@metamask-previews/kyc-controller 0.0.0-preview-e57e5c3dc → 0.0.0-preview-c34a16a37

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,GAC9B,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,GAC/B,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,SAAS,GACV,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}
+{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,qCAAqC,EACrC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,oCAAoC,EACpC,gCAAgC,EAChC,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,oCAAoC,EACpC,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC/B,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}

package/dist/index.d.mts

@@ -1,14 +1,14 @@
 export { KycController, getDefaultKycControllerState, controllerName, } from "./KycController.mjs";
-export type { KycControllerActions, KycControllerEvents, KycControllerGetStateAction, KycControllerMessenger, KycControllerOptions, KycControllerState, KycControllerStateChangeEvent, } from "./KycController.mjs";
-export type { KycControllerAcceptTermsAndStartSessionAction, KycControllerBuildAuthFrameUrlAction, KycControllerBuildCheckFrameUrlAction, KycControllerBuildResetFrameUrlAction, KycControllerCheckKycRequiredAction, KycControllerClearSavedTermsAction, KycControllerGetKycStatusAction, KycControllerGetSessionStatusAction, KycControllerHandleFrameMessageAction, KycControllerInitializeAction, KycControllerLoadDisclaimersAction, KycControllerResetAction, KycControllerStartSumSubAction, } from "./KycController-method-action-types.mjs";
+export type { KycControllerActions, KycControllerEvents, KycControllerGetStateAction, KycControllerMessenger, KycControllerOptions, KycControllerState, KycControllerStateChangeEvent, KycControllerStatusChangedEvent, } from "./KycController.mjs";
+export type { KycControllerAcceptTermsAndStartSessionAction, KycControllerBuildAuthFrameUrlAction, KycControllerBuildCheckFrameUrlAction, KycControllerBuildResetFrameUrlAction, KycControllerCheckKycRequiredAction, KycControllerClearSavedTermsAction, KycControllerCreateIronCustomerAction, KycControllerGetCustomerIdentityAction, KycControllerGetKycStatusAction, KycControllerGetSessionStatusAction, KycControllerHandleFrameMessageAction, KycControllerInitializeAction, KycControllerLoadDisclaimersAction, KycControllerRefreshKycStatusAction, KycControllerResetAction, KycControllerStartSumSubAction, } from "./KycController-method-action-types.mjs";
 export { KycService, serviceName } from "./KycService.mjs";
-export type { ApplicantAccessTokenResponse, CheckKycRequiredParams, CreateSessionParams, CreateUkycSessionParams, GetSessionStatusParams, GetWrappingKeyParams, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, UkycSessionResponse, WrappedEncryptionKey, WrappingKeyResponse, } from "./KycService.mjs";
-export type { KycServiceCheckKycRequiredAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchDisclaimersAction, KycServiceFetchJwksAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceGetWrappingKeyAction, } from "./KycService-method-action-types.mjs";
+export type { ApplicantAccessTokenResponse, CheckKycRequiredParams, CreateIronCustomerParams, CreateSessionParams, CreateUkycSessionParams, GetSessionStatusParams, GetWrappingKeyParams, IronCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SubmitConsentsParams, UkycSessionResponse, WrappedEncryptionKey, WrappingKeyResponse, } from "./KycService.mjs";
+export type { KycServiceCheckIronKycRequiredAction, KycServiceCheckKycRequiredAction, KycServiceCreateIronCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchDisclaimersAction, KycServiceFetchIronDisclaimersAction, KycServiceFetchJwksAction, KycServiceFetchKycStatusAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceGetWrappingKeyAction, KycServiceSubmitConsentsAction, } from "./KycService-method-action-types.mjs";
 export { selectIsKycRequiredForProduct, selectKycPhase, selectKycSumSub, } from "./selectors.mjs";
 export { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from "./countryCodes.mjs";
 export { decryptCredentials, generateKeyPair } from "./crypto.mjs";
 export type { DecryptedCredentials, DecryptResult, EncryptedCredentialsEnvelope, X25519KeyPair, } from "./crypto.mjs";
-export type { KycDisclaimer, KycPhase, KycProduct, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycVendor, } from "./types.mjs";
+export type { KycCustomerIdentity, KycDisclaimer, KycPhase, KycProduct, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, } from "./types.mjs";
 export { UKYC_CAPABILITY_AUTH_SCHEME, UKYC_KWIL_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES, UKYC_STORAGE_ACCESS_TOKEN_VERSION, } from "./ukyc/constants.mjs";
 export { deriveClientMaterial, encodeClientMaterial, } from "./ukyc/deriveClientMaterial.mjs";
 export type { EncodedUkycClientMaterial, UkycClientMaterial, } from "./ukyc/deriveClientMaterial.mjs";

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,GAC9B,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,GAC/B,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,aAAa,EACb,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,SAAS,GACV,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,qCAAqC,EACrC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,oCAAoC,EACpC,gCAAgC,EAChC,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,oCAAoC,EACpC,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC/B,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACf,4BAA2B;AA0B5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAgC1D,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,EAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAmBlE,iFAAiF;AACjF,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,EAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,wCAAuC;AAKxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACvB,sCAAqC;AAQtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B","sourcesContent":["export {\n  KycController,\n  getDefaultKycControllerState,\n  controllerName,\n} from './KycController.js';\nexport type {\n  KycControllerActions,\n  KycControllerEvents,\n  KycControllerGetStateAction,\n  KycControllerMessenger,\n  KycControllerOptions,\n  KycControllerState,\n  KycControllerStateChangeEvent,\n} from './KycController.js';\nexport type {\n  KycControllerAcceptTermsAndStartSessionAction,\n  KycControllerBuildAuthFrameUrlAction,\n  KycControllerBuildCheckFrameUrlAction,\n  KycControllerBuildResetFrameUrlAction,\n  KycControllerCheckKycRequiredAction,\n  KycControllerClearSavedTermsAction,\n  KycControllerGetKycStatusAction,\n  KycControllerGetSessionStatusAction,\n  KycControllerHandleFrameMessageAction,\n  KycControllerInitializeAction,\n  KycControllerLoadDisclaimersAction,\n  KycControllerResetAction,\n  KycControllerStartSumSubAction,\n} from './KycController-method-action-types.js';\n\nexport { KycService, serviceName } from './KycService.js';\nexport type {\n  ApplicantAccessTokenResponse,\n  CheckKycRequiredParams,\n  CreateSessionParams,\n  CreateUkycSessionParams,\n  GetSessionStatusParams,\n  GetWrappingKeyParams,\n  JwksResponse,\n  KycServiceActions,\n  KycServiceCacheUpdatedEvent,\n  KycServiceEvents,\n  KycServiceGranularCacheUpdatedEvent,\n  KycServiceInvalidateQueriesAction,\n  KycServiceMessenger,\n  KycServiceOptions,\n  UkycSessionResponse,\n  WrappedEncryptionKey,\n  WrappingKeyResponse,\n} from './KycService.js';\nexport type {\n  KycServiceCheckKycRequiredAction,\n  KycServiceCreateJourneyAction,\n  KycServiceCreateSessionAction,\n  KycServiceCreateUkycSessionAction,\n  KycServiceFetchDisclaimersAction,\n  KycServiceFetchJwksAction,\n  KycServiceGetGeoCountryAction,\n  KycServiceGetSessionStatusAction,\n  KycServiceGetWrappingKeyAction,\n} from './KycService-method-action-types.js';\n\nexport {\n  selectIsKycRequiredForProduct,\n  selectKycPhase,\n  selectKycSumSub,\n} from './selectors.js';\n\nexport { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from './countryCodes.js';\nexport { decryptCredentials, generateKeyPair } from './crypto.js';\nexport type {\n  DecryptedCredentials,\n  DecryptResult,\n  EncryptedCredentialsEnvelope,\n  X25519KeyPair,\n} from './crypto.js';\n\nexport type {\n  KycDisclaimer,\n  KycPhase,\n  KycProduct,\n  KycSessionStatus,\n  KycSumSubLaunchParams,\n  KycSumSubLauncher,\n  KycSumSubStatus,\n  KycVendor,\n} from './types.js';\n\n// UKYC storage-access-token utilities. Exported so a signed capability token can\n// be minted for testing UKYC Storage (see `mintUkycTestToken`).\nexport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_KWIL_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './ukyc/constants.js';\nexport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport type {\n  EncodedUkycClientMaterial,\n  UkycClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nexport type {\n  SignStorageAccessTokenParams,\n  UkycStorageAccessToken,\n  UkycStorageAccessTokenPayload,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './ukyc/storageAccessToken.js';\nexport { mintUkycTestToken } from './ukyc/testToken.js';\nexport type {\n  MintedUkycTestToken,\n  MintUkycTestTokenParams,\n} from './ukyc/testToken.js';\n"]}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACf,4BAA2B;AA8B5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAwC1D,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,EAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAsBlE,iFAAiF;AACjF,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,EAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,wCAAuC;AAKxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACvB,sCAAqC;AAQtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B","sourcesContent":["export {\n  KycController,\n  getDefaultKycControllerState,\n  controllerName,\n} from './KycController.js';\nexport type {\n  KycControllerActions,\n  KycControllerEvents,\n  KycControllerGetStateAction,\n  KycControllerMessenger,\n  KycControllerOptions,\n  KycControllerState,\n  KycControllerStateChangeEvent,\n  KycControllerStatusChangedEvent,\n} from './KycController.js';\nexport type {\n  KycControllerAcceptTermsAndStartSessionAction,\n  KycControllerBuildAuthFrameUrlAction,\n  KycControllerBuildCheckFrameUrlAction,\n  KycControllerBuildResetFrameUrlAction,\n  KycControllerCheckKycRequiredAction,\n  KycControllerClearSavedTermsAction,\n  KycControllerCreateIronCustomerAction,\n  KycControllerGetCustomerIdentityAction,\n  KycControllerGetKycStatusAction,\n  KycControllerGetSessionStatusAction,\n  KycControllerHandleFrameMessageAction,\n  KycControllerInitializeAction,\n  KycControllerLoadDisclaimersAction,\n  KycControllerRefreshKycStatusAction,\n  KycControllerResetAction,\n  KycControllerStartSumSubAction,\n} from './KycController-method-action-types.js';\n\nexport { KycService, serviceName } from './KycService.js';\nexport type {\n  ApplicantAccessTokenResponse,\n  CheckKycRequiredParams,\n  CreateIronCustomerParams,\n  CreateSessionParams,\n  CreateUkycSessionParams,\n  GetSessionStatusParams,\n  GetWrappingKeyParams,\n  IronCustomerResponse,\n  JwksResponse,\n  KycServiceActions,\n  KycServiceCacheUpdatedEvent,\n  KycServiceEvents,\n  KycServiceGranularCacheUpdatedEvent,\n  KycServiceInvalidateQueriesAction,\n  KycServiceMessenger,\n  KycServiceOptions,\n  SubmitConsentsParams,\n  UkycSessionResponse,\n  WrappedEncryptionKey,\n  WrappingKeyResponse,\n} from './KycService.js';\nexport type {\n  KycServiceCheckIronKycRequiredAction,\n  KycServiceCheckKycRequiredAction,\n  KycServiceCreateIronCustomerAction,\n  KycServiceCreateJourneyAction,\n  KycServiceCreateSessionAction,\n  KycServiceCreateUkycSessionAction,\n  KycServiceFetchDisclaimersAction,\n  KycServiceFetchIronDisclaimersAction,\n  KycServiceFetchJwksAction,\n  KycServiceFetchKycStatusAction,\n  KycServiceGetGeoCountryAction,\n  KycServiceGetSessionStatusAction,\n  KycServiceGetWrappingKeyAction,\n  KycServiceSubmitConsentsAction,\n} from './KycService-method-action-types.js';\n\nexport {\n  selectIsKycRequiredForProduct,\n  selectKycPhase,\n  selectKycSumSub,\n} from './selectors.js';\n\nexport { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from './countryCodes.js';\nexport { decryptCredentials, generateKeyPair } from './crypto.js';\nexport type {\n  DecryptedCredentials,\n  DecryptResult,\n  EncryptedCredentialsEnvelope,\n  X25519KeyPair,\n} from './crypto.js';\n\nexport type {\n  KycCustomerIdentity,\n  KycDisclaimer,\n  KycPhase,\n  KycProduct,\n  KycSessionStatus,\n  KycSumSubLaunchParams,\n  KycSumSubLauncher,\n  KycSumSubStatus,\n  KycUserStatus,\n  KycUserStatusResponse,\n  KycVendor,\n} from './types.js';\n\n// UKYC storage-access-token utilities. Exported so a signed capability token can\n// be minted for testing UKYC Storage (see `mintUkycTestToken`).\nexport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_KWIL_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './ukyc/constants.js';\nexport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport type {\n  EncodedUkycClientMaterial,\n  UkycClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nexport type {\n  SignStorageAccessTokenParams,\n  UkycStorageAccessToken,\n  UkycStorageAccessTokenPayload,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './ukyc/storageAccessToken.js';\nexport { mintUkycTestToken } from './ukyc/testToken.js';\nexport type {\n  MintedUkycTestToken,\n  MintUkycTestTokenParams,\n} from './ukyc/testToken.js';\n"]}

