@trusset/sdk 0.1.0 → 0.5.0

package/dist/chunk-OQG3PEF3.mjs

@@ -0,0 +1,916 @@
+import {
+  ConfirmationError,
+  InstanceChain,
+  TrussetError,
+  ValidationError,
+  attachTransactions,
+  clampInt,
+  confirmExecuted,
+  execute,
+  optionalAddress,
+  optionalHash,
+  planOf,
+  preflightChain,
+  requireAddress,
+  requireCountry,
+  requireHash,
+  requireSigner,
+  requireString,
+  signMessage,
+  signerAddress
+} from "./chunk-3YF42MHV.mjs";
+
+// src/modules/customers/management.ts
+var CustomerManagement = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * List customers for the current instance.
+   */
+  async list(options = {}) {
+    const params = {
+      limit: clampInt(options.limit, 1, 200, 100),
+      offset: clampInt(options.offset, 0, Number.MAX_SAFE_INTEGER, 0),
+      includeArchived: options.includeArchived ? "true" : void 0,
+      search: options.search || void 0,
+      customerType: options.customerType || void 0
+    };
+    const { data, metadata } = await this.http.getWithMeta("/customers/api/manage", params);
+    const customers = Array.isArray(data) ? data : [];
+    return { customers, total: metadata.total ?? customers.length };
+  }
+  /**
+   * Get a customer by wallet address, ID, externalId, or referenceKey.
+   *
+   * Note: the backend routes 20-30 character identifiers to the internal-ID
+   * lookup, so an externalId in that length range will not resolve here -
+   * use `searchByExternalId`, which handles the ambiguity.
+   */
+  async get(identifier) {
+    requireString(identifier, "identifier");
+    return this.http.get(`/customers/api/manage/${encodeURIComponent(identifier)}`);
+  }
+  /**
+   * Create a new customer record.
+   */
+  async create(input) {
+    if (input.walletAddress) optionalAddress(input.walletAddress, "walletAddress");
+    return this.http.post("/customers/api/manage", input);
+  }
+  /**
+   * Update an existing customer.
+   */
+  async update(customerId, input) {
+    requireString(customerId, "customerId");
+    return this.http.put(`/customers/api/manage/${encodeURIComponent(customerId)}`, input);
+  }
+  /**
+   * Archive (soft-delete) a customer.
+   */
+  async archive(customerId) {
+    requireString(customerId, "customerId");
+    return this.http.delete(`/customers/api/manage/${encodeURIComponent(customerId)}`);
+  }
+  /**
+   * Link a wallet address to a customer created via referenceKey.
+   */
+  async linkWallet(input) {
+    requireString(input.referenceKey, "referenceKey");
+    requireAddress(input.walletAddress, "walletAddress");
+    return this.http.post("/customers/api/manage/link-wallet", input);
+  }
+  /**
+   * Batch-fetch country codes for a list of wallet addresses.
+   */
+  async batchGetCountries(addresses) {
+    if (!Array.isArray(addresses) || addresses.length === 0) {
+      return {};
+    }
+    return this.http.post("/customers/api/manage/countries/batch", { addresses });
+  }
+  // -----------------------------------------------------------------------
+  // Linked wallets (secondary wallets on one customer)
+  // -----------------------------------------------------------------------
+  /**
+   * List all wallets of a customer: the primary plus any linked wallets.
+   */
+  async listWallets(customerId) {
+    requireString(customerId, "customerId");
+    return this.http.get(`/customers/api/manage/${encodeURIComponent(customerId)}/wallets`);
+  }
+  /**
+   * Link an additional wallet to a customer. The wallet must not be in use
+   * by any other customer in the instance.
+   */
+  async addWallet(customerId, walletAddress, label) {
+    requireString(customerId, "customerId");
+    requireAddress(walletAddress, "walletAddress");
+    return this.http.post(`/customers/api/manage/${encodeURIComponent(customerId)}/wallets`, {
+      walletAddress,
+      label
+    });
+  }
+  /**
+   * Remove a linked (non-primary) wallet from a customer.
+   */
+  async removeWallet(customerId, walletAddress) {
+    requireString(customerId, "customerId");
+    requireAddress(walletAddress, "walletAddress");
+    return this.http.delete(`/customers/api/manage/${encodeURIComponent(customerId)}/wallets/${walletAddress}`);
+  }
+  /**
+   * Promote a linked wallet to primary. The previous primary becomes a
+   * linked wallet labeled "Previously primary".
+   */
+  async promoteWallet(customerId, walletAddress) {
+    requireString(customerId, "customerId");
+    requireAddress(walletAddress, "walletAddress");
+    return this.http.post(`/customers/api/manage/${encodeURIComponent(customerId)}/wallets/${walletAddress}/promote`);
+  }
+  // -----------------------------------------------------------------------
+  // Convenience search helpers
+  // -----------------------------------------------------------------------
+  /**
+   * Search customers by name substring.
+   */
+  async searchByName(name, options) {
+    return this.list({ ...options, search: name });
+  }
+  /**
+   * Find a customer by wallet address.
+   */
+  async searchByWallet(walletAddress) {
+    requireAddress(walletAddress, "walletAddress");
+    return this.get(walletAddress);
+  }
+  /**
+   * Find a customer by external ID (your system's unique identifier).
+   */
+  async searchByExternalId(externalId) {
+    requireString(externalId, "externalId");
+    try {
+      return await this.get(externalId);
+    } catch (err) {
+      if (err?.statusCode !== 404) throw err;
+      const { customers } = await this.list({ search: externalId, limit: 200 });
+      const match = customers.find((c) => c.externalId === externalId);
+      if (match) return match;
+      throw err;
+    }
+  }
+  /**
+   * Find a customer by reference key (for pre-wallet customers).
+   */
+  async searchByReference(referenceKey) {
+    requireString(referenceKey, "referenceKey");
+    return this.get(referenceKey);
+  }
+};
+
+// src/utils/manifest.ts
+function manifestToVerifyInput(manifest, overrides = {}) {
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    throw new ValidationError("manifest must be the manifest.json object produced by the KYC proof tool");
+  }
+  const walletAddress = requireAddress(overrides.walletAddress ?? manifest.walletAddress, "manifest.walletAddress");
+  const kycHash = requireHash(manifest.kycHash, "manifest.kycHash");
+  const passthrough = manifest.passthrough ?? {};
+  const country = overrides.country ?? passthrough.country;
+  if (!country || typeof country !== "string") {
+    throw new ValidationError(
+      "country is required: this manifest has no passthrough.country, pass { country } as an override"
+    );
+  }
+  return {
+    walletAddress,
+    country,
+    kycHash,
+    investorType: overrides.investorType ?? passthrough.investorType,
+    softExpiryDays: overrides.softExpiryDays ?? passthrough.softExpiryDays,
+    hardExpiryDays: overrides.hardExpiryDays ?? passthrough.hardExpiryDays
+  };
+}
+
+// src/utils/register.ts
+var MAX_ROUNDS = 6;
+var HASH_RE = /^0x[0-9a-fA-F]{64}$/;
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new TrussetError("The API returned no plan the SDK can sign. Nothing was signed", "UNSIGNABLE_PLAN", 0);
+  }
+  return value;
+}
+function bytesOf(hash) {
+  const out = new Uint8Array(32);
+  for (let i = 0; i < 32; i++) out[i] = parseInt(hash.slice(2 + i * 2, 4 + i * 2), 16);
+  return out;
+}
+function messageOf(error) {
+  if (error && typeof error === "object" && typeof error.message === "string") {
+    return error.message.split("\n")[0].slice(0, 200);
+  }
+  return String(error);
+}
+function unsignable(plan) {
+  const phase = typeof plan.phase === "string" ? ` (register phase ${plan.phase})` : "";
+  return new TrussetError(`The prepared write carries no transaction the SDK can sign${phase}, so nothing was signed`, "UNSIGNABLE_PLAN", 0);
+}
+async function executeAfter(chain, plan, options, earlier) {
+  try {
+    return await execute(chain, plan, options);
+  } catch (err) {
+    if (!earlier.some((t) => t.txHash !== null)) throw err;
+    if (err instanceof ConfirmationError) {
+      throw new ConfirmationError(`${err.message}. Earlier steps of this registration are on chain as well`, err.code === "CONFIRMATION_FAILED" ? "CONFIRMATION_FAILED" : "TRANSACTION_FAILED", [...earlier, ...err.transactions], err.txHash, err.failure);
+    }
+    throw new ConfirmationError(`${messageOf(err)}. Earlier steps of this registration are already on chain; see err.transactions for every hash sent`, "TRANSACTION_FAILED", earlier, null, err);
+  }
+}
+async function runRegisterPlan(chain, options, spec) {
+  await preflightChain(chain, options);
+  const carry = {
+    signerAddress: await signerAddress(requireSigner(options.signer)),
+    claimSignatures: [...spec.seed?.claimSignatures ?? []],
+    identities: { ...spec.seed?.identities ?? {} }
+  };
+  const transactions = [];
+  const signedMessages = /* @__PURE__ */ new Set();
+  for (let round = 0; round < MAX_ROUNDS; round++) {
+    const plan = asRecord(await spec.build(carry));
+    if (plan.phase === "DEPLOY_IDENTITY") {
+      const steