@metamask/superstruct": "^3.4.1",
-    "@metamask/utils": "^11.12.0",
+    "@metamask/utils": "^11.11.0",
     "@noble/ciphers": "^1.3.0",
     "@noble/curves": "^1.9.2",
     "@noble/hashes": "^1.8.0",

package/dist/logger.cjs

@@ -1,9 +0,0 @@
-"use strict";
-/* istanbul ignore file */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createModuleLogger = exports.controllerLog = exports.projectLogger = void 0;
-const utils_1 = require("@metamask/utils");
-Object.defineProperty(exports, "createModuleLogger", { enumerable: true, get: function () { return utils_1.createModuleLogger; } });
-exports.projectLogger = (0, utils_1.createProjectLogger)('kyc-controller');
-exports.controllerLog = (0, utils_1.createModuleLogger)(exports.projectLogger, 'KycController');
-//# sourceMappingURL=logger.cjs.map

package/dist/logger.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.cjs","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAAA,0BAA0B;;;AAE1B,2CAA0E;AAMjE,mGANqB,0BAAkB,OAMrB;AAJd,QAAA,aAAa,GAAG,IAAA,2BAAmB,EAAC,gBAAgB,CAAC,CAAC;AAEtD,QAAA,aAAa,GAAG,IAAA,0BAAkB,EAAC,qBAAa,EAAE,eAAe,CAAC,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nexport const projectLogger = createProjectLogger('kyc-controller');\n\nexport const controllerLog = createModuleLogger(projectLogger, 'KycController');\n\nexport { createModuleLogger };\n"]}

package/dist/logger.d.cts

@@ -1,6 +0,0 @@
-/// <reference types="debug" />
-import { createModuleLogger } from "@metamask/utils";
-export declare const projectLogger: import("debug").Debugger;
-export declare const controllerLog: import("debug").Debugger;
-export { createModuleLogger };
-//# sourceMappingURL=logger.d.cts.map

package/dist/logger.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.d.cts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAEA,OAAO,EAAuB,kBAAkB,EAAE,wBAAwB;AAE1E,eAAO,MAAM,aAAa,0BAAwC,CAAC;AAEnE,eAAO,MAAM,aAAa,0BAAqD,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/logger.d.mts

@@ -1,6 +0,0 @@
-/// <reference types="debug" />
-import { createModuleLogger } from "@metamask/utils";
-export declare const projectLogger: import("debug").Debugger;
-export declare const controllerLog: import("debug").Debugger;
-export { createModuleLogger };
-//# sourceMappingURL=logger.d.mts.map

package/dist/logger.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.d.mts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAEA,OAAO,EAAuB,kBAAkB,EAAE,wBAAwB;AAE1E,eAAO,MAAM,aAAa,0BAAwC,CAAC;AAEnE,eAAO,MAAM,aAAa,0BAAqD,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/logger.mjs

@@ -1,6 +0,0 @@
-/* istanbul ignore file */
-import { createProjectLogger, createModuleLogger } from "@metamask/utils";
-export const projectLogger = createProjectLogger('kyc-controller');
-export const controllerLog = createModuleLogger(projectLogger, 'KycController');
-export { createModuleLogger };
-//# sourceMappingURL=logger.mjs.map

package/dist/logger.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.mjs","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB;AAE1E,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nexport const projectLogger = createProjectLogger('kyc-controller');\n\nexport const controllerLog = createModuleLogger(projectLogger, 'KycController');\n\nexport { createModuleLogger };\n"]}

package/dist/vendorDisclaimerAcceptance.cjs

@@ -1,74 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearVendorDisclaimerAcceptance = exports.recordVendorDisclaimerAcceptance = exports.ironDisclaimerIds = exports.hasVendorDisclaimerAcceptance = void 0;
-/**
- * Returns whether persisted vendor disclaimer acceptance exists for `vendor`.
- *
- * @param accepted - Vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor to inspect.
- * @returns Whether acceptance is present for the vendor.
- */
-function hasVendorDisclaimerAcceptance(accepted, vendor) {
-    if (vendor === 'moonpay') {
-        return Boolean(accepted.moonpay?.termsAcceptedAt);
-    }
-    if (vendor === 'iron') {
-        return Boolean(accepted.iron?.disclaimerIds.length);
-    }
-    return false;
-}
-exports.hasVendorDisclaimerAcceptance = hasVendorDisclaimerAcceptance;
-/**
- * Returns persisted Iron disclaimer ids, if any.
- *
- * @param accepted - Vendor-disclaimer acceptance map.
- * @returns The accepted disclaimer ids, or an empty array.
- */
-function ironDisclaimerIds(accepted) {
-    return accepted.iron?.disclaimerIds ?? [];
-}
-exports.ironDisclaimerIds = ironDisclaimerIds;
-/**
- * Records vendor disclaimer acceptance for the active vendor.
- *
- * @param accepted - Existing vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor being accepted.
- * @param params - Acceptance payload for the vendor.
- * @param params.termsAcceptedAt - MoonPay acceptance timestamp.
- * @param params.disclaimerIds - Iron disclaimer ids.
- * @returns The updated acceptance map.
- */
-function recordVendorDisclaimerAcceptance(accepted, vendor, params) {
-    if (vendor === 'moonpay') {
-        return {
-            ...accepted,
-            moonpay: { termsAcceptedAt: params.termsAcceptedAt },
-        };
-    }
-    if (vendor === 'iron') {
-        return {
-            ...accepted,
-            iron: { disclaimerIds: params.disclaimerIds },
-        };
-    }
-    return accepted;
-}
-exports.recordVendorDisclaimerAcceptance = recordVendorDisclaimerAcceptance;
-/**
- * Clears persisted vendor disclaimer acceptance for one vendor.
- *
- * @param accepted - Existing vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor whose acceptance should be cleared.
- * @returns The updated acceptance map.
- */
-function clearVendorDisclaimerAcceptance(accepted, vendor) {
-    if (vendor === 'moonpay') {
-        return { ...accepted, moonpay: null };
-    }
-    if (vendor === 'iron') {
-        return { ...accepted, iron: null };
-    }
-    return accepted;
-}
-exports.clearVendorDisclaimerAcceptance = clearVendorDisclaimerAcceptance;
-//# sourceMappingURL=vendorDisclaimerAcceptance.cjs.map