package/dist/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps and card can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card';\n\n/**\n * Identity vendors supported behind the KYC surface.\n */\nexport type KycVendor = 'moonpay';\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session.\n * - `check` — running the invisible connection-check frame.\n * - `auth` — running the visible authentication (OTP) frame.\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`.\n * - `submit` — submitting the KYC-required check.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub`. When KYC is\n *   required, the document-verification sub-flow is launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a session is\n * created.\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}
+{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for Money\n * toast / banner rendering. Collapses Iron + SumSub / relay state into the\n * offsite contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or posting consents\n *   (Iron).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Iron skips this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a session is\n * created.\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}

package/dist/types.d.cts

@@ -7,27 +7,65 @@
  */
 /**
  * A MetaMask feature that consumes KYC. Used to key the per-product
- * "is KYC required" cache so ramps and card can share one controller.
+ * "is KYC required" cache so ramps, card, and money can share one controller.
  */
-export type KycProduct = 'ramps' | 'card';
+export type KycProduct = 'ramps' | 'card' | 'money';
 /**
  * Identity vendors supported behind the KYC surface.
+ *
+ * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.
+ * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →
+ *   SumSub, with no MoonPay Check/Auth frames.
+ */
+export type KycVendor = 'moonpay' | 'iron';
+/**
+ * Vendor-scoped identity for the currently authenticated KYC customer.
+ *
+ * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to
+ * downstream provider calls without reading the full KYC state, which also
+ * holds session/access tokens. The identifier is session-scoped: it is only
+ * available once the customer has authenticated through the current flow and
+ * is cleared on `reset()`.
  */
-export type KycVendor = 'moonpay';
+export type KycCustomerIdentity = {
+    /** The identity vendor that issued {@link KycCustomerIdentity.id}. */
+    vendor: KycVendor;
+    /** The vendor customer id (e.g. MoonPay customer UUID). */
+    id: string;
+};
+/**
+ * User-keyed KYC status returned by `GET /kyc/status` and stored for Money
+ * toast / banner rendering. Collapses Iron + SumSub / relay state into the
+ * offsite contract.
+ */
+export type KycUserStatus = 'not-started' | 'pending' | 'need-more-information' | 'terminal-failure' | 'completed';
+/**
+ * Payload from `GET /kyc/status`, including optional fields that power the
+ * 3-state error contract (retryable SumSub vs terminal vs EDD).
+ */
+export type KycUserStatusResponse = {
+    status: KycUserStatus;
+    /** Present when the user can reopen a SumSub session (retryable path). */
+    sumsubSessionId?: string;
+    /** Machine-readable error code for terminal / EDD UX. */
+    errorCode?: string;
+};
 /**
  * Phases of the end-to-end identity flow.
  *
  * - `idle` — nothing started.
  * - `terms` — waiting for the customer to accept the vendor terms.
- * - `session` — creating the vendor session.
- * - `check` — running the invisible connection-check frame.
- * - `auth` — running the visible authentication (OTP) frame.
+ * - `session` — creating the vendor session (MoonPay) or posting consents
+ *   (Iron).
+ * - `check` — running the invisible connection-check frame (MoonPay only).
+ * - `auth` — running the visible authentication (OTP) frame (MoonPay only).
  * - `form` — authenticated. When the flow is scoped to a product, the
  *   KYC-required check runs automatically from here; otherwise the consumer
- *   drives it manually via `checkKycRequired`.
- * - `submit` — submitting the KYC-required check.
- * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub`. When KYC is
- *   required, the document-verification sub-flow is launched automatically.
+ *   drives it manually via `checkKycRequired`. Iron skips this phase.
+ * - `submit` — submitting the KYC-required check / launching SumSub.
+ * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /
+ *   `userStatus`. When KYC is required, the document-verification sub-flow is
+ *   launched automatically.
  * - `error` — flow halted; see `error`.
  */
 export type KycPhase = 'idle' | 'terms' | 'session' | 'check' | 'auth' | 'form' | 'submit' | 'done' | 'error';

package/dist/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}
+{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}

package/dist/types.d.mts

@@ -7,27 +7,65 @@
  */
 /**
  * A MetaMask feature that consumes KYC. Used to key the per-product
- * "is KYC required" cache so ramps and card can share one controller.
+ * "is KYC required" cache so ramps, card, and money can share one controller.
  */
-export type KycProduct = 'ramps' | 'card';
+export type KycProduct = 'ramps' | 'card' | 'money';
 /**
  * Identity vendors supported behind the KYC surface.
+ *
+ * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.
+ * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →
+ *   SumSub, with no MoonPay Check/Auth frames.
+ */
+export type KycVendor = 'moonpay' | 'iron';
+/**
+ * Vendor-scoped identity for the currently authenticated KYC customer.
+ *
+ * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to
+ * downstream provider calls without reading the full KYC state, which also
+ * holds session/access tokens. The identifier is session-scoped: it is only
+ * available once the customer has authenticated through the current flow and
+ * is cleared on `reset()`.
  */
-export type KycVendor = 'moonpay';
+export type KycCustomerIdentity = {
+    /** The identity vendor that issued {@link KycCustomerIdentity.id}. */
+    vendor: KycVendor;
+    /** The vendor customer id (e.g. MoonPay customer UUID). */
+    id: string;
+};
+/**
+ * User-keyed KYC status returned by `GET /kyc/status` and stored for Money
+ * toast / banner rendering. Collapses Iron + SumSub / relay state into the
+ * offsite contract.
+ */
+export type KycUserStatus = 'not-started' | 'pending' | 'need-more-information' | 'terminal-failure' | 'completed';
+/**
+ * Payload from `GET /kyc/status`, including optional fields that power the
+ * 3-state error contract (retryable SumSub vs terminal vs EDD).
+ */
+export type KycUserStatusResponse = {
+    status: KycUserStatus;
+    /** Present when the user can reopen a SumSub session (retryable path). */
+    sumsubSessionId?: string;
+    /** Machine-readable error code for terminal / EDD UX. */
+    errorCode?: string;
+};
 /**
  * Phases of the end-to-end identity flow.
  *
  * - `idle` — nothing started.
  * - `terms` — waiting for the customer to accept the vendor terms.
- * - `session` — creating the vendor session.
- * - `check` — running the invisible connection-check frame.
- * - `auth` — running the visible authentication (OTP) frame.
+ * - `session` — creating the vendor session (MoonPay) or posting consents
+ *   (Iron).
+ * - `check` — running the invisible connection-check frame (MoonPay only).
+ * - `auth` — running the visible authentication (OTP) frame (MoonPay only).
  * - `form` — authenticated. When the flow is scoped to a product, the
  *   KYC-required check runs automatically from here; otherwise the consumer
- *   drives it manually via `checkKycRequired`.
- * - `submit` — submitting the KYC-required check.
- * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub`. When KYC is
- *   required, the document-verification sub-flow is launched automatically.
+ *   drives it manually via `checkKycRequired`. Iron skips this phase.
+ * - `submit` — submitting the KYC-required check / launching SumSub.
+ * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /
+ *   `userStatus`. When KYC is required, the document-verification sub-flow is
+ *   launched automatically.
  * - `error` — flow halted; see `error`.
  */
 export type KycPhase = 'idle' | 'terms' | 'session' | 'check' | 'auth' | 'form' | 'submit' | 'done' | 'error';

package/dist/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}

package/dist/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps and card can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card';\n\n/**\n * Identity vendors supported behind the KYC surface.\n */\nexport type KycVendor = 'moonpay';\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session.\n * - `check` — running the invisible connection-check frame.\n * - `auth` — running the visible authentication (OTP) frame.\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`.\n * - `submit` — submitting the KYC-required check.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub`. When KYC is\n *   required, the document-verification sub-flow is launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a session is\n * created.\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}
+{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for Money\n * toast / banner rendering. Collapses Iron + SumSub / relay state into the\n * offsite contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or posting consents\n *   (Iron).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Iron skips this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a session is\n * created.\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}

package/dist/ukyc/deriveClientMaterial.cjs

@@ -5,8 +5,8 @@ const utils_1 = require("@metamask/utils");
 const ed25519_1 = require("@noble/curves/ed25519");
 const hkdf_1 = require("@noble/hashes/hkdf");
 const sha2_1 = require("@noble/hashes/sha2");
-const constants_js_1 = require("./constants.cjs");
 const encoding_js_1 = require("../encoding.cjs");
+const constants_js_1 = require("./constants.cjs");
 /**
  * Derives a single labeled value from `local_user_secret`.
  *

package/dist/ukyc/deriveClientMaterial.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deriveClientMaterial.cjs","sourceRoot":"","sources":["../../src/ukyc/deriveClientMaterial.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,mDAAgD;AAChD,6CAA0C;AAC1C,6CAA4C;AAE5C,kDAAuE;AACvE,iDAA6C;AAsC7C;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,eAA2B,EAC3B,IAAY,EACZ,MAAc;IAEd,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,eAAe,EAAE,SAAS,EAAE,IAAA,qBAAa,EAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,oBAAoB,CAClC,eAA2B;IAE3B,MAAM,SAAS,GAAG,aAAa,CAC7B,eAAe,EACf,4BAAa,CAAC,SAAS,EACvB,qCAAsB,CAAC,SAAS,CACjC,CAAC;IAEF,MAAM,iBAAiB,GAAG,aAAa,CACrC,eAAe,EACf,4BAAa,CAAC,iBAAiB,EAC/B,qCAAsB,CAAC,iBAAiB,CACzC,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAC9B,eAAe,EACf,4BAAa,CAAC,UAAU,EACxB,qCAAsB,CAAC,UAAU,CAClC,CAAC;IAEF,MAAM,cAAc,GAAG,aAAa,CAClC,eAAe,EACf,4BAAa,CAAC,cAAc,EAC5B,qCAAsB,CAAC,cAAc,CACtC,CAAC;IAEF,MAAM,gBAAgB,GAAG,iBAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;KACf,CAAC;AACJ,CAAC;AApCD,oDAoCC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,QAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,SAAS,CAAC;QAC1C,gBAAgB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,gBAAgB,CAAC;KACzD,CAAC;AACJ,CAAC;AAPD,oDAOC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from './constants.js';\nimport { toBase64Url } from '../encoding.js';\n\n/**\n * Derives UKYC client material from the root `local_user_secret` using\n * HKDF-SHA256 with domain-separated `info` labels — see the architecture doc,\n * section \"Client-Derived Material\".\n */\n\n/**\n * The set of values derived from `local_user_secret`.\n */\nexport type UkycClientMaterial = {\n  /** Opaque lookup key for the encrypted KYC object. */\n  storageId: Uint8Array;\n  /** Symmetric key that encrypts `encrypted_kyc_data` (or wraps per-blob keys). */\n  dataEncryptionKey: Uint8Array;\n  /**\n   * Ed25519 private key used to sign `storage_access_token` capabilities. For\n   * Ed25519 the 32-byte HKDF output *is* the private key. The private half\n   * never leaves the device.\n   */\n  signingKey: Uint8Array;\n  /** Public half of `signingKey`, registered with the object on first write. */\n  signingPublicKey: Uint8Array;\n  /** Key for establishing/authenticating the encrypted tunnel to idOS, if needed. */\n  relayTunnelKey: Uint8Array;\n};\n\n/**\n * The same material with byte fields base64url-encoded, matching the wire\n * shapes in the architecture doc (`storage_id` as an opaque id, public key as a\n * \"base64url public key\"). Secret material is intentionally omitted.\n */\nexport type EncodedUkycClientMaterial = {\n  storageId: string;\n  signingPublicKey: string;\n};\n\n/**\n * Derives a single labeled value from `local_user_secret`.\n *\n * No salt is used: `local_user_secret` is already a high-entropy\n * uniformly-random secret, so per-output domain separation comes entirely from\n * the `info` label.\n *\n * @param localUserSecret - The root `local_user_secret` bytes.\n * @param info - Domain-separation label for this output.\n * @param length - Desired output length in bytes.\n * @returns The derived bytes.\n */\nfunction deriveLabeled(\n  localUserSecret: Uint8Array,\n  info: string,\n  length: number,\n): Uint8Array {\n  return hkdf(sha256, localUserSecret, undefined, stringToBytes(info), length);\n}\n\n/**\n * Derives all UKYC client material from the root `local_user_secret`.\n *\n * This is a pure function of `local_user_secret`: the same input always yields\n * the same outputs, which is what makes `storage_id` and `signing_key` stable\n * across sessions and devices.\n *\n * @param localUserSecret - The `local_user_secret` produced by\n * `getOrCreateLocalUserSecret`.\n * @returns The derived {@link UkycClientMaterial}.\n */\nexport function deriveClientMaterial(\n  localUserSecret: Uint8Array,\n): UkycClientMaterial {\n  const storageId = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.storageId,\n    UKYC_DERIVED_KEY_SIZES.storageId,\n  );\n\n  const dataEncryptionKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.dataEncryptionKey,\n    UKYC_DERIVED_KEY_SIZES.dataEncryptionKey,\n  );\n\n  const signingKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.signingKey,\n    UKYC_DERIVED_KEY_SIZES.signingKey,\n  );\n\n  const relayTunnelKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.relayTunnelKey,\n    UKYC_DERIVED_KEY_SIZES.relayTunnelKey,\n  );\n\n  const signingPublicKey = ed25519.getPublicKey(signingKey);\n\n  return {\n    storageId,\n    dataEncryptionKey,\n    signingKey,\n    signingPublicKey,\n    relayTunnelKey,\n  };\n}\n\n/**\n * Encodes the non-secret client material into the base64url wire shapes used by\n * the UKYC storage API (`storage_id` and `signing_public_key`).\n *\n * @param material - The derived client material.\n * @returns The base64url-encoded, non-secret fields.\n */\nexport function encodeClientMaterial(\n  material: UkycClientMaterial,\n): EncodedUkycClientMaterial {\n  return {\n    storageId: toBase64Url(material.storageId),\n    signingPublicKey: toBase64Url(material.signingPublicKey),\n  };\n}\n"]}
+{"version":3,"file":"deriveClientMaterial.cjs","sourceRoot":"","sources":["../../src/ukyc/deriveClientMaterial.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,mDAAgD;AAChD,6CAA0C;AAC1C,6CAA4C;AAE5C,iDAA6C;AAC7C,kDAAuE;AAsCvE;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,eAA2B,EAC3B,IAAY,EACZ,MAAc;IAEd,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,eAAe,EAAE,SAAS,EAAE,IAAA,qBAAa,EAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,oBAAoB,CAClC,eAA2B;IAE3B,MAAM,SAAS,GAAG,aAAa,CAC7B,eAAe,EACf,4BAAa,CAAC,SAAS,EACvB,qCAAsB,CAAC,SAAS,CACjC,CAAC;IAEF,MAAM,iBAAiB,GAAG,aAAa,CACrC,eAAe,EACf,4BAAa,CAAC,iBAAiB,EAC/B,qCAAsB,CAAC,iBAAiB,CACzC,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAC9B,eAAe,EACf,4BAAa,CAAC,UAAU,EACxB,qCAAsB,CAAC,UAAU,CAClC,CAAC;IAEF,MAAM,cAAc,GAAG,aAAa,CAClC,eAAe,EACf,4BAAa,CAAC,cAAc,EAC5B,qCAAsB,CAAC,cAAc,CACtC,CAAC;IAEF,MAAM,gBAAgB,GAAG,iBAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;KACf,CAAC;AACJ,CAAC;AApCD,oDAoCC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,QAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,SAAS,CAAC;QAC1C,gBAAgB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,gBAAgB,CAAC;KACzD,CAAC;AACJ,CAAC;AAPD,oDAOC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { toBase64Url } from '../encoding.js';\nimport { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from './constants.js';\n\n/**\n * Derives UKYC client material from the root `local_user_secret` using\n * HKDF-SHA256 with domain-separated `info` labels — see the architecture doc,\n * section \"Client-Derived Material\".\n */\n\n/**\n * The set of values derived from `local_user_secret`.\n */\nexport type UkycClientMaterial = {\n  /** Opaque lookup key for the encrypted KYC object. */\n  storageId: Uint8Array;\n  /** Symmetric key that encrypts `encrypted_kyc_data` (or wraps per-blob keys). */\n  dataEncryptionKey: Uint8Array;\n  /**\n   * Ed25519 private key used to sign `storage_access_token` capabilities. For\n   * Ed25519 the 32-byte HKDF output *is* the private key. The private half\n   * never leaves the device.\n   */\n  signingKey: Uint8Array;\n  /** Public half of `signingKey`, registered with the object on first write. */\n  signingPublicKey: Uint8Array;\n  /** Key for establishing/authenticating the encrypted tunnel to idOS, if needed. */\n  relayTunnelKey: Uint8Array;\n};\n\n/**\n * The same material with byte fields base64url-encoded, matching the wire\n * shapes in the architecture doc (`storage_id` as an opaque id, public key as a\n * \"base64url public key\"). Secret material is intentionally omitted.\n */\nexport type EncodedUkycClientMaterial = {\n  storageId: string;\n  signingPublicKey: string;\n};\n\n/**\n * Derives a single labeled value from `local_user_secret`.\n *\n * No salt is used: `local_user_secret` is already a high-entropy\n * uniformly-random secret, so per-output domain separation comes entirely from\n * the `info` label.\n *\n * @param localUserSecret - The root `local_user_secret` bytes.\n * @param info - Domain-separation label for this output.\n * @param length - Desired output length in bytes.\n * @returns The derived bytes.\n */\nfunction deriveLabeled(\n  localUserSecret: Uint8Array,\n  info: string,\n  length: number,\n): Uint8Array {\n  return hkdf(sha256, localUserSecret, undefined, stringToBytes(info), length);\n}\n\n/**\n * Derives all UKYC client material from the root `local_user_secret`.\n *\n * This is a pure function of `local_user_secret`: the same input always yields\n * the same outputs, which is what makes `storage_id` and `signing_key` stable\n * across sessions and devices.\n *\n * @param localUserSecret - The `local_user_secret` produced by\n * `getOrCreateLocalUserSecret`.\n * @returns The derived {@link UkycClientMaterial}.\n */\nexport function deriveClientMaterial(\n  localUserSecret: Uint8Array,\n): UkycClientMaterial {\n  const storageId = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.storageId,\n    UKYC_DERIVED_KEY_SIZES.storageId,\n  );\n\n  const dataEncryptionKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.dataEncryptionKey,\n    UKYC_DERIVED_KEY_SIZES.dataEncryptionKey,\n  );\n\n  const signingKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.signingKey,\n    UKYC_DERIVED_KEY_SIZES.signingKey,\n  );\n\n  const relayTunnelKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.relayTunnelKey,\n    UKYC_DERIVED_KEY_SIZES.relayTunnelKey,\n  );\n\n  const signingPublicKey = ed25519.getPublicKey(signingKey);\n\n  return {\n    storageId,\n    dataEncryptionKey,\n    signingKey,\n    signingPublicKey,\n    relayTunnelKey,\n  };\n}\n\n/**\n * Encodes the non-secret client material into the base64url wire shapes used by\n * the UKYC storage API (`storage_id` and `signing_public_key`).\n *\n * @param material - The derived client material.\n * @returns The base64url-encoded, non-secret fields.\n */\nexport function encodeClientMaterial(\n  material: UkycClientMaterial,\n): EncodedUkycClientMaterial {\n  return {\n    storageId: toBase64Url(material.storageId),\n    signingPublicKey: toBase64Url(material.signingPublicKey),\n  };\n}\n"]}

package/dist/ukyc/deriveClientMaterial.mjs

@@ -2,8 +2,8 @@ import { stringToBytes } from "@metamask/utils";
 import { ed25519 } from "@noble/curves/ed25519";
 import { hkdf } from "@noble/hashes/hkdf";
 import { sha256 } from "@noble/hashes/sha2";
-import { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from "./constants.mjs";
 import { toBase64Url } from "../encoding.mjs";
+import { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from "./constants.mjs";
 /**
  * Derives a single labeled value from `local_user_secret`.
  *

