@metamask-previews/kyc-controller 0.0.0-preview-abca9bcea → 0.0.0-preview-ec24abb79

package/dist/vendors/MoonPayFrameHandler.d.cts

@@ -1,74 +0,0 @@
-import type { KycPhase, KycVendor } from "../types.cjs";
-type MoonPayFrameState = {
-    activeVendor: KycVendor;
-    moonpayAccessToken: string | null;
-    moonpayCustomerId: string | null;
-    moonpaySessionToken: string | null;
-    phase: KycPhase;
-    statusMessage: string;
-};
-export type MoonPayFrameHandlerOptions = {
-    getState: () => MoonPayFrameState;
-    update: (updater: (state: MoonPayFrameState) => void) => void;
-    fail: (message: string) => void;
-    onAuthenticated: () => Promise<void>;
-    requireTermsReacceptance: () => void;
-};
-/**
- * Owns MoonPay Check/Auth frame state and protocol handling.
- */
-export declare class MoonPayFrameHandler {
-    #private;
-    constructor({ getState, update, fail, onAuthenticated, requireTermsReacceptance, }: MoonPayFrameHandlerOptions);
-    /**
-     * Creates a fresh keypair for a new MoonPay flow.
-     */
-    startFlow(): void;
-    /**
-     * Ensures an in-progress MoonPay flow has a frame keypair.
-     */
-    ensureKeypair(): void;
-    /**
-     * Clears all non-persisted MoonPay frame artifacts.
-     */
-    clear(): void;
-    /**
-     * Clears authentication associated with an earlier MoonPay session.
-     */
-    clearAuthentication(): void;
-    /**
-     * Handles a message posted by a MoonPay Check/Auth frame.
-     *
-     * @param message - The raw message posted by the frame.
-     * @returns An object whose optional `reply` should be posted back.
-     */
-    handleMessage(message: unknown): Promise<{
-        reply?: unknown;
-    }>;
-    /**
-     * Builds the Check-frame URL, or `null` when no session exists yet.
-     *
-     * @returns The Check-frame URL or `null`.
-     */
-    buildCheckFrameUrl(): string | null;
-    /**
-     * Builds the Auth-frame URL, or `null` when no client token is available.
-     *
-     * @returns The Auth-frame URL or `null`.
-     */
-    buildAuthFrameUrl(): string | null;
-    /**
-     * Builds the Reset-frame URL.
-     *
-     * @returns The Reset-frame URL.
-     */
-    buildResetFrameUrl(): string;
-}
-/**
- * Drops persisted-in-memory MoonPay session artifacts from controller state.
- *
- * @param state - The state to mutate.
- */
-export declare function clearMoonPaySession(state: MoonPayFrameState): void;
-export {};
-//# sourceMappingURL=MoonPayFrameHandler.d.cts.map

package/dist/vendors/MoonPayFrameHandler.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"MoonPayFrameHandler.d.cts","sourceRoot":"","sources":["../../src/vendors/MoonPayFrameHandler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAoB;AAOvD,KAAK,iBAAiB,GAAG;IACvB,YAAY,EAAE,SAAS,CAAC;IACxB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,QAAQ,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAoBF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,iBAAiB,CAAC;IAClC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,wBAAwB,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AAEF;;GAEG;AACH,qBAAa,mBAAmB;;gBAiBlB,EACV,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,eAAe,EACf,wBAAwB,GACzB,EAAE,0BAA0B;IAQ7B;;OAEG;IACH,SAAS,IAAI,IAAI;IAIjB;;OAEG;IACH,aAAa,IAAI,IAAI;IAIrB;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,mBAAmB,IAAI,IAAI;IAI3B;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IA6EnE;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAiBnC;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAgBlC;;;;OAIG;IACH,kBAAkB,IAAI,MAAM;CAsD7B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAIlE"}

package/dist/vendors/MoonPayFrameHandler.d.mts

@@ -1,74 +0,0 @@
-import type { KycPhase, KycVendor } from "../types.mjs";
-type MoonPayFrameState = {
-    activeVendor: KycVendor;
-    moonpayAccessToken: string | null;
-    moonpayCustomerId: string | null;
-    moonpaySessionToken: string | null;
-    phase: KycPhase;
-    statusMessage: string;
-};
-export type MoonPayFrameHandlerOptions = {
-    getState: () => MoonPayFrameState;
-    update: (updater: (state: MoonPayFrameState) => void) => void;
-    fail: (message: string) => void;
-    onAuthenticated: () => Promise<void>;
-    requireTermsReacceptance: () => void;
-};
-/**
- * Owns MoonPay Check/Auth frame state and protocol handling.