package/dist/vendorDisclaimerAcceptance.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"vendorDisclaimerAcceptance.cjs","sourceRoot":"","sources":["../src/vendorDisclaimerAcceptance.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAC3C,QAAsC,EACtC,MAAiB;IAEjB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAXD,sEAWC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,QAAsC;IAEtC,OAAO,QAAQ,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC;AAC5C,CAAC;AAJD,8CAIC;AAED;;;;;;;;;GASG;AACH,SAAgB,gCAAgC,CAC9C,QAAsC,EACtC,MAAiB,EACjB,MAA4D;IAE5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,QAAQ;YACX,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;SACrD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,QAAQ;YACX,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;SAC9C,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAlBD,4EAkBC;AAED;;;;;;GAMG;AACH,SAAgB,+BAA+B,CAC7C,QAAsC,EACtC,MAAiB;IAEjB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAXD,0EAWC","sourcesContent":["import type { KycVendor, KycVendorDisclaimersAccepted } from './types.js';\n\n/**\n * Returns whether persisted vendor disclaimer acceptance exists for `vendor`.\n *\n * @param accepted - Vendor-disclaimer acceptance map.\n * @param vendor - Identity vendor to inspect.\n * @returns Whether acceptance is present for the vendor.\n */\nexport function hasVendorDisclaimerAcceptance(\n  accepted: KycVendorDisclaimersAccepted,\n  vendor: KycVendor,\n): boolean {\n  if (vendor === 'moonpay') {\n    return Boolean(accepted.moonpay?.termsAcceptedAt);\n  }\n  if (vendor === 'iron') {\n    return Boolean(accepted.iron?.disclaimerIds.length);\n  }\n  return false;\n}\n\n/**\n * Returns persisted Iron disclaimer ids, if any.\n *\n * @param accepted - Vendor-disclaimer acceptance map.\n * @returns The accepted disclaimer ids, or an empty array.\n */\nexport function ironDisclaimerIds(\n  accepted: KycVendorDisclaimersAccepted,\n): string[] {\n  return accepted.iron?.disclaimerIds ?? [];\n}\n\n/**\n * Records vendor disclaimer acceptance for the active vendor.\n *\n * @param accepted - Existing vendor-disclaimer acceptance map.\n * @param vendor - Identity vendor being accepted.\n * @param params - Acceptance payload for the vendor.\n * @param params.termsAcceptedAt - MoonPay acceptance timestamp.\n * @param params.disclaimerIds - Iron disclaimer ids.\n * @returns The updated acceptance map.\n */\nexport function recordVendorDisclaimerAcceptance(\n  accepted: KycVendorDisclaimersAccepted,\n  vendor: KycVendor,\n  params: { termsAcceptedAt: string; disclaimerIds: string[] },\n): KycVendorDisclaimersAccepted {\n  if (vendor === 'moonpay') {\n    return {\n      ...accepted,\n      moonpay: { termsAcceptedAt: params.termsAcceptedAt },\n    };\n  }\n  if (vendor === 'iron') {\n    return {\n      ...accepted,\n      iron: { disclaimerIds: params.disclaimerIds },\n    };\n  }\n  return accepted;\n}\n\n/**\n * Clears persisted vendor disclaimer acceptance for one vendor.\n *\n * @param accepted - Existing vendor-disclaimer acceptance map.\n * @param vendor - Identity vendor whose acceptance should be cleared.\n * @returns The updated acceptance map.\n */\nexport function clearVendorDisclaimerAcceptance(\n  accepted: KycVendorDisclaimersAccepted,\n  vendor: KycVendor,\n): KycVendorDisclaimersAccepted {\n  if (vendor === 'moonpay') {\n    return { ...accepted, moonpay: null };\n  }\n  if (vendor === 'iron') {\n    return { ...accepted, iron: null };\n  }\n  return accepted;\n}\n"]}

package/dist/vendorDisclaimerAcceptance.d.cts

@@ -1,39 +0,0 @@
-import type { KycVendor, KycVendorDisclaimersAccepted } from "./types.cjs";
-/**
- * Returns whether persisted vendor disclaimer acceptance exists for `vendor`.
- *
- * @param accepted - Vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor to inspect.
- * @returns Whether acceptance is present for the vendor.
- */
-export declare function hasVendorDisclaimerAcceptance(accepted: KycVendorDisclaimersAccepted, vendor: KycVendor): boolean;
-/**
- * Returns persisted Iron disclaimer ids, if any.
- *
- * @param accepted - Vendor-disclaimer acceptance map.
- * @returns The accepted disclaimer ids, or an empty array.
- */
-export declare function ironDisclaimerIds(accepted: KycVendorDisclaimersAccepted): string[];
-/**
- * Records vendor disclaimer acceptance for the active vendor.
- *
- * @param accepted - Existing vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor being accepted.
- * @param params - Acceptance payload for the vendor.
- * @param params.termsAcceptedAt - MoonPay acceptance timestamp.
- * @param params.disclaimerIds - Iron disclaimer ids.
- * @returns The updated acceptance map.
- */
-export declare function recordVendorDisclaimerAcceptance(accepted: KycVendorDisclaimersAccepted, vendor: KycVendor, params: {
-    termsAcceptedAt: string;
-    disclaimerIds: string[];
-}): KycVendorDisclaimersAccepted;
-/**
- * Clears persisted vendor disclaimer acceptance for one vendor.
- *
- * @param accepted - Existing vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor whose acceptance should be cleared.
- * @returns The updated acceptance map.
- */
-export declare function clearVendorDisclaimerAcceptance(accepted: KycVendorDisclaimersAccepted, vendor: KycVendor): KycVendorDisclaimersAccepted;
-//# sourceMappingURL=vendorDisclaimerAcceptance.d.cts.map

