@metamask-previews/kyc-controller 0.0.0-preview-e68ab1498 → 0.0.0-preview-4b37525

package/dist/index.d.cts

@@ -2,13 +2,13 @@ export { KycController, getDefaultKycControllerState, controllerName, } from "./
 export type { KycControllerActions, KycControllerEvents, KycControllerGetStateAction, KycControllerMessenger, KycControllerOptions, KycControllerState, KycControllerStateChangeEvent, KycControllerStatusChangedEvent, } from "./KycController.cjs";
 export type { KycControllerAcceptTermsAndStartSessionAction, KycControllerBuildAuthFrameUrlAction, KycControllerBuildCheckFrameUrlAction, KycControllerBuildResetFrameUrlAction, KycControllerCheckKycRequiredAction, KycControllerClearSavedTermsAction, KycControllerClearStateAction, KycControllerCreateVendorCustomerAction, KycControllerGetCustomerIdentityAction, KycControllerGetKycStatusAction, KycControllerGetSessionStatusAction, KycControllerHandleFrameMessageAction, KycControllerInitializeAction, KycControllerLoadDisclaimersAction, KycControllerRefreshKycStatusAction, KycControllerResetAction, KycControllerStartSumSubAction, } from "./KycController-method-action-types.cjs";
 export { KycService, serviceName } from "./KycService.cjs";
-export type { ApplicantAccessTokenResponse, CheckKycRequiredParams, CreateVendorCustomerParams, CreateSessionParams, CreateUkycSessionParams, GetSessionStatusParams, GetWrappingKeyParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SubmitConsentsParams, UkycSessionResponse, WrappedEncryptionKey, WrappingKeyResponse, } from "./KycService.cjs";
-export type { KycServiceCheckKycRequiredAction, KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchDisclaimersAction, KycServiceFetchJwksAction, KycServiceFetchKycStatusAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceGetWrappingKeyAction, KycServiceSubmitConsentsAction, } from "./KycService-method-action-types.cjs";
+export type { ApplicantAccessTokenResponse, CapabilityAuthorization, CheckKycRequiredParams, CreateVendorCustomerParams, CreateSessionParams, CreateUkycSessionParams, EncryptionSchema, FetchSessionDisclaimersParams, GetSessionStatusParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SetAuthorizationsParams, SubmitSessionDisclaimersParams, SubmitVendorDisclaimersParams, UkycSessionResponse, } from "./KycService.cjs";
+export type { KycServiceCheckKycRequiredAction, KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchDisclaimersAction, KycServiceFetchJwksAction, KycServiceFetchKycStatusAction, KycServiceFetchSessionDisclaimersAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceSetAuthorizationsAction, KycServiceSubmitSessionDisclaimersAction, KycServiceSubmitVendorDisclaimersAction, } from "./KycService-method-action-types.cjs";
 export { selectIsKycRequiredForProduct, selectKycPhase, selectKycSumSub, } from "./selectors.cjs";
 export { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from "./countryCodes.cjs";
 export { decryptCredentials, generateKeyPair } from "./crypto.cjs";
 export type { DecryptedCredentials, DecryptResult, EncryptedCredentialsEnvelope, X25519KeyPair, } from "./crypto.cjs";
-export type { KycCustomerIdentity, KycDisclaimer, KycPhase, KycProduct, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, } from "./types.cjs";
+export type { KycConsentDocument, KycConsentRecord, KycCustomerIdentity, KycDisclaimer, KycPhase, KycProduct, KycSessionDisclaimers, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, KycVendorSigning, } from "./types.cjs";
 export { UKYC_CAPABILITY_AUTH_SCHEME, UKYC_KWIL_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES, UKYC_STORAGE_ACCESS_TOKEN_VERSION, } from "./ukyc/constants.cjs";
 export { deriveClientMaterial, encodeClientMaterial, } from "./ukyc/deriveClientMaterial.cjs";
 export type { EncodedUkycClientMaterial, UkycClientMaterial, } from "./ukyc/deriveClientMaterial.cjs";

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC/B,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}
+{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,EAC9B,uCAAuC,EACvC,6BAA6B,EAC7B,gCAAgC,EAChC,iCAAiC,EACjC,wCAAwC,EACxC,uCAAuC,GACxC,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,gBAAgB,GACjB,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}

package/dist/index.d.mts

@@ -2,13 +2,13 @@ export { KycController, getDefaultKycControllerState, controllerName, } from "./
 export type { KycControllerActions, KycControllerEvents, KycControllerGetStateAction, KycControllerMessenger, KycControllerOptions, KycControllerState, KycControllerStateChangeEvent, KycControllerStatusChangedEvent, } from "./KycController.mjs";
 export type { KycControllerAcceptTermsAndStartSessionAction, KycControllerBuildAuthFrameUrlAction, KycControllerBuildCheckFrameUrlAction, KycControllerBuildResetFrameUrlAction, KycControllerCheckKycRequiredAction, KycControllerClearSavedTermsAction, KycControllerClearStateAction, KycControllerCreateVendorCustomerAction, KycControllerGetCustomerIdentityAction, KycControllerGetKycStatusAction, KycControllerGetSessionStatusAction, KycControllerHandleFrameMessageAction, KycControllerInitializeAction, KycControllerLoadDisclaimersAction, KycControllerRefreshKycStatusAction, KycControllerResetAction, KycControllerStartSumSubAction, } from "./KycController-method-action-types.mjs";
 export { KycService, serviceName } from "./KycService.mjs";
-export type { ApplicantAccessTokenResponse, CheckKycRequiredParams, CreateVendorCustomerParams, CreateSessionParams, CreateUkycSessionParams, GetSessionStatusParams, GetWrappingKeyParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SubmitConsentsParams, UkycSessionResponse, WrappedEncryptionKey, WrappingKeyResponse, } from "./KycService.mjs";
-export type { KycServiceCheckKycRequiredAction, KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchDisclaimersAction, KycServiceFetchJwksAction, KycServiceFetchKycStatusAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceGetWrappingKeyAction, KycServiceSubmitConsentsAction, } from "./KycService-method-action-types.mjs";
+export type { ApplicantAccessTokenResponse, CapabilityAuthorization, CheckKycRequiredParams, CreateVendorCustomerParams, CreateSessionParams, CreateUkycSessionParams, EncryptionSchema, FetchSessionDisclaimersParams, GetSessionStatusParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SetAuthorizationsParams, SubmitSessionDisclaimersParams, SubmitVendorDisclaimersParams, UkycSessionResponse, } from "./KycService.mjs";
+export type { KycServiceCheckKycRequiredAction, KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchDisclaimersAction, KycServiceFetchJwksAction, KycServiceFetchKycStatusAction, KycServiceFetchSessionDisclaimersAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceSetAuthorizationsAction, KycServiceSubmitSessionDisclaimersAction, KycServiceSubmitVendorDisclaimersAction, } from "./KycService-method-action-types.mjs";
 export { selectIsKycRequiredForProduct, selectKycPhase, selectKycSumSub, } from "./selectors.mjs";
 export { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from "./countryCodes.mjs";
 export { decryptCredentials, generateKeyPair } from "./crypto.mjs";
 export type { DecryptedCredentials, DecryptResult, EncryptedCredentialsEnvelope, X25519KeyPair, } from "./crypto.mjs";
-export type { KycCustomerIdentity, KycDisclaimer, KycPhase, KycProduct, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, } from "./types.mjs";
+export type { KycConsentDocument, KycConsentRecord, KycCustomerIdentity, KycDisclaimer, KycPhase, KycProduct, KycSessionDisclaimers, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, KycVendorSigning, } from "./types.mjs";
 export { UKYC_CAPABILITY_AUTH_SCHEME, UKYC_KWIL_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES, UKYC_STORAGE_ACCESS_TOKEN_VERSION, } from "./ukyc/constants.mjs";
 export { deriveClientMaterial, encodeClientMaterial, } from "./ukyc/deriveClientMaterial.mjs";
 export type { EncodedUkycClientMaterial, UkycClientMaterial, } from "./ukyc/deriveClientMaterial.mjs";