package/dist/ukyc/deriveClientMaterial.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deriveClientMaterial.mjs","sourceRoot":"","sources":["../../src/ukyc/deriveClientMaterial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB;AAChD,OAAO,EAAE,OAAO,EAAE,8BAA8B;AAChD,OAAO,EAAE,IAAI,EAAE,2BAA2B;AAC1C,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,wBAAuB;AACvE,OAAO,EAAE,WAAW,EAAE,wBAAuB;AAsC7C;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,eAA2B,EAC3B,IAAY,EACZ,MAAc;IAEd,OAAO,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAA2B;IAE3B,MAAM,SAAS,GAAG,aAAa,CAC7B,eAAe,EACf,aAAa,CAAC,SAAS,EACvB,sBAAsB,CAAC,SAAS,CACjC,CAAC;IAEF,MAAM,iBAAiB,GAAG,aAAa,CACrC,eAAe,EACf,aAAa,CAAC,iBAAiB,EAC/B,sBAAsB,CAAC,iBAAiB,CACzC,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAC9B,eAAe,EACf,aAAa,CAAC,UAAU,EACxB,sBAAsB,CAAC,UAAU,CAClC,CAAC;IAEF,MAAM,cAAc,GAAG,aAAa,CAClC,eAAe,EACf,aAAa,CAAC,cAAc,EAC5B,sBAAsB,CAAC,cAAc,CACtC,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1C,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KACzD,CAAC;AACJ,CAAC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from './constants.js';\nimport { toBase64Url } from '../encoding.js';\n\n/**\n * Derives UKYC client material from the root `local_user_secret` using\n * HKDF-SHA256 with domain-separated `info` labels — see the architecture doc,\n * section \"Client-Derived Material\".\n */\n\n/**\n * The set of values derived from `local_user_secret`.\n */\nexport type UkycClientMaterial = {\n  /** Opaque lookup key for the encrypted KYC object. */\n  storageId: Uint8Array;\n  /** Symmetric key that encrypts `encrypted_kyc_data` (or wraps per-blob keys). */\n  dataEncryptionKey: Uint8Array;\n  /**\n   * Ed25519 private key used to sign `storage_access_token` capabilities. For\n   * Ed25519 the 32-byte HKDF output *is* the private key. The private half\n   * never leaves the device.\n   */\n  signingKey: Uint8Array;\n  /** Public half of `signingKey`, registered with the object on first write. */\n  signingPublicKey: Uint8Array;\n  /** Key for establishing/authenticating the encrypted tunnel to idOS, if needed. */\n  relayTunnelKey: Uint8Array;\n};\n\n/**\n * The same material with byte fields base64url-encoded, matching the wire\n * shapes in the architecture doc (`storage_id` as an opaque id, public key as a\n * \"base64url public key\"). Secret material is intentionally omitted.\n */\nexport type EncodedUkycClientMaterial = {\n  storageId: string;\n  signingPublicKey: string;\n};\n\n/**\n * Derives a single labeled value from `local_user_secret`.\n *\n * No salt is used: `local_user_secret` is already a high-entropy\n * uniformly-random secret, so per-output domain separation comes entirely from\n * the `info` label.\n *\n * @param localUserSecret - The root `local_user_secret` bytes.\n * @param info - Domain-separation label for this output.\n * @param length - Desired output length in bytes.\n * @returns The derived bytes.\n */\nfunction deriveLabeled(\n  localUserSecret: Uint8Array,\n  info: string,\n  length: number,\n): Uint8Array {\n  return hkdf(sha256, localUserSecret, undefined, stringToBytes(info), length);\n}\n\n/**\n * Derives all UKYC client material from the root `local_user_secret`.\n *\n * This is a pure function of `local_user_secret`: the same input always yields\n * the same outputs, which is what makes `storage_id` and `signing_key` stable\n * across sessions and devices.\n *\n * @param localUserSecret - The `local_user_secret` produced by\n * `getOrCreateLocalUserSecret`.\n * @returns The derived {@link UkycClientMaterial}.\n */\nexport function deriveClientMaterial(\n  localUserSecret: Uint8Array,\n): UkycClientMaterial {\n  const storageId = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.storageId,\n    UKYC_DERIVED_KEY_SIZES.storageId,\n  );\n\n  const dataEncryptionKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.dataEncryptionKey,\n    UKYC_DERIVED_KEY_SIZES.dataEncryptionKey,\n  );\n\n  const signingKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.signingKey,\n    UKYC_DERIVED_KEY_SIZES.signingKey,\n  );\n\n  const relayTunnelKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.relayTunnelKey,\n    UKYC_DERIVED_KEY_SIZES.relayTunnelKey,\n  );\n\n  const signingPublicKey = ed25519.getPublicKey(signingKey);\n\n  return {\n    storageId,\n    dataEncryptionKey,\n    signingKey,\n    signingPublicKey,\n    relayTunnelKey,\n  };\n}\n\n/**\n * Encodes the non-secret client material into the base64url wire shapes used by\n * the UKYC storage API (`storage_id` and `signing_public_key`).\n *\n * @param material - The derived client material.\n * @returns The base64url-encoded, non-secret fields.\n */\nexport function encodeClientMaterial(\n  material: UkycClientMaterial,\n): EncodedUkycClientMaterial {\n  return {\n    storageId: toBase64Url(material.storageId),\n    signingPublicKey: toBase64Url(material.signingPublicKey),\n  };\n}\n"]}
+{"version":3,"file":"deriveClientMaterial.mjs","sourceRoot":"","sources":["../../src/ukyc/deriveClientMaterial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB;AAChD,OAAO,EAAE,OAAO,EAAE,8BAA8B;AAChD,OAAO,EAAE,IAAI,EAAE,2BAA2B;AAC1C,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,OAAO,EAAE,WAAW,EAAE,wBAAuB;AAC7C,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,wBAAuB;AAsCvE;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,eAA2B,EAC3B,IAAY,EACZ,MAAc;IAEd,OAAO,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAA2B;IAE3B,MAAM,SAAS,GAAG,aAAa,CAC7B,eAAe,EACf,aAAa,CAAC,SAAS,EACvB,sBAAsB,CAAC,SAAS,CACjC,CAAC;IAEF,MAAM,iBAAiB,GAAG,aAAa,CACrC,eAAe,EACf,aAAa,CAAC,iBAAiB,EAC/B,sBAAsB,CAAC,iBAAiB,CACzC,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAC9B,eAAe,EACf,aAAa,CAAC,UAAU,EACxB,sBAAsB,CAAC,UAAU,CAClC,CAAC;IAEF,MAAM,cAAc,GAAG,aAAa,CAClC,eAAe,EACf,aAAa,CAAC,cAAc,EAC5B,sBAAsB,CAAC,cAAc,CACtC,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1C,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KACzD,CAAC;AACJ,CAAC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { toBase64Url } from '../encoding.js';\nimport { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from './constants.js';\n\n/**\n * Derives UKYC client material from the root `local_user_secret` using\n * HKDF-SHA256 with domain-separated `info` labels — see the architecture doc,\n * section \"Client-Derived Material\".\n */\n\n/**\n * The set of values derived from `local_user_secret`.\n */\nexport type UkycClientMaterial = {\n  /** Opaque lookup key for the encrypted KYC object. */\n  storageId: Uint8Array;\n  /** Symmetric key that encrypts `encrypted_kyc_data` (or wraps per-blob keys). */\n  dataEncryptionKey: Uint8Array;\n  /**\n   * Ed25519 private key used to sign `storage_access_token` capabilities. For\n   * Ed25519 the 32-byte HKDF output *is* the private key. The private half\n   * never leaves the device.\n   */\n  signingKey: Uint8Array;\n  /** Public half of `signingKey`, registered with the object on first write. */\n  signingPublicKey: Uint8Array;\n  /** Key for establishing/authenticating the encrypted tunnel to idOS, if needed. */\n  relayTunnelKey: Uint8Array;\n};\n\n/**\n * The same material with byte fields base64url-encoded, matching the wire\n * shapes in the architecture doc (`storage_id` as an opaque id, public key as a\n * \"base64url public key\"). Secret material is intentionally omitted.\n */\nexport type EncodedUkycClientMaterial = {\n  storageId: string;\n  signingPublicKey: string;\n};\n\n/**\n * Derives a single labeled value from `local_user_secret`.\n *\n * No salt is used: `local_user_secret` is already a high-entropy\n * uniformly-random secret, so per-output domain separation comes entirely from\n * the `info` label.\n *\n * @param localUserSecret - The root `local_user_secret` bytes.\n * @param info - Domain-separation label for this output.\n * @param length - Desired output length in bytes.\n * @returns The derived bytes.\n */\nfunction deriveLabeled(\n  localUserSecret: Uint8Array,\n  info: string,\n  length: number,\n): Uint8Array {\n  return hkdf(sha256, localUserSecret, undefined, stringToBytes(info), length);\n}\n\n/**\n * Derives all UKYC client material from the root `local_user_secret`.\n *\n * This is a pure function of `local_user_secret`: the same input always yields\n * the same outputs, which is what makes `storage_id` and `signing_key` stable\n * across sessions and devices.\n *\n * @param localUserSecret - The `local_user_secret` produced by\n * `getOrCreateLocalUserSecret`.\n * @returns The derived {@link UkycClientMaterial}.\n */\nexport function deriveClientMaterial(\n  localUserSecret: Uint8Array,\n): UkycClientMaterial {\n  const storageId = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.storageId,\n    UKYC_DERIVED_KEY_SIZES.storageId,\n  );\n\n  const dataEncryptionKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.dataEncryptionKey,\n    UKYC_DERIVED_KEY_SIZES.dataEncryptionKey,\n  );\n\n  const signingKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.signingKey,\n    UKYC_DERIVED_KEY_SIZES.signingKey,\n  );\n\n  const relayTunnelKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.relayTunnelKey,\n    UKYC_DERIVED_KEY_SIZES.relayTunnelKey,\n  );\n\n  const signingPublicKey = ed25519.getPublicKey(signingKey);\n\n  return {\n    storageId,\n    dataEncryptionKey,\n    signingKey,\n    signingPublicKey,\n    relayTunnelKey,\n  };\n}\n\n/**\n * Encodes the non-secret client material into the base64url wire shapes used by\n * the UKYC storage API (`storage_id` and `signing_public_key`).\n *\n * @param material - The derived client material.\n * @returns The base64url-encoded, non-secret fields.\n */\nexport function encodeClientMaterial(\n  material: UkycClientMaterial,\n): EncodedUkycClientMaterial {\n  return {\n    storageId: toBase64Url(material.storageId),\n    signingPublicKey: toBase64Url(material.signingPublicKey),\n  };\n}\n"]}

package/dist/ukyc/storageAccessToken.cjs

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.encodeStorageAccessTokenForHeader = exports.signStorageAccessToken = exports.canonicalizeJson = void 0;
 const utils_1 = require("@metamask/utils");
 const ed25519_1 = require("@noble/curves/ed25519");
-const constants_js_1 = require("./constants.cjs");
 const encoding_js_1 = require("../encoding.cjs");
+const constants_js_1 = require("./constants.cjs");
 /**
  * Serializes a JSON value to RFC 8785 (JCS) canonical form.
  *