package/dist/vendorDisclaimerAcceptance.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vendorDisclaimerAcceptance.d.cts","sourceRoot":"","sources":["../src/vendorDisclaimerAcceptance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B,EAAE,oBAAmB;AAE1E;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,4BAA4B,EACtC,MAAM,EAAE,SAAS,GAChB,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,4BAA4B,GACrC,MAAM,EAAE,CAEV;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,4BAA4B,EACtC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3D,4BAA4B,CAc9B;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,4BAA4B,EACtC,MAAM,EAAE,SAAS,GAChB,4BAA4B,CAQ9B"}

package/dist/vendorDisclaimerAcceptance.d.mts

@@ -1,39 +0,0 @@
-import type { KycVendor, KycVendorDisclaimersAccepted } from "./types.mjs";
-/**
- * Returns whether persisted vendor disclaimer acceptance exists for `vendor`.
- *
- * @param accepted - Vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor to inspect.
- * @returns Whether acceptance is present for the vendor.
- */
-export declare function hasVendorDisclaimerAcceptance(accepted: KycVendorDisclaimersAccepted, vendor: KycVendor): boolean;
-/**
- * Returns persisted Iron disclaimer ids, if any.
- *
- * @param accepted - Vendor-disclaimer acceptance map.
- * @returns The accepted disclaimer ids, or an empty array.
- */
-export declare function ironDisclaimerIds(accepted: KycVendorDisclaimersAccepted): string[];
-/**
- * Records vendor disclaimer acceptance for the active vendor.
- *
- * @param accepted - Existing vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor being accepted.
- * @param params - Acceptance payload for the vendor.
- * @param params.termsAcceptedAt - MoonPay acceptance timestamp.
- * @param params.disclaimerIds - Iron disclaimer ids.
- * @returns The updated acceptance map.
- */
-export declare function recordVendorDisclaimerAcceptance(accepted: KycVendorDisclaimersAccepted, vendor: KycVendor, params: {
-    termsAcceptedAt: string;
-    disclaimerIds: string[];
-}): KycVendorDisclaimersAccepted;
-/**
- * Clears persisted vendor disclaimer acceptance for one vendor.
- *
- * @param accepted - Existing vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor whose acceptance should be cleared.
- * @returns The updated acceptance map.
- */
-export declare function clearVendorDisclaimerAcceptance(accepted: KycVendorDisclaimersAccepted, vendor: KycVendor): KycVendorDisclaimersAccepted;
-//# sourceMappingURL=vendorDisclaimerAcceptance.d.mts.map

package/dist/vendorDisclaimerAcceptance.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vendorDisclaimerAcceptance.d.mts","sourceRoot":"","sources":["../src/vendorDisclaimerAcceptance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B,EAAE,oBAAmB;AAE1E;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,4BAA4B,EACtC,MAAM,EAAE,SAAS,GAChB,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,4BAA4B,GACrC,MAAM,EAAE,CAEV;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,4BAA4B,EACtC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3D,4BAA4B,CAc9B;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,4BAA4B,EACtC,MAAM,EAAE,SAAS,GAChB,4BAA4B,CAQ9B"}

package/dist/vendorDisclaimerAcceptance.mjs

@@ -1,67 +0,0 @@
-/**
- * Returns whether persisted vendor disclaimer acceptance exists for `vendor`.
- *
- * @param accepted - Vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor to inspect.
- * @returns Whether acceptance is present for the vendor.
- */
-export function hasVendorDisclaimerAcceptance(accepted, vendor) {
-    if (vendor === 'moonpay') {
-        return Boolean(accepted.moonpay?.termsAcceptedAt);
-    }
-    if (vendor === 'iron') {
-        return Boolean(accepted.iron?.disclaimerIds.length);
-    }
-    return false;
-}
-/**
- * Returns persisted Iron disclaimer ids, if any.
- *
- * @param accepted - Vendor-disclaimer acceptance map.
- * @returns The accepted disclaimer ids, or an empty array.
- */
-export function ironDisclaimerIds(accepted) {
-    return accepted.iron?.disclaimerIds ?? [];
-}
-/**
- * Records vendor disclaimer acceptance for the active vendor.
- *
- * @param accepted - Existing vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor being accepted.
- * @param params - Acceptance payload for the vendor.
- * @param params.termsAcceptedAt - MoonPay acceptance timestamp.
- * @param params.disclaimerIds - Iron disclaimer ids.
- * @returns The updated acceptance map.
- */
-export function recordVendorDisclaimerAcceptance(accepted, vendor, params) {
-    if (vendor === 'moonpay') {
-        return {
-            ...accepted,
-            moonpay: { termsAcceptedAt: params.termsAcceptedAt },
-        };
-    }
-    if (vendor === 'iron') {
-        return {
-            ...accepted,
-            iron: { disclaimerIds: params.disclaimerIds },
-        };
-    }
-    return accepted;
-}
-/**
- * Clears persisted vendor disclaimer acceptance for one vendor.
- *
- * @param accepted - Existing vendor-disclaimer acceptance map.
- * @param vendor - Identity vendor whose acceptance should be cleared.
- * @returns The updated acceptance map.
- */
-export function clearVendorDisclaimerAcceptance(accepted, vendor) {
-    if (vendor === 'moonpay') {
-        return { ...accepted, moonpay: null };
-    }
-    if (vendor === 'iron') {
-        return { ...accepted, iron: null };
-    }
-    return accepted;
-}
-//# sourceMappingURL=vendorDisclaimerAcceptance.mjs.map