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC/B,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,EAC9B,uCAAuC,EACvC,6BAA6B,EAC7B,gCAAgC,EAChC,iCAAiC,EACjC,wCAAwC,EACxC,uCAAuC,GACxC,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,gBAAgB,GACjB,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACf,4BAA2B;AA+B5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAsC1D,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,EAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAsBlE,iFAAiF;AACjF,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,EAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,wCAAuC;AAKxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACvB,sCAAqC;AAQtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B","sourcesContent":["export {\n  KycController,\n  getDefaultKycControllerState,\n  controllerName,\n} from './KycController.js';\nexport type {\n  KycControllerActions,\n  KycControllerEvents,\n  KycControllerGetStateAction,\n  KycControllerMessenger,\n  KycControllerOptions,\n  KycControllerState,\n  KycControllerStateChangeEvent,\n  KycControllerStatusChangedEvent,\n} from './KycController.js';\nexport type {\n  KycControllerAcceptTermsAndStartSessionAction,\n  KycControllerBuildAuthFrameUrlAction,\n  KycControllerBuildCheckFrameUrlAction,\n  KycControllerBuildResetFrameUrlAction,\n  KycControllerCheckKycRequiredAction,\n  KycControllerClearSavedTermsAction,\n  KycControllerClearStateAction,\n  KycControllerCreateVendorCustomerAction,\n  KycControllerGetCustomerIdentityAction,\n  KycControllerGetKycStatusAction,\n  KycControllerGetSessionStatusAction,\n  KycControllerHandleFrameMessageAction,\n  KycControllerInitializeAction,\n  KycControllerLoadDisclaimersAction,\n  KycControllerRefreshKycStatusAction,\n  KycControllerResetAction,\n  KycControllerStartSumSubAction,\n} from './KycController-method-action-types.js';\n\nexport { KycService, serviceName } from './KycService.js';\nexport type {\n  ApplicantAccessTokenResponse,\n  CheckKycRequiredParams,\n  CreateVendorCustomerParams,\n  CreateSessionParams,\n  CreateUkycSessionParams,\n  GetSessionStatusParams,\n  GetWrappingKeyParams,\n  VendorCustomerResponse,\n  JwksResponse,\n  KycServiceActions,\n  KycServiceCacheUpdatedEvent,\n  KycServiceEvents,\n  KycServiceGranularCacheUpdatedEvent,\n  KycServiceInvalidateQueriesAction,\n  KycServiceMessenger,\n  KycServiceOptions,\n  SubmitConsentsParams,\n  UkycSessionResponse,\n  WrappedEncryptionKey,\n  WrappingKeyResponse,\n} from './KycService.js';\nexport type {\n  KycServiceCheckKycRequiredAction,\n  KycServiceCreateVendorCustomerAction,\n  KycServiceCreateJourneyAction,\n  KycServiceCreateSessionAction,\n  KycServiceCreateUkycSessionAction,\n  KycServiceFetchDisclaimersAction,\n  KycServiceFetchJwksAction,\n  KycServiceFetchKycStatusAction,\n  KycServiceGetGeoCountryAction,\n  KycServiceGetSessionStatusAction,\n  KycServiceGetWrappingKeyAction,\n  KycServiceSubmitConsentsAction,\n} from './KycService-method-action-types.js';\n\nexport {\n  selectIsKycRequiredForProduct,\n  selectKycPhase,\n  selectKycSumSub,\n} from './selectors.js';\n\nexport { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from './countryCodes.js';\nexport { decryptCredentials, generateKeyPair } from './crypto.js';\nexport type {\n  DecryptedCredentials,\n  DecryptResult,\n  EncryptedCredentialsEnvelope,\n  X25519KeyPair,\n} from './crypto.js';\n\nexport type {\n  KycCustomerIdentity,\n  KycDisclaimer,\n  KycPhase,\n  KycProduct,\n  KycSessionStatus,\n  KycSumSubLaunchParams,\n  KycSumSubLauncher,\n  KycSumSubStatus,\n  KycUserStatus,\n  KycUserStatusResponse,\n  KycVendor,\n} from './types.js';\n\n// UKYC storage-access-token utilities. Exported so a signed capability token can\n// be minted for testing UKYC Storage (see `mintUkycTestToken`).\nexport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_KWIL_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './ukyc/constants.js';\nexport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport type {\n  EncodedUkycClientMaterial,\n  UkycClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nexport type {\n  SignStorageAccessTokenParams,\n  UkycStorageAccessToken,\n  UkycStorageAccessTokenPayload,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './ukyc/storageAccessToken.js';\nexport { mintUkycTestToken } from './ukyc/testToken.js';\nexport type {\n  MintedUkycTestToken,\n  MintUkycTestTokenParams,\n} from './ukyc/testToken.js';\n"]}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACf,4BAA2B;AA+B5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AA0C1D,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,EAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AA0BlE,iFAAiF;AACjF,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,EAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,wCAAuC;AAKxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACvB,sCAAqC;AAQtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B","sourcesContent":["export {\n  KycController,\n  getDefaultKycControllerState,\n  controllerName,\n} from './KycController.js';\nexport type {\n  KycControllerActions,\n  KycControllerEvents,\n  KycControllerGetStateAction,\n  KycControllerMessenger,\n  KycControllerOptions,\n  KycControllerState,\n  KycControllerStateChangeEvent,\n  KycControllerStatusChangedEvent,\n} from './KycController.js';\nexport type {\n  KycControllerAcceptTermsAndStartSessionAction,\n  KycControllerBuildAuthFrameUrlAction,\n  KycControllerBuildCheckFrameUrlAction,\n  KycControllerBuildResetFrameUrlAction,\n  KycControllerCheckKycRequiredAction,\n  KycControllerClearSavedTermsAction,\n  KycControllerClearStateAction,\n  KycControllerCreateVendorCustomerAction,\n  KycControllerGetCustomerIdentityAction,\n  KycControllerGetKycStatusAction,\n  KycControllerGetSessionStatusAction,\n  KycControllerHandleFrameMessageAction,\n  KycControllerInitializeAction,\n  KycControllerLoadDisclaimersAction,\n  KycControllerRefreshKycStatusAction,\n  KycControllerResetAction,\n  KycControllerStartSumSubAction,\n} from './KycController-method-action-types.js';\n\nexport { KycService, serviceName } from './KycService.js';\nexport type {\n  ApplicantAccessTokenResponse,\n  CapabilityAuthorization,\n  CheckKycRequiredParams,\n  CreateVendorCustomerParams,\n  CreateSessionParams,\n  CreateUkycSessionParams,\n  EncryptionSchema,\n  FetchSessionDisclaimersParams,\n  GetSessionStatusParams,\n  VendorCustomerResponse,\n  JwksResponse,\n  KycServiceActions,\n  KycServiceCacheUpdatedEvent,\n  KycServiceEvents,\n  KycServiceGranularCacheUpdatedEvent,\n  KycServiceInvalidateQueriesAction,\n  KycServiceMessenger,\n  KycServiceOptions,\n  SetAuthorizationsParams,\n  SubmitSessionDisclaimersParams,\n  SubmitVendorDisclaimersParams,\n  UkycSessionResponse,\n} from './KycService.js';\nexport type {\n  KycServiceCheckKycRequiredAction,\n  KycServiceCreateVendorCustomerAction,\n  KycServiceCreateJourneyAction,\n  KycServiceCreateSessionAction,\n  KycServiceCreateUkycSessionAction,\n  KycServiceFetchDisclaimersAction,\n  KycServiceFetchJwksAction,\n  KycServiceFetchKycStatusAction,\n  KycServiceFetchSessionDisclaimersAction,\n  KycServiceGetGeoCountryAction,\n  KycServiceGetSessionStatusAction,\n  KycServiceSetAuthorizationsAction,\n  KycServiceSubmitSessionDisclaimersAction,\n  KycServiceSubmitVendorDisclaimersAction,\n} from './KycService-method-action-types.js';\n\nexport {\n  selectIsKycRequiredForProduct,\n  selectKycPhase,\n  selectKycSumSub,\n} from './selectors.js';\n\nexport { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from './countryCodes.js';\nexport { decryptCredentials, generateKeyPair } from './crypto.js';\nexport type {\n  DecryptedCredentials,\n  DecryptResult,\n  EncryptedCredentialsEnvelope,\n  X25519KeyPair,\n} from './crypto.js';\n\nexport type {\n  KycConsentDocument,\n  KycConsentRecord,\n  KycCustomerIdentity,\n  KycDisclaimer,\n  KycPhase,\n  KycProduct,\n  KycSessionDisclaimers,\n  KycSessionStatus,\n  KycSumSubLaunchParams,\n  KycSumSubLauncher,\n  KycSumSubStatus,\n  KycUserStatus,\n  KycUserStatusResponse,\n  KycVendor,\n  KycVendorSigning,\n} from './types.js';\n\n// UKYC storage-access-token utilities. Exported so a signed capability token can\n// be minted for testing UKYC Storage (see `mintUkycTestToken`).\nexport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_KWIL_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './ukyc/constants.js';\nexport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport type {\n  EncodedUkycClientMaterial,\n  UkycClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nexport type {\n  SignStorageAccessTokenParams,\n  UkycStorageAccessToken,\n  UkycStorageAccessTokenPayload,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './ukyc/storageAccessToken.js';\nexport { mintUkycTestToken } from './ukyc/testToken.js';\nexport type {\n  MintedUkycTestToken,\n  MintUkycTestTokenParams,\n} from './ukyc/testToken.js';\n"]}