- */
-export declare class MoonPayFrameHandler {
-    #private;
-    constructor({ getState, update, fail, onAuthenticated, requireTermsReacceptance, }: MoonPayFrameHandlerOptions);
-    /**
-     * Creates a fresh keypair for a new MoonPay flow.
-     */
-    startFlow(): void;
-    /**
-     * Ensures an in-progress MoonPay flow has a frame keypair.
-     */
-    ensureKeypair(): void;
-    /**
-     * Clears all non-persisted MoonPay frame artifacts.
-     */
-    clear(): void;
-    /**
-     * Clears authentication associated with an earlier MoonPay session.
-     */
-    clearAuthentication(): void;
-    /**
-     * Handles a message posted by a MoonPay Check/Auth frame.
-     *
-     * @param message - The raw message posted by the frame.
-     * @returns An object whose optional `reply` should be posted back.
-     */
-    handleMessage(message: unknown): Promise<{
-        reply?: unknown;
-    }>;
-    /**
-     * Builds the Check-frame URL, or `null` when no session exists yet.
-     *
-     * @returns The Check-frame URL or `null`.
-     */
-    buildCheckFrameUrl(): string | null;
-    /**
-     * Builds the Auth-frame URL, or `null` when no client token is available.
-     *
-     * @returns The Auth-frame URL or `null`.
-     */
-    buildAuthFrameUrl(): string | null;
-    /**
-     * Builds the Reset-frame URL.
-     *
-     * @returns The Reset-frame URL.
-     */
-    buildResetFrameUrl(): string;
-}
-/**
- * Drops persisted-in-memory MoonPay session artifacts from controller state.
- *
- * @param state - The state to mutate.
- */
-export declare function clearMoonPaySession(state: MoonPayFrameState): void;
-export {};
-//# sourceMappingURL=MoonPayFrameHandler.d.mts.map

package/dist/vendors/MoonPayFrameHandler.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"MoonPayFrameHandler.d.mts","sourceRoot":"","sources":["../../src/vendors/MoonPayFrameHandler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAoB;AAOvD,KAAK,iBAAiB,GAAG;IACvB,YAAY,EAAE,SAAS,CAAC;IACxB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,QAAQ,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAoBF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,iBAAiB,CAAC;IAClC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,wBAAwB,EAAE,MAAM,IAAI,CAAC;CACtC,CAAC;AAEF;;GAEG;AACH,qBAAa,mBAAmB;;gBAiBlB,EACV,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,eAAe,EACf,wBAAwB,GACzB,EAAE,0BAA0B;IAQ7B;;OAEG;IACH,SAAS,IAAI,IAAI;IAIjB;;OAEG;IACH,aAAa,IAAI,IAAI;IAIrB;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,mBAAmB,IAAI,IAAI;IAI3B;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IA6EnE;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAiBnC;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAgBlC;;;;OAIG;IACH,kBAAkB,IAAI,MAAM;CAsD7B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAIlE"}

package/dist/vendors/MoonPayFrameHandler.mjs

@@ -1,230 +0,0 @@
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _MoonPayFrameHandler_instances, _MoonPayFrameHandler_getState, _MoonPayFrameHandler_update, _MoonPayFrameHandler_fail, _MoonPayFrameHandler_onAuthenticated, _MoonPayFrameHandler_requireTermsReacceptance, _MoonPayFrameHandler_frameKeypair, _MoonPayFrameHandler_authClientToken, _MoonPayFrameHandler_handleCheckOutcome, _MoonPayFrameHandler_handleAuthOutcome;
-import { decryptCredentials, generateKeyPair } from "../crypto.mjs";
-const FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';
-const CHANNEL_CHECK = 'ch_1';
-const CHANNEL_AUTH = 'ch_2';
-const CHANNEL_RESET = 'ch_reset';
-/**
- * Owns MoonPay Check/Auth frame state and protocol handling.
- */
-export class MoonPayFrameHandler {
-    constructor({ getState, update, fail, onAuthenticated, requireTermsReacceptance, }) {
-        _MoonPayFrameHandler_instances.add(this);
-        _MoonPayFrameHandler_getState.set(this, void 0);
-        _MoonPayFrameHandler_update.set(this, void 0);
-        _MoonPayFrameHandler_fail.set(this, void 0);
-        _MoonPayFrameHandler_onAuthenticated.set(this, void 0);
-        _MoonPayFrameHandler_requireTermsReacceptance.set(this, void 0);
-        /** MoonPay Check/Auth frame X25519 keypair (never persisted). */
-        _MoonPayFrameHandler_frameKeypair.set(this, null);
-        /** Auth-frame client token, kept out of controller state. */
-        _MoonPayFrameHandler_authClientToken.set(this, null);
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_getState, getState, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_update, update, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_fail, fail, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_onAuthenticated, onAuthenticated, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_requireTermsReacceptance, requireTermsReacceptance, "f");
-    }
-    /**
-     * Creates a fresh keypair for a new MoonPay flow.
-     */
-    startFlow() {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_frameKeypair, generateKeyPair(), "f");
-    }
-    /**
-     * Ensures an in-progress MoonPay flow has a frame keypair.
-     */
-    ensureKeypair() {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_frameKeypair, __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f") ?? generateKeyPair(), "f");
-    }
-    /**
-     * Clears all non-persisted MoonPay frame artifacts.
-     */
-    clear() {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_frameKeypair, null, "f");
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_authClientToken, null, "f");
-    }
-    /**
-     * Clears authentication associated with an earlier MoonPay session.
-     */
-    clearAuthentication() {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_authClientToken, null, "f");
-    }
-    /**
-     * Handles a message posted by a MoonPay Check/Auth frame.
-     *
-     * @param message - The raw message posted by the frame.
-     * @returns An object whose optional `reply` should be posted back.
-     */
-    async handleMessage(message) {
-        const payload = message;
-        if (!payload) {
-            return {};
-        }
-        if (payload.kind === 'handshake') {
-            const channelId = payload.meta?.channelId;
-            return { reply: { version: 2, meta: { channelId }, kind: 'ack' } };
-        }
-        if (payload.kind !== 'complete') {
-            return {};
-        }
-        const channelId = payload.meta?.channelId;
-        const state = __classPrivateFieldGet(this, _MoonPayFrameHandler_getState, "f").call(this);
-        // Only honor a completion for the MoonPay frame the flow is currently
-        // waiting on. This drops stale or duplicate messages after reset, phase
-        // advancement, or a vendor switch so they cannot restore tokens or rewind
-        // the flow. Unlike awaited controller work, external frame messages are
-        // not protected by the controller's generation guard.
-        let expectedPhase = null;
-        if (channelId === CHANNEL_CHECK) {
-            expectedPhase = 'check';
-        }
-        else if (channelId === CHANNEL_AUTH) {
-            expectedPhase = 'auth';
-        }
-        if (!expectedPhase ||
-            state.phase !== expectedPhase ||
-            state.activeVendor !== 'moonpay') {
-            return {};
-        }
-        const status = payload.payload?.status;
-        const credentialsEnvelope = payload.payload?.credentials;
-        const customerId = payload.payload?.customer?.id ?? null;
-        if (customerId) {
-            __classPrivateFieldGet(this, _MoonPayFrameHandler_update, "f").call(this, (draft) => {
-                draft.moonpayCustomerId = customerId;
-            });
-        }
-        if (!status) {
-            return {};
-        }
-        let accessToken;
-        let clientToken;
-        if (credentialsEnvelope && __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f")) {
-            try {
-                const { credentials } = decryptCredentials(credentialsEnvelope, __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f").privateKey);
-                accessToken = credentials.accessToken;
-                clientToken = credentials.clientToken;
-            }
-            catch (error) {
-                __classPrivateFieldGet(this, _MoonPayFrameHandler_fail, "f").call(this, `Failed to decrypt frame credentials: ${String(error)}`);
-                return {};
-            }
-        }
-        if (channelId === CHANNEL_CHECK) {
-            await __classPrivateFieldGet(this, _MoonPayFrameHandler_instances, "m", _MoonPayFrameHandler_handleCheckOutcome).call(this, status, accessToken, clientToken);
-        }
-        else {
-            await __classPrivateFieldGet(this, _MoonPayFrameHandler_instances, "m", _MoonPayFrameHandler_handleAuthOutcome).call(this, status, accessToken);
-        }
-        return {};
-    }
-    /**
-     * Builds the Check-frame URL, or `null` when no session exists yet.