package/dist/vendorDisclaimerAcceptance.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"vendorDisclaimerAcceptance.mjs","sourceRoot":"","sources":["../src/vendorDisclaimerAcceptance.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAsC,EACtC,MAAiB;IAEjB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAsC;IAEtC,OAAO,QAAQ,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAsC,EACtC,MAAiB,EACjB,MAA4D;IAE5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,QAAQ;YACX,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;SACrD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,QAAQ;YACX,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;SAC9C,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAsC,EACtC,MAAiB;IAEjB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["import type { KycVendor, KycVendorDisclaimersAccepted } from './types.js';\n\n/**\n * Returns whether persisted vendor disclaimer acceptance exists for `vendor`.\n *\n * @param accepted - Vendor-disclaimer acceptance map.\n * @param vendor - Identity vendor to inspect.\n * @returns Whether acceptance is present for the vendor.\n */\nexport function hasVendorDisclaimerAcceptance(\n  accepted: KycVendorDisclaimersAccepted,\n  vendor: KycVendor,\n): boolean {\n  if (vendor === 'moonpay') {\n    return Boolean(accepted.moonpay?.termsAcceptedAt);\n  }\n  if (vendor === 'iron') {\n    return Boolean(accepted.iron?.disclaimerIds.length);\n  }\n  return false;\n}\n\n/**\n * Returns persisted Iron disclaimer ids, if any.\n *\n * @param accepted - Vendor-disclaimer acceptance map.\n * @returns The accepted disclaimer ids, or an empty array.\n */\nexport function ironDisclaimerIds(\n  accepted: KycVendorDisclaimersAccepted,\n): string[] {\n  return accepted.iron?.disclaimerIds ?? [];\n}\n\n/**\n * Records vendor disclaimer acceptance for the active vendor.\n *\n * @param accepted - Existing vendor-disclaimer acceptance map.\n * @param vendor - Identity vendor being accepted.\n * @param params - Acceptance payload for the vendor.\n * @param params.termsAcceptedAt - MoonPay acceptance timestamp.\n * @param params.disclaimerIds - Iron disclaimer ids.\n * @returns The updated acceptance map.\n */\nexport function recordVendorDisclaimerAcceptance(\n  accepted: KycVendorDisclaimersAccepted,\n  vendor: KycVendor,\n  params: { termsAcceptedAt: string; disclaimerIds: string[] },\n): KycVendorDisclaimersAccepted {\n  if (vendor === 'moonpay') {\n    return {\n      ...accepted,\n      moonpay: { termsAcceptedAt: params.termsAcceptedAt },\n    };\n  }\n  if (vendor === 'iron') {\n    return {\n      ...accepted,\n      iron: { disclaimerIds: params.disclaimerIds },\n    };\n  }\n  return accepted;\n}\n\n/**\n * Clears persisted vendor disclaimer acceptance for one vendor.\n *\n * @param accepted - Existing vendor-disclaimer acceptance map.\n * @param vendor - Identity vendor whose acceptance should be cleared.\n * @returns The updated acceptance map.\n */\nexport function clearVendorDisclaimerAcceptance(\n  accepted: KycVendorDisclaimersAccepted,\n  vendor: KycVendor,\n): KycVendorDisclaimersAccepted {\n  if (vendor === 'moonpay') {\n    return { ...accepted, moonpay: null };\n  }\n  if (vendor === 'iron') {\n    return { ...accepted, iron: null };\n  }\n  return accepted;\n}\n"]}

package/dist/vendors/MoonPayFrameHandler.cjs

@@ -1,235 +0,0 @@
-"use strict";
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _MoonPayFrameHandler_instances, _MoonPayFrameHandler_getState, _MoonPayFrameHandler_update, _MoonPayFrameHandler_fail, _MoonPayFrameHandler_onAuthenticated, _MoonPayFrameHandler_requireTermsReacceptance, _MoonPayFrameHandler_frameKeypair, _MoonPayFrameHandler_authClientToken, _MoonPayFrameHandler_handleCheckOutcome, _MoonPayFrameHandler_handleAuthOutcome;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearMoonPaySession = exports.MoonPayFrameHandler = void 0;
-const crypto_js_1 = require("../crypto.cjs");
-const FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';
-const CHANNEL_CHECK = 'ch_1';
-const CHANNEL_AUTH = 'ch_2';
-const CHANNEL_RESET = 'ch_reset';
-/**
- * Owns MoonPay Check/Auth frame state and protocol handling.
- */
-class MoonPayFrameHandler {
-    constructor({ getState, update, fail, onAuthenticated, requireTermsReacceptance, }) {
-        _MoonPayFrameHandler_instances.add(this);
-        _MoonPayFrameHandler_getState.set(this, void 0);
-        _MoonPayFrameHandler_update.set(this, void 0);
-        _MoonPayFrameHandler_fail.set(this, void 0);
-        _MoonPayFrameHandler_onAuthenticated.set(this, void 0);
-        _MoonPayFrameHandler_requireTermsReacceptance.set(this, void 0);
-        /** MoonPay Check/Auth frame X25519 keypair (never persisted). */
-        _MoonPayFrameHandler_frameKeypair.set(this, null);
-        /** Auth-frame client token, kept out of controller state. */
-        _MoonPayFrameHandler_authClientToken.set(this, null);
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_getState, getState, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_update, update, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_fail, fail, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_onAuthenticated, onAuthenticated, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_requireTermsReacceptance, requireTermsReacceptance, "f");
-    }
-    /**
-     * Creates a fresh keypair for a new MoonPay flow.
-     */
-    startFlow() {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_frameKeypair, (0, crypto_js_1.generateKeyPair)(), "f");
-    }
-    /**
-     * Ensures an in-progress MoonPay flow has a frame keypair.
-     */
-    ensureKeypair() {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_frameKeypair, __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f") ?? (0, crypto_js_1.generateKeyPair)(), "f");
-    }
-    /**
-     * Clears all non-persisted MoonPay frame artifacts.
-     */
-    clear() {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_frameKeypair, null, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_authClientToken, null, "f");
-    }
-    /**
-     * Clears authentication associated with an earlier MoonPay session.
-     */
-    clearAuthentication() {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_authClientToken, null, "f");
-    }
-    /**
-     * Handles a message posted by a MoonPay Check/Auth frame.
-     *
-     * @param message - The raw message posted by the frame.
-     * @returns An object whose optional `reply` should be posted back.
-     */
-    async handleMessage(message) {
-        const payload = message;
-        if (!payload) {
-            return {};
-        }
-        if (payload.kind === 'handshake') {
-            const channelId = payload.meta?.channelId;
-            return { reply: { version: 2, meta: { channelId }, kind: 'ack' } };
-        }
-        if (payload.kind !== 'complete') {
-            return {};
-        }
-        const channelId = payload.meta?.channelId;
-        const state = __classPrivateFieldGet(this, _MoonPayFrameHandler_getState, "f").call(this);
-        // Only honor a completion for the MoonPay frame the flow is currently
-        // waiting on. This drops stale or duplicate messages after reset, phase
-        // advancement, or a vendor switch so they cannot restore tokens or rewind
-        // the flow. Unlike awaited controller work, external frame messages are
-        // not protected by the controller's generation guard.
-        let expectedPhase = null;
-        if (channelId === CHANNEL_CHECK) {
-            expectedPhase = 'check';
-        }
-        else if (channelId === CHANNEL_AUTH) {
-            expectedPhase = 'auth';
-        }
-        if (!expectedPhase ||
-            state.phase !== expectedPhase ||
-            state.activeVendor !== 'moonpay') {
-            return {};
-        }
-        const status = payload.payload?.status;
-        const credentialsEnvelope = payload.payload?.credentials;
-        const customerId = payload.payload?.customer?.id ?? null;
-        if (customerId) {
-            __classPrivateFieldGet(this, _MoonPayFrameHandler_update, "f").call(this, (draft) => {
-                draft.moonpayCustomerId = customerId;
-            });
-        }
-        if (!status) {
-            return {};
-        }
-        let accessToken;
-        let clientToken;
-        if (credentialsEnvelope && __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f")) {
-            try {
-                const { credentials } = (0, crypto_js_1.decryptCredentials)(credentialsEnvelope, __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f").privateKey);
-                accessToken = credentials.accessToken;
-                clientToken = credentials.clientToken;
-            }
-            catch (error) {
