@metamask-previews/kyc-controller 0.0.0-preview-e57e5c3dc → 0.0.0-preview-c449b8da8

package/dist/ukyc/constants.d.mts

@@ -1,69 +0,0 @@
-/**
- * Constants for the UKYC client-derived key material and storage-authorization
- * layer. See the architecture doc, section "Client-Derived Material".
- */
-/**
- * Fully-qualified key path for the `local_user_secret` in Encrypted User
- * Storage.
- */
-export declare const UKYC_LOCAL_USER_SECRET_PATH: "ukyc.local_user_secret";
-/**
- * Size of the `local_user_secret` in bytes. 32 bytes (256 bits) provides high
- * entropy and matches the input length expected by the HKDF-SHA256 derivations
- * below.
- */
-export declare const UKYC_LOCAL_USER_SECRET_SIZE_BYTES = 32;
-/**
- * Byte length of each value derived from `local_user_secret`.
- *
- * `signingKey` is 32 bytes because it is used directly as the Ed25519
- * private key (for Ed25519 the 32-byte seed *is* the private key).
- */
-export declare const UKYC_DERIVED_KEY_SIZES: {
-    readonly storageId: 32;
-    readonly dataEncryptionKey: 32;
-    readonly signingKey: 32;
-    readonly relayTunnelKey: 32;
-};
-/**
- * HKDF `info` labels providing domain separation between the values derived
- * from `local_user_secret`.
- */
-export declare const UKYC_KDF_INFO: {
-    readonly storageId: "metamask.ukyc.storage.v1.storage_id";
-    readonly dataEncryptionKey: "metamask.ukyc.storage.v1.data_encryption_key";
-    readonly signingKey: "metamask.ukyc.storage.v1.signing_key";
-    readonly relayTunnelKey: "metamask.ukyc.storage.v1.relay_tunnel_key";
-};
-/**
- * Version bound into every `storage_access_token` payload.
- */
-export declare const UKYC_STORAGE_ACCESS_TOKEN_VERSION = 1;
-/**
- * Audience identifying the UKYC user-storage service. Required by UKYC Storage
- * when it verifies a `storage_access_token`.
- */
-export declare const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE: "metamask:user-storage:ukyc";
-/**
- * Audience identifying the idOS Kwil credential-registry nodes. Required by
- * idOS Kwil when it verifies a `storage_access_token`.
- */
-export declare const UKYC_KWIL_AUDIENCE: "idos:kwil";
-/**
- * Full audience list bound into every `storage_access_token` payload. `aud`
- * lists every verifier that may accept the token, so both UKYC Storage and
- * idOS Kwil can each find their own entry.
- */
-export declare const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES: readonly ["metamask:user-storage:ukyc", "idos:kwil"];
-/**
- * Authorization scheme under which a signed `storage_access_token` envelope is
- * carried to UKYC Storage: `Authorization: AccessToken <base64url(envelope)>`.
- * The credentials portion is what `encodeStorageAccessTokenForHeader` returns.
- */
-export declare const UKYC_CAPABILITY_AUTH_SCHEME: "AccessToken";
-/**
- * Standard well-known path where the Fractal encryption service publishes its
- * JWKS (the Ed25519 public keys used to sign the `jwtChain`).
- */
-export declare const UKYC_JWKS_PATH = "/.well-known/jwks.json";
-//# sourceMappingURL=constants.d.mts.map

package/dist/ukyc/constants.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../src/ukyc/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,eAAO,MAAM,2BAA2B,0BAAoC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;CAKzB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,kCAAkC,8BACR,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,aAAuB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,sDAGtC,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAyB,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,cAAc,2BAA2B,CAAC"}

package/dist/ukyc/constants.mjs

@@ -1,72 +0,0 @@
-/**
- * Constants for the UKYC client-derived key material and storage-authorization
- * layer. See the architecture doc, section "Client-Derived Material".
- */
-/**
- * Fully-qualified key path for the `local_user_secret` in Encrypted User
- * Storage.
- */
-export const UKYC_LOCAL_USER_SECRET_PATH = `ukyc.local_user_secret`;
-/**
- * Size of the `local_user_secret` in bytes. 32 bytes (256 bits) provides high
- * entropy and matches the input length expected by the HKDF-SHA256 derivations
- * below.
- */
-export const UKYC_LOCAL_USER_SECRET_SIZE_BYTES = 32;
-/**
- * Byte length of each value derived from `local_user_secret`.
- *
- * `signingKey` is 32 bytes because it is used directly as the Ed25519
- * private key (for Ed25519 the 32-byte seed *is* the private key).
- */
-export const UKYC_DERIVED_KEY_SIZES = {
-    storageId: 32,
-    dataEncryptionKey: 32,
-    signingKey: 32,
-    relayTunnelKey: 32,
-};
-/**
- * HKDF `info` labels providing domain separation between the values derived
- * from `local_user_secret`.
- */
-export const UKYC_KDF_INFO = {
-    storageId: 'metamask.ukyc.storage.v1.storage_id',
-    dataEncryptionKey: 'metamask.ukyc.storage.v1.data_encryption_key',
-    signingKey: 'metamask.ukyc.storage.v1.signing_key',
-    relayTunnelKey: 'metamask.ukyc.storage.v1.relay_tunnel_key',
-};
-/**
- * Version bound into every `storage_access_token` payload.
- */
-export const UKYC_STORAGE_ACCESS_TOKEN_VERSION = 1;
-/**
- * Audience identifying the UKYC user-storage service. Required by UKYC Storage
- * when it verifies a `storage_access_token`.
- */
-export const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE = 'metamask:user-storage:ukyc';
-/**
- * Audience identifying the idOS Kwil credential-registry nodes. Required by
- * idOS Kwil when it verifies a `storage_access_token`.
- */
-export const UKYC_KWIL_AUDIENCE = 'idos:kwil';
-/**
- * Full audience list bound into every `storage_access_token` payload. `aud`
- * lists every verifier that may accept the token, so both UKYC Storage and
- * idOS Kwil can each find their own entry.
- */
-export const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES = [
-    UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,
-    UKYC_KWIL_AUDIENCE,
-];
-/**
- * Authorization scheme under which a signed `storage_access_token` envelope is
- * carried to UKYC Storage: `Authorization: AccessToken <base64url(envelope)>`.
- * The credentials portion is what `encodeStorageAccessTokenForHeader` returns.
- */
-export const UKYC_CAPABILITY_AUTH_SCHEME = 'AccessToken';
-/**
- * Standard well-known path where the Fractal encryption service publishes its
- * JWKS (the Ed25519 public keys used to sign the `jwtChain`).
- */
-export const UKYC_JWKS_PATH = '/.well-known/jwks.json';
-//# sourceMappingURL=constants.mjs.map