-     *
-     * @returns The Check-frame URL or `null`.
-     */
-    buildCheckFrameUrl() {
-        const state = __classPrivateFieldGet(this, _MoonPayFrameHandler_getState, "f").call(this);
-        if (state.activeVendor !== 'moonpay' ||
-            !state.moonpaySessionToken ||
-            !__classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f")) {
-            return null;
-        }
-        const url = new URL(`${FRAMES_BASE_URL}/check-connection`);
-        url.searchParams.set('sessionToken', state.moonpaySessionToken);
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f").publicKeyHex);
-        url.searchParams.set('channelId', CHANNEL_CHECK);
-        url.searchParams.set('skipKyc', 'true');
-        return url.toString();
-    }
-    /**
-     * Builds the Auth-frame URL, or `null` when no client token is available.
-     *
-     * @returns The Auth-frame URL or `null`.
-     */
-    buildAuthFrameUrl() {
-        const state = __classPrivateFieldGet(this, _MoonPayFrameHandler_getState, "f").call(this);
-        if (state.activeVendor !== 'moonpay' ||
-            !__classPrivateFieldGet(this, _MoonPayFrameHandler_authClientToken, "f") ||
-            !__classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f")) {
-            return null;
-        }
-        const url = new URL(`${FRAMES_BASE_URL}/auth`);
-        url.searchParams.set('clientToken', __classPrivateFieldGet(this, _MoonPayFrameHandler_authClientToken, "f"));
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _MoonPayFrameHandler_frameKeypair, "f").publicKeyHex);
-        url.searchParams.set('channelId', CHANNEL_AUTH);
-        return url.toString();
-    }
-    /**
-     * Builds the Reset-frame URL.
-     *
-     * @returns The Reset-frame URL.
-     */
-    buildResetFrameUrl() {
-        const url = new URL(`${FRAMES_BASE_URL}/reset`);
-        url.searchParams.set('channelId', CHANNEL_RESET);
-        return url.toString();
-    }
-}
-_MoonPayFrameHandler_getState = new WeakMap(), _MoonPayFrameHandler_update = new WeakMap(), _MoonPayFrameHandler_fail = new WeakMap(), _MoonPayFrameHandler_onAuthenticated = new WeakMap(), _MoonPayFrameHandler_requireTermsReacceptance = new WeakMap(), _MoonPayFrameHandler_frameKeypair = new WeakMap(), _MoonPayFrameHandler_authClientToken = new WeakMap(), _MoonPayFrameHandler_instances = new WeakSet(), _MoonPayFrameHandler_handleCheckOutcome = async function _MoonPayFrameHandler_handleCheckOutcome(status, accessToken, clientToken) {
-    if (status === 'active' && accessToken) {
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_update, "f").call(this, (state) => {
-            state.moonpayAccessToken = accessToken;
-            state.phase = 'form';
-            state.statusMessage = 'Already authenticated. Review to submit.';
-        });
-        await __classPrivateFieldGet(this, _MoonPayFrameHandler_onAuthenticated, "f").call(this);
-        return;
-    }
-    if (status === 'connectionRequired' && clientToken) {
-        __classPrivateFieldSet(this, _MoonPayFrameHandler_authClientToken, clientToken, "f");
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_update, "f").call(this, (state) => {
-            state.phase = 'auth';
-            state.statusMessage = 'Verify your email via OTP in the Auth frame.';
-        });
-        return;
-    }
-    if (status === 'termsAcceptanceRequired') {
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_requireTermsReacceptance, "f").call(this);
-        return;
-    }
-    __classPrivateFieldGet(this, _MoonPayFrameHandler_fail, "f").call(this, `Check frame returned status: ${status}`);
-}, _MoonPayFrameHandler_handleAuthOutcome = async function _MoonPayFrameHandler_handleAuthOutcome(status, accessToken) {
-    if (status === 'active' && accessToken) {
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_update, "f").call(this, (state) => {
-            state.moonpayAccessToken = accessToken;
-            state.phase = 'form';
-            state.statusMessage = 'Authenticated. Review to submit.';
-        });
-        await __classPrivateFieldGet(this, _MoonPayFrameHandler_onAuthenticated, "f").call(this);
-        return;
-    }
-    if (status === 'termsAcceptanceRequired') {
-        __classPrivateFieldGet(this, _MoonPayFrameHandler_requireTermsReacceptance, "f").call(this);
-        return;
-    }
-    __classPrivateFieldGet(this, _MoonPayFrameHandler_fail, "f").call(this, `Auth frame returned status: ${status}`);
-};
-/**
- * Drops persisted-in-memory MoonPay session artifacts from controller state.