-                __classPrivateFieldGet(this, _MoonPayFrameHandler_fail, "f").call(this, `Failed to decrypt frame credentials: ${String(error)}`);
-                return {};
-            }
-        }
-        if (channelId === CHANNEL_CHECK) {
-            await __classPrivateFieldGet(this, _MoonPayFrameHandler_instances, "m", _MoonPayFrameHandler_handleCheckOutcome).call(this, status, accessToken, clientToken);
-        }
-        else {
-            await __classPrivateFieldGet(this, _MoonPayFrameHandler_instances, "m", _MoonPayFrameHandler_handleAuthOutcome).call(this, status, accessToken);
-        }
-        return {};
-    }
-    /**
-     * Builds the Check-frame URL, or `null` when no session exists yet.
-     *
-     * @returns The Check-frame URL or `null`.
-     */
-    buildCheckFrameUrl() {
-        const state = __classPrivateFieldGet(this, _MoonPayFrameHandler_getState, "f").call(this);
-        if (state.activeVendor !== 'moonpay' ||
-            !state.moonpaySessionToken ||
-            !__classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f")) {
-            return null;
-        }
-        const url = new URL(`${FRAMES_BASE_URL}/check-connection`);
-        url.searchParams.set('sessionToken', state.moonpaySessionToken);
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f").publicKeyHex);
-        url.searchParams.set('channelId', CHANNEL_CHECK);
-        url.searchParams.set('skipKyc', 'true');
-        return url.toString();
-    }
-    /**
-     * Builds the Auth-frame URL, or `null` when no client token is available.
-     *
-     * @returns The Auth-frame URL or `null`.
-     */
-    buildAuthFrameUrl() {
-        const state = __classPrivateFieldGet(this, _MoonPayFrameHandler_getState, "f").call(this);
-        if (state.activeVendor !== 'moonpay' ||
-            !__classPrivateFieldGet(this, _MoonPayFrameHandler_authClientToken, "f") ||
-            !__classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f")) {
-            return null;
-        }
-        const url = new URL(`${FRAMES_BASE_URL}/auth`);
-        url.searchParams.set('clientToken', __classPrivateFieldGet(this, _MoonPayFrameHandler_authClientToken, "f"));
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f").publicKeyHex);
-        url.searchParams.set('channelId', CHANNEL_AUTH);
-        return url.toString();
-    }
-    /**
-     * Builds the Reset-frame URL.
-     *
-     * @returns The Reset-frame URL.
-     */
-    buildResetFrameUrl() {
-        const url = new URL(`${FRAMES_BASE_URL}/reset`);
-        url.searchParams.set('channelId', CHANNEL_RESET);
-        return url.toString();
-    }
-}
-exports.MoonPayFrameHandler = MoonPayFrameHandler;
-_MoonPayFrameHandler_getState = new WeakMap(), _MoonPayFrameHandler_update = new WeakMap(), _MoonPayFrameHandler_fail = new WeakMap(), _MoonPayFrameHandler_onAuthenticated = new WeakMap(), _MoonPayFrameHandler_requireTermsReacceptance = new WeakMap(), _MoonPayFrameHandler_frameKeypair = new WeakMap(), _MoonPayFrameHandler_authClientToken = new WeakMap(), _MoonPayFrameHandler_instances = new WeakSet(), _MoonPayFrameHandler_handleCheckOutcome = async function _MoonPayFrameHandler_handleCheckOutcome(status, accessToken, clientToken) {
-    if (status === 'active' && accessToken) {
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_update, "f").call(this, (state) => {
-            state.moonpayAccessToken = accessToken;
-            state.phase = 'form';
-            state.statusMessage = 'Already authenticated. Review to submit.';
-        });
-        await __classPrivateFieldGet(this, _MoonPayFrameHandler_onAuthenticated, "f").call(this);
-        return;
-    }
-    if (status === 'connectionRequired' && clientToken) {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_authClientToken, clientToken, "f");
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_update, "f").call(this, (state) => {
-            state.phase = 'auth';
-            state.statusMessage = 'Verify your email via OTP in the Auth frame.';
-        });
-        return;
-    }
-    if (status === 'termsAcceptanceRequired') {
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_requireTermsReacceptance, "f").call(this);
-        return;
-    }
-    __classPrivateFieldGet(this, _MoonPayFrameHandler_fail, "f").call(this, `Check frame returned status: ${status}`);
-}, _MoonPayFrameHandler_handleAuthOutcome = async function _MoonPayFrameHandler_handleAuthOutcome(status, accessToken) {
-    if (status === 'active' && accessToken) {
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_update, "f").call(this, (state) => {
-            state.moonpayAccessToken = accessToken;
-            state.phase = 'form';
-            state.statusMessage = 'Authenticated. Review to submit.';
-        });
-        await __classPrivateFieldGet(this, _MoonPayFrameHandler_onAuthenticated, "f").call(this);
-        return;
-    }
-    if (status === 'termsAcceptanceRequired') {
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_requireTermsReacceptance, "f").call(this);
-        return;
-    }
-    __classPrivateFieldGet(this, _MoonPayFrameHandler_fail, "f").call(this, `Auth frame returned status: ${status}`);
-};
-/**
- * Drops persisted-in-memory MoonPay session artifacts from controller state.
- *
- * @param state - The state to mutate.
- */
-function clearMoonPaySession(state) {
-    state.moonpayCustomerId = null;
-    state.moonpaySessionToken = null;
-    state.moonpayAccessToken = null;
-}
-exports.clearMoonPaySession = clearMoonPaySession;
-//# sourceMappingURL=MoonPayFrameHandler.cjs.map