package/dist/ukyc/constants.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../src/ukyc/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAiC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,SAAS,EAAE,EAAE;IACb,iBAAiB,EAAE,EAAE;IACrB,UAAU,EAAE,EAAE;IACd,cAAc,EAAE,EAAE;CACV,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,SAAS,EAAE,qCAAqC;IAChD,iBAAiB,EAAE,8CAA8C;IACjE,UAAU,EAAE,sCAAsC;IAClD,cAAc,EAAE,2CAA2C;CACnD,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,4BAAqC,CAAC;AAExC;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,kCAAkC;IAClC,kBAAkB;CACV,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,aAAsB,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,wBAAwB,CAAC","sourcesContent":["/**\n * Constants for the UKYC client-derived key material and storage-authorization\n * layer. See the architecture doc, section \"Client-Derived Material\".\n */\n\n/**\n * Fully-qualified key path for the `local_user_secret` in Encrypted User\n * Storage.\n */\nexport const UKYC_LOCAL_USER_SECRET_PATH = `ukyc.local_user_secret` as const;\n\n/**\n * Size of the `local_user_secret` in bytes. 32 bytes (256 bits) provides high\n * entropy and matches the input length expected by the HKDF-SHA256 derivations\n * below.\n */\nexport const UKYC_LOCAL_USER_SECRET_SIZE_BYTES = 32;\n\n/**\n * Byte length of each value derived from `local_user_secret`.\n *\n * `signingKey` is 32 bytes because it is used directly as the Ed25519\n * private key (for Ed25519 the 32-byte seed *is* the private key).\n */\nexport const UKYC_DERIVED_KEY_SIZES = {\n  storageId: 32,\n  dataEncryptionKey: 32,\n  signingKey: 32,\n  relayTunnelKey: 32,\n} as const;\n\n/**\n * HKDF `info` labels providing domain separation between the values derived\n * from `local_user_secret`.\n */\nexport const UKYC_KDF_INFO = {\n  storageId: 'metamask.ukyc.storage.v1.storage_id',\n  dataEncryptionKey: 'metamask.ukyc.storage.v1.data_encryption_key',\n  signingKey: 'metamask.ukyc.storage.v1.signing_key',\n  relayTunnelKey: 'metamask.ukyc.storage.v1.relay_tunnel_key',\n} as const;\n\n/**\n * Version bound into every `storage_access_token` payload.\n */\nexport const UKYC_STORAGE_ACCESS_TOKEN_VERSION = 1;\n\n/**\n * Audience identifying the UKYC user-storage service. Required by UKYC Storage\n * when it verifies a `storage_access_token`.\n */\nexport const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE =\n  'metamask:user-storage:ukyc' as const;\n\n/**\n * Audience identifying the idOS Kwil credential-registry nodes. Required by\n * idOS Kwil when it verifies a `storage_access_token`.\n */\nexport const UKYC_KWIL_AUDIENCE = 'idos:kwil' as const;\n\n/**\n * Full audience list bound into every `storage_access_token` payload. `aud`\n * lists every verifier that may accept the token, so both UKYC Storage and\n * idOS Kwil can each find their own entry.\n */\nexport const UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES = [\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_KWIL_AUDIENCE,\n] as const;\n\n/**\n * Authorization scheme under which a signed `storage_access_token` envelope is\n * carried to UKYC Storage: `Authorization: AccessToken <base64url(envelope)>`.\n * The credentials portion is what `encodeStorageAccessTokenForHeader` returns.\n */\nexport const UKYC_CAPABILITY_AUTH_SCHEME = 'AccessToken' as const;\n\n/**\n * Standard well-known path where the Fractal encryption service publishes its\n * JWKS (the Ed25519 public keys used to sign the `jwtChain`).\n */\nexport const UKYC_JWKS_PATH = '/.well-known/jwks.json';\n"]}