- *
- * @param state - The state to mutate.
- */
-export function clearMoonPaySession(state) {
-    state.moonpayCustomerId = null;
-    state.moonpaySessionToken = null;
-    state.moonpayAccessToken = null;
-}
-//# sourceMappingURL=MoonPayFrameHandler.mjs.map

package/dist/vendors/MoonPayFrameHandler.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"MoonPayFrameHandler.mjs","sourceRoot":"","sources":["../../src/vendors/MoonPayFrameHandler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,sBAAqB;AAInE,MAAM,eAAe,GAAG,wCAAwC,CAAC;AACjE,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,aAAa,GAAG,UAAU,CAAC;AAqCjC;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAiB9B,YAAY,EACV,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,eAAe,EACf,wBAAwB,GACG;;QAtBpB,gDAAkD;QAElD,8CAA8C;QAE9C,4CAA0C;QAE1C,uDAAgE;QAEhE,gEAAkF;QAE3F,iEAAiE;QACjE,4CAAsC,IAAI,EAAC;QAE3C,6DAA6D;QAC7D,+CAAkC,IAAI,EAAC;QASrC,uBAAA,IAAI,iCAAa,QAAQ,MAAA,CAAC;QAC1B,uBAAA,IAAI,+BAAW,MAAM,MAAA,CAAC;QACtB,uBAAA,IAAI,6BAAS,IAAI,MAAA,CAAC;QAClB,uBAAA,IAAI,wCAAoB,eAAe,MAAA,CAAC;QACxC,uBAAA,IAAI,iDAA6B,wBAAwB,MAAA,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,SAAS;QACP,uBAAA,IAAI,qCAAiB,eAAe,EAAE,MAAA,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,wIAAuB,eAAe,EAAE,MAAA,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK;QACH,uBAAA,IAAI,qCAAiB,IAAI,MAAA,CAAC;QAC1B,uBAAA,IAAI,wCAAoB,IAAI,MAAA,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,uBAAA,IAAI,wCAAoB,IAAI,MAAA,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,MAAM,OAAO,GAAG,OAAmC,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1C,MAAM,KAAK,GAAG,uBAAA,IAAI,qCAAU,MAAd,IAAI,CAAY,CAAC;QAE/B,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,aAAa,GAAoB,IAAI,CAAC;QAC1C,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,aAAa,GAAG,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;YACtC,aAAa,GAAG,MAAM,CAAC;QACzB,CAAC;QAED,IACE,CAAC,aAAa;YACd,KAAK,CAAC,KAAK,KAAK,aAAa;YAC7B,KAAK,CAAC,YAAY,KAAK,SAAS,EAChC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;QACvC,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC;QAEzD,IAAI,UAAU,EAAE,CAAC;YACf,uBAAA,IAAI,mCAAQ,MAAZ,IAAI,EAAS,CAAC,KAAK,EAAE,EAAE;gBACrB,KAAK,CAAC,iBAAiB,GAAG,UAAU,CAAC;YACvC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,WAA+B,CAAC;QACpC,IAAI,mBAAmB,IAAI,uBAAA,IAAI,yCAAc,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,CACxC,mBAAmB,EACnB,uBAAA,IAAI,yCAAc,CAAC,UAAU,CAC9B,CAAC;gBACF,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;gBACtC,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,uBAAA,IAAI,iCAAM,MAAV,IAAI,EAAO,wCAAwC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACpE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,MAAM,uBAAA,IAAI,+EAAoB,MAAxB,IAAI,EAAqB,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,uBAAA,IAAI,8EAAmB,MAAvB,IAAI,EAAoB,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,MAAM,KAAK,GAAG,uBAAA,IAAI,qCAAU,MAAd,IAAI,CAAY,CAAC;QAC/B,IACE,KAAK,CAAC,YAAY,KAAK,SAAS;YAChC,CAAC,KAAK,CAAC,mBAAmB;YAC1B,CAAC,uBAAA,IAAI,yCAAc,EACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,eAAe,mBAAmB,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAChE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,uBAAA,IAAI,yCAAc,CAAC,YAAY,CAAC,CAAC;QACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,MAAM,KAAK,GAAG,uBAAA,IAAI,qCAAU,MAAd,IAAI,CAAY,CAAC;QAC/B,IACE,KAAK,CAAC,YAAY,KAAK,SAAS;YAChC,CAAC,uBAAA,IAAI,4CAAiB;YACtB,CAAC,uBAAA,IAAI,yCAAc,EACnB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,eAAe,OAAO,CAAC,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,uBAAA,IAAI,4CAAiB,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,uBAAA,IAAI,yCAAc,CAAC,YAAY,CAAC,CAAC;QACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,eAAe,QAAQ,CAAC,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;CAkDF;+bAhDC,KAAK,kDACH,MAAmB,EACnB,WAAoB,EACpB,WAAoB;IAEpB,IAAI,MAAM,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC;QACvC,uBAAA,IAAI,mCAAQ,MAAZ,IAAI,EAAS,CAAC,KAAK,EAAE,EAAE;YACrB,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC;YACvC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YACrB,KAAK,CAAC,aAAa,GAAG,0CAA0C,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,MAAM,uBAAA,IAAI,4CAAiB,MAArB,IAAI,CAAmB,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,oBAAoB,IAAI,WAAW,EAAE,CAAC;QACnD,uBAAA,IAAI,wCAAoB,WAAW,MAAA,CAAC;QACpC,uBAAA,IAAI,mCAAQ,MAAZ,IAAI,EAAS,CAAC,KAAK,EAAE,EAAE;YACrB,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YACrB,KAAK,CAAC,aAAa,GAAG,8CAA8C,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,uBAAA,IAAI,qDAA0B,MAA9B,IAAI,CAA4B,CAAC;QACjC,OAAO;IACT,CAAC;IACD,uBAAA,IAAI,iCAAM,MAAV,IAAI,EAAO,gCAAgC,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC,2CAED,KAAK,iDACH,MAAmB,EACnB,WAAoB;IAEpB,IAAI,MAAM,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC;QACvC,uBAAA,IAAI,mCAAQ,MAAZ,IAAI,EAAS,CAAC,KAAK,EAAE,EAAE;YACrB,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC;YACvC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC;YACrB,KAAK,CAAC,aAAa,GAAG,kCAAkC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,MAAM,uBAAA,IAAI,4CAAiB,MAArB,IAAI,CAAmB,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzC,uBAAA,IAAI,qDAA0B,MAA9B,IAAI,CAA4B,CAAC;QACjC,OAAO;IACT,CAAC;IACD,uBAAA,IAAI,iCAAM,MAAV,IAAI,EAAO,+BAA+B,MAAM,EAAE,CAAC,CAAC;AACtD,CAAC;AAGH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAwB;IAC1D,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC;AAClC,CAAC","sourcesContent":["import { decryptCredentials, generateKeyPair } from '../crypto.js';\nimport type { EncryptedCredentialsEnvelope, X25519KeyPair } from '../crypto.js';\nimport type { KycPhase, KycVendor } from '../types.js';\n\nconst FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';\nconst CHANNEL_CHECK = 'ch_1';\nconst CHANNEL_AUTH = 'ch_2';\nconst CHANNEL_RESET = 'ch_reset';\n\ntype MoonPayFrameState = {\n  activeVendor: KycVendor;\n  moonpayAccessToken: string | null;\n  moonpayCustomerId: string | null;\n  moonpaySessionToken: string | null;\n  phase: KycPhase;\n  statusMessage: string;\n};\n\ntype FrameMessage = {\n  meta?: { channelId?: string };\n  kind?: string;\n  payload?: {\n    status?:\n      | 'active'\n      | 'connectionRequired'\n      | 'termsAcceptanceRequired'\n      | 'pending'\n      | 'unavailable'\n      | 'failed';\n    credentials?: EncryptedCredentialsEnvelope | string;\n    customer?: { id?: string };\n  };\n};\n\ntype FrameStatus = NonNullable<FrameMessage['payload']>['status'];\n\nexport type MoonPayFrameHandlerOptions = {\n  getState: () => MoonPayFrameState;\n  update: (updater: (state: MoonPayFrameState) => void) => void;\n  fail: (message: string) => void;\n  onAuthenticated: () => Promise<void>;\n  requireTermsReacceptance: () => void;\n};\n\n/**\n * Owns MoonPay Check/Auth frame state and protocol handling.