package/dist/vendors/MoonPayFrameHandler.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"MoonPayFrameHandler.cjs","sourceRoot":"","sources":["../../src/vendors/MoonPayFrameHandler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAmE;AAInE,MAAM,eAAe,GAAG,wCAAwC,CAAC;AACjE,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,aAAa,GAAG,UAAU,CAAC;AAqCjC;;GAEG;AACH,MAAa,mBAAmB;IAiB9B,YAAY,EACV,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,eAAe,EACf,wBAAwB,GACG;;QAtBpB,gDAAkD;QAElD,8CAA8C;QAE9C,4CAA0C;QAE1C,uDAAgE;QAEhE,gEAAkF;QAE3F,iEAAiE;QACjE,4CAAsC,IAAI,EAAC;QAE3C,6DAA6D;QAC7D,+CAAkC,IAAI,EAAC;QASrC,uBAAA,IAAI,iCAAa,QAAQ,MAAA,CAAC;QAC1B,uBAAA,IAAI,+BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,6BAAS,IAAI,MAAA,CAAC;QAClB,uBAAA,IAAI,wCAAoB,eAAe,MAAA,CAAC;QACxC,uBAAA,IAAI,iDAA6B,wBAAwB,MAAA,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,SAAS;QACP,uBAAA,IAAI,qCAAiB,IAAA,2BAAe,GAAE,MAAA,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,wIAAuB,IAAA,2BAAe,GAAE,MAAA,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,uBAAA,IAAI,qCAAiB,IAAI,MAAA,CAAC;QAC1B,uBAAA,IAAI,wCAAoB,IAAI,MAAA,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,uBAAA,IAAI,wCAAoB,IAAI,MAAA,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,MAAM,OAAO,GAAG,OAAmC,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,uBAAA,IAAI,qCAAU,MAAd,IAAI,CAAY,CAAC;QAE/B,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,aAAa,GAAoB,IAAI,CAAC;QAC1C,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,aAAa,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;YACtC,aAAa,GAAG,MAAM,CAAC;QACzB,CAAC;QAED,IACE,CAAC,aAAa;YACd,KAAK,CAAC,KAAK,KAAK,aAAa;YAC7B,KAAK,CAAC,YAAY,KAAK,SAAS,EAChC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;QACvC,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC;QAEzD,IAAI,UAAU,EAAE,CAAC;YACf,uBAAA,IAAI,mCAAQ,MAAZ,IAAI,EAAS,CAAC,KAAK,EAAE,EAAE;gBACrB,KAAK,CAAC,iBAAiB,GAAG,UAAU,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,WAA+B,CAAC;QACpC,IAAI,mBAAmB,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,8BAAkB,EACxC,mBAAmB,EACnB,uBAAA,IAAI,yCAAc,CAAC,UAAU,CAC9B,CAAC;gBACF,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;gBACtC,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,uBAAA,IAAI,iCAAM,MAAV,IAAI,EAAO,wCAAwC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACpE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,MAAM,uBAAA,IAAI,+EAAoB,MAAxB,IAAI,EAAqB,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,uBAAA,IAAI,8EAAmB,MAAvB,IAAI,EAAoB,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,MAAM,KAAK,GAAG,uBAAA,IAAI,qCAAU,MAAd,IAAI,CAAY,CAAC;QAC/B,IACE,KAAK,CAAC,YAAY,KAAK,SAAS;YAChC,CAAC,KAAK,CAAC,mBAAmB;YAC1B,CAAC,uBAAA,IAAI,yCAAc,EACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,eAAe,mBAAmB,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAChE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,uBAAA,IAAI,yCAAc,CAAC,YAAY,CAAC,CAAC;QACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,MAAM,KAAK,GAAG,uBAAA,IAAI,qCAAU,MAAd,IAAI,CAAY,CAAC;QAC/B,IACE,KAAK,CAAC,YAAY,KAAK,SAAS;YAChC,CAAC,uBAAA,IAAI,4CAAiB;YACtB,CAAC,uBAAA,IAAI,yCAAc,EACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,eAAe,OAAO,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,uBAAA,IAAI,4CAAiB,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,uBAAA,IAAI,yCAAc,CAAC,YAAY,CAAC,CAAC;QACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,eAAe,QAAQ,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;CAkDF;AArPD,kDAqPC;+bAhDC,KAAK,kDACH,MAAmB,EACnB,WAAoB,EACpB,WAAoB;IAEpB,IAAI,MAAM,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC;QACvC,uBAAA,IAAI,mCAAQ,MAAZ,IAAI,EAAS,CAAC,KAAK,EAAE,EAAE;YACrB,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC;YACvC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YACrB,KAAK,CAAC,aAAa,GAAG,0CAA0C,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,MAAM,uBAAA,IAAI,4CAAiB,MAArB,IAAI,CAAmB,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,oBAAoB,IAAI,WAAW,EAAE,CAAC;QACnD,uBAAA,IAAI,wCAAoB,WAAW,MAAA,CAAC;QACpC,uBAAA,IAAI,mCAAQ,MAAZ,IAAI,EAAS,CAAC,KAAK,EAAE,EAAE;YACrB,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YACrB,KAAK,CAAC,aAAa,GAAG,8CAA8C,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,uBAAA,IAAI,qDAA0B,MAA9B,IAAI,CAA4B,CAAC;QACjC,OAAO;IACT,CAAC;IACD,uBAAA,IAAI,iCAAM,MAAV,IAAI,EAAO,gCAAgC,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC,2CAED,KAAK,iDACH,MAAmB,EACnB,WAAoB;IAEpB,IAAI,MAAM,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC;QACvC,uBAAA,IAAI,mCAAQ,MAAZ,IAAI,EAAS,CAAC,KAAK,EAAE,EAAE;YACrB,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC;YACvC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YACrB,KAAK,CAAC,aAAa,GAAG,kCAAkC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,MAAM,uBAAA,IAAI,4CAAiB,MAArB,IAAI,CAAmB,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,uBAAA,IAAI,qDAA0B,MAA9B,IAAI,CAA4B,CAAC;QACjC,OAAO;IACT,CAAC;IACD,uBAAA,IAAI,iCAAM,MAAV,IAAI,EAAO,+BAA+B,MAAM,EAAE,CAAC,CAAC;AACtD,CAAC;AAGH;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAwB;IAC1D,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC;AAClC,CAAC;AAJD,kDAIC","sourcesContent":["import { decryptCredentials, generateKeyPair } from '../crypto.js';\nimport type { EncryptedCredentialsEnvelope, X25519KeyPair } from '../crypto.js';\nimport type { KycPhase, KycVendor } from '../types.js';\n\nconst FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';\nconst CHANNEL_CHECK = 'ch_1';\nconst CHANNEL_AUTH = 'ch_2';\nconst CHANNEL_RESET = 'ch_reset';\n\ntype MoonPayFrameState = {\n  activeVendor: KycVendor;\n  moonpayAccessToken: string | null;\n  moonpayCustomerId: string | null;\n  moonpaySessionToken: string | null;\n  phase: KycPhase;\n  statusMessage: string;\n};\n\ntype FrameMessage = {\n  meta?: { channelId?: string };\n  kind?: string;\n  payload?: {\n    status?:\n      | 'active'\n      | 'connectionRequired'\n      | 'termsAcceptanceRequired'\n      | 'pending'\n      | 'unavailable'\n      | 'failed';\n    credentials?: EncryptedCredentialsEnvelope | string;\n    customer?: { id?: string };\n  };\n};\n\ntype FrameStatus = NonNullable<FrameMessage['payload']>['status'];\n\nexport type MoonPayFrameHandlerOptions = {\n  getState: () => MoonPayFrameState;\n  update: (updater: (state: MoonPayFrameState) => void) => void;\n  fail: (message: string) => void;\n  onAuthenticated: () => Promise<void>;\n  requireTermsReacceptance: () => void;\n};\n\n/**\n * Owns MoonPay Check/Auth frame state and protocol handling.\n */\nexport class MoonPayFrameHandler {\n  readonly #getState: MoonPayFrameHandlerOptions['getState'];\n\n  readonly #update: MoonPayFrameHandlerOptions['update'];\n\n  readonly #fail: MoonPayFrameHandlerOptions['fail'];\n\n  readonly #onAuthenticated: MoonPayFrameHandlerOptions['onAuthenticated'];\n\n  readonly #requireTermsReacceptance: MoonPayFrameHandlerOptions['requireTermsReacceptance'];\n\n  /** MoonPay Check/Auth frame X25519 keypair (never persisted). */\n  #frameKeypair: X25519KeyPair | null = null;\n\n  /** Auth-frame client token, kept out of controller state. */\n  #authClientToken: string | null = null;\n\n  constructor({\n    getState,\n    update,\n    fail,\n    onAuthenticated,\n    requireTermsReacceptance,\n  }: MoonPayFrameHandlerOptions) {\n    this.