package/dist/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for toast /\n * banner rendering. Collapses vendor + SumSub / relay state into the offsite\n * contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or posting consents\n *   (non-MoonPay vendors).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Consents-path vendors skip\n *   this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a session is\n * created.\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}
+{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for toast /\n * banner rendering. Collapses vendor + SumSub / relay state into the offsite\n * contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or creating the UKYC\n *   session and recording session-scoped disclaimers (non-MoonPay vendors).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Consents-path vendors skip\n *   this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a vendor session is\n * created (`GET /vendors/{vendor}/disclaimers`).\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * A vendor T&C signing returned by `POST /vendors/{vendor}/disclaimers`.\n */\nexport type KycVendorSigning = {\n  /** Iron signing id. */\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  customer_id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  content_id?: string;\n};\n\n/**\n * A legal document in the session-scoped idOS / KYC-provider catalog\n * (`GET`/`POST /sessions/{sessionId}/disclaimers`).\n */\nexport type KycConsentDocument = {\n  /** Stable identifier of the legal document. */\n  key: string;\n  /** Version of the document currently in force. */\n  version: string;\n  /** Human-readable document title. */\n  title: string;\n  /** URL the document body is hosted at. */\n  url: string;\n  /** Whether this session already consented to this document version. */\n  consented: boolean;\n};\n\n/**\n * A consent record posted for a catalog document. `key` and `version` must\n * match the current session catalog.\n */\nexport type KycConsentRecord = {\n  key: string;\n  version: string;\n};\n\n/**\n * Session-scoped disclaimer catalog returned by\n * `GET`/`POST /sessions/{sessionId}/disclaimers`.\n */\nexport type KycSessionDisclaimers = {\n  /** idOS legal documents. */\n  idOS: KycConsentDocument[];\n  /** KYC provider (SumSub) legal documents. */\n  kycProvider: KycConsentDocument[];\n  /** Whether the user consented to reuse existing idOS credentials. */\n  credentialReusabilityConsentGiven: boolean;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}

package/dist/types.d.cts

@@ -55,8 +55,8 @@ export type KycUserStatusResponse = {
  *
  * - `idle` — nothing started.
  * - `terms` — waiting for the customer to accept the vendor terms.
- * - `session` — creating the vendor session (MoonPay) or posting consents
- *   (non-MoonPay vendors).
+ * - `session` — creating the vendor session (MoonPay) or creating the UKYC
+ *   session and recording session-scoped disclaimers (non-MoonPay vendors).
  * - `check` — running the invisible connection-check frame (MoonPay only).
  * - `auth` — running the visible authentication (OTP) frame (MoonPay only).
  * - `form` — authenticated. When the flow is scoped to a product, the
@@ -106,14 +106,59 @@ export type KycSessionStatus = {
     vendorStatus: string;
 };
 /**
- * A single disclaimer/term the customer must accept before a session is
- * created.
+ * A single disclaimer/term the customer must accept before a vendor session is
+ * created (`GET /vendors/{vendor}/disclaimers`).
  */
 export type KycDisclaimer = {
     id: string;
     display_name: string;
     url: string;
 };
+/**
+ * A vendor T&C signing returned by `POST /vendors/{vendor}/disclaimers`.
+ */
+export type KycVendorSigning = {
+    /** Iron signing id. */
+    id: string;
+    customer_id: string;
+    content_id?: string;
+};
+/**
+ * A legal document in the session-scoped idOS / KYC-provider catalog
+ * (`GET`/`POST /sessions/{sessionId}/disclaimers`).
+ */
+export type KycConsentDocument = {
+    /** Stable identifier of the legal document. */
+    key: string;
+    /** Version of the document currently in force. */
+    version: string;
+    /** Human-readable document title. */
+    title: string;
+    /** URL the document body is hosted at. */
+    url: string;
+    /** Whether this session already consented to this document version. */
+    consented: boolean;
+};
+/**
+ * A consent record posted for a catalog document. `key` and `version` must
+ * match the current session catalog.
+ */
+export type KycConsentRecord = {
+    key: string;
+    version: string;
+};
+/**
+ * Session-scoped disclaimer catalog returned by
+ * `GET`/`POST /sessions/{sessionId}/disclaimers`.
+ */
+export type KycSessionDisclaimers = {
+    /** idOS legal documents. */
+    idOS: KycConsentDocument[];
+    /** KYC provider (SumSub) legal documents. */
+    kycProvider: KycConsentDocument[];
+    /** Whether the user consented to reuse existing idOS credentials. */
+    credentialReusabilityConsentGiven: boolean;
+};
 /**
  * Parameters passed to a platform SumSub launcher.
  */