package/dist/ukyc/storageAccessToken.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"storageAccessToken.cjs","sourceRoot":"","sources":["../../src/ukyc/storageAccessToken.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,mDAAgD;AAEhD,kDAGwB;AAExB,iDAA6C;AAiF7C;;;;;;;;;;;;;GAaG;AACH,SAAgB,gBAAgB,CAAC,KAAgB;IAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC/B,IAAI,EAAE;SACN,MAAM,CAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;IAET,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AArCD,4CAqCC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAU;IAClC,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,MAAoC;IAEpC,MAAM,EACJ,QAAQ,EACR,UAAU,EACV,SAAS,GAAG,QAAQ,EACpB,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,EACrB,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,SAAS,KAAK,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkC;QAC7C,OAAO,EAAE,gDAAiC;QAC1C,GAAG,EAAE,CAAC,GAAG,kDAAmC,CAAC;QAC7C,UAAU,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,kBAAkB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,UAAU;QACV,SAAS;QACT,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACxC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,qBAAa,EAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,iBAAO,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE7D,OAAO;QACL,OAAO;QACP,SAAS,EAAE,IAAA,yBAAW,EAAC,SAAS,CAAC;KAClC,CAAC;AACJ,CAAC;AA1DD,wDA0DC;AAED;;;;;;;;GAQG;AACH,SAAgB,iCAAiC,CAC/C,KAA6B;IAE7B,OAAO,IAAA,yBAAW,EAAC,IAAA,qBAAa,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAJD,8EAIC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,UAAkC;IAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport {\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './constants.js';\nimport type { UkycClientMaterial } from './deriveClientMaterial.js';\nimport { toBase64Url } from '../encoding.js';\n\n/**\n * Mints `storage_access_token` capabilities — the client-signed, scoped,\n * session-bound proofs that authorize UKYC storage operations. See the\n * architecture doc, section \"Storage Authentication\".\n *\n * The token is Ed25519 over RFC 8785 (JCS) canonical JSON of the payload. Only\n * the client holds the private `signing_key`, so only the client can mint a\n * token; a `read`/`write`-scoped token may then be handed to the Relay to\n * present, but `delete` is never delegated.\n */\n\n/**\n * Storage operations a `storage_access_token` can authorize.\n */\nexport type UkycStorageOperation = 'read' | 'write' | 'delete';\n\n/**\n * Who presents the token to UKYC storage. The Relay may only present\n * `read`/`write` tokens; `delete` is always client-presented.\n */\nexport type UkycTokenPresenter = 'client' | 'idos-relay';\n\n/**\n * The signed `storage_access_token` payload. Field names are snake_case because\n * they are canonicalized and hashed exactly as they appear on the wire.\n */\nexport type UkycStorageAccessTokenPayload = {\n  version: number;\n  /** Every verifier that may accept the token, e.g. UKYC Storage and idOS Kwil. */\n  aud: string[];\n  // Wire-shape fields are snake_case; they are canonicalized and signed exactly\n  // as they appear on the wire.\n  /* eslint-disable @typescript-eslint/naming-convention */\n  storage_id: string;\n  signing_public_key: string;\n  operations: UkycStorageOperation[];\n  presenter: UkycTokenPresenter;\n  /** UKYC session id. Required (and only present) when presenter is `idos-relay`. */\n  session_id?: string;\n  issued_at: string;\n  expires_at: string;\n  /* eslint-enable @typescript-eslint/naming-convention */\n};\n\n/**\n * The on-the-wire envelope: the payload plus its detached Ed25519 signature\n * (base64url) over the JCS canonicalization of the payload.\n */\nexport type UkycStorageAccessToken = {\n  payload: UkycStorageAccessTokenPayload;\n  signature: string;\n};\n\n/**\n * Inputs for minting a `storage_access_token`.\n */\nexport type SignStorageAccessTokenParams = {\n  /** Client material derived from `local_user_secret`. */\n  material: UkycClientMaterial;\n  /** Operations the token authorizes. `delete` must be the sole operation. */\n  operations: UkycStorageOperation[];\n  /** Who will present the token. Defaults to `client`. */\n  presenter?: UkycTokenPresenter;\n  /** UKYC session id. Required when presenter is `idos-relay`. */\n  sessionId?: string;\n  /** Token issue time. Defaults to now. */\n  issuedAt?: Date;\n  /** Token expiry. Must be strictly after `issuedAt`. */\n  expiresAt: Date;\n};\n\ntype JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { [key: string]: JsonValue | undefined };\n\n/**\n * Serializes a JSON value to RFC 8785 (JCS) canonical form.\n *\n * Scope note: this implementation covers the JSON shapes used by UKYC storage\n * payloads — objects, arrays, strings, integers, booleans, and null. Object\n * members are sorted by their UTF-16 code units (matching JS default string\n * ordering, which is what JCS requires) and `undefined` members are dropped.\n * Non-finite and non-integer numbers are rejected, since the payloads never\n * contain them and correct JCS number formatting for the general case is\n * intentionally out of scope here.\n *\n * @param value - The value to canonicalize.\n * @returns The canonical JSON string.\n */\nexport function canonicalizeJson(value: JsonValue): string {\n  if (value === null) {\n    return 'null';\n  }\n\n  if (typeof value === 'boolean') {\n    return value ? 'true' : 'false';\n  }\n\n  if (typeof value === 'number') {\n    if (!Number.isInteger(value)) {\n      throw new Error(\n        'UKYC: cannot canonicalize a non-integer number for JCS.',\n      );\n    }\n    return JSON.stringify(value);\n  }\n\n  if (typeof value === 'string') {\n    return JSON.stringify(value);\n  }\n\n  if (Array.isArray(value)) {\n    return `[${value.map((item) => canonicalizeJson(item)).join(',')}]`;\n  }\n\n  const entries = Object.keys(value)\n    .sort()\n    .reduce<string[]>((acc, key) => {\n      const child = value[key];\n      if (child !== undefined) {\n        acc.push(`${JSON.stringify(key)}:${canonicalizeJson(child)}`);\n      }\n      return acc;\n    }, []);\n\n  return `{${entries.join(',')}}`;\n}\n\n/**\n * Formats a date as RFC 3339 UTC with whole-second precision (e.g.\n * `2026-07-07T00:00:00Z`). `Date.prototype.toISOString` always emits\n * milliseconds (`...:00.000Z`); the `storage_access_token` wire format omits\n * fractional seconds, so the sub-second component is truncated (not rounded).\n *\n * @param date - The date to format.\n * @returns The RFC 3339 timestamp without fractional seconds.\n */\nfunction toRfc3339Seconds(date: Date): string {\n  return `${date.toISOString().slice(0, 19)}Z`;\n}\n\n/**\n * Builds and signs a `storage_access_token`.\n *\n * @param params - See {@link SignStorageAccessTokenParams}.\n * @returns The signed token envelope.\n */\nexport function signStorageAccessToken(\n  params: SignStorageAccessTokenParams,\n): UkycStorageAccessToken {\n  const {\n    material,\n    operations,\n    presenter = 'client',\n    sessionId,\n    issuedAt = new Date(),\n    expiresAt,\n  } = params;\n\n  assertValidOperations(operations);\n\n  if (expiresAt.getTime() <= issuedAt.getTime()) {\n    throw new Error(\n      'UKYC: storage_access_token expires_at must be after issued_at.',\n    );\n  }\n\n  const isDelete = operations.includes('delete');\n\n  if (presenter === 'idos-relay' && isDelete) {\n    throw new Error(\n      'UKYC: a delete-scoped storage_access_token cannot be delegated to the Relay.',\n    );\n  }\n\n  if (presenter === 'idos-relay' && !sessionId) {\n    throw new Error(\n      'UKYC: a Relay-presented storage_access_token requires a session_id.',\n    );\n  }\n\n  const payload: UkycStorageAccessTokenPayload = {\n    version: UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n    aud: [...UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES],\n    storage_id: toBase64Url(material.storageId),\n    signing_public_key: toBase64Url(material.signingPublicKey),\n    operations,\n    presenter,\n    issued_at: toRfc3339Seconds(issuedAt),\n    expires_at: toRfc3339Seconds(expiresAt),\n  };\n\n  // Only bind session_id for Relay-presented tokens; omit the key entirely for\n  // client-presented tokens so it does not appear in the canonicalized payload.\n  if (presenter === 'idos-relay') {\n    payload.session_id = sessionId;\n  }\n\n  const message = stringToBytes(canonicalizeJson(payload));\n  const signature = ed25519.sign(message, material.signingKey);\n\n  return {\n    payload,\n    signature: toBase64Url(signature),\n  };\n}\n\n/**\n * Serializes a signed token to a compact string suitable for header transport\n * (`Authorization: AccessToken <token>`, see `UKYC_CAPABILITY_AUTH_SCHEME`). The\n * complete envelope is base64url-encoded; the private `signing_key` is never\n * included.\n *\n * @param token - The signed token envelope.\n * @returns The base64url-encoded envelope string.\n */\nexport function encodeStorageAccessTokenForHeader(\n  token: UkycStorageAccessToken,\n): string {\n  return toBase64Url(stringToBytes(JSON.stringify(token)));\n}\n\n/**\n * Validates that an operations list is one storage understands: a non-empty set\n * of `read`/`write`, or exactly `['delete']`. `delete` is never combined with\n * other operations.\n *\n * @param operations - The requested operations.\n */\nfunction assertValidOperations(operations: UkycStorageOperation[]): void {\n  if (operations.length === 0) {\n    throw new Error(\n      'UKYC: storage_access_token requires at least one operation.',\n    );\n  }\n\n  const unique = new Set(operations);\n\n  if (unique.size !== operations.length) {\n    throw new Error('UKYC: storage_access_token operations must be unique.');\n  }\n\n  if (unique.has('delete') && operations.length > 1) {\n    throw new Error(\n      'UKYC: a delete-scoped storage_access_token must contain only \"delete\".',\n    );\n  }\n}\n"]}
+{"version":3,"file":"storageAccessToken.cjs","sourceRoot":"","sources":["../../src/ukyc/storageAccessToken.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,mDAAgD;AAEhD,iDAA6C;AAC7C,kDAGwB;AAkFxB;;;;;;;;;;;;;GAaG;AACH,SAAgB,gBAAgB,CAAC,KAAgB;IAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC/B,IAAI,EAAE;SACN,MAAM,CAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;IAET,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AArCD,4CAqCC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAU;IAClC,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,MAAoC;IAEpC,MAAM,EACJ,QAAQ,EACR,UAAU,EACV,SAAS,GAAG,QAAQ,EACpB,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,EACrB,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,SAAS,KAAK,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkC;QAC7C,OAAO,EAAE,gDAAiC;QAC1C,GAAG,EAAE,CAAC,GAAG,kDAAmC,CAAC;QAC7C,UAAU,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,kBAAkB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,UAAU;QACV,SAAS;QACT,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACxC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,qBAAa,EAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,iBAAO,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE7D,OAAO;QACL,OAAO;QACP,SAAS,EAAE,IAAA,yBAAW,EAAC,SAAS,CAAC;KAClC,CAAC;AACJ,CAAC;AA1DD,wDA0DC;AAED;;;;;;;;GAQG;AACH,SAAgB,iCAAiC,CAC/C,KAA6B;IAE7B,OAAO,IAAA,yBAAW,EAAC,IAAA,qBAAa,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAJD,8EAIC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,UAAkC;IAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport { toBase64Url } from '../encoding.js';\nimport {\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './constants.js';\nimport type { UkycClientMaterial } from './deriveClientMaterial.js';\n\n/**\n * Mints `storage_access_token` capabilities — the client-signed, scoped,\n * session-bound proofs that authorize UKYC storage operations. See the\n * architecture doc, section \"Storage Authentication\".\n *\n * The token is Ed25519 over RFC 8785 (JCS) canonical JSON of the payload. Only\n * the client holds the private `signing_key`, so only the client can mint a\n * token; a `read`/`write`-scoped token may then be handed to the Relay to\n * present, but `delete` is never delegated.\n */\n\n/**\n * Storage operations a `storage_access_token` can authorize.\n */\nexport type UkycStorageOperation = 'read' | 'write' | 'delete';\n\n/**\n * Who presents the token to UKYC storage. The Relay may only present\n * `read`/`write` tokens; `delete` is always client-presented.\n */\nexport type UkycTokenPresenter = 'client' | 'idos-relay';\n\n/**\n * The signed `storage_access_token` payload. Field names are snake_case because\n * they are canonicalized and hashed exactly as they appear on the wire.\n */\nexport type UkycStorageAccessTokenPayload = {\n  version: number;\n  /** Every verifier that may accept the token, e.g. UKYC Storage and idOS Kwil. */\n  aud: string[];\n  // Wire-shape fields are snake_case; they are canonicalized and signed exactly\n  // as they appear on the wire.\n  /* eslint-disable @typescript-eslint/naming-convention */\n  storage_id: string;\n  signing_public_key: string;\n  operations: UkycStorageOperation[];\n  presenter: UkycTokenPresenter;\n  /** UKYC session id. Required (and only present) when presenter is `idos-relay`. */\n  session_id?: string;\n  issued_at: string;\n  expires_at: string;\n  /* eslint-enable @typescript-eslint/naming-convention */\n};\n\n/**\n * The on-the-wire envelope: the payload plus its detached Ed25519 signature\n * (base64url) over the JCS canonicalization of the payload.\n */\nexport type UkycStorageAccessToken = {\n  payload: UkycStorageAccessTokenPayload;\n  signature: string;\n};\n\n/**\n * Inputs for minting a `storage_access_token`.\n */\nexport type SignStorageAccessTokenParams = {\n  /** Client material derived from `local_user_secret`. */\n  material: UkycClientMaterial;\n  /** Operations the token authorizes. `delete` must be the sole operation. */\n  operations: UkycStorageOperation[];\n  /** Who will present the token. Defaults to `client`. */\n  presenter?: UkycTokenPresenter;\n  /** UKYC session id. Required when presenter is `idos-relay`. */\n  sessionId?: string;\n  /** Token issue time. Defaults to now. */\n  issuedAt?: Date;\n  /** Token expiry. Must be strictly after `issuedAt`. */\n  expiresAt: Date;\n};\n\ntype JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { [key: string]: JsonValue | undefined };\n\n/**\n * Serializes a JSON value to RFC 8785 (JCS) canonical form.\n *\n * Scope note: this implementation covers the JSON shapes used by UKYC storage\n * payloads — objects, arrays, strings, integers, booleans, and null. Object\n * members are sorted by their UTF-16 code units (matching JS default string\n * ordering, which is what JCS requires) and `undefined` members are dropped.\n * Non-finite and non-integer numbers are rejected, since the payloads never\n * contain them and correct JCS number formatting for the general case is\n * intentionally out of scope here.\n *\n * @param value - The value to canonicalize.\n * @returns The canonical JSON string.\n */\nexport function canonicalizeJson(value: JsonValue): string {\n  if (value === null) {\n    return 'null';\n  }\n\n  if (typeof value === 'boolean') {\n    return value ? 'true' : 'false';\n  }\n\n  if (typeof value === 'number') {\n    if (!Number.isInteger(value)) {\n      throw new Error(\n        'UKYC: cannot canonicalize a non-integer number for JCS.',\n      );\n    }\n    return JSON.stringify(value);\n  }\n\n  if (typeof value === 'string') {\n    return JSON.stringify(value);\n  }\n\n  if (Array.isArray(value)) {\n    return `[${value.map((item) => canonicalizeJson(item)).join(',')}]`;\n  }\n\n  const entries = Object.keys(value)\n    .sort()\n    .reduce<string[]>((acc, key) => {\n      const child = value[key];\n      if (child !== undefined) {\n        acc.push(`${JSON.stringify(key)}:${canonicalizeJson(child)}`);\n      }\n      return acc;\n    }, []);\n\n  return `{${entries.join(',')}}`;\n}\n\n/**\n * Formats a date as RFC 3339 UTC with whole-second precision (e.g.\n * `2026-07-07T00:00:00Z`). `Date.prototype.toISOString` always emits\n * milliseconds (`...:00.000Z`); the `storage_access_token` wire format omits\n * fractional seconds, so the sub-second component is truncated (not rounded).\n *\n * @param date - The date to format.\n * @returns The RFC 3339 timestamp without fractional seconds.\n */\nfunction toRfc3339Seconds(date: Date): string {\n  return `${date.toISOString().slice(0, 19)}Z`;\n}\n\n/**\n * Builds and signs a `storage_access_token`.\n *\n * @param params - See {@link SignStorageAccessTokenParams}.\n * @returns The signed token envelope.\n */\nexport function signStorageAccessToken(\n  params: SignStorageAccessTokenParams,\n): UkycStorageAccessToken {\n  const {\n    material,\n    operations,\n    presenter = 'client',\n    sessionId,\n    issuedAt = new Date(),\n    expiresAt,\n  } = params;\n\n  assertValidOperations(operations);\n\n  if (expiresAt.getTime() <= issuedAt.getTime()) {\n    throw new Error(\n      'UKYC: storage_access_token expires_at must be after issued_at.',\n    );\n  }\n\n  const isDelete = operations.includes('delete');\n\n  if (presenter === 'idos-relay' && isDelete) {\n    throw new Error(\n      'UKYC: a delete-scoped storage_access_token cannot be delegated to the Relay.',\n    );\n  }\n\n  if (presenter === 'idos-relay' && !sessionId) {\n    throw new Error(\n      'UKYC: a Relay-presented storage_access_token requires a session_id.',\n    );\n  }\n\n  const payload: UkycStorageAccessTokenPayload = {\n    version: UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n    aud: [...UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES],\n    storage_id: toBase64Url(material.storageId),\n    signing_public_key: toBase64Url(material.signingPublicKey),\n    operations,\n    presenter,\n    issued_at: toRfc3339Seconds(issuedAt),\n    expires_at: toRfc3339Seconds(expiresAt),\n  };\n\n  // Only bind session_id for Relay-presented tokens; omit the key entirely for\n  // client-presented tokens so it does not appear in the canonicalized payload.\n  if (presenter === 'idos-relay') {\n    payload.session_id = sessionId;\n  }\n\n  const message = stringToBytes(canonicalizeJson(payload));\n  const signature = ed25519.sign(message, material.signingKey);\n\n  return {\n    payload,\n    signature: toBase64Url(signature),\n  };\n}\n\n/**\n * Serializes a signed token to a compact string suitable for header transport\n * (`Authorization: AccessToken <token>`, see `UKYC_CAPABILITY_AUTH_SCHEME`). The\n * complete envelope is base64url-encoded; the private `signing_key` is never\n * included.\n *\n * @param token - The signed token envelope.\n * @returns The base64url-encoded envelope string.\n */\nexport function encodeStorageAccessTokenForHeader(\n  token: UkycStorageAccessToken,\n): string {\n  return toBase64Url(stringToBytes(JSON.stringify(token)));\n}\n\n/**\n * Validates that an operations list is one storage understands: a non-empty set\n * of `read`/`write`, or exactly `['delete']`. `delete` is never combined with\n * other operations.\n *\n * @param operations - The requested operations.\n */\nfunction assertValidOperations(operations: UkycStorageOperation[]): void {\n  if (operations.length === 0) {\n    throw new Error(\n      'UKYC: storage_access_token requires at least one operation.',\n    );\n  }\n\n  const unique = new Set(operations);\n\n  if (unique.size !== operations.length) {\n    throw new Error('UKYC: storage_access_token operations must be unique.');\n  }\n\n  if (unique.has('delete') && operations.length > 1) {\n    throw new Error(\n      'UKYC: a delete-scoped storage_access_token must contain only \"delete\".',\n    );\n  }\n}\n"]}

package/dist/ukyc/storageAccessToken.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"storageAccessToken.d.cts","sourceRoot":"","sources":["../../src/ukyc/storageAccessToken.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAAkC;AAGpE;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,GAAG,EAAE,MAAM,EAAE,CAAC;IAId,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CAEpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,6BAA6B,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,wDAAwD;IACxD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,uDAAuD;IACvD,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,KAAK,SAAS,GACV,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAqCzD;AAeD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,4BAA4B,GACnC,sBAAsB,CAwDxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,sBAAsB,GAC5B,MAAM,CAER"}
+{"version":3,"file":"storageAccessToken.d.cts","sourceRoot":"","sources":["../../src/ukyc/storageAccessToken.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAAkC;AAEpE;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,GAAG,EAAE,MAAM,EAAE,CAAC;IAId,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CAEpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,6BAA6B,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,wDAAwD;IACxD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,uDAAuD;IACvD,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,KAAK,SAAS,GACV,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAqCzD;AAeD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,4BAA4B,GACnC,sBAAsB,CAwDxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,sBAAsB,GAC5B,MAAM,CAER"}

package/dist/ukyc/storageAccessToken.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"storageAccessToken.d.mts","sourceRoot":"","sources":["../../src/ukyc/storageAccessToken.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAAkC;AAGpE;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,GAAG,EAAE,MAAM,EAAE,CAAC;IAId,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CAEpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,6BAA6B,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,wDAAwD;IACxD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,uDAAuD;IACvD,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,KAAK,SAAS,GACV,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAqCzD;AAeD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,4BAA4B,GACnC,sBAAsB,CAwDxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,sBAAsB,GAC5B,MAAM,CAER"}
+{"version":3,"file":"storageAccessToken.d.mts","sourceRoot":"","sources":["../../src/ukyc/storageAccessToken.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAAkC;AAEpE;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,GAAG,EAAE,MAAM,EAAE,CAAC;IAId,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CAEpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,6BAA6B,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,wDAAwD;IACxD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACnC,wDAAwD;IACxD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,uDAAuD;IACvD,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,KAAK,SAAS,GACV,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAqCzD;AAeD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,4BAA4B,GACnC,sBAAsB,CAwDxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,sBAAsB,GAC5B,MAAM,CAER"}

package/dist/ukyc/storageAccessToken.mjs

@@ -1,7 +1,7 @@
 import { stringToBytes } from "@metamask/utils";
 import { ed25519 } from "@noble/curves/ed25519";
-import { UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES, UKYC_STORAGE_ACCESS_TOKEN_VERSION } from "./constants.mjs";
 import { toBase64Url } from "../encoding.mjs";
+import { UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES, UKYC_STORAGE_ACCESS_TOKEN_VERSION } from "./constants.mjs";
 /**
  * Serializes a JSON value to RFC 8785 (JCS) canonical form.
  *