#getState = getState;\n    this.#update = update;\n    this.#fail = fail;\n    this.#onAuthenticated = onAuthenticated;\n    this.#requireTermsReacceptance = requireTermsReacceptance;\n  }\n\n  /**\n   * Creates a fresh keypair for a new MoonPay flow.\n   */\n  startFlow(): void {\n    this.#frameKeypair = generateKeyPair();\n  }\n\n  /**\n   * Ensures an in-progress MoonPay flow has a frame keypair.\n   */\n  ensureKeypair(): void {\n    this.#frameKeypair ??= generateKeyPair();\n  }\n\n  /**\n   * Clears all non-persisted MoonPay frame artifacts.\n   */\n  clear(): void {\n    this.#frameKeypair = null;\n    this.#authClientToken = null;\n  }\n\n  /**\n   * Clears authentication associated with an earlier MoonPay session.\n   */\n  clearAuthentication(): void {\n    this.#authClientToken = null;\n  }\n\n  /**\n   * Handles a message posted by a MoonPay Check/Auth frame.\n   *\n   * @param message - The raw message posted by the frame.\n   * @returns An object whose optional `reply` should be posted back.\n   */\n  async handleMessage(message: unknown): Promise<{ reply?: unknown }> {\n    const payload = message as FrameMessage | undefined;\n\n    if (!payload) {\n      return {};\n    }\n\n    if (payload.kind === 'handshake') {\n      const channelId = payload.meta?.channelId;\n      return { reply: { version: 2, meta: { channelId }, kind: 'ack' } };\n    }\n\n    if (payload.kind !== 'complete') {\n      return {};\n    }\n\n    const channelId = payload.meta?.channelId;\n    const state = this.#getState();\n\n    // Only honor a completion for the MoonPay frame the flow is currently\n    // waiting on. This drops stale or duplicate messages after reset, phase\n    // advancement, or a vendor switch so they cannot restore tokens or rewind\n    // the flow. Unlike awaited controller work, external frame messages are\n    // not protected by the controller's generation guard.\n    let expectedPhase: KycPhase | null = null;\n    if (channelId === CHANNEL_CHECK) {\n      expectedPhase = 'check';\n    } else if (channelId === CHANNEL_AUTH) {\n      expectedPhase = 'auth';\n    }\n\n    if (\n      !expectedPhase ||\n      state.phase !== expectedPhase ||\n      state.activeVendor !== 'moonpay'\n    ) {\n      return {};\n    }\n\n    const status = payload.payload?.status;\n    const credentialsEnvelope = payload.payload?.credentials;\n    const customerId = payload.payload?.customer?.id ?? null;\n\n    if (customerId) {\n      this.#update((draft) => {\n        draft.moonpayCustomerId = customerId;\n      });\n    }\n\n    if (!status) {\n      return {};\n    }\n\n    let accessToken: string | undefined;\n    let clientToken: string | undefined;\n    if (credentialsEnvelope && this.#frameKeypair) {\n      try {\n        const { credentials } = decryptCredentials(\n          credentialsEnvelope,\n          this.#frameKeypair.privateKey,\n        );\n        accessToken = credentials.accessToken;\n        clientToken = credentials.clientToken;\n      } catch (error) {\n        this.#fail(`Failed to decrypt frame credentials: ${String(error)}`);\n        return {};\n      }\n    }\n\n    if (channelId === CHANNEL_CHECK) {\n      await this.#handleCheckOutcome(status, accessToken, clientToken);\n    } else {\n      await this.#handleAuthOutcome(status, accessToken);\n    }\n    return {};\n  }\n\n  /**\n   * Builds the Check-frame URL, or `null` when no session exists yet.\n   *\n   * @returns The Check-frame URL or `null`.\n   */\n  buildCheckFrameUrl(): string | null {\n    const state = this.#getState();\n    if (\n      state.activeVendor !== 'moonpay' ||\n      !state.moonpaySessionToken ||\n      !this.#frameKeypair\n    ) {\n      return null;\n    }\n    const url = new URL(`${FRAMES_BASE_URL}/check-connection`);\n    url.searchParams.set('sessionToken', state.moonpaySessionToken);\n    url.searchParams.set('publicKey', this.#frameKeypair.publicKeyHex);\n    url.searchParams.set('channelId', CHANNEL_CHECK);\n    url.searchParams.set('skipKyc', 'true');\n    return url.toString();\n  }\n\n  /**\n   * Builds the Auth-frame URL, or `null` when no client token is available.\n   *\n   * @returns The Auth-frame URL or `null`.\n   */\n  buildAuthFrameUrl(): string | null {\n    const state = this.#getState();\n    if (\n      state.activeVendor !== 'moonpay' ||\n      !this.#authClientToken ||\n      !this.#frameKeypair\n    ) {\n      return null;\n    }\n    const url = new URL(`${FRAMES_BASE_URL}/auth`);\n    url.searchParams.set('clientToken', this.#authClientToken);\n    url.searchParams.set('publicKey', this.#frameKeypair.publicKeyHex);\n    url.searchParams.set('channelId', CHANNEL_AUTH);\n    return url.toString();\n  }\n\n  /**\n   * Builds the Reset-frame URL.\n   *\n   * @returns The Reset-frame URL.\n   */\n  buildResetFrameUrl(): string {\n    const url = new URL(`${FRAMES_BASE_URL}/reset`);\n    url.searchParams.set('channelId', CHANNEL_RESET);\n    return url.toString();\n  }\n\n  async #handleCheckOutcome(\n    status: FrameStatus,\n    accessToken?: string,\n    clientToken?: string,\n  ): Promise<void> {\n    if (status === 'active' && accessToken) {\n      this.#update((state) => {\n        state.moonpayAccessToken = accessToken;\n        state.phase = 'form';\n        state.statusMessage = 'Already authenticated. Review to submit.';\n      });\n      await this.#onAuthenticated();\n      return;\n    }\n    if (status === 'connectionRequired' && clientToken) {\n      this.#authClientToken = clientToken;\n      this.#update((state) => {\n        state.phase = 'auth';\n        state.statusMessage = 'Verify your email via OTP in the Auth frame.';\n      });\n      return;\n    }\n    if (status === 'termsAcceptanceRequired') {\n      this.#requireTermsReacceptance();\n      return;\n    }\n    this.#fail(`Check frame returned status: ${status}`);\n  }\n\n  async #handleAuthOutcome(\n    status: FrameStatus,\n    accessToken?: string,\n  ): Promise<void> {\n    if (status === 'active' && accessToken) {\n      this.#update((state) => {\n        state.moonpayAccessToken = accessToken;\n        state.phase = 'form';\n        state.statusMessage = 'Authenticated. Review to submit.';\n      });\n      await this.#onAuthenticated();\n      return;\n    }\n    if (status === 'termsAcceptanceRequired') {\n      this.#requireTermsReacceptance();\n      return;\n    }\n    this.#fail(`Auth frame returned status: ${status}`);\n  }\n}\n\n/**\n * Drops persisted-in-memory MoonPay session artifacts from controller state.\n *\n * @param state - The state to mutate.\n */\nexport function clearMoonPaySession(state: MoonPayFrameState): void {\n  state.moonpayCustomerId = null;\n  state.moonpaySessionToken = null;\n  state.moonpayAccessToken = null;\n}\n"]}