package/dist/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}
+{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAGX,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,4BAA4B;IAC5B,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,qEAAqE;IACrE,iCAAiC,EAAE,OAAO,CAAC;CAC5C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}

package/dist/types.d.mts

@@ -55,8 +55,8 @@ export type KycUserStatusResponse = {
  *
  * - `idle` — nothing started.
  * - `terms` — waiting for the customer to accept the vendor terms.
- * - `session` — creating the vendor session (MoonPay) or posting consents
- *   (non-MoonPay vendors).
+ * - `session` — creating the vendor session (MoonPay) or creating the UKYC
+ *   session and recording session-scoped disclaimers (non-MoonPay vendors).
  * - `check` — running the invisible connection-check frame (MoonPay only).
  * - `auth` — running the visible authentication (OTP) frame (MoonPay only).
  * - `form` — authenticated. When the flow is scoped to a product, the
@@ -106,14 +106,59 @@ export type KycSessionStatus = {
     vendorStatus: string;
 };
 /**
- * A single disclaimer/term the customer must accept before a session is
- * created.
+ * A single disclaimer/term the customer must accept before a vendor session is
+ * created (`GET /vendors/{vendor}/disclaimers`).
  */
 export type KycDisclaimer = {
     id: string;
     display_name: string;
     url: string;
 };
+/**
+ * A vendor T&C signing returned by `POST /vendors/{vendor}/disclaimers`.
+ */
+export type KycVendorSigning = {
+    /** Iron signing id. */
+    id: string;
+    customer_id: string;
+    content_id?: string;
+};
+/**
+ * A legal document in the session-scoped idOS / KYC-provider catalog
+ * (`GET`/`POST /sessions/{sessionId}/disclaimers`).
+ */
+export type KycConsentDocument = {
+    /** Stable identifier of the legal document. */
+    key: string;
+    /** Version of the document currently in force. */
+    version: string;
+    /** Human-readable document title. */
+    title: string;
+    /** URL the document body is hosted at. */
+    url: string;
+    /** Whether this session already consented to this document version. */
+    consented: boolean;
+};
+/**
+ * A consent record posted for a catalog document. `key` and `version` must
+ * match the current session catalog.
+ */
+export type KycConsentRecord = {
+    key: string;
+    version: string;
+};
+/**
+ * Session-scoped disclaimer catalog returned by
+ * `GET`/`POST /sessions/{sessionId}/disclaimers`.
+ */
+export type KycSessionDisclaimers = {
+    /** idOS legal documents. */
+    idOS: KycConsentDocument[];
+    /** KYC provider (SumSub) legal documents. */
+    kycProvider: KycConsentDocument[];
+    /** Whether the user consented to reuse existing idOS credentials. */
+    credentialReusabilityConsentGiven: boolean;
+};
 /**
  * Parameters passed to a platform SumSub launcher.
  */

package/dist/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAGX,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,4BAA4B;IAC5B,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,qEAAqE;IACrE,iCAAiC,EAAE,OAAO,CAAC;CAC5C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}

package/dist/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for toast /\n * banner rendering. Collapses vendor + SumSub / relay state into the offsite\n * contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or posting consents\n *   (non-MoonPay vendors).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Consents-path vendors skip\n *   this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a session is\n * created.\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}
+{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for toast /\n * banner rendering. Collapses vendor + SumSub / relay state into the offsite\n * contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or creating the UKYC\n *   session and recording session-scoped disclaimers (non-MoonPay vendors).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Consents-path vendors skip\n *   this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a vendor session is\n * created (`GET /vendors/{vendor}/disclaimers`).\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * A vendor T&C signing returned by `POST /vendors/{vendor}/disclaimers`.\n */\nexport type KycVendorSigning = {\n  /** Iron signing id. */\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  customer_id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  content_id?: string;\n};\n\n/**\n * A legal document in the session-scoped idOS / KYC-provider catalog\n * (`GET`/`POST /sessions/{sessionId}/disclaimers`).\n */\nexport type KycConsentDocument = {\n  /** Stable identifier of the legal document. */\n  key: string;\n  /** Version of the document currently in force. */\n  version: string;\n  /** Human-readable document title. */\n  title: string;\n  /** URL the document body is hosted at. */\n  url: string;\n  /** Whether this session already consented to this document version. */\n  consented: boolean;\n};\n\n/**\n * A consent record posted for a catalog document. `key` and `version` must\n * match the current session catalog.\n */\nexport type KycConsentRecord = {\n  key: string;\n  version: string;\n};\n\n/**\n * Session-scoped disclaimer catalog returned by\n * `GET`/`POST /sessions/{sessionId}/disclaimers`.\n */\nexport type KycSessionDisclaimers = {\n  /** idOS legal documents. */\n  idOS: KycConsentDocument[];\n  /** KYC provider (SumSub) legal documents. */\n  kycProvider: KycConsentDocument[];\n  /** Whether the user consented to reuse existing idOS credentials. */\n  credentialReusabilityConsentGiven: boolean;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}

package/dist/ukyc/jwtChain.cjs

@@ -25,7 +25,7 @@ function decodeJsonSegment(segment, label) {
  * `header.payload` input. Returns the decoded, verified payload.
  *
  * @param keys - The JWKS keys published by the Fractal encryption service.
- * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.
+ * @param jwtChain - The compact-serialized EdDSA JWT from an encryption schema.
  * @returns The verified JWT payload.
  */
 function verifyJwtChain(keys, jwtChain) {