\n */\nexport class MoonPayFrameHandler {\n  readonly #getState: MoonPayFrameHandlerOptions['getState'];\n\n  readonly #update: MoonPayFrameHandlerOptions['update'];\n\n  readonly #fail: MoonPayFrameHandlerOptions['fail'];\n\n  readonly #onAuthenticated: MoonPayFrameHandlerOptions['onAuthenticated'];\n\n  readonly #requireTermsReacceptance: MoonPayFrameHandlerOptions['requireTermsReacceptance'];\n\n  /** MoonPay Check/Auth frame X25519 keypair (never persisted). */\n  #frameKeypair: X25519KeyPair | null = null;\n\n  /** Auth-frame client token, kept out of controller state. */\n  #authClientToken: string | null = null;\n\n  constructor({\n    getState,\n    update,\n    fail,\n    onAuthenticated,\n    requireTermsReacceptance,\n  }: MoonPayFrameHandlerOptions) {\n    this.#getState = getState;\n    this.#update = update;\n    this.#fail = fail;\n    this.#onAuthenticated = onAuthenticated;\n    this.#requireTermsReacceptance = requireTermsReacceptance;\n  }\n\n  /**\n   * Creates a fresh keypair for a new MoonPay flow.\n   */\n  startFlow(): void {\n    this.#frameKeypair = generateKeyPair();\n  }\n\n  /**\n   * Ensures an in-progress MoonPay flow has a frame keypair.\n   */\n  ensureKeypair(): void {\n    this.#frameKeypair ??= generateKeyPair();\n  }\n\n  /**\n   * Clears all non-persisted MoonPay frame artifacts.\n   */\n  clear(): void {\n    this.#frameKeypair = null;\n    this.#authClientToken = null;\n  }\n\n  /**\n   * Clears authentication associated with an earlier MoonPay session.\n   */\n  clearAuthentication(): void {\n    this.#authClientToken = null;\n  }\n\n  /**\n   * Handles a message posted by a MoonPay Check/Auth frame.\n   *\n   * @param message - The raw message posted by the frame.\n   * @returns An object whose optional `reply` should be posted back.\n   */\n  async handleMessage(message: unknown): Promise<{ reply?: unknown }> {\n    const payload = message as FrameMessage | undefined;\n\n    if (!payload) {\n      return {};\n    }\n\n    if (payload.kind === 'handshake') {\n      const channelId = payload.meta?.channelId;\n      return { reply: { version: 2, meta: { channelId }, kind: 'ack' } };\n    }\n\n    if (payload.kind !== 'complete') {\n      return {};\n    }\n\n    const channelId = payload.meta?.channelId;\n    const state = this.#getState();\n\n    // Only honor a completion for the MoonPay frame the flow is currently\n    // waiting on. This drops stale or duplicate messages after reset, phase\n    // advancement, or a vendor switch so they cannot restore tokens or rewind\n    // the flow. Unlike awaited controller work, external frame messages are\n    // not protected by the controller's generation guard.\n    let expectedPhase: KycPhase | null = null;\n    if (channelId === CHANNEL_CHECK) {\n      expectedPhase = 'check';\n    } else if (channelId === CHANNEL_AUTH) {\n      expectedPhase = 'auth';\n    }\n\n    if (\n      !expectedPhase ||\n      state.phase !== expectedPhase ||\n      state.activeVendor !== 'moonpay'\n    ) {\n      return {};\n    }\n\n    const status = payload.payload?.status;\n    const credentialsEnvelope = payload.payload?.credentials;\n    const customerId = payload.payload?.customer?.id ?? null;\n\n    if (customerId) {\n      this.#update((draft) => {\n        draft.moonpayCustomerId = customerId;\n      });\n    }\n\n    if (!status) {\n      return {};\n    }\n\n    let accessToken: string | undefined;\n    let clientToken: string | undefined;\n    if (credentialsEnvelope && this.#frameKeypair) {\n      try {\n        const { credentials } = decryptCredentials(\n          credentialsEnvelope,\n          this.#frameKeypair.privateKey,\n        );\n        accessToken = credentials.accessToken;\n        clientToken = credentials.clientToken;\n      } catch (error) {\n        this.#fail(`Failed to decrypt frame credentials: ${String(error)}`);\n        return {};\n      }\n    }\n\n    if (channelId === CHANNEL_CHECK) {\n      await this.