package/dist/ukyc/deriveClientMaterial.cjs

@@ -1,65 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.encodeClientMaterial = exports.deriveClientMaterial = void 0;
-const utils_1 = require("@metamask/utils");
-const ed25519_1 = require("@noble/curves/ed25519");
-const hkdf_1 = require("@noble/hashes/hkdf");
-const sha2_1 = require("@noble/hashes/sha2");
-const constants_js_1 = require("./constants.cjs");
-const encoding_js_1 = require("../encoding.cjs");
-/**
- * Derives a single labeled value from `local_user_secret`.
- *
- * No salt is used: `local_user_secret` is already a high-entropy
- * uniformly-random secret, so per-output domain separation comes entirely from
- * the `info` label.
- *
- * @param localUserSecret - The root `local_user_secret` bytes.
- * @param info - Domain-separation label for this output.
- * @param length - Desired output length in bytes.
- * @returns The derived bytes.
- */
-function deriveLabeled(localUserSecret, info, length) {
-    return (0, hkdf_1.hkdf)(sha2_1.sha256, localUserSecret, undefined, (0, utils_1.stringToBytes)(info), length);
-}
-/**
- * Derives all UKYC client material from the root `local_user_secret`.
- *
- * This is a pure function of `local_user_secret`: the same input always yields
- * the same outputs, which is what makes `storage_id` and `signing_key` stable
- * across sessions and devices.
- *
- * @param localUserSecret - The `local_user_secret` produced by
- * `getOrCreateLocalUserSecret`.
- * @returns The derived {@link UkycClientMaterial}.
- */
-function deriveClientMaterial(localUserSecret) {
-    const storageId = deriveLabeled(localUserSecret, constants_js_1.UKYC_KDF_INFO.storageId, constants_js_1.UKYC_DERIVED_KEY_SIZES.storageId);
-    const dataEncryptionKey = deriveLabeled(localUserSecret, constants_js_1.UKYC_KDF_INFO.dataEncryptionKey, constants_js_1.UKYC_DERIVED_KEY_SIZES.dataEncryptionKey);
-    const signingKey = deriveLabeled(localUserSecret, constants_js_1.UKYC_KDF_INFO.signingKey, constants_js_1.UKYC_DERIVED_KEY_SIZES.signingKey);
-    const relayTunnelKey = deriveLabeled(localUserSecret, constants_js_1.UKYC_KDF_INFO.relayTunnelKey, constants_js_1.UKYC_DERIVED_KEY_SIZES.relayTunnelKey);
-    const signingPublicKey = ed25519_1.ed25519.getPublicKey(signingKey);
-    return {
-        storageId,
-        dataEncryptionKey,
-        signingKey,
-        signingPublicKey,
-        relayTunnelKey,
-    };
-}
-exports.deriveClientMaterial = deriveClientMaterial;
-/**
- * Encodes the non-secret client material into the base64url wire shapes used by
- * the UKYC storage API (`storage_id` and `signing_public_key`).
- *
- * @param material - The derived client material.
- * @returns The base64url-encoded, non-secret fields.
- */
-function encodeClientMaterial(material) {
-    return {
-        storageId: (0, encoding_js_1.toBase64Url)(material.storageId),
-        signingPublicKey: (0, encoding_js_1.toBase64Url)(material.signingPublicKey),
-    };
-}
-exports.encodeClientMaterial = encodeClientMaterial;
-//# sourceMappingURL=deriveClientMaterial.cjs.map

package/dist/ukyc/deriveClientMaterial.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"deriveClientMaterial.cjs","sourceRoot":"","sources":["../../src/ukyc/deriveClientMaterial.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,mDAAgD;AAChD,6CAA0C;AAC1C,6CAA4C;AAE5C,kDAAuE;AACvE,iDAA6C;AAsC7C;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,eAA2B,EAC3B,IAAY,EACZ,MAAc;IAEd,OAAO,IAAA,WAAI,EAAC,aAAM,EAAE,eAAe,EAAE,SAAS,EAAE,IAAA,qBAAa,EAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,oBAAoB,CAClC,eAA2B;IAE3B,MAAM,SAAS,GAAG,aAAa,CAC7B,eAAe,EACf,4BAAa,CAAC,SAAS,EACvB,qCAAsB,CAAC,SAAS,CACjC,CAAC;IAEF,MAAM,iBAAiB,GAAG,aAAa,CACrC,eAAe,EACf,4BAAa,CAAC,iBAAiB,EAC/B,qCAAsB,CAAC,iBAAiB,CACzC,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAC9B,eAAe,EACf,4BAAa,CAAC,UAAU,EACxB,qCAAsB,CAAC,UAAU,CAClC,CAAC;IAEF,MAAM,cAAc,GAAG,aAAa,CAClC,eAAe,EACf,4BAAa,CAAC,cAAc,EAC5B,qCAAsB,CAAC,cAAc,CACtC,CAAC;IAEF,MAAM,gBAAgB,GAAG,iBAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;KACf,CAAC;AACJ,CAAC;AApCD,oDAoCC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,QAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,SAAS,CAAC;QAC1C,gBAAgB,EAAE,IAAA,yBAAW,EAAC,QAAQ,CAAC,gBAAgB,CAAC;KACzD,CAAC;AACJ,CAAC;AAPD,oDAOC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from './constants.js';\nimport { toBase64Url } from '../encoding.js';\n\n/**\n * Derives UKYC client material from the root `local_user_secret` using\n * HKDF-SHA256 with domain-separated `info` labels — see the architecture doc,\n * section \"Client-Derived Material\".\n */\n\n/**\n * The set of values derived from `local_user_secret`.\n */\nexport type UkycClientMaterial = {\n  /** Opaque lookup key for the encrypted KYC object. */\n  storageId: Uint8Array;\n  /** Symmetric key that encrypts `encrypted_kyc_data` (or wraps per-blob keys). */\n  dataEncryptionKey: Uint8Array;\n  /**\n   * Ed25519 private key used to sign `storage_access_token` capabilities. For\n   * Ed25519 the 32-byte HKDF output *is* the private key. The private half\n   * never leaves the device.\n   */\n  signingKey: Uint8Array;\n  /** Public half of `signingKey`, registered with the object on first write. */\n  signingPublicKey: Uint8Array;\n  /** Key for establishing/authenticating the encrypted tunnel to idOS, if needed. */\n  relayTunnelKey: Uint8Array;\n};\n\n/**\n * The same material with byte fields base64url-encoded, matching the wire\n * shapes in the architecture doc (`storage_id` as an opaque id, public key as a\n * \"base64url public key\"). Secret material is intentionally omitted.\n */\nexport type EncodedUkycClientMaterial = {\n  storageId: string;\n  signingPublicKey: string;\n};\n\n/**\n * Derives a single labeled value from `local_user_secret`.\n *\n * No salt is used: `local_user_secret` is already a high-entropy\n * uniformly-random secret, so per-output domain separation comes entirely from\n * the `info` label.\n *\n * @param localUserSecret - The root `local_user_secret` bytes.\n * @param info - Domain-separation label for this output.\n * @param length - Desired output length in bytes.\n * @returns The derived bytes.\n */\nfunction deriveLabeled(\n  localUserSecret: Uint8Array,\n  info: string,\n  length: number,\n): Uint8Array {\n  return hkdf(sha256, localUserSecret, undefined, stringToBytes(info), length);\n}\n\n/**\n * Derives all UKYC client material from the root `local_user_secret`.\n *\n * This is a pure function of `local_user_secret`: the same input always yields\n * the same outputs, which is what makes `storage_id` and `signing_key` stable\n * across sessions and devices.\n *\n * @param localUserSecret - The `local_user_secret` produced by\n * `getOrCreateLocalUserSecret`.\n * @returns The derived {@link UkycClientMaterial}.\n */\nexport function deriveClientMaterial(\n  localUserSecret: Uint8Array,\n): UkycClientMaterial {\n  const storageId = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.storageId,\n    UKYC_DERIVED_KEY_SIZES.storageId,\n  );\n\n  const dataEncryptionKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.dataEncryptionKey,\n    UKYC_DERIVED_KEY_SIZES.dataEncryptionKey,\n  );\n\n  const signingKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.signingKey,\n    UKYC_DERIVED_KEY_SIZES.signingKey,\n  );\n\n  const relayTunnelKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.relayTunnelKey,\n    UKYC_DERIVED_KEY_SIZES.relayTunnelKey,\n  );\n\n  const signingPublicKey = ed25519.getPublicKey(signingKey);\n\n  return {\n    storageId,\n    dataEncryptionKey,\n    signingKey,\n    signingPublicKey,\n    relayTunnelKey,\n  };\n}\n\n/**\n * Encodes the non-secret client material into the base64url wire shapes used by\n * the UKYC storage API (`storage_id` and `signing_public_key`).\n *\n * @param material - The derived client material.\n * @returns The base64url-encoded, non-secret fields.\n */\nexport function encodeClientMaterial(\n  material: UkycClientMaterial,\n): EncodedUkycClientMaterial {\n  return {\n    storageId: toBase64Url(material.storageId),\n    signingPublicKey: toBase64Url(material.signingPublicKey),\n  };\n}\n"]}

package/dist/ukyc/deriveClientMaterial.d.cts

@@ -1,54 +0,0 @@
-/**
- * Derives UKYC client material from the root `local_user_secret` using
- * HKDF-SHA256 with domain-separated `info` labels — see the architecture doc,
- * section "Client-Derived Material".
- */
-/**
- * The set of values derived from `local_user_secret`.
- */
-export type UkycClientMaterial = {
-    /** Opaque lookup key for the encrypted KYC object. */
-    storageId: Uint8Array;
-    /** Symmetric key that encrypts `encrypted_kyc_data` (or wraps per-blob keys). */
-    dataEncryptionKey: Uint8Array;
-    /**
-     * Ed25519 private key used to sign `storage_access_token` capabilities. For
-     * Ed25519 the 32-byte HKDF output *is* the private key. The private half
-     * never leaves the device.
-     */
-    signingKey: Uint8Array;
-    /** Public half of `signingKey`, registered with the object on first write. */
-    signingPublicKey: Uint8Array;
-    /** Key for establishing/authenticating the encrypted tunnel to idOS, if needed. */
-    relayTunnelKey: Uint8Array;
-};
-/**
- * The same material with byte fields base64url-encoded, matching the wire
- * shapes in the architecture doc (`storage_id` as an opaque id, public key as a
- * "base64url public key"). Secret material is intentionally omitted.
- */
-export type EncodedUkycClientMaterial = {
-    storageId: string;
-    signingPublicKey: string;
-};
-/**
- * Derives all UKYC client material from the root `local_user_secret`.
- *
- * This is a pure function of `local_user_secret`: the same input always yields
- * the same outputs, which is what makes `storage_id` and `signing_key` stable
- * across sessions and devices.
- *
- * @param localUserSecret - The `local_user_secret` produced by
- * `getOrCreateLocalUserSecret`.
- * @returns The derived {@link UkycClientMaterial}.
- */
-export declare function deriveClientMaterial(localUserSecret: Uint8Array): UkycClientMaterial;
-/**
- * Encodes the non-secret client material into the base64url wire shapes used by
- * the UKYC storage API (`storage_id` and `signing_public_key`).
- *
- * @param material - The derived client material.
- * @returns The base64url-encoded, non-secret fields.
- */
-export declare function encodeClientMaterial(material: UkycClientMaterial): EncodedUkycClientMaterial;
-//# sourceMappingURL=deriveClientMaterial.d.cts.map

package/dist/ukyc/deriveClientMaterial.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deriveClientMaterial.d.cts","sourceRoot":"","sources":["../../src/ukyc/deriveClientMaterial.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sDAAsD;IACtD,SAAS,EAAE,UAAU,CAAC;IACtB,iFAAiF;IACjF,iBAAiB,EAAE,UAAU,CAAC;IAC9B;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB,8EAA8E;IAC9E,gBAAgB,EAAE,UAAU,CAAC;IAC7B,mFAAmF;IACnF,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAsBF;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,UAAU,GAC1B,kBAAkB,CAkCpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,kBAAkB,GAC3B,yBAAyB,CAK3B"}

package/dist/ukyc/deriveClientMaterial.d.mts

@@ -1,54 +0,0 @@
-/**
- * Derives UKYC client material from the root `local_user_secret` using
- * HKDF-SHA256 with domain-separated `info` labels — see the architecture doc,
- * section "Client-Derived Material".
- */
-/**
- * The set of values derived from `local_user_secret`.
- */
-export type UkycClientMaterial = {
-    /** Opaque lookup key for the encrypted KYC object. */
-    storageId: Uint8Array;
-    /** Symmetric key that encrypts `encrypted_kyc_data` (or wraps per-blob keys). */
-    dataEncryptionKey: Uint8Array;
-    /**
-     * Ed25519 private key used to sign `storage_access_token` capabilities. For
-     * Ed25519 the 32-byte HKDF output *is* the private key. The private half
-     * never leaves the device.
-     */
-    signingKey: Uint8Array;
-    /** Public half of `signingKey`, registered with the object on first write. */
-    signingPublicKey: Uint8Array;
-    /** Key for establishing/authenticating the encrypted tunnel to idOS, if needed. */
-    relayTunnelKey: Uint8Array;
-};
-/**
- * The same material with byte fields base64url-encoded, matching the wire
- * shapes in the architecture doc (`storage_id` as an opaque id, public key as a
- * "base64url public key"). Secret material is intentionally omitted.
- */
-export type EncodedUkycClientMaterial = {
-    storageId: string;
-    signingPublicKey: string;
-};
-/**
- * Derives all UKYC client material from the root `local_user_secret`.
- *
- * This is a pure function of `local_user_secret`: the same input always yields
- * the same outputs, which is what makes `storage_id` and `signing_key` stable
- * across sessions and devices.
- *
- * @param localUserSecret - The `local_user_secret` produced by
- * `getOrCreateLocalUserSecret`.
- * @returns The derived {@link UkycClientMaterial}.
- */
-export declare function deriveClientMaterial(localUserSecret: Uint8Array): UkycClientMaterial;
-/**
- * Encodes the non-secret client material into the base64url wire shapes used by
- * the UKYC storage API (`storage_id` and `signing_public_key`).
- *
- * @param material - The derived client material.
- * @returns The base64url-encoded, non-secret fields.
- */
-export declare function encodeClientMaterial(material: UkycClientMaterial): EncodedUkycClientMaterial;
-//# sourceMappingURL=deriveClientMaterial.d.mts.map

package/dist/ukyc/deriveClientMaterial.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deriveClientMaterial.d.mts","sourceRoot":"","sources":["../../src/ukyc/deriveClientMaterial.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sDAAsD;IACtD,SAAS,EAAE,UAAU,CAAC;IACtB,iFAAiF;IACjF,iBAAiB,EAAE,UAAU,CAAC;IAC9B;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB,8EAA8E;IAC9E,gBAAgB,EAAE,UAAU,CAAC;IAC7B,mFAAmF;IACnF,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAsBF;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,UAAU,GAC1B,kBAAkB,CAkCpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,kBAAkB,GAC3B,yBAAyB,CAK3B"}

package/dist/ukyc/deriveClientMaterial.mjs

@@ -1,60 +0,0 @@
-import { stringToBytes } from "@metamask/utils";
-import { ed25519 } from "@noble/curves/ed25519";
-import { hkdf } from "@noble/hashes/hkdf";
-import { sha256 } from "@noble/hashes/sha2";
-import { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from "./constants.mjs";
-import { toBase64Url } from "../encoding.mjs";
-/**
- * Derives a single labeled value from `local_user_secret`.
- *
- * No salt is used: `local_user_secret` is already a high-entropy
- * uniformly-random secret, so per-output domain separation comes entirely from
- * the `info` label.
- *
- * @param localUserSecret - The root `local_user_secret` bytes.
- * @param info - Domain-separation label for this output.
- * @param length - Desired output length in bytes.
- * @returns The derived bytes.
- */
-function deriveLabeled(localUserSecret, info, length) {
-    return hkdf(sha256, localUserSecret, undefined, stringToBytes(info), length);
-}
-/**
- * Derives all UKYC client material from the root `local_user_secret`.
- *
- * This is a pure function of `local_user_secret`: the same input always yields
- * the same outputs, which is what makes `storage_id` and `signing_key` stable
- * across sessions and devices.
- *
- * @param localUserSecret - The `local_user_secret` produced by
- * `getOrCreateLocalUserSecret`.
- * @returns The derived {@link UkycClientMaterial}.
- */
-export function deriveClientMaterial(localUserSecret) {
-    const storageId = deriveLabeled(localUserSecret, UKYC_KDF_INFO.storageId, UKYC_DERIVED_KEY_SIZES.storageId);
-    const dataEncryptionKey = deriveLabeled(localUserSecret, UKYC_KDF_INFO.dataEncryptionKey, UKYC_DERIVED_KEY_SIZES.dataEncryptionKey);
-    const signingKey = deriveLabeled(localUserSecret, UKYC_KDF_INFO.signingKey, UKYC_DERIVED_KEY_SIZES.signingKey);
-    const relayTunnelKey = deriveLabeled(localUserSecret, UKYC_KDF_INFO.relayTunnelKey, UKYC_DERIVED_KEY_SIZES.relayTunnelKey);
-    const signingPublicKey = ed25519.getPublicKey(signingKey);
-    return {
-        storageId,
-        dataEncryptionKey,
-        signingKey,
-        signingPublicKey,
-        relayTunnelKey,
-    };
-}
-/**
- * Encodes the non-secret client material into the base64url wire shapes used by
- * the UKYC storage API (`storage_id` and `signing_public_key`).
- *
- * @param material - The derived client material.
- * @returns The base64url-encoded, non-secret fields.
- */
-export function encodeClientMaterial(material) {
-    return {
-        storageId: toBase64Url(material.storageId),
-        signingPublicKey: toBase64Url(material.signingPublicKey),
-    };
-}
-//# sourceMappingURL=deriveClientMaterial.mjs.map

package/dist/ukyc/deriveClientMaterial.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"deriveClientMaterial.mjs","sourceRoot":"","sources":["../../src/ukyc/deriveClientMaterial.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB;AAChD,OAAO,EAAE,OAAO,EAAE,8BAA8B;AAChD,OAAO,EAAE,IAAI,EAAE,2BAA2B;AAC1C,OAAO,EAAE,MAAM,EAAE,2BAA2B;AAE5C,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,wBAAuB;AACvE,OAAO,EAAE,WAAW,EAAE,wBAAuB;AAsC7C;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,eAA2B,EAC3B,IAAY,EACZ,MAAc;IAEd,OAAO,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAA2B;IAE3B,MAAM,SAAS,GAAG,aAAa,CAC7B,eAAe,EACf,aAAa,CAAC,SAAS,EACvB,sBAAsB,CAAC,SAAS,CACjC,CAAC;IAEF,MAAM,iBAAiB,GAAG,aAAa,CACrC,eAAe,EACf,aAAa,CAAC,iBAAiB,EAC/B,sBAAsB,CAAC,iBAAiB,CACzC,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAC9B,eAAe,EACf,aAAa,CAAC,UAAU,EACxB,sBAAsB,CAAC,UAAU,CAClC,CAAC;IAEF,MAAM,cAAc,GAAG,aAAa,CAClC,eAAe,EACf,aAAa,CAAC,cAAc,EAC5B,sBAAsB,CAAC,cAAc,CACtC,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,UAAU;QACV,gBAAgB;QAChB,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1C,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KACzD,CAAC;AACJ,CAAC","sourcesContent":["import { stringToBytes } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\nimport { hkdf } from '@noble/hashes/hkdf';\nimport { sha256 } from '@noble/hashes/sha2';\n\nimport { UKYC_DERIVED_KEY_SIZES, UKYC_KDF_INFO } from './constants.js';\nimport { toBase64Url } from '../encoding.js';\n\n/**\n * Derives UKYC client material from the root `local_user_secret` using\n * HKDF-SHA256 with domain-separated `info` labels — see the architecture doc,\n * section \"Client-Derived Material\".\n */\n\n/**\n * The set of values derived from `local_user_secret`.\n */\nexport type UkycClientMaterial = {\n  /** Opaque lookup key for the encrypted KYC object. */\n  storageId: Uint8Array;\n  /** Symmetric key that encrypts `encrypted_kyc_data` (or wraps per-blob keys). */\n  dataEncryptionKey: Uint8Array;\n  /**\n   * Ed25519 private key used to sign `storage_access_token` capabilities. For\n   * Ed25519 the 32-byte HKDF output *is* the private key. The private half\n   * never leaves the device.\n   */\n  signingKey: Uint8Array;\n  /** Public half of `signingKey`, registered with the object on first write. */\n  signingPublicKey: Uint8Array;\n  /** Key for establishing/authenticating the encrypted tunnel to idOS, if needed. */\n  relayTunnelKey: Uint8Array;\n};\n\n/**\n * The same material with byte fields base64url-encoded, matching the wire\n * shapes in the architecture doc (`storage_id` as an opaque id, public key as a\n * \"base64url public key\"). Secret material is intentionally omitted.\n */\nexport type EncodedUkycClientMaterial = {\n  storageId: string;\n  signingPublicKey: string;\n};\n\n/**\n * Derives a single labeled value from `local_user_secret`.\n *\n * No salt is used: `local_user_secret` is already a high-entropy\n * uniformly-random secret, so per-output domain separation comes entirely from\n * the `info` label.\n *\n * @param localUserSecret - The root `local_user_secret` bytes.\n * @param info - Domain-separation label for this output.\n * @param length - Desired output length in bytes.\n * @returns The derived bytes.\n */\nfunction deriveLabeled(\n  localUserSecret: Uint8Array,\n  info: string,\n  length: number,\n): Uint8Array {\n  return hkdf(sha256, localUserSecret, undefined, stringToBytes(info), length);\n}\n\n/**\n * Derives all UKYC client material from the root `local_user_secret`.\n *\n * This is a pure function of `local_user_secret`: the same input always yields\n * the same outputs, which is what makes `storage_id` and `signing_key` stable\n * across sessions and devices.\n *\n * @param localUserSecret - The `local_user_secret` produced by\n * `getOrCreateLocalUserSecret`.\n * @returns The derived {@link UkycClientMaterial}.\n */\nexport function deriveClientMaterial(\n  localUserSecret: Uint8Array,\n): UkycClientMaterial {\n  const storageId = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.storageId,\n    UKYC_DERIVED_KEY_SIZES.storageId,\n  );\n\n  const dataEncryptionKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.dataEncryptionKey,\n    UKYC_DERIVED_KEY_SIZES.dataEncryptionKey,\n  );\n\n  const signingKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.signingKey,\n    UKYC_DERIVED_KEY_SIZES.signingKey,\n  );\n\n  const relayTunnelKey = deriveLabeled(\n    localUserSecret,\n    UKYC_KDF_INFO.relayTunnelKey,\n    UKYC_DERIVED_KEY_SIZES.relayTunnelKey,\n  );\n\n  const signingPublicKey = ed25519.getPublicKey(signingKey);\n\n  return {\n    storageId,\n    dataEncryptionKey,\n    signingKey,\n    signingPublicKey,\n    relayTunnelKey,\n  };\n}\n\n/**\n * Encodes the non-secret client material into the base64url wire shapes used by\n * the UKYC storage API (`storage_id` and `signing_public_key`).\n *\n * @param material - The derived client material.\n * @returns The base64url-encoded, non-secret fields.\n */\nexport function encodeClientMaterial(\n  material: UkycClientMaterial,\n): EncodedUkycClientMaterial {\n  return {\n    storageId: toBase64Url(material.storageId),\n    signingPublicKey: toBase64Url(material.signingPublicKey),\n  };\n}\n"]}

package/dist/ukyc/jwtChain.cjs

@@ -1,54 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyJwtChain = void 0;
-const utils_1 = require("@metamask/utils");
-const ed25519_1 = require("@noble/curves/ed25519");
-const encoding_js_1 = require("../encoding.cjs");
-/**
- * Decodes a base64url JWT segment into a parsed JSON object.
- *
- * @param segment - The base64url-encoded segment.
- * @param label - Human-readable segment name for error messages.
- * @returns The parsed JSON object.
- */
-function decodeJsonSegment(segment, label) {
-    try {
-        return JSON.parse((0, utils_1.bytesToString)((0, encoding_js_1.base64UrlToBytes)(segment)));
-    }
-    catch (error) {
-        throw new Error(`UKYC: failed to decode jwtChain ${label}: ${String(error)}`);
-    }
-}
-/**
- * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a
- * published Ed25519 signing key and checks the EdDSA signature over the
- * `header.payload` input. Returns the decoded, verified payload.
- *
- * @param keys - The JWKS keys published by the Fractal encryption service.
- * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.
- * @returns The verified JWT payload.
- */
-function verifyJwtChain(keys, jwtChain) {
-    const [headerSegment, payloadSegment, signatureSegment] = jwtChain.split('.');
-    if (!headerSegment || !payloadSegment || !signatureSegment) {
-        throw new Error('UKYC: jwtChain is not a well-formed JWT (expected 3 segments).');
-    }
-    const header = decodeJsonSegment(headerSegment, 'header');
-    if (header.alg !== 'EdDSA') {
-        throw new Error(`UKYC: unsupported jwtChain alg "${String(header.alg)}" (expected EdDSA).`);
-    }
-    const jwk = keys.find((key) => key.kid === header.kid);
-    if (!jwk) {
-        throw new Error(`UKYC: no JWKS key matches jwtChain kid "${String(header.kid)}".`);
-    }
-    if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {
-        throw new Error(`UKYC: JWKS key ${jwk.kid} is not an Ed25519 OKP key (kty=${jwk.kty}, crv=${jwk.crv}).`);
-    }
-    const isValid = ed25519_1.ed25519.verify((0, encoding_js_1.base64UrlToBytes)(signatureSegment), new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), (0, encoding_js_1.base64UrlToBytes)(jwk.x));
-    if (!isValid) {
-        throw new Error('UKYC: jwtChain signature verification failed against JWKS.');
-    }
-    return decodeJsonSegment(payloadSegment, 'payload');
-}
-exports.verifyJwtChain = verifyJwtChain;
-//# sourceMappingURL=jwtChain.cjs.map

package/dist/ukyc/jwtChain.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwtChain.cjs","sourceRoot":"","sources":["../../src/ukyc/jwtChain.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,mDAAgD;AAEhD,iDAAkD;AA0ClD;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAO,OAAe,EAAE,KAAa;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,qBAAa,EAAC,IAAA,8BAAgB,EAAC,OAAO,CAAC,CAAC,CAAS,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,IAAW,EAAE,QAAgB;IAC1D,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAY,aAAa,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CACvC,MAAM,CAAC,GAAG,CACX,qBAAqB,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,GAAG,mCAAmC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,IAAI,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAO,CAAC,MAAM,CAC5B,IAAA,8BAAgB,EAAC,gBAAgB,CAAC,EAClC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC,EAC9D,IAAA,8BAAgB,EAAC,GAAG,CAAC,CAAC,CAAC,CACxB,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CAAkB,cAAc,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAzCD,wCAyCC","sourcesContent":["import { bytesToString } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport { base64UrlToBytes } from '../encoding.js';\n\n/**\n * Verifies the `jwtChain` returned by the Fractal encryption service against\n * its published JWKS.\n *\n * The signature check is done with `@noble/curves` (rather than WebCrypto\n * `subtle`) because not every MetaMask runtime exposes a `subtle`\n * implementation for Ed25519; JWT parsing is a plain base64url/JSON decode, so\n * no `jose` dependency is required.\n */\n\n/**\n * A single Ed25519 (OKP) JSON Web Key from the Fractal JWKS.\n */\nexport type Jwk = {\n  kty: string;\n  crv: string;\n  x: string;\n  kid: string;\n  use?: string;\n  alg?: string;\n};\n\n/**\n * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the\n * server's X25519 public key so the client can confirm the value returned\n * out-of-band by `getWrappingKey` was not tampered with.\n */\nexport type JwtChainPayload = {\n  sessionServerPublicKeyX: string;\n  nonce: string;\n};\n\n/**\n * The protected header of a compact JWT.\n */\ntype JwtHeader = {\n  alg?: string;\n  kid?: string;\n};\n\n/**\n * Decodes a base64url JWT segment into a parsed JSON object.\n *\n * @param segment - The base64url-encoded segment.\n * @param label - Human-readable segment name for error messages.\n * @returns The parsed JSON object.\n */\nfunction decodeJsonSegment<Type>(segment: string, label: string): Type {\n  try {\n    return JSON.parse(bytesToString(base64UrlToBytes(segment))) as Type;\n  } catch (error) {\n    throw new Error(\n      `UKYC: failed to decode jwtChain ${label}: ${String(error)}`,\n    );\n  }\n}\n\n/**\n * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a\n * published Ed25519 signing key and checks the EdDSA signature over the\n * `header.payload` input. Returns the decoded, verified payload.\n *\n * @param keys - The JWKS keys published by the Fractal encryption service.\n * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.\n * @returns The verified JWT payload.\n */\nexport function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload {\n  const [headerSegment, payloadSegment, signatureSegment] = jwtChain.split('.');\n  if (!headerSegment || !payloadSegment || !signatureSegment) {\n    throw new Error(\n      'UKYC: jwtChain is not a well-formed JWT (expected 3 segments).',\n    );\n  }\n\n  const header = decodeJsonSegment<JwtHeader>(headerSegment, 'header');\n  if (header.alg !== 'EdDSA') {\n    throw new Error(\n      `UKYC: unsupported jwtChain alg \"${String(\n        header.alg,\n      )}\" (expected EdDSA).`,\n    );\n  }\n\n  const jwk = keys.find((key) => key.kid === header.kid);\n  if (!jwk) {\n    throw new Error(\n      `UKYC: no JWKS key matches jwtChain kid \"${String(header.kid)}\".`,\n    );\n  }\n  if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {\n    throw new Error(\n      `UKYC: JWKS key ${jwk.kid} is not an Ed25519 OKP key (kty=${jwk.kty}, crv=${jwk.crv}).`,\n    );\n  }\n\n  const isValid = ed25519.verify(\n    base64UrlToBytes(signatureSegment),\n    new TextEncoder().encode(`${headerSegment}.${payloadSegment}`),\n    base64UrlToBytes(jwk.x),\n  );\n  if (!isValid) {\n    throw new Error(\n      'UKYC: jwtChain signature verification failed against JWKS.',\n    );\n  }\n\n  return decodeJsonSegment<JwtChainPayload>(payloadSegment, 'payload');\n}\n"]}

package/dist/ukyc/jwtChain.d.cts

@@ -1,40 +0,0 @@
-/**
- * Verifies the `jwtChain` returned by the Fractal encryption service against
- * its published JWKS.
- *
- * The signature check is done with `@noble/curves` (rather than WebCrypto
- * `subtle`) because not every MetaMask runtime exposes a `subtle`
- * implementation for Ed25519; JWT parsing is a plain base64url/JSON decode, so
- * no `jose` dependency is required.
- */
-/**
- * A single Ed25519 (OKP) JSON Web Key from the Fractal JWKS.
- */
-export type Jwk = {
-    kty: string;
-    crv: string;
-    x: string;
-    kid: string;
-    use?: string;
-    alg?: string;
-};
-/**
- * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the
- * server's X25519 public key so the client can confirm the value returned
- * out-of-band by `getWrappingKey` was not tampered with.
- */
-export type JwtChainPayload = {
-    sessionServerPublicKeyX: string;
-    nonce: string;
-};
-/**
- * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a
- * published Ed25519 signing key and checks the EdDSA signature over the
- * `header.payload` input. Returns the decoded, verified payload.
- *
- * @param keys - The JWKS keys published by the Fractal encryption service.
- * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.
- * @returns The verified JWT payload.
- */
-export declare function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload;
-//# sourceMappingURL=jwtChain.d.cts.map

package/dist/ukyc/jwtChain.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwtChain.d.cts","sourceRoot":"","sources":["../../src/ukyc/jwtChain.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AA2BF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAyC7E"}

package/dist/ukyc/jwtChain.d.mts

@@ -1,40 +0,0 @@
-/**
- * Verifies the `jwtChain` returned by the Fractal encryption service against
- * its published JWKS.
- *
- * The signature check is done with `@noble/curves` (rather than WebCrypto
- * `subtle`) because not every MetaMask runtime exposes a `subtle`
- * implementation for Ed25519; JWT parsing is a plain base64url/JSON decode, so
- * no `jose` dependency is required.
- */
-/**
- * A single Ed25519 (OKP) JSON Web Key from the Fractal JWKS.
- */
-export type Jwk = {
-    kty: string;
-    crv: string;
-    x: string;
-    kid: string;
-    use?: string;
-    alg?: string;
-};
-/**
- * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the
- * server's X25519 public key so the client can confirm the value returned
- * out-of-band by `getWrappingKey` was not tampered with.
- */
-export type JwtChainPayload = {
-    sessionServerPublicKeyX: string;
-    nonce: string;
-};
-/**
- * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a
- * published Ed25519 signing key and checks the EdDSA signature over the
- * `header.payload` input. Returns the decoded, verified payload.
- *
- * @param keys - The JWKS keys published by the Fractal encryption service.
- * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.
- * @returns The verified JWT payload.
- */
-export declare function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload;
-//# sourceMappingURL=jwtChain.d.mts.map

package/dist/ukyc/jwtChain.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwtChain.d.mts","sourceRoot":"","sources":["../../src/ukyc/jwtChain.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,MAAM,GAAG,GAAG;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,MAAM,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AA2BF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAyC7E"}

package/dist/ukyc/jwtChain.mjs

@@ -1,50 +0,0 @@
-import { bytesToString } from "@metamask/utils";
-import { ed25519 } from "@noble/curves/ed25519";
-import { base64UrlToBytes } from "../encoding.mjs";
-/**
- * Decodes a base64url JWT segment into a parsed JSON object.
- *
- * @param segment - The base64url-encoded segment.
- * @param label - Human-readable segment name for error messages.
- * @returns The parsed JSON object.
- */
-function decodeJsonSegment(segment, label) {
-    try {
-        return JSON.parse(bytesToString(base64UrlToBytes(segment)));
-    }
-    catch (error) {
-        throw new Error(`UKYC: failed to decode jwtChain ${label}: ${String(error)}`);
-    }
-}
-/**
- * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a
- * published Ed25519 signing key and checks the EdDSA signature over the
- * `header.payload` input. Returns the decoded, verified payload.
- *
- * @param keys - The JWKS keys published by the Fractal encryption service.
- * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.
- * @returns The verified JWT payload.
- */
-export function verifyJwtChain(keys, jwtChain) {
-    const [headerSegment, payloadSegment, signatureSegment] = jwtChain.split('.');
-    if (!headerSegment || !payloadSegment || !signatureSegment) {
-        throw new Error('UKYC: jwtChain is not a well-formed JWT (expected 3 segments).');
-    }
-    const header = decodeJsonSegment(headerSegment, 'header');
-    if (header.alg !== 'EdDSA') {
-        throw new Error(`UKYC: unsupported jwtChain alg "${String(header.alg)}" (expected EdDSA).`);
-    }
-    const jwk = keys.find((key) => key.kid === header.kid);
-    if (!jwk) {
-        throw new Error(`UKYC: no JWKS key matches jwtChain kid "${String(header.kid)}".`);
-    }
-    if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {
-        throw new Error(`UKYC: JWKS key ${jwk.kid} is not an Ed25519 OKP key (kty=${jwk.kty}, crv=${jwk.crv}).`);
-    }
-    const isValid = ed25519.verify(base64UrlToBytes(signatureSegment), new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), base64UrlToBytes(jwk.x));
-    if (!isValid) {
-        throw new Error('UKYC: jwtChain signature verification failed against JWKS.');
-    }
-    return decodeJsonSegment(payloadSegment, 'payload');
-}
-//# sourceMappingURL=jwtChain.mjs.map