package/dist/ukyc/jwtChain.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwtChain.cjs","sourceRoot":"","sources":["../../src/ukyc/jwtChain.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,mDAAgD;AAEhD,iDAAkD;AA0ClD;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAO,OAAe,EAAE,KAAa;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,qBAAa,EAAC,IAAA,8BAAgB,EAAC,OAAO,CAAC,CAAC,CAAS,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,IAAW,EAAE,QAAgB;IAC1D,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAY,aAAa,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CACvC,MAAM,CAAC,GAAG,CACX,qBAAqB,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,GAAG,mCAAmC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,IAAI,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAO,CAAC,MAAM,CAC5B,IAAA,8BAAgB,EAAC,gBAAgB,CAAC,EAClC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC,EAC9D,IAAA,8BAAgB,EAAC,GAAG,CAAC,CAAC,CAAC,CACxB,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CAAkB,cAAc,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAzCD,wCAyCC","sourcesContent":["import { bytesToString } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport { base64UrlToBytes } from '../encoding.js';\n\n/**\n * Verifies the `jwtChain` returned by the Fractal encryption service against\n * its published JWKS.\n *\n * The signature check is done with `@noble/curves` (rather than WebCrypto\n * `subtle`) because not every MetaMask runtime exposes a `subtle`\n * implementation for Ed25519; JWT parsing is a plain base64url/JSON decode, so\n * no `jose` dependency is required.\n */\n\n/**\n * A single Ed25519 (OKP) JSON Web Key from the Fractal JWKS.\n */\nexport type Jwk = {\n  kty: string;\n  crv: string;\n  x: string;\n  kid: string;\n  use?: string;\n  alg?: string;\n};\n\n/**\n * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the\n * server's X25519 public key so the client can confirm the value returned\n * out-of-band by `getWrappingKey` was not tampered with.\n */\nexport type JwtChainPayload = {\n  sessionServerPublicKeyX: string;\n  nonce: string;\n};\n\n/**\n * The protected header of a compact JWT.\n */\ntype JwtHeader = {\n  alg?: string;\n  kid?: string;\n};\n\n/**\n * Decodes a base64url JWT segment into a parsed JSON object.\n *\n * @param segment - The base64url-encoded segment.\n * @param label - Human-readable segment name for error messages.\n * @returns The parsed JSON object.\n */\nfunction decodeJsonSegment<Type>(segment: string, label: string): Type {\n  try {\n    return JSON.parse(bytesToString(base64UrlToBytes(segment))) as Type;\n  } catch (error) {\n    throw new Error(\n      `UKYC: failed to decode jwtChain ${label}: ${String(error)}`,\n    );\n  }\n}\n\n/**\n * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a\n * published Ed25519 signing key and checks the EdDSA signature over the\n * `header.payload` input. Returns the decoded, verified payload.\n *\n * @param keys - The JWKS keys published by the Fractal encryption service.\n * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.\n * @returns The verified JWT payload.\n */\nexport function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload {\n  const [headerSegment, payloadSegment, signatureSegment] = jwtChain.split('.');\n  if (!headerSegment || !payloadSegment || !signatureSegment) {\n    throw new Error(\n      'UKYC: jwtChain is not a well-formed JWT (expected 3 segments).',\n    );\n  }\n\n  const header = decodeJsonSegment<JwtHeader>(headerSegment, 'header');\n  if (header.alg !== 'EdDSA') {\n    throw new Error(\n      `UKYC: unsupported jwtChain alg \"${String(\n        header.alg,\n      )}\" (expected EdDSA).`,\n    );\n  }\n\n  const jwk = keys.find((key) => key.kid === header.kid);\n  if (!jwk) {\n    throw new Error(\n      `UKYC: no JWKS key matches jwtChain kid \"${String(header.kid)}\".`,\n    );\n  }\n  if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {\n    throw new Error(\n      `UKYC: JWKS key ${jwk.kid} is not an Ed25519 OKP key (kty=${jwk.kty}, crv=${jwk.crv}).`,\n    );\n  }\n\n  const isValid = ed25519.verify(\n    base64UrlToBytes(signatureSegment),\n    new TextEncoder().encode(`${headerSegment}.${payloadSegment}`),\n    base64UrlToBytes(jwk.x),\n  );\n  if (!isValid) {\n    throw new Error(\n      'UKYC: jwtChain signature verification failed against JWKS.',\n    );\n  }\n\n  return decodeJsonSegment<JwtChainPayload>(payloadSegment, 'payload');\n}\n"]}
+{"version":3,"file":"jwtChain.cjs","sourceRoot":"","sources":["../../src/ukyc/jwtChain.ts"],"names":[],"mappings":";;;AAAA,2CAAgD;AAChD,mDAAgD;AAEhD,iDAAkD;AA0ClD;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAO,OAAe,EAAE,KAAa;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,qBAAa,EAAC,IAAA,8BAAgB,EAAC,OAAO,CAAC,CAAC,CAAS,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,IAAW,EAAE,QAAgB;IAC1D,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAY,aAAa,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CACvC,MAAM,CAAC,GAAG,CACX,qBAAqB,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,GAAG,mCAAmC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,IAAI,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAO,CAAC,MAAM,CAC5B,IAAA,8BAAgB,EAAC,gBAAgB,CAAC,EAClC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC,EAC9D,IAAA,8BAAgB,EAAC,GAAG,CAAC,CAAC,CAAC,CACxB,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CAAkB,cAAc,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAzCD,wCAyCC","sourcesContent":["import { bytesToString } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport { base64UrlToBytes } from '../encoding.js';\n\n/**\n * Verifies the `jwtChain` returned by the Fractal encryption service against\n * its published JWKS.\n *\n * The signature check is done with `@noble/curves` (rather than WebCrypto\n * `subtle`) because not every MetaMask runtime exposes a `subtle`\n * implementation for Ed25519; JWT parsing is a plain base64url/JSON decode, so\n * no `jose` dependency is required.\n */\n\n/**\n * A single Ed25519 (OKP) JSON Web Key from the Fractal JWKS.\n */\nexport type Jwk = {\n  kty: string;\n  crv: string;\n  x: string;\n  kid: string;\n  use?: string;\n  alg?: string;\n};\n\n/**\n * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the\n * server's X25519 public key so the client can confirm the value returned\n * out-of-band in an encryption schema was not tampered with.\n */\nexport type JwtChainPayload = {\n  sessionServerPublicKeyX: string;\n  nonce: string;\n};\n\n/**\n * The protected header of a compact JWT.\n */\ntype JwtHeader = {\n  alg?: string;\n  kid?: string;\n};\n\n/**\n * Decodes a base64url JWT segment into a parsed JSON object.\n *\n * @param segment - The base64url-encoded segment.\n * @param label - Human-readable segment name for error messages.\n * @returns The parsed JSON object.\n */\nfunction decodeJsonSegment<Type>(segment: string, label: string): Type {\n  try {\n    return JSON.parse(bytesToString(base64UrlToBytes(segment))) as Type;\n  } catch (error) {\n    throw new Error(\n      `UKYC: failed to decode jwtChain ${label}: ${String(error)}`,\n    );\n  }\n}\n\n/**\n * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a\n * published Ed25519 signing key and checks the EdDSA signature over the\n * `header.payload` input. Returns the decoded, verified payload.\n *\n * @param keys - The JWKS keys published by the Fractal encryption service.\n * @param jwtChain - The compact-serialized EdDSA JWT from an encryption schema.\n * @returns The verified JWT payload.\n */\nexport function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload {\n  const [headerSegment, payloadSegment, signatureSegment] = jwtChain.split('.');\n  if (!headerSegment || !payloadSegment || !signatureSegment) {\n    throw new Error(\n      'UKYC: jwtChain is not a well-formed JWT (expected 3 segments).',\n    );\n  }\n\n  const header = decodeJsonSegment<JwtHeader>(headerSegment, 'header');\n  if (header.alg !== 'EdDSA') {\n    throw new Error(\n      `UKYC: unsupported jwtChain alg \"${String(\n        header.alg,\n      )}\" (expected EdDSA).`,\n    );\n  }\n\n  const jwk = keys.find((key) => key.kid === header.kid);\n  if (!jwk) {\n    throw new Error(\n      `UKYC: no JWKS key matches jwtChain kid \"${String(header.kid)}\".`,\n    );\n  }\n  if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {\n    throw new Error(\n      `UKYC: JWKS key ${jwk.kid} is not an Ed25519 OKP key (kty=${jwk.kty}, crv=${jwk.crv}).`,\n    );\n  }\n\n  const isValid = ed25519.verify(\n    base64UrlToBytes(signatureSegment),\n    new TextEncoder().encode(`${headerSegment}.${payloadSegment}`),\n    base64UrlToBytes(jwk.x),\n  );\n  if (!isValid) {\n    throw new Error(\n      'UKYC: jwtChain signature verification failed against JWKS.',\n    );\n  }\n\n  return decodeJsonSegment<JwtChainPayload>(payloadSegment, 'payload');\n}\n"]}