#handleCheckOutcome(status, accessToken, clientToken);\n    } else {\n      await this.#handleAuthOutcome(status, accessToken);\n    }\n    return {};\n  }\n\n  /**\n   * Builds the Check-frame URL, or `null` when no session exists yet.\n   *\n   * @returns The Check-frame URL or `null`.\n   */\n  buildCheckFrameUrl(): string | null {\n    const state = this.#getState();\n    if (\n      state.activeVendor !== 'moonpay' ||\n      !state.moonpaySessionToken ||\n      !this.#frameKeypair\n    ) {\n      return null;\n    }\n    const url = new URL(`${FRAMES_BASE_URL}/check-connection`);\n    url.searchParams.set('sessionToken', state.moonpaySessionToken);\n    url.searchParams.set('publicKey', this.#frameKeypair.publicKeyHex);\n    url.searchParams.set('channelId', CHANNEL_CHECK);\n    url.searchParams.set('skipKyc', 'true');\n    return url.toString();\n  }\n\n  /**\n   * Builds the Auth-frame URL, or `null` when no client token is available.\n   *\n   * @returns The Auth-frame URL or `null`.\n   */\n  buildAuthFrameUrl(): string | null {\n    const state = this.#getState();\n    if (\n      state.activeVendor !== 'moonpay' ||\n      !this.#authClientToken ||\n      !this.#frameKeypair\n    ) {\n      return null;\n    }\n    const url = new URL(`${FRAMES_BASE_URL}/auth`);\n    url.searchParams.set('clientToken', this.#authClientToken);\n    url.searchParams.set('publicKey', this.#frameKeypair.publicKeyHex);\n    url.searchParams.set('channelId', CHANNEL_AUTH);\n    return url.toString();\n  }\n\n  /**\n   * Builds the Reset-frame URL.\n   *\n   * @returns The Reset-frame URL.\n   */\n  buildResetFrameUrl(): string {\n    const url = new URL(`${FRAMES_BASE_URL}/reset`);\n    url.searchParams.set('channelId', CHANNEL_RESET);\n    return url.toString();\n  }\n\n  async #handleCheckOutcome(\n    status: FrameStatus,\n    accessToken?: string,\n    clientToken?: string,\n  ): Promise<void> {\n    if (status === 'active' && accessToken) {\n      this.#update((state) => {\n        state.moonpayAccessToken = accessToken;\n        state.phase = 'form';\n        state.statusMessage = 'Already authenticated. Review to submit.';\n      });\n      await this.#onAuthenticated();\n      return;\n    }\n    if (status === 'connectionRequired' && clientToken) {\n      this.#authClientToken = clientToken;\n      this.#update((state) => {\n        state.phase = 'auth';\n        state.statusMessage = 'Verify your email via OTP in the Auth frame.';\n      });\n      return;\n    }\n    if (status === 'termsAcceptanceRequired') {\n      this.#requireTermsReacceptance();\n      return;\n    }\n    this.#fail(`Check frame returned status: ${status}`);\n  }\n\n  async #handleAuthOutcome(\n    status: FrameStatus,\n    accessToken?: string,\n  ): Promise<void> {\n    if (status === 'active' && accessToken) {\n      this.#update((state) => {\n        state.moonpayAccessToken = accessToken;\n        state.phase = 'form';\n        state.statusMessage = 'Authenticated. Review to submit.';\n      });\n      await this.#onAuthenticated();\n      return;\n    }\n    if (status === 'termsAcceptanceRequired') {\n      this.#requireTermsReacceptance();\n      return;\n    }\n    this.#fail(`Auth frame returned status: ${status}`);\n  }\n}\n\n/**\n * Drops persisted-in-memory MoonPay session artifacts from controller state.\n *\n * @param state - The state to mutate.\n */\nexport function clearMoonPaySession(state: MoonPayFrameState): void {\n  state.moonpayCustomerId = null;\n  state.moonpaySessionToken = null;\n  state.moonpayAccessToken = null;\n}\n"]}