package/dist/ukyc/storageAccessToken.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storageAccessToken.mjs","sourceRoot":"","sources":["../../src/ukyc/storageAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB;AAChD,OAAO,EAAE,OAAO,EAAE,8BAA8B;AAEhD,OAAO,EACL,mCAAmC,EACnC,iCAAiC,EAClC,wBAAuB;AAExB,OAAO,EAAE,WAAW,EAAE,wBAAuB;AAiF7C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB;IAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC/B,IAAI,EAAE;SACN,MAAM,CAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;IAET,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAU;IAClC,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAoC;IAEpC,MAAM,EACJ,QAAQ,EACR,UAAU,EACV,SAAS,GAAG,QAAQ,EACpB,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,EACrB,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,SAAS,KAAK,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkC;QAC7C,OAAO,EAAE,iCAAiC;QAC1C,GAAG,EAAE,CAAC,GAAG,mCAAmC,CAAC;QAC7C,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,kBAAkB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,UAAU;QACV,SAAS;QACT,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACxC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE7D,OAAO;QACL,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,KAA6B;IAE7B,OAAO,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,UAAkC;IAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport {\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './constants.js';\nimport type { UkycClientMaterial } from './deriveClientMaterial.js';\nimport { toBase64Url } from '../encoding.js';\n\n/**\n * Mints `storage_access_token` capabilities — the client-signed, scoped,\n * session-bound proofs that authorize UKYC storage operations. See the\n * architecture doc, section \"Storage Authentication\".\n *\n * The token is Ed25519 over RFC 8785 (JCS) canonical JSON of the payload. Only\n * the client holds the private `signing_key`, so only the client can mint a\n * token; a `read`/`write`-scoped token may then be handed to the Relay to\n * present, but `delete` is never delegated.\n */\n\n/**\n * Storage operations a `storage_access_token` can authorize.\n */\nexport type UkycStorageOperation = 'read' | 'write' | 'delete';\n\n/**\n * Who presents the token to UKYC storage. The Relay may only present\n * `read`/`write` tokens; `delete` is always client-presented.\n */\nexport type UkycTokenPresenter = 'client' | 'idos-relay';\n\n/**\n * The signed `storage_access_token` payload. Field names are snake_case because\n * they are canonicalized and hashed exactly as they appear on the wire.\n */\nexport type UkycStorageAccessTokenPayload = {\n  version: number;\n  /** Every verifier that may accept the token, e.g. UKYC Storage and idOS Kwil. */\n  aud: string[];\n  // Wire-shape fields are snake_case; they are canonicalized and signed exactly\n  // as they appear on the wire.\n  /* eslint-disable @typescript-eslint/naming-convention */\n  storage_id: string;\n  signing_public_key: string;\n  operations: UkycStorageOperation[];\n  presenter: UkycTokenPresenter;\n  /** UKYC session id. Required (and only present) when presenter is `idos-relay`. */\n  session_id?: string;\n  issued_at: string;\n  expires_at: string;\n  /* eslint-enable @typescript-eslint/naming-convention */\n};\n\n/**\n * The on-the-wire envelope: the payload plus its detached Ed25519 signature\n * (base64url) over the JCS canonicalization of the payload.\n */\nexport type UkycStorageAccessToken = {\n  payload: UkycStorageAccessTokenPayload;\n  signature: string;\n};\n\n/**\n * Inputs for minting a `storage_access_token`.\n */\nexport type SignStorageAccessTokenParams = {\n  /** Client material derived from `local_user_secret`. */\n  material: UkycClientMaterial;\n  /** Operations the token authorizes. `delete` must be the sole operation. */\n  operations: UkycStorageOperation[];\n  /** Who will present the token. Defaults to `client`. */\n  presenter?: UkycTokenPresenter;\n  /** UKYC session id. Required when presenter is `idos-relay`. */\n  sessionId?: string;\n  /** Token issue time. Defaults to now. */\n  issuedAt?: Date;\n  /** Token expiry. Must be strictly after `issuedAt`. */\n  expiresAt: Date;\n};\n\ntype JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { [key: string]: JsonValue | undefined };\n\n/**\n * Serializes a JSON value to RFC 8785 (JCS) canonical form.\n *\n * Scope note: this implementation covers the JSON shapes used by UKYC storage\n * payloads — objects, arrays, strings, integers, booleans, and null. Object\n * members are sorted by their UTF-16 code units (matching JS default string\n * ordering, which is what JCS requires) and `undefined` members are dropped.\n * Non-finite and non-integer numbers are rejected, since the payloads never\n * contain them and correct JCS number formatting for the general case is\n * intentionally out of scope here.\n *\n * @param value - The value to canonicalize.\n * @returns The canonical JSON string.\n */\nexport function canonicalizeJson(value: JsonValue): string {\n  if (value === null) {\n    return 'null';\n  }\n\n  if (typeof value === 'boolean') {\n    return value ? 'true' : 'false';\n  }\n\n  if (typeof value === 'number') {\n    if (!Number.isInteger(value)) {\n      throw new Error(\n        'UKYC: cannot canonicalize a non-integer number for JCS.',\n      );\n    }\n    return JSON.stringify(value);\n  }\n\n  if (typeof value === 'string') {\n    return JSON.stringify(value);\n  }\n\n  if (Array.isArray(value)) {\n    return `[${value.map((item) => canonicalizeJson(item)).join(',')}]`;\n  }\n\n  const entries = Object.keys(value)\n    .sort()\n    .reduce<string[]>((acc, key) => {\n      const child = value[key];\n      if (child !== undefined) {\n        acc.push(`${JSON.stringify(key)}:${canonicalizeJson(child)}`);\n      }\n      return acc;\n    }, []);\n\n  return `{${entries.join(',')}}`;\n}\n\n/**\n * Formats a date as RFC 3339 UTC with whole-second precision (e.g.\n * `2026-07-07T00:00:00Z`). `Date.prototype.toISOString` always emits\n * milliseconds (`...:00.000Z`); the `storage_access_token` wire format omits\n * fractional seconds, so the sub-second component is truncated (not rounded).\n *\n * @param date - The date to format.\n * @returns The RFC 3339 timestamp without fractional seconds.\n */\nfunction toRfc3339Seconds(date: Date): string {\n  return `${date.toISOString().slice(0, 19)}Z`;\n}\n\n/**\n * Builds and signs a `storage_access_token`.\n *\n * @param params - See {@link SignStorageAccessTokenParams}.\n * @returns The signed token envelope.\n */\nexport function signStorageAccessToken(\n  params: SignStorageAccessTokenParams,\n): UkycStorageAccessToken {\n  const {\n    material,\n    operations,\n    presenter = 'client',\n    sessionId,\n    issuedAt = new Date(),\n    expiresAt,\n  } = params;\n\n  assertValidOperations(operations);\n\n  if (expiresAt.getTime() <= issuedAt.getTime()) {\n    throw new Error(\n      'UKYC: storage_access_token expires_at must be after issued_at.',\n    );\n  }\n\n  const isDelete = operations.includes('delete');\n\n  if (presenter === 'idos-relay' && isDelete) {\n    throw new Error(\n      'UKYC: a delete-scoped storage_access_token cannot be delegated to the Relay.',\n    );\n  }\n\n  if (presenter === 'idos-relay' && !sessionId) {\n    throw new Error(\n      'UKYC: a Relay-presented storage_access_token requires a session_id.',\n    );\n  }\n\n  const payload: UkycStorageAccessTokenPayload = {\n    version: UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n    aud: [...UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES],\n    storage_id: toBase64Url(material.storageId),\n    signing_public_key: toBase64Url(material.signingPublicKey),\n    operations,\n    presenter,\n    issued_at: toRfc3339Seconds(issuedAt),\n    expires_at: toRfc3339Seconds(expiresAt),\n  };\n\n  // Only bind session_id for Relay-presented tokens; omit the key entirely for\n  // client-presented tokens so it does not appear in the canonicalized payload.\n  if (presenter === 'idos-relay') {\n    payload.session_id = sessionId;\n  }\n\n  const message = stringToBytes(canonicalizeJson(payload));\n  const signature = ed25519.sign(message, material.signingKey);\n\n  return {\n    payload,\n    signature: toBase64Url(signature),\n  };\n}\n\n/**\n * Serializes a signed token to a compact string suitable for header transport\n * (`Authorization: AccessToken <token>`, see `UKYC_CAPABILITY_AUTH_SCHEME`). The\n * complete envelope is base64url-encoded; the private `signing_key` is never\n * included.\n *\n * @param token - The signed token envelope.\n * @returns The base64url-encoded envelope string.\n */\nexport function encodeStorageAccessTokenForHeader(\n  token: UkycStorageAccessToken,\n): string {\n  return toBase64Url(stringToBytes(JSON.stringify(token)));\n}\n\n/**\n * Validates that an operations list is one storage understands: a non-empty set\n * of `read`/`write`, or exactly `['delete']`. `delete` is never combined with\n * other operations.\n *\n * @param operations - The requested operations.\n */\nfunction assertValidOperations(operations: UkycStorageOperation[]): void {\n  if (operations.length === 0) {\n    throw new Error(\n      'UKYC: storage_access_token requires at least one operation.',\n    );\n  }\n\n  const unique = new Set(operations);\n\n  if (unique.size !== operations.length) {\n    throw new Error('UKYC: storage_access_token operations must be unique.');\n  }\n\n  if (unique.has('delete') && operations.length > 1) {\n    throw new Error(\n      'UKYC: a delete-scoped storage_access_token must contain only \"delete\".',\n    );\n  }\n}\n"]}
+{"version":3,"file":"storageAccessToken.mjs","sourceRoot":"","sources":["../../src/ukyc/storageAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB;AAChD,OAAO,EAAE,OAAO,EAAE,8BAA8B;AAEhD,OAAO,EAAE,WAAW,EAAE,wBAAuB;AAC7C,OAAO,EACL,mCAAmC,EACnC,iCAAiC,EAClC,wBAAuB;AAkFxB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB;IAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC/B,IAAI,EAAE;SACN,MAAM,CAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;IAET,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAU;IAClC,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAoC;IAEpC,MAAM,EACJ,QAAQ,EACR,UAAU,EACV,SAAS,GAAG,QAAQ,EACpB,SAAS,EACT,QAAQ,GAAG,IAAI,IAAI,EAAE,EACrB,SAAS,GACV,GAAG,MAAM,CAAC;IAEX,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE/C,IAAI,SAAS,KAAK,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkC;QAC7C,OAAO,EAAE,iCAAiC;QAC1C,GAAG,EAAE,CAAC,GAAG,mCAAmC,CAAC;QAC7C,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,kBAAkB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,UAAU;QACV,SAAS;QACT,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACxC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE7D,OAAO;QACL,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,KAA6B;IAE7B,OAAO,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,UAAkC;IAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAEnC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport { toBase64Url } from '../encoding.js';\nimport {\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './constants.js';\nimport type { UkycClientMaterial } from './deriveClientMaterial.js';\n\n/**\n * Mints `storage_access_token` capabilities — the client-signed, scoped,\n * session-bound proofs that authorize UKYC storage operations. See the\n * architecture doc, section \"Storage Authentication\".\n *\n * The token is Ed25519 over RFC 8785 (JCS) canonical JSON of the payload. Only\n * the client holds the private `signing_key`, so only the client can mint a\n * token; a `read`/`write`-scoped token may then be handed to the Relay to\n * present, but `delete` is never delegated.\n */\n\n/**\n * Storage operations a `storage_access_token` can authorize.\n */\nexport type UkycStorageOperation = 'read' | 'write' | 'delete';\n\n/**\n * Who presents the token to UKYC storage. The Relay may only present\n * `read`/`write` tokens; `delete` is always client-presented.\n */\nexport type UkycTokenPresenter = 'client' | 'idos-relay';\n\n/**\n * The signed `storage_access_token` payload. Field names are snake_case because\n * they are canonicalized and hashed exactly as they appear on the wire.\n */\nexport type UkycStorageAccessTokenPayload = {\n  version: number;\n  /** Every verifier that may accept the token, e.g. UKYC Storage and idOS Kwil. */\n  aud: string[];\n  // Wire-shape fields are snake_case; they are canonicalized and signed exactly\n  // as they appear on the wire.\n  /* eslint-disable @typescript-eslint/naming-convention */\n  storage_id: string;\n  signing_public_key: string;\n  operations: UkycStorageOperation[];\n  presenter: UkycTokenPresenter;\n  /** UKYC session id. Required (and only present) when presenter is `idos-relay`. */\n  session_id?: string;\n  issued_at: string;\n  expires_at: string;\n  /* eslint-enable @typescript-eslint/naming-convention */\n};\n\n/**\n * The on-the-wire envelope: the payload plus its detached Ed25519 signature\n * (base64url) over the JCS canonicalization of the payload.\n */\nexport type UkycStorageAccessToken = {\n  payload: UkycStorageAccessTokenPayload;\n  signature: string;\n};\n\n/**\n * Inputs for minting a `storage_access_token`.\n */\nexport type SignStorageAccessTokenParams = {\n  /** Client material derived from `local_user_secret`. */\n  material: UkycClientMaterial;\n  /** Operations the token authorizes. `delete` must be the sole operation. */\n  operations: UkycStorageOperation[];\n  /** Who will present the token. Defaults to `client`. */\n  presenter?: UkycTokenPresenter;\n  /** UKYC session id. Required when presenter is `idos-relay`. */\n  sessionId?: string;\n  /** Token issue time. Defaults to now. */\n  issuedAt?: Date;\n  /** Token expiry. Must be strictly after `issuedAt`. */\n  expiresAt: Date;\n};\n\ntype JsonValue =\n  | null\n  | boolean\n  | number\n  | string\n  | JsonValue[]\n  | { [key: string]: JsonValue | undefined };\n\n/**\n * Serializes a JSON value to RFC 8785 (JCS) canonical form.\n *\n * Scope note: this implementation covers the JSON shapes used by UKYC storage\n * payloads — objects, arrays, strings, integers, booleans, and null. Object\n * members are sorted by their UTF-16 code units (matching JS default string\n * ordering, which is what JCS requires) and `undefined` members are dropped.\n * Non-finite and non-integer numbers are rejected, since the payloads never\n * contain them and correct JCS number formatting for the general case is\n * intentionally out of scope here.\n *\n * @param value - The value to canonicalize.\n * @returns The canonical JSON string.\n */\nexport function canonicalizeJson(value: JsonValue): string {\n  if (value === null) {\n    return 'null';\n  }\n\n  if (typeof value === 'boolean') {\n    return value ? 'true' : 'false';\n  }\n\n  if (typeof value === 'number') {\n    if (!Number.isInteger(value)) {\n      throw new Error(\n        'UKYC: cannot canonicalize a non-integer number for JCS.',\n      );\n    }\n    return JSON.stringify(value);\n  }\n\n  if (typeof value === 'string') {\n    return JSON.stringify(value);\n  }\n\n  if (Array.isArray(value)) {\n    return `[${value.map((item) => canonicalizeJson(item)).join(',')}]`;\n  }\n\n  const entries = Object.keys(value)\n    .sort()\n    .reduce<string[]>((acc, key) => {\n      const child = value[key];\n      if (child !== undefined) {\n        acc.push(`${JSON.stringify(key)}:${canonicalizeJson(child)}`);\n      }\n      return acc;\n    }, []);\n\n  return `{${entries.join(',')}}`;\n}\n\n/**\n * Formats a date as RFC 3339 UTC with whole-second precision (e.g.\n * `2026-07-07T00:00:00Z`). `Date.prototype.toISOString` always emits\n * milliseconds (`...:00.000Z`); the `storage_access_token` wire format omits\n * fractional seconds, so the sub-second component is truncated (not rounded).\n *\n * @param date - The date to format.\n * @returns The RFC 3339 timestamp without fractional seconds.\n */\nfunction toRfc3339Seconds(date: Date): string {\n  return `${date.toISOString().slice(0, 19)}Z`;\n}\n\n/**\n * Builds and signs a `storage_access_token`.\n *\n * @param params - See {@link SignStorageAccessTokenParams}.\n * @returns The signed token envelope.\n */\nexport function signStorageAccessToken(\n  params: SignStorageAccessTokenParams,\n): UkycStorageAccessToken {\n  const {\n    material,\n    operations,\n    presenter = 'client',\n    sessionId,\n    issuedAt = new Date(),\n    expiresAt,\n  } = params;\n\n  assertValidOperations(operations);\n\n  if (expiresAt.getTime() <= issuedAt.getTime()) {\n    throw new Error(\n      'UKYC: storage_access_token expires_at must be after issued_at.',\n    );\n  }\n\n  const isDelete = operations.includes('delete');\n\n  if (presenter === 'idos-relay' && isDelete) {\n    throw new Error(\n      'UKYC: a delete-scoped storage_access_token cannot be delegated to the Relay.',\n    );\n  }\n\n  if (presenter === 'idos-relay' && !sessionId) {\n    throw new Error(\n      'UKYC: a Relay-presented storage_access_token requires a session_id.',\n    );\n  }\n\n  const payload: UkycStorageAccessTokenPayload = {\n    version: UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n    aud: [...UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES],\n    storage_id: toBase64Url(material.storageId),\n    signing_public_key: toBase64Url(material.signingPublicKey),\n    operations,\n    presenter,\n    issued_at: toRfc3339Seconds(issuedAt),\n    expires_at: toRfc3339Seconds(expiresAt),\n  };\n\n  // Only bind session_id for Relay-presented tokens; omit the key entirely for\n  // client-presented tokens so it does not appear in the canonicalized payload.\n  if (presenter === 'idos-relay') {\n    payload.session_id = sessionId;\n  }\n\n  const message = stringToBytes(canonicalizeJson(payload));\n  const signature = ed25519.sign(message, material.signingKey);\n\n  return {\n    payload,\n    signature: toBase64Url(signature),\n  };\n}\n\n/**\n * Serializes a signed token to a compact string suitable for header transport\n * (`Authorization: AccessToken <token>`, see `UKYC_CAPABILITY_AUTH_SCHEME`). The\n * complete envelope is base64url-encoded; the private `signing_key` is never\n * included.\n *\n * @param token - The signed token envelope.\n * @returns The base64url-encoded envelope string.\n */\nexport function encodeStorageAccessTokenForHeader(\n  token: UkycStorageAccessToken,\n): string {\n  return toBase64Url(stringToBytes(JSON.stringify(token)));\n}\n\n/**\n * Validates that an operations list is one storage understands: a non-empty set\n * of `read`/`write`, or exactly `['delete']`. `delete` is never combined with\n * other operations.\n *\n * @param operations - The requested operations.\n */\nfunction assertValidOperations(operations: UkycStorageOperation[]): void {\n  if (operations.length === 0) {\n    throw new Error(\n      'UKYC: storage_access_token requires at least one operation.',\n    );\n  }\n\n  const unique = new Set(operations);\n\n  if (unique.size !== operations.length) {\n    throw new Error('UKYC: storage_access_token operations must be unique.');\n  }\n\n  if (unique.has('delete') && operations.length > 1) {\n    throw new Error(\n      'UKYC: a delete-scoped storage_access_token must contain only \"delete\".',\n    );\n  }\n}\n"]}

package/dist/ukyc/wrappedRelayPayload.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"wrappedRelayPayload.cjs","sourceRoot":"","sources":["../../src/ukyc/wrappedRelayPayload.ts"],"names":[],"mappings":";;;AACA,iDAA6C;AA4B7C;;;;;;;;;;GAUG;AACH,SAAgB,wBAAwB,CACtC,QAA4B,EAC5B,kBAA0C;IAE1C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC;IAE7D,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,mBAAmB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC5D,kBAAkB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,oBAAoB,EAAE,kBAAkB;KACzC,CAAC;AACJ,CAAC;AAxBD,4DAwBC","sourcesContent":["import type { UkycClientMaterial } from './deriveClientMaterial.js';\nimport { toBase64Url } from '../encoding.js';\nimport type { UkycStorageAccessToken } from './storageAccessToken.js';\n\n/**\n * Builds the `wrapped_relay_payload` — the only client-derived material that\n * leaves the device. It is sent to the idOS Relay (through the UKYC API) so the\n * Relay can encrypt/decrypt and store KYC payloads on the user's behalf. See the\n * architecture doc, section \"Client-Derived Material\".\n *\n * Neither `local_user_secret` nor the private `signing_key` are ever included.\n * The `data_encryption_key` *is* included: it is intentionally shared with the\n * Relay so it can encrypt/decrypt payloads transiently.\n */\n\n/**\n * The Relay-facing bundle. `data_encryption_key` is base64url-encoded secret\n * material shared with the Relay; the other fields are non-secret.\n */\nexport type UkycWrappedRelayPayload = {\n  // Wire-shape fields are snake_case.\n  /* eslint-disable @typescript-eslint/naming-convention */\n  storage_id: string;\n  data_encryption_key: string;\n  signing_public_key: string;\n  storage_access_token: UkycStorageAccessToken;\n  /* eslint-enable @typescript-eslint/naming-convention */\n};\n\n/**\n * Assembles the `wrapped_relay_payload` from derived client material and a\n * Relay-presented `storage_access_token`.\n *\n * The token must be scoped for the Relay to present (`presenter: 'idos-relay'`)\n * and must not authorize `delete`, which is never delegated to the Relay.\n *\n * @param material - Client material derived from `local_user_secret`.\n * @param storageAccessToken - A `read`/`write`-scoped, Relay-presented token.\n * @returns The `wrapped_relay_payload` to send to the Relay via the UKYC API.\n */\nexport function buildWrappedRelayPayload(\n  material: UkycClientMaterial,\n  storageAccessToken: UkycStorageAccessToken,\n): UkycWrappedRelayPayload {\n  const { presenter, operations } = storageAccessToken.payload;\n\n  if (presenter !== 'idos-relay') {\n    throw new Error(\n      'UKYC: wrapped_relay_payload requires a Relay-presented storage_access_token.',\n    );\n  }\n\n  if (operations.includes('delete')) {\n    throw new Error(\n      'UKYC: wrapped_relay_payload must not carry a delete-scoped storage_access_token.',\n    );\n  }\n\n  return {\n    storage_id: toBase64Url(material.storageId),\n    data_encryption_key: toBase64Url(material.dataEncryptionKey),\n    signing_public_key: toBase64Url(material.signingPublicKey),\n    storage_access_token: storageAccessToken,\n  };\n}\n"]}
+{"version":3,"file":"wrappedRelayPayload.cjs","sourceRoot":"","sources":["../../src/ukyc/wrappedRelayPayload.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AA6B7C;;;;;;;;;;GAUG;AACH,SAAgB,wBAAwB,CACtC,QAA4B,EAC5B,kBAA0C;IAE1C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC;IAE7D,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,mBAAmB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC5D,kBAAkB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,oBAAoB,EAAE,kBAAkB;KACzC,CAAC;AACJ,CAAC;AAxBD,4DAwBC","sourcesContent":["import { toBase64Url } from '../encoding.js';\nimport type { UkycClientMaterial } from './deriveClientMaterial.js';\nimport type { UkycStorageAccessToken } from './storageAccessToken.js';\n\n/**\n * Builds the `wrapped_relay_payload` — the only client-derived material that\n * leaves the device. It is sent to the idOS Relay (through the UKYC API) so the\n * Relay can encrypt/decrypt and store KYC payloads on the user's behalf. See the\n * architecture doc, section \"Client-Derived Material\".\n *\n * Neither `local_user_secret` nor the private `signing_key` are ever included.\n * The `data_encryption_key` *is* included: it is intentionally shared with the\n * Relay so it can encrypt/decrypt payloads transiently.\n */\n\n/**\n * The Relay-facing bundle. `data_encryption_key` is base64url-encoded secret\n * material shared with the Relay; the other fields are non-secret.\n */\nexport type UkycWrappedRelayPayload = {\n  // Wire-shape fields are snake_case.\n  /* eslint-disable @typescript-eslint/naming-convention */\n  storage_id: string;\n  data_encryption_key: string;\n  signing_public_key: string;\n  storage_access_token: UkycStorageAccessToken;\n  /* eslint-enable @typescript-eslint/naming-convention */\n};\n\n/**\n * Assembles the `wrapped_relay_payload` from derived client material and a\n * Relay-presented `storage_access_token`.\n *\n * The token must be scoped for the Relay to present (`presenter: 'idos-relay'`)\n * and must not authorize `delete`, which is never delegated to the Relay.\n *\n * @param material - Client material derived from `local_user_secret`.\n * @param storageAccessToken - A `read`/`write`-scoped, Relay-presented token.\n * @returns The `wrapped_relay_payload` to send to the Relay via the UKYC API.\n */\nexport function buildWrappedRelayPayload(\n  material: UkycClientMaterial,\n  storageAccessToken: UkycStorageAccessToken,\n): UkycWrappedRelayPayload {\n  const { presenter, operations } = storageAccessToken.payload;\n\n  if (presenter !== 'idos-relay') {\n    throw new Error(\n      'UKYC: wrapped_relay_payload requires a Relay-presented storage_access_token.',\n    );\n  }\n\n  if (operations.includes('delete')) {\n    throw new Error(\n      'UKYC: wrapped_relay_payload must not carry a delete-scoped storage_access_token.',\n    );\n  }\n\n  return {\n    storage_id: toBase64Url(material.storageId),\n    data_encryption_key: toBase64Url(material.dataEncryptionKey),\n    signing_public_key: toBase64Url(material.signingPublicKey),\n    storage_access_token: storageAccessToken,\n  };\n}\n"]}

package/dist/ukyc/wrappedRelayPayload.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"wrappedRelayPayload.d.cts","sourceRoot":"","sources":["../../src/ukyc/wrappedRelayPayload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAAkC;AAEpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,iCAAgC;AAEtE;;;;;;;;;GASG;AAEH;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAGpC,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,sBAAsB,CAAC;CAE9C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,kBAAkB,EAAE,sBAAsB,GACzC,uBAAuB,CAqBzB"}
+{"version":3,"file":"wrappedRelayPayload.d.cts","sourceRoot":"","sources":["../../src/ukyc/wrappedRelayPayload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAAkC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,iCAAgC;AAEtE;;;;;;;;;GASG;AAEH;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAGpC,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,sBAAsB,CAAC;CAE9C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,kBAAkB,EAAE,sBAAsB,GACzC,uBAAuB,CAqBzB"}