package/dist/ukyc/jwtChain.d.cts

@@ -21,7 +21,7 @@ export type Jwk = {
 /**
  * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the
  * server's X25519 public key so the client can confirm the value returned
- * out-of-band by `getWrappingKey` was not tampered with.
+ * out-of-band in an encryption schema was not tampered with.
  */
 export type JwtChainPayload = {
     sessionServerPublicKeyX: string;
@@ -33,7 +33,7 @@ export type JwtChainPayload = {
  * `header.payload` input. Returns the decoded, verified payload.
  *
  * @param keys - The JWKS keys published by the Fractal encryption service.
- * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.
+ * @param jwtChain - The compact-serialized EdDSA JWT from an encryption schema.
  * @returns The verified JWT payload.
  */
 export declare function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload;

package/dist/ukyc/jwtChain.d.mts

@@ -21,7 +21,7 @@ export type Jwk = {
 /**
  * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the
  * server's X25519 public key so the client can confirm the value returned
- * out-of-band by `getWrappingKey` was not tampered with.
+ * out-of-band in an encryption schema was not tampered with.
  */
 export type JwtChainPayload = {
     sessionServerPublicKeyX: string;
@@ -33,7 +33,7 @@ export type JwtChainPayload = {
  * `header.payload` input. Returns the decoded, verified payload.
  *
  * @param keys - The JWKS keys published by the Fractal encryption service.
- * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.
+ * @param jwtChain - The compact-serialized EdDSA JWT from an encryption schema.
  * @returns The verified JWT payload.
  */
 export declare function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload;

package/dist/ukyc/jwtChain.mjs

@@ -22,7 +22,7 @@ function decodeJsonSegment(segment, label) {
  * `header.payload` input. Returns the decoded, verified payload.
  *
  * @param keys - The JWKS keys published by the Fractal encryption service.
- * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.
+ * @param jwtChain - The compact-serialized EdDSA JWT from an encryption schema.
  * @returns The verified JWT payload.
  */
 export function verifyJwtChain(keys, jwtChain) {

package/dist/ukyc/jwtChain.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwtChain.mjs","sourceRoot":"","sources":["../../src/ukyc/jwtChain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB;AAChD,OAAO,EAAE,OAAO,EAAE,8BAA8B;AAEhD,OAAO,EAAE,gBAAgB,EAAE,wBAAuB;AA0ClD;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAO,OAAe,EAAE,KAAa;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAS,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAW,EAAE,QAAgB;IAC1D,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAY,aAAa,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CACvC,MAAM,CAAC,GAAG,CACX,qBAAqB,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,GAAG,mCAAmC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,IAAI,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAC5B,gBAAgB,CAAC,gBAAgB,CAAC,EAClC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC,EAC9D,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CACxB,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CAAkB,cAAc,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import { bytesToString } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport { base64UrlToBytes } from '../encoding.js';\n\n/**\n * Verifies the `jwtChain` returned by the Fractal encryption service against\n * its published JWKS.\n *\n * The signature check is done with `@noble/curves` (rather than WebCrypto\n * `subtle`) because not every MetaMask runtime exposes a `subtle`\n * implementation for Ed25519; JWT parsing is a plain base64url/JSON decode, so\n * no `jose` dependency is required.\n */\n\n/**\n * A single Ed25519 (OKP) JSON Web Key from the Fractal JWKS.\n */\nexport type Jwk = {\n  kty: string;\n  crv: string;\n  x: string;\n  kid: string;\n  use?: string;\n  alg?: string;\n};\n\n/**\n * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the\n * server's X25519 public key so the client can confirm the value returned\n * out-of-band by `getWrappingKey` was not tampered with.\n */\nexport type JwtChainPayload = {\n  sessionServerPublicKeyX: string;\n  nonce: string;\n};\n\n/**\n * The protected header of a compact JWT.\n */\ntype JwtHeader = {\n  alg?: string;\n  kid?: string;\n};\n\n/**\n * Decodes a base64url JWT segment into a parsed JSON object.\n *\n * @param segment - The base64url-encoded segment.\n * @param label - Human-readable segment name for error messages.\n * @returns The parsed JSON object.\n */\nfunction decodeJsonSegment<Type>(segment: string, label: string): Type {\n  try {\n    return JSON.parse(bytesToString(base64UrlToBytes(segment))) as Type;\n  } catch (error) {\n    throw new Error(\n      `UKYC: failed to decode jwtChain ${label}: ${String(error)}`,\n    );\n  }\n}\n\n/**\n * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a\n * published Ed25519 signing key and checks the EdDSA signature over the\n * `header.payload` input. Returns the decoded, verified payload.\n *\n * @param keys - The JWKS keys published by the Fractal encryption service.\n * @param jwtChain - The compact-serialized EdDSA JWT from `getWrappingKey`.\n * @returns The verified JWT payload.\n */\nexport function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload {\n  const [headerSegment, payloadSegment, signatureSegment] = jwtChain.split('.');\n  if (!headerSegment || !payloadSegment || !signatureSegment) {\n    throw new Error(\n      'UKYC: jwtChain is not a well-formed JWT (expected 3 segments).',\n    );\n  }\n\n  const header = decodeJsonSegment<JwtHeader>(headerSegment, 'header');\n  if (header.alg !== 'EdDSA') {\n    throw new Error(\n      `UKYC: unsupported jwtChain alg \"${String(\n        header.alg,\n      )}\" (expected EdDSA).`,\n    );\n  }\n\n  const jwk = keys.find((key) => key.kid === header.kid);\n  if (!jwk) {\n    throw new Error(\n      `UKYC: no JWKS key matches jwtChain kid \"${String(header.kid)}\".`,\n    );\n  }\n  if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {\n    throw new Error(\n      `UKYC: JWKS key ${jwk.kid} is not an Ed25519 OKP key (kty=${jwk.kty}, crv=${jwk.crv}).`,\n    );\n  }\n\n  const isValid = ed25519.verify(\n    base64UrlToBytes(signatureSegment),\n    new TextEncoder().encode(`${headerSegment}.${payloadSegment}`),\n    base64UrlToBytes(jwk.x),\n  );\n  if (!isValid) {\n    throw new Error(\n      'UKYC: jwtChain signature verification failed against JWKS.',\n    );\n  }\n\n  return decodeJsonSegment<JwtChainPayload>(payloadSegment, 'payload');\n}\n"]}
+{"version":3,"file":"jwtChain.mjs","sourceRoot":"","sources":["../../src/ukyc/jwtChain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,wBAAwB;AAChD,OAAO,EAAE,OAAO,EAAE,8BAA8B;AAEhD,OAAO,EAAE,gBAAgB,EAAE,wBAAuB;AA0ClD;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAO,OAAe,EAAE,KAAa;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAS,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAW,EAAE,QAAgB;IAC1D,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAY,aAAa,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CACvC,MAAM,CAAC,GAAG,CACX,qBAAqB,CACvB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,GAAG,mCAAmC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,IAAI,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAC5B,gBAAgB,CAAC,gBAAgB,CAAC,EAClC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC,EAC9D,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CACxB,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,iBAAiB,CAAkB,cAAc,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import { bytesToString } from '@metamask/utils';\nimport { ed25519 } from '@noble/curves/ed25519';\n\nimport { base64UrlToBytes } from '../encoding.js';\n\n/**\n * Verifies the `jwtChain` returned by the Fractal encryption service against\n * its published JWKS.\n *\n * The signature check is done with `@noble/curves` (rather than WebCrypto\n * `subtle`) because not every MetaMask runtime exposes a `subtle`\n * implementation for Ed25519; JWT parsing is a plain base64url/JSON decode, so\n * no `jose` dependency is required.\n */\n\n/**\n * A single Ed25519 (OKP) JSON Web Key from the Fractal JWKS.\n */\nexport type Jwk = {\n  kty: string;\n  crv: string;\n  x: string;\n  kid: string;\n  use?: string;\n  alg?: string;\n};\n\n/**\n * The verified `jwtChain` payload. `sessionServerPublicKeyX` attests the\n * server's X25519 public key so the client can confirm the value returned\n * out-of-band in an encryption schema was not tampered with.\n */\nexport type JwtChainPayload = {\n  sessionServerPublicKeyX: string;\n  nonce: string;\n};\n\n/**\n * The protected header of a compact JWT.\n */\ntype JwtHeader = {\n  alg?: string;\n  kid?: string;\n};\n\n/**\n * Decodes a base64url JWT segment into a parsed JSON object.\n *\n * @param segment - The base64url-encoded segment.\n * @param label - Human-readable segment name for error messages.\n * @returns The parsed JSON object.\n */\nfunction decodeJsonSegment<Type>(segment: string, label: string): Type {\n  try {\n    return JSON.parse(bytesToString(base64UrlToBytes(segment))) as Type;\n  } catch (error) {\n    throw new Error(\n      `UKYC: failed to decode jwtChain ${label}: ${String(error)}`,\n    );\n  }\n}\n\n/**\n * Verifies `jwtChain` against `keys`: matches the JWT header `kid` to a\n * published Ed25519 signing key and checks the EdDSA signature over the\n * `header.payload` input. Returns the decoded, verified payload.\n *\n * @param keys - The JWKS keys published by the Fractal encryption service.\n * @param jwtChain - The compact-serialized EdDSA JWT from an encryption schema.\n * @returns The verified JWT payload.\n */\nexport function verifyJwtChain(keys: Jwk[], jwtChain: string): JwtChainPayload {\n  const [headerSegment, payloadSegment, signatureSegment] = jwtChain.split('.');\n  if (!headerSegment || !payloadSegment || !signatureSegment) {\n    throw new Error(\n      'UKYC: jwtChain is not a well-formed JWT (expected 3 segments).',\n    );\n  }\n\n  const header = decodeJsonSegment<JwtHeader>(headerSegment, 'header');\n  if (header.alg !== 'EdDSA') {\n    throw new Error(\n      `UKYC: unsupported jwtChain alg \"${String(\n        header.alg,\n      )}\" (expected EdDSA).`,\n    );\n  }\n\n  const jwk = keys.find((key) => key.kid === header.kid);\n  if (!jwk) {\n    throw new Error(\n      `UKYC: no JWKS key matches jwtChain kid \"${String(header.kid)}\".`,\n    );\n  }\n  if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {\n    throw new Error(\n      `UKYC: JWKS key ${jwk.kid} is not an Ed25519 OKP key (kty=${jwk.kty}, crv=${jwk.crv}).`,\n    );\n  }\n\n  const isValid = ed25519.verify(\n    base64UrlToBytes(signatureSegment),\n    new TextEncoder().encode(`${headerSegment}.${payloadSegment}`),\n    base64UrlToBytes(jwk.x),\n  );\n  if (!isValid) {\n    throw new Error(\n      'UKYC: jwtChain signature verification failed against JWKS.',\n    );\n  }\n\n  return decodeJsonSegment<JwtChainPayload>(payloadSegment, 'payload');\n}\n"]}

package/dist/ukyc/wrapEncryptionKey.cjs

@@ -4,23 +4,32 @@ exports.wrapEncryptionKey = void 0;
 const tweetnacl_1 = require("tweetnacl");
 const encoding_js_1 = require("../encoding.cjs");
 /**
- * Wraps `keyToWrap` for the UKYC session server.
+ * Wraps `plaintext` for the UKYC session server.
  *
  * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
  * between our session client private key and the session server public key
- * returned by `getWrappingKey`.
+ * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)
+ * returned by `createUkycSession`. The 32-byte client public key is prefixed
+ * onto `data` so the server can open the box without a prior key-registration
+ * step.
  *
  * @param sessionClientPrivateKey - Our session's X25519 private key.
  * @param sessionServerPublicKey - The server's X25519 public key (base64url).
- * @param keyToWrap - The raw symmetric key bytes to encrypt.
- * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.
+ * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`
+ * or the encoded `ukyc_capability_token`).
+ * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and
+ * `nonce`.
  */
-function wrapEncryptionKey(sessionClientPrivateKey, sessionServerPublicKey, keyToWrap) {
+function wrapEncryptionKey(sessionClientPrivateKey, sessionServerPublicKey, plaintext) {
     const serverPublicKey = (0, encoding_js_1.base64UrlToBytes)(sessionServerPublicKey);
+    const { publicKey: clientPublicKey } = tweetnacl_1.box.keyPair.fromSecretKey(sessionClientPrivateKey);
     const nonce = (0, tweetnacl_1.randomBytes)(tweetnacl_1.box.nonceLength);
-    const encryptedKey = (0, tweetnacl_1.box)(keyToWrap, nonce, serverPublicKey, sessionClientPrivateKey);
+    const ciphertext = (0, tweetnacl_1.box)(plaintext, nonce, serverPublicKey, sessionClientPrivateKey);
+    const data = new Uint8Array(clientPublicKey.length + ciphertext.length);
+    data.set(clientPublicKey, 0);
+    data.set(ciphertext, clientPublicKey.length);
     return {
-        encryptedKey: (0, encoding_js_1.toBase64Url)(encryptedKey),
+        data: (0, encoding_js_1.toBase64Url)(data),
         nonce: (0, encoding_js_1.toBase64Url)(nonce),
     };
 }

