@metamask-previews/kyc-controller 0.0.0-preview-e57e5c3dc → 0.0.0-preview-c449b8da8

package/dist/encoding.mjs

@@ -1,35 +0,0 @@
-import { base64ToBytes, bytesToBase64 } from "@metamask/utils";
-/**
- * Shared base64url encoding helpers used by frame crypto and UKYC modules.
- *
- * These are platform-agnostic: they rely on `@metamask/utils` rather than
- * `Buffer` / `atob`, so they run unchanged on mobile, extension, and web.
- */
-/**
- * Encodes bytes as unpadded base64url (RFC 4648 §5). This is the wire shape
- * used for `storage_id`, `signing_public_key`, and Ed25519 signatures in the
- * UKYC storage API.
- *
- * @param bytes - The bytes to encode.
- * @returns The base64url string without `=` padding.
- */
-export function toBase64Url(bytes) {
-    return bytesToBase64(bytes)
-        .replace(/\+/gu, '-')
-        .replace(/\//gu, '_')
-        .replace(/[=]+$/u, '');
-}
-/**
- * Decodes an unpadded (or padded) base64url string back to bytes. Inverse of
- * {@link toBase64Url}.
- *
- * @param value - The base64url string.
- * @returns The decoded bytes.
- */
-export function base64UrlToBytes(value) {
-    return base64ToBytes(value
-        .replace(/-/gu, '+')
-        .replace(/_/gu, '/')
-        .padEnd(value.length + ((4 - (value.length % 4)) % 4), '='));
-}
-//# sourceMappingURL=encoding.mjs.map

package/dist/encoding.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"encoding.mjs","sourceRoot":"","sources":["../src/encoding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB;AAE/D;;;;;GAKG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,OAAO,aAAa,CAAC,KAAK,CAAC;SACxB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,aAAa,CAClB,KAAK;SACF,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAC9D,CAAC;AACJ,CAAC","sourcesContent":["import { base64ToBytes, bytesToBase64 } from '@metamask/utils';\n\n/**\n * Shared base64url encoding helpers used by frame crypto and UKYC modules.\n *\n * These are platform-agnostic: they rely on `@metamask/utils` rather than\n * `Buffer` / `atob`, so they run unchanged on mobile, extension, and web.\n */\n\n/**\n * Encodes bytes as unpadded base64url (RFC 4648 §5). This is the wire shape\n * used for `storage_id`, `signing_public_key`, and Ed25519 signatures in the\n * UKYC storage API.\n *\n * @param bytes - The bytes to encode.\n * @returns The base64url string without `=` padding.\n */\nexport function toBase64Url(bytes: Uint8Array): string {\n  return bytesToBase64(bytes)\n    .replace(/\\+/gu, '-')\n    .replace(/\\//gu, '_')\n    .replace(/[=]+$/u, '');\n}\n\n/**\n * Decodes an unpadded (or padded) base64url string back to bytes. Inverse of\n * {@link toBase64Url}.\n *\n * @param value - The base64url string.\n * @returns The decoded bytes.\n */\nexport function base64UrlToBytes(value: string): Uint8Array {\n  return base64ToBytes(\n    value\n      .replace(/-/gu, '+')\n      .replace(/_/gu, '/')\n      .padEnd(value.length + ((4 - (value.length % 4)) % 4), '='),\n  );\n}\n"]}

package/dist/selectors.cjs

@@ -1,30 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.selectIsKycRequiredForProduct = exports.selectKycSumSub = exports.selectKycPhase = void 0;
-const reselect_1 = require("reselect");
-const selectKycRequiredByProduct = (state) => state.kycRequiredByProduct;
-/**
- * Selects the current flow phase.
- *
- * @param state - The KycController state.
- * @returns The current phase.
- */
-const selectKycPhase = (state) => state.phase;
-exports.selectKycPhase = selectKycPhase;
-/**
- * Selects the SumSub sub-flow state.
- *
- * @param state - The KycController state.
- * @returns The SumSub state.
- */
-const selectKycSumSub = (state) => state.sumsub;
-exports.selectKycSumSub = selectKycSumSub;
-/**
- * Creates a selector that returns whether KYC is required for a product.
- *
- * @param product - The consuming feature.
- * @returns A selector returning the cached requirement, or `undefined`.
- */
-const selectIsKycRequiredForProduct = (product) => (0, reselect_1.createSelector)([selectKycRequiredByProduct], (map) => map[product]);
-exports.selectIsKycRequiredForProduct = selectIsKycRequiredForProduct;
-//# sourceMappingURL=selectors.cjs.map