package/dist/ukyc/wrapEncryptionKey.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"wrapEncryptionKey.cjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;;AAAA,yCAA6C;AAE7C,iDAA+D;AAwB/D;;;;;;;;;;;GAWG;AACH,SAAgB,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,IAAA,8BAAgB,EAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAA,uBAAW,EAAC,eAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAA,eAAG,EACtB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,OAAO;QACL,YAAY,EAAE,IAAA,yBAAW,EAAC,YAAY,CAAC;QACvC,KAAK,EAAE,IAAA,yBAAW,EAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAjBD,8CAiBC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps the `data_encryption_key` for the UKYC session server using NaCl's\n * `crypto_box` (X25519 + XSalsa20-Poly1305) established with the server's\n * per-session wrapping key.\n *\n * Unlike {@link wrapUserKey} (which generates a fresh ephemeral keypair per\n * call), this uses the session client keypair whose public half was already\n * handed to the server via `POST /wrapping-key`. The server therefore already\n * knows our public key and can derive the same shared secret from its session\n * private key, so only `{ encryptedKey, nonce }` need be transmitted.\n */\n\n/**\n * The transmitted portion of a wrapped encryption key: the `crypto_box`\n * ciphertext (which includes the 16-byte Poly1305 auth tag) and the nonce,\n * both unpadded base64url-encoded.\n */\nexport type WrappedEncryptionKeyParts = {\n  encryptedKey: string;\n  nonce: string;\n};\n\n/**\n * Wraps `keyToWrap` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * returned by `getWrappingKey`.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param keyToWrap - The raw symmetric key bytes to encrypt.\n * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  keyToWrap: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const nonce = randomBytes(box.nonceLength);\n  const encryptedKey = box(\n    keyToWrap,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  return {\n    encryptedKey: toBase64Url(encryptedKey),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}
+{"version":3,"file":"wrapEncryptionKey.cjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;;AAAA,yCAA6C;AAE7C,iDAA+D;AA0B/D;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,IAAA,8BAAgB,EAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,eAAG,CAAC,OAAO,CAAC,aAAa,CAC9D,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,IAAA,uBAAW,EAAC,eAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAA,eAAG,EACpB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,IAAA,yBAAW,EAAC,IAAI,CAAC;QACvB,KAAK,EAAE,IAAA,yBAAW,EAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAvBD,8CAuBC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps a secret for the UKYC session server using NaCl's `crypto_box`\n * (X25519 + XSalsa20-Poly1305) established with a per-secret wrapping key\n * returned inside an encryption schema from `createUkycSession`.\n *\n * Unlike {@link wrapUserKey} (which generates a fresh ephemeral keypair per\n * call), this reuses a session client keypair. There is no prior wrapping-key\n * exchange to register that public key, so `data` is\n * `clientPublicKey (32) || ciphertext+tag` and only `{ data, nonce }` need be\n * transmitted. Used for both the `data_encryption_key` and the\n * `ukyc_capability_token`.\n */\n\n/**\n * The transmitted portion of a wrapped secret: the sender public key prefixed\n * to the `crypto_box` ciphertext (which includes the 16-byte Poly1305 auth\n * tag), and the nonce, both unpadded base64url-encoded. Matches the KYC API\n * `CapabilityAuthorization` wire shape.\n */\nexport type WrappedEncryptionKeyParts = {\n  data: string;\n  nonce: string;\n};\n\n/**\n * Wraps `plaintext` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)\n * returned by `createUkycSession`. The 32-byte client public key is prefixed\n * onto `data` so the server can open the box without a prior key-registration\n * step.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`\n * or the encoded `ukyc_capability_token`).\n * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and\n * `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  plaintext: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const { publicKey: clientPublicKey } = box.keyPair.fromSecretKey(\n    sessionClientPrivateKey,\n  );\n  const nonce = randomBytes(box.nonceLength);\n  const ciphertext = box(\n    plaintext,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  const data = new Uint8Array(clientPublicKey.length + ciphertext.length);\n  data.set(clientPublicKey, 0);\n  data.set(ciphertext, clientPublicKey.length);\n  return {\n    data: toBase64Url(data),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}

package/dist/ukyc/wrapEncryptionKey.d.cts

@@ -1,34 +1,41 @@
 /**
- * Wraps the `data_encryption_key` for the UKYC session server using NaCl's
- * `crypto_box` (X25519 + XSalsa20-Poly1305) established with the server's
- * per-session wrapping key.
+ * Wraps a secret for the UKYC session server using NaCl's `crypto_box`
+ * (X25519 + XSalsa20-Poly1305) established with a per-secret wrapping key
+ * returned inside an encryption schema from `createUkycSession`.
  *
  * Unlike {@link wrapUserKey} (which generates a fresh ephemeral keypair per
- * call), this uses the session client keypair whose public half was already
- * handed to the server via `POST /wrapping-key`. The server therefore already
- * knows our public key and can derive the same shared secret from its session
- * private key, so only `{ encryptedKey, nonce }` need be transmitted.
+ * call), this reuses a session client keypair. There is no prior wrapping-key
+ * exchange to register that public key, so `data` is
+ * `clientPublicKey (32) || ciphertext+tag` and only `{ data, nonce }` need be
+ * transmitted. Used for both the `data_encryption_key` and the
+ * `ukyc_capability_token`.
  */
 /**
- * The transmitted portion of a wrapped encryption key: the `crypto_box`
- * ciphertext (which includes the 16-byte Poly1305 auth tag) and the nonce,
- * both unpadded base64url-encoded.
+ * The transmitted portion of a wrapped secret: the sender public key prefixed
+ * to the `crypto_box` ciphertext (which includes the 16-byte Poly1305 auth
+ * tag), and the nonce, both unpadded base64url-encoded. Matches the KYC API
+ * `CapabilityAuthorization` wire shape.
  */
 export type WrappedEncryptionKeyParts = {
-    encryptedKey: string;
+    data: string;
     nonce: string;
 };
 /**
- * Wraps `keyToWrap` for the UKYC session server.
+ * Wraps `plaintext` for the UKYC session server.
  *
  * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
  * between our session client private key and the session server public key
- * returned by `getWrappingKey`.
+ * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)
+ * returned by `createUkycSession`. The 32-byte client public key is prefixed
+ * onto `data` so the server can open the box without a prior key-registration
+ * step.
  *
  * @param sessionClientPrivateKey - Our session's X25519 private key.
  * @param sessionServerPublicKey - The server's X25519 public key (base64url).
- * @param keyToWrap - The raw symmetric key bytes to encrypt.
- * @returns The base64url `encryptedKey` (ciphertext + tag) and `nonce`.
+ * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`
+ * or the encoded `ukyc_capability_token`).
+ * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and
+ * `nonce`.
  */
-export declare function wrapEncryptionKey(sessionClientPrivateKey: Uint8Array, sessionServerPublicKey: string, keyToWrap: Uint8Array): WrappedEncryptionKeyParts;
+export declare function wrapEncryptionKey(sessionClientPrivateKey: Uint8Array, sessionServerPublicKey: string, plaintext: Uint8Array): WrappedEncryptionKeyParts;
 //# sourceMappingURL=wrapEncryptionKey.d.cts.map

package/dist/ukyc/wrapEncryptionKey.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"wrapEncryptionKey.d.cts","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,uBAAuB,EAAE,UAAU,EACnC,sBAAsB,EAAE,MAAM,EAC9B,SAAS,EAAE,UAAU,GACpB,yBAAyB,CAa3B"}
+{"version":3,"file":"wrapEncryptionKey.d.cts","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,uBAAuB,EAAE,UAAU,EACnC,sBAAsB,EAAE,MAAM,EAC9B,SAAS,EAAE,UAAU,GACpB,yBAAyB,CAmB3B"}