package/dist/selectors.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"selectors.cjs","sourceRoot":"","sources":["../src/selectors.ts"],"names":[],"mappings":";;;AAAA,uCAA0C;AAK1C,MAAM,0BAA0B,GAAG,CACjC,KAAyB,EACmB,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;AAE5E;;;;;GAKG;AACI,MAAM,cAAc,GAAG,CAC5B,KAAyB,EACI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;AAFjC,QAAA,cAAc,kBAEmB;AAE9C;;;;;GAKG;AACI,MAAM,eAAe,GAAG,CAC7B,KAAyB,EACK,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;AAFnC,QAAA,eAAe,mBAEoB;AAEhD;;;;;GAKG;AACI,MAAM,6BAA6B,GAAG,CAC3C,OAAmB,EACmC,EAAE,CACxD,IAAA,yBAAc,EACZ,CAAC,0BAA0B,CAAC,EAC5B,CAAC,GAAG,EAAuB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAC3C,CAAC;AANS,QAAA,6BAA6B,iCAMtC","sourcesContent":["import { createSelector } from 'reselect';\n\nimport type { KycControllerState } from './KycController.js';\nimport type { KycProduct } from './types.js';\n\nconst selectKycRequiredByProduct = (\n  state: KycControllerState,\n): KycControllerState['kycRequiredByProduct'] => state.kycRequiredByProduct;\n\n/**\n * Selects the current flow phase.\n *\n * @param state - The KycController state.\n * @returns The current phase.\n */\nexport const selectKycPhase = (\n  state: KycControllerState,\n): KycControllerState['phase'] => state.phase;\n\n/**\n * Selects the SumSub sub-flow state.\n *\n * @param state - The KycController state.\n * @returns The SumSub state.\n */\nexport const selectKycSumSub = (\n  state: KycControllerState,\n): KycControllerState['sumsub'] => state.sumsub;\n\n/**\n * Creates a selector that returns whether KYC is required for a product.\n *\n * @param product - The consuming feature.\n * @returns A selector returning the cached requirement, or `undefined`.\n */\nexport const selectIsKycRequiredForProduct = (\n  product: KycProduct,\n): ((state: KycControllerState) => boolean | undefined) =>\n  createSelector(\n    [selectKycRequiredByProduct],\n    (map): boolean | undefined => map[product],\n  );\n"]}

package/dist/selectors.d.cts

@@ -1,24 +0,0 @@
-import type { KycControllerState } from "./KycController.cjs";
-import type { KycProduct } from "./types.cjs";
-/**
- * Selects the current flow phase.
- *
- * @param state - The KycController state.
- * @returns The current phase.
- */
-export declare const selectKycPhase: (state: KycControllerState) => KycControllerState['phase'];
-/**
- * Selects the SumSub sub-flow state.
- *
- * @param state - The KycController state.
- * @returns The SumSub state.
- */
-export declare const selectKycSumSub: (state: KycControllerState) => KycControllerState['sumsub'];
-/**
- * Creates a selector that returns whether KYC is required for a product.
- *
- * @param product - The consuming feature.
- * @returns A selector returning the cached requirement, or `undefined`.
- */
-export declare const selectIsKycRequiredForProduct: (product: KycProduct) => (state: KycControllerState) => boolean | undefined;
-//# sourceMappingURL=selectors.d.cts.map

package/dist/selectors.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"selectors.d.cts","sourceRoot":"","sources":["../src/selectors.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,4BAA2B;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAmB;AAM7C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,UAClB,kBAAkB,KACxB,kBAAkB,CAAC,OAAO,CAAgB,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,eAAe,UACnB,kBAAkB,KACxB,kBAAkB,CAAC,QAAQ,CAAiB,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,YAC/B,UAAU,aACT,kBAAkB,KAAK,OAAO,GAAG,SAI1C,CAAC"}

package/dist/selectors.d.mts

@@ -1,24 +0,0 @@
-import type { KycControllerState } from "./KycController.mjs";
-import type { KycProduct } from "./types.mjs";
-/**
- * Selects the current flow phase.
- *
- * @param state - The KycController state.
- * @returns The current phase.
- */
-export declare const selectKycPhase: (state: KycControllerState) => KycControllerState['phase'];
-/**
- * Selects the SumSub sub-flow state.
- *
- * @param state - The KycController state.
- * @returns The SumSub state.
- */
-export declare const selectKycSumSub: (state: KycControllerState) => KycControllerState['sumsub'];
-/**
- * Creates a selector that returns whether KYC is required for a product.
- *
- * @param product - The consuming feature.
- * @returns A selector returning the cached requirement, or `undefined`.
- */
-export declare const selectIsKycRequiredForProduct: (product: KycProduct) => (state: KycControllerState) => boolean | undefined;
-//# sourceMappingURL=selectors.d.mts.map

package/dist/selectors.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"selectors.d.mts","sourceRoot":"","sources":["../src/selectors.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,4BAA2B;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAmB;AAM7C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,UAClB,kBAAkB,KACxB,kBAAkB,CAAC,OAAO,CAAgB,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,eAAe,UACnB,kBAAkB,KACxB,kBAAkB,CAAC,QAAQ,CAAiB,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,YAC/B,UAAU,aACT,kBAAkB,KAAK,OAAO,GAAG,SAI1C,CAAC"}

package/dist/selectors.mjs

@@ -1,24 +0,0 @@
-import { createSelector } from "reselect";
-const selectKycRequiredByProduct = (state) => state.kycRequiredByProduct;
-/**
- * Selects the current flow phase.
- *
- * @param state - The KycController state.
- * @returns The current phase.
- */
-export const selectKycPhase = (state) => state.phase;
-/**
- * Selects the SumSub sub-flow state.
- *
- * @param state - The KycController state.
- * @returns The SumSub state.
- */
-export const selectKycSumSub = (state) => state.sumsub;
-/**
- * Creates a selector that returns whether KYC is required for a product.
- *
- * @param product - The consuming feature.
- * @returns A selector returning the cached requirement, or `undefined`.
- */
-export const selectIsKycRequiredForProduct = (product) => createSelector([selectKycRequiredByProduct], (map) => map[product]);
-//# sourceMappingURL=selectors.mjs.map

package/dist/selectors.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"selectors.mjs","sourceRoot":"","sources":["../src/selectors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB;AAK1C,MAAM,0BAA0B,GAAG,CACjC,KAAyB,EACmB,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAyB,EACI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAAyB,EACK,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,OAAmB,EACmC,EAAE,CACxD,cAAc,CACZ,CAAC,0BAA0B,CAAC,EAC5B,CAAC,GAAG,EAAuB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAC3C,CAAC","sourcesContent":["import { createSelector } from 'reselect';\n\nimport type { KycControllerState } from './KycController.js';\nimport type { KycProduct } from './types.js';\n\nconst selectKycRequiredByProduct = (\n  state: KycControllerState,\n): KycControllerState['kycRequiredByProduct'] => state.kycRequiredByProduct;\n\n/**\n * Selects the current flow phase.\n *\n * @param state - The KycController state.\n * @returns The current phase.\n */\nexport const selectKycPhase = (\n  state: KycControllerState,\n): KycControllerState['phase'] => state.phase;\n\n/**\n * Selects the SumSub sub-flow state.\n *\n * @param state - The KycController state.\n * @returns The SumSub state.\n */\nexport const selectKycSumSub = (\n  state: KycControllerState,\n): KycControllerState['sumsub'] => state.sumsub;\n\n/**\n * Creates a selector that returns whether KYC is required for a product.\n *\n * @param product - The consuming feature.\n * @returns A selector returning the cached requirement, or `undefined`.\n */\nexport const selectIsKycRequiredForProduct = (\n  product: KycProduct,\n): ((state: KycControllerState) => boolean | undefined) =>\n  createSelector(\n    [selectKycRequiredByProduct],\n    (map): boolean | undefined => map[product],\n  );\n"]}

package/dist/types.cjs

@@ -1,10 +0,0 @@
-"use strict";
-/**
- * Shared types for the KYC controller and service.
- *
- * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for
- * document verification) but the surface exposed to consumers (ramps, card) is
- * intentionally vendor-neutral so a future vendor swap does not ripple out.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.cjs.map

package/dist/types.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps and card can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card';\n\n/**\n * Identity vendors supported behind the KYC surface.\n */\nexport type KycVendor = 'moonpay';\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session.\n * - `check` — running the invisible connection-check frame.\n * - `auth` — running the visible authentication (OTP) frame.\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`.\n * - `submit` — submitting the KYC-required check.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub`. When KYC is\n *   required, the document-verification sub-flow is launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a session is\n * created.\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}

package/dist/types.d.cts

@@ -1,124 +0,0 @@
-/**
- * Shared types for the KYC controller and service.
- *
- * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for
- * document verification) but the surface exposed to consumers (ramps, card) is
- * intentionally vendor-neutral so a future vendor swap does not ripple out.
- */
-/**
- * A MetaMask feature that consumes KYC. Used to key the per-product
- * "is KYC required" cache so ramps and card can share one controller.
- */
-export type KycProduct = 'ramps' | 'card';
-/**
- * Identity vendors supported behind the KYC surface.
- */
-export type KycVendor = 'moonpay';
-/**
- * Phases of the end-to-end identity flow.
- *
- * - `idle` — nothing started.
- * - `terms` — waiting for the customer to accept the vendor terms.
- * - `session` — creating the vendor session.
- * - `check` — running the invisible connection-check frame.
- * - `auth` — running the visible authentication (OTP) frame.
- * - `form` — authenticated. When the flow is scoped to a product, the
- *   KYC-required check runs automatically from here; otherwise the consumer
- *   drives it manually via `checkKycRequired`.
- * - `submit` — submitting the KYC-required check.
- * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub`. When KYC is
- *   required, the document-verification sub-flow is launched automatically.
- * - `error` — flow halted; see `error`.
- */
-export type KycPhase = 'idle' | 'terms' | 'session' | 'check' | 'auth' | 'form' | 'submit' | 'done' | 'error';
-/**
- * Progress of the SumSub document-verification sub-flow.
- *
- * - `polling` — the SDK finished and the controller is polling the UKYC
- *   backend for the session's final decision (see `KycSessionStatus`). The
- *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.
- * - `vendorProcessing` — session creation reported that the applicant is
- *   already approved on the relay (`kycStatus`) while the vendor is still
- *   finalizing its own decision (`finalStatus`). There is nothing left for the
- *   applicant to do, so the SDK is not launched; see `statusMessage`.
- */
-export type KycSumSubStatus = 'idle' | 'creatingSession' | 'fetchingToken' | 'launching' | 'inProgress' | 'polling' | 'complete' | 'failed' | 'vendorProcessing';
-/**
- * The status of a UKYC session, returned by the `GET /sessions/{id}/status`
- * endpoint and polled after the SumSub SDK completes to determine the final
- * verification decision.
- */
-export type KycSessionStatus = {
-    /**
-     * The overall status of the session. Terminal values (e.g. `approved`,
-     * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value
-     * keeps polling.
-     */
-    finalStatus: string;
-    /** Optional human-readable message describing the status. */
-    statusMessage?: string;
-    /** The vendor-agnostic external user id associated with the session. */
-    externalUserId: string;
-    /** The KYC decision status. */
-    kycStatus: string;
-    /** The identity vendor that handled the session. */
-    vendor: string;
-    /** The vendor-specific status. */
-    vendorStatus: string;
-};
-/**
- * A single disclaimer/term the customer must accept before a session is
- * created.
- */
-export type KycDisclaimer = {
-    id: string;
-    display_name: string;
-    url: string;
-};
-/**
- * Parameters passed to a platform SumSub launcher.
- */
-export type KycSumSubLaunchParams = {
-    /**
-     * The applicant access token used to initialize the SumSub SDK.
-     */
-    applicantAccessToken: string;
-    /**
-     * Called by the SDK when the access token expires; must resolve with a fresh
-     * applicant access token.
-     */
-    onTokenExpiration: () => Promise<string>;
-    /**
-     * Called when the SDK reports a status transition.
-     */
-    onStatusChange?: (prevStatus: string, newStatus: string) => void;
-    /**
-     * BCP-47 locale for the SDK UI.
-     */
-    locale?: string;
-    /**
-     * Enables SDK debug logging.
-     */
-    debug?: boolean;
-};
-/**
- * Platform adapter that launches the native/web SumSub SDK.
- *
- * The KYC controller is platform-agnostic and does not import any SDK; each
- * client (mobile / extension / web) injects an implementation of this
- * interface. The controller owns all orchestration (session creation, token
- * exchange, token refresh, state) and only delegates the actual SDK
- * presentation to `launch`.
- */
-export type KycSumSubLauncher = {
-    /**
-     * Whether the underlying SDK is available in the current runtime (e.g. the
-     * native module is linked). When `false`, `startSumSub` fails fast.
-     */
-    isAvailable(): boolean;
-    /**
-     * Presents the SumSub verification flow and resolves with the SDK result.
-     */
-    launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;
-};
-//# sourceMappingURL=types.d.cts.map

package/dist/types.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}

package/dist/types.d.mts

@@ -1,124 +0,0 @@
-/**
- * Shared types for the KYC controller and service.
- *
- * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for
- * document verification) but the surface exposed to consumers (ramps, card) is
- * intentionally vendor-neutral so a future vendor swap does not ripple out.
- */
-/**
- * A MetaMask feature that consumes KYC. Used to key the per-product
- * "is KYC required" cache so ramps and card can share one controller.
- */
-export type KycProduct = 'ramps' | 'card';
-/**
- * Identity vendors supported behind the KYC surface.
- */
-export type KycVendor = 'moonpay';
-/**
- * Phases of the end-to-end identity flow.
- *
- * - `idle` — nothing started.
- * - `terms` — waiting for the customer to accept the vendor terms.
- * - `session` — creating the vendor session.
- * - `check` — running the invisible connection-check frame.
- * - `auth` — running the visible authentication (OTP) frame.
- * - `form` — authenticated. When the flow is scoped to a product, the
- *   KYC-required check runs automatically from here; otherwise the consumer
- *   drives it manually via `checkKycRequired`.
- * - `submit` — submitting the KYC-required check.
- * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub`. When KYC is
- *   required, the document-verification sub-flow is launched automatically.
- * - `error` — flow halted; see `error`.
- */
-export type KycPhase = 'idle' | 'terms' | 'session' | 'check' | 'auth' | 'form' | 'submit' | 'done' | 'error';
-/**
- * Progress of the SumSub document-verification sub-flow.
- *
- * - `polling` — the SDK finished and the controller is polling the UKYC
- *   backend for the session's final decision (see `KycSessionStatus`). The
- *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.
- * - `vendorProcessing` — session creation reported that the applicant is
- *   already approved on the relay (`kycStatus`) while the vendor is still
- *   finalizing its own decision (`finalStatus`). There is nothing left for the
- *   applicant to do, so the SDK is not launched; see `statusMessage`.
- */
-export type KycSumSubStatus = 'idle' | 'creatingSession' | 'fetchingToken' | 'launching' | 'inProgress' | 'polling' | 'complete' | 'failed' | 'vendorProcessing';
-/**
- * The status of a UKYC session, returned by the `GET /sessions/{id}/status`
- * endpoint and polled after the SumSub SDK completes to determine the final
- * verification decision.
- */
-export type KycSessionStatus = {
-    /**
-     * The overall status of the session. Terminal values (e.g. `approved`,
-     * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value
-     * keeps polling.
-     */
-    finalStatus: string;
-    /** Optional human-readable message describing the status. */
-    statusMessage?: string;
-    /** The vendor-agnostic external user id associated with the session. */
-    externalUserId: string;
-    /** The KYC decision status. */
-    kycStatus: string;
-    /** The identity vendor that handled the session. */
-    vendor: string;
-    /** The vendor-specific status. */
-    vendorStatus: string;
-};
-/**
- * A single disclaimer/term the customer must accept before a session is
- * created.
- */
-export type KycDisclaimer = {
-    id: string;
-    display_name: string;
-    url: string;
-};
-/**
- * Parameters passed to a platform SumSub launcher.
- */
-export type KycSumSubLaunchParams = {
-    /**
-     * The applicant access token used to initialize the SumSub SDK.
-     */
-    applicantAccessToken: string;
-    /**
-     * Called by the SDK when the access token expires; must resolve with a fresh
-     * applicant access token.
-     */
-    onTokenExpiration: () => Promise<string>;
-    /**
-     * Called when the SDK reports a status transition.
-     */
-    onStatusChange?: (prevStatus: string, newStatus: string) => void;
-    /**
-     * BCP-47 locale for the SDK UI.
-     */
-    locale?: string;
-    /**
-     * Enables SDK debug logging.
-     */
-    debug?: boolean;
-};
-/**
- * Platform adapter that launches the native/web SumSub SDK.
- *
- * The KYC controller is platform-agnostic and does not import any SDK; each
- * client (mobile / extension / web) injects an implementation of this
- * interface. The controller owns all orchestration (session creation, token
- * exchange, token refresh, state) and only delegates the actual SDK
- * presentation to `launch`.
- */
-export type KycSumSubLauncher = {
-    /**
-     * Whether the underlying SDK is available in the current runtime (e.g. the
-     * native module is linked). When `false`, `startSumSub` fails fast.
-     */
-    isAvailable(): boolean;
-    /**
-     * Presents the SumSub verification flow and resolves with the SDK result.
-     */
-    launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;
-};
-//# sourceMappingURL=types.d.mts.map

package/dist/types.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC;AAElC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}

package/dist/types.mjs

@@ -1,9 +0,0 @@
-/**
- * Shared types for the KYC controller and service.
- *
- * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for
- * document verification) but the surface exposed to consumers (ramps, card) is
- * intentionally vendor-neutral so a future vendor swap does not ripple out.
- */
-export {};
-//# sourceMappingURL=types.mjs.map

package/dist/types.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps and card can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card';\n\n/**\n * Identity vendors supported behind the KYC surface.\n */\nexport type KycVendor = 'moonpay';\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session.\n * - `check` — running the invisible connection-check frame.\n * - `auth` — running the visible authentication (OTP) frame.\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`.\n * - `submit` — submitting the KYC-required check.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub`. When KYC is\n *   required, the document-verification sub-flow is launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a session is\n * created.\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}

package/dist/ukyc/constants.cjs

@@ -1,75 +0,0 @@
-"use strict";
-/**
- * Constants for the UKYC client-derived key material and storage-authorization
- * layer. See the architecture doc, section "Client-Derived Material".
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UKYC_JWKS_PATH = exports.UKYC_CAPABILITY_AUTH_SCHEME = exports.UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES = exports.UKYC_KWIL_AUDIENCE = exports.UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE = exports.UKYC_STORAGE_ACCESS_TOKEN_VERSION = exports.UKYC_KDF_INFO = exports.UKYC_DERIVED_KEY_SIZES = exports.UKYC_LOCAL_USER_SECRET_SIZE_BYTES = exports.UKYC_LOCAL_USER_SECRET_PATH = void 0;
-/**
- * Fully-qualified key path for the `local_user_secret` in Encrypted User
- * Storage.
- */
-exports.UKYC_LOCAL_USER_SECRET_PATH = `ukyc.local_user_secret`;
-/**
- * Size of the `local_user_secret` in bytes. 32 bytes (256 bits) provides high
- * entropy and matches the input length expected by the HKDF-SHA256 derivations
- * below.
- */
-exports.UKYC_LOCAL_USER_SECRET_SIZE_BYTES = 32;
-/**
- * Byte length of each value derived from `local_user_secret`.
- *
- * `signingKey` is 32 bytes because it is used directly as the Ed25519
- * private key (for Ed25519 the 32-byte seed *is* the private key).
- */
-exports.UKYC_DERIVED_KEY_SIZES = {
-    storageId: 32,
-    dataEncryptionKey: 32,
-    signingKey: 32,
-    relayTunnelKey: 32,
-};
-/**
- * HKDF `info` labels providing domain separation between the values derived
- * from `local_user_secret`.
- */
-exports.UKYC_KDF_INFO = {
-    storageId: 'metamask.ukyc.storage.v1.storage_id',
-    dataEncryptionKey: 'metamask.ukyc.storage.v1.data_encryption_key',
-    signingKey: 'metamask.ukyc.storage.v1.signing_key',
-    relayTunnelKey: 'metamask.ukyc.storage.v1.relay_tunnel_key',
-};
-/**
- * Version bound into every `storage_access_token` payload.
- */
-exports.UKYC_STORAGE_ACCESS_TOKEN_VERSION = 1;
-/**
- * Audience identifying the UKYC user-storage service. Required by UKYC Storage
- * when it verifies a `storage_access_token`.
- */
-exports.UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE = 'metamask:user-storage:ukyc';
-/**
- * Audience identifying the idOS Kwil credential-registry nodes. Required by
- * idOS Kwil when it verifies a `storage_access_token`.
- */
-exports.UKYC_KWIL_AUDIENCE = 'idos:kwil';
-/**
- * Full audience list bound into every `storage_access_token` payload. `aud`
- * lists every verifier that may accept the token, so both UKYC Storage and
- * idOS Kwil can each find their own entry.
- */
-exports.UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES = [
-    exports.UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,
-    exports.UKYC_KWIL_AUDIENCE,
-];
-/**
- * Authorization scheme under which a signed `storage_access_token` envelope is
- * carried to UKYC Storage: `Authorization: AccessToken <base64url(envelope)>`.
- * The credentials portion is what `encodeStorageAccessTokenForHeader` returns.
- */
-exports.UKYC_CAPABILITY_AUTH_SCHEME = 'AccessToken';
-/**
- * Standard well-known path where the Fractal encryption service publishes its
- * JWKS (the Ed25519 public keys used to sign the `jwtChain`).
- */
-exports.UKYC_JWKS_PATH = '/.well-known/jwks.json';
-//# sourceMappingURL=constants.cjs.map

package/dist/ukyc/constants.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.cjs","sourceRoot":"","sources":["../../src/ukyc/constants.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH;;;GAGG;AACU,QAAA,2BAA2B,GAAG,wBAAiC,CAAC;AAE7E;;;;GAIG;AACU,QAAA,iCAAiC,GAAG,EAAE,CAAC;AAEpD;;;;;GAKG;AACU,QAAA,sBAAsB,GAAG;IACpC,SAAS,EAAE,EAAE;IACb,iBAAiB,EAAE,EAAE;IACrB,UAAU,EAAE,EAAE;IACd,cAAc,EAAE,EAAE;CACV,CAAC;AAEX;;;GAGG;AACU,QAAA,aAAa,GAAG;IAC3B,SAAS,EAAE,qCAAqC;IAChD,iBAAiB,EAAE,8CAA8C;IACjE,UAAU,EAAE,sCAAsC;IAClD,cAAc,EAAE,2CAA2C;CACnD,CAAC;AAEX;;GAEG;AACU,QAAA,iCAAiC,GAAG,CAAC,CAAC;AAEnD;;;GAGG;AACU,QAAA,kCAAkC,GAC7C,4BAAqC,CAAC;AAExC;;;GAGG;AACU,QAAA,kBAAkB,GAAG,WAAoB,CAAC;AAEvD;;;;GAIG;AACU,QAAA,mCAAmC,GAAG;IACjD,0CAAkC;IAClC,0BAAkB;CACV,CAAC;AAEX;;;;GAIG;AACU,QAAA,2BAA2B,GAAG,aAAsB,CAAC;AAElE;;;GAGG;AACU,QAAA,cAAc,GAAG,wBAAwB,CAAC","sourcesContent":["/**\n * Constants for the UKYC client-derived key material and storage-authorization\n * layer. See the architecture doc, section \"Client-Derived Material\".\n */\n\n/**\n * Fully-qualified key path for the `local_user_secret` in Encrypted User\n * Storage.\n */\nexport const UKYC_LOCAL_USER_SECRET_PATH = `ukyc.local_user_secret` as const;\n\n/**\n * Size of the `local_user_secret` in bytes. 32 bytes (256 bits) provides high\n * entropy and matches the input length expected by the HKDF-SHA256 derivations\n * below.\n */\nexport const UKYC_LOCAL_USER_SECRET_SIZE_BYTES = 32;\n\n/**\n * Byte length of each value derived from `local_user_secret`.\n *\n * `signingKey` is 32 bytes because it is used directly as the Ed25519\n * private key (for Ed25519 the 32-byte seed *is* the private key).\n */\nexport const UKYC_DERIVED_KEY_SIZES = {\n  storageId: 32,\n  dataEncryptionKey: 32,\n  signingKey: 32,\n  relayTunnelKey: 32,\n} as const;\n\n/**\n * HKDF `info` labels providing domain separation between the values derived\n * from `local_user_secret`.\n */\nexport const UKYC_KDF_INFO = {\n  storageId: 'metamask.ukyc.storage.v1.storage_id',\n  dataEncryptionKey: 'metamask.ukyc.storage.v1.data_encryption_key',\n  signingKey: 'metamask.ukyc.storage.v1.signing_key',\n  relayTunnelKey: 'metamask.ukyc.storage.v1.relay_tunnel_key',\n} as const;\n\n/**\n * Version bound into every `storage_access_token` payload.\n */\nexport const UKYC_STORAGE_ACCESS_TOKEN_VERSION = 1;\n\n/**\n * Audience identifying the UKYC user-storage service. Required by UKYC Storage\n * when it verifies a `storage_access_token`.\n */\nexport const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE =\n  'metamask:user-storage:ukyc' as const;\n\n/**\n * Audience identifying the idOS Kwil credential-registry nodes. Required by\n * idOS Kwil when it verifies a `storage_access_token`.\n */\nexport const UKYC_KWIL_AUDIENCE = 'idos:kwil' as const;\n\n/**\n * Full audience list bound into every `storage_access_token` payload. `aud`\n * lists every verifier that may accept the token, so both UKYC Storage and\n * idOS Kwil can each find their own entry.\n */\nexport const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES = [\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_KWIL_AUDIENCE,\n] as const;\n\n/**\n * Authorization scheme under which a signed `storage_access_token` envelope is\n * carried to UKYC Storage: `Authorization: AccessToken <base64url(envelope)>`.\n * The credentials portion is what `encodeStorageAccessTokenForHeader` returns.\n */\nexport const UKYC_CAPABILITY_AUTH_SCHEME = 'AccessToken' as const;\n\n/**\n * Standard well-known path where the Fractal encryption service publishes its\n * JWKS (the Ed25519 public keys used to sign the `jwtChain`).\n */\nexport const UKYC_JWKS_PATH = '/.well-known/jwks.json';\n"]}

package/dist/ukyc/constants.d.cts

@@ -1,69 +0,0 @@
-/**
- * Constants for the UKYC client-derived key material and storage-authorization
- * layer. See the architecture doc, section "Client-Derived Material".
- */
-/**
- * Fully-qualified key path for the `local_user_secret` in Encrypted User
- * Storage.
- */
-export declare const UKYC_LOCAL_USER_SECRET_PATH: "ukyc.local_user_secret";
-/**
- * Size of the `local_user_secret` in bytes. 32 bytes (256 bits) provides high
- * entropy and matches the input length expected by the HKDF-SHA256 derivations
- * below.
- */
-export declare const UKYC_LOCAL_USER_SECRET_SIZE_BYTES = 32;
-/**
- * Byte length of each value derived from `local_user_secret`.
- *
- * `signingKey` is 32 bytes because it is used directly as the Ed25519
- * private key (for Ed25519 the 32-byte seed *is* the private key).
- */
-export declare const UKYC_DERIVED_KEY_SIZES: {
-    readonly storageId: 32;
-    readonly dataEncryptionKey: 32;
-    readonly signingKey: 32;
-    readonly relayTunnelKey: 32;
-};
-/**
- * HKDF `info` labels providing domain separation between the values derived
- * from `local_user_secret`.
- */
-export declare const UKYC_KDF_INFO: {
-    readonly storageId: "metamask.ukyc.storage.v1.storage_id";
-    readonly dataEncryptionKey: "metamask.ukyc.storage.v1.data_encryption_key";
-    readonly signingKey: "metamask.ukyc.storage.v1.signing_key";
-    readonly relayTunnelKey: "metamask.ukyc.storage.v1.relay_tunnel_key";
-};
-/**
- * Version bound into every `storage_access_token` payload.
- */
-export declare const UKYC_STORAGE_ACCESS_TOKEN_VERSION = 1;
-/**
- * Audience identifying the UKYC user-storage service. Required by UKYC Storage
- * when it verifies a `storage_access_token`.
- */
-export declare const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE: "metamask:user-storage:ukyc";
-/**
- * Audience identifying the idOS Kwil credential-registry nodes. Required by
- * idOS Kwil when it verifies a `storage_access_token`.
- */
-export declare const UKYC_KWIL_AUDIENCE: "idos:kwil";
-/**
- * Full audience list bound into every `storage_access_token` payload. `aud`
- * lists every verifier that may accept the token, so both UKYC Storage and
- * idOS Kwil can each find their own entry.
- */
-export declare const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES: readonly ["metamask:user-storage:ukyc", "idos:kwil"];
-/**
- * Authorization scheme under which a signed `storage_access_token` envelope is
- * carried to UKYC Storage: `Authorization: AccessToken <base64url(envelope)>`.
- * The credentials portion is what `encodeStorageAccessTokenForHeader` returns.
- */
-export declare const UKYC_CAPABILITY_AUTH_SCHEME: "AccessToken";
-/**
- * Standard well-known path where the Fractal encryption service publishes its
- * JWKS (the Ed25519 public keys used to sign the `jwtChain`).
- */
-export declare const UKYC_JWKS_PATH = "/.well-known/jwks.json";
-//# sourceMappingURL=constants.d.cts.map

package/dist/ukyc/constants.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.cts","sourceRoot":"","sources":["../../src/ukyc/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,eAAO,MAAM,2BAA2B,0BAAoC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;CAKzB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,kCAAkC,8BACR,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAAuB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,sDAGtC,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAyB,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,cAAc,2BAA2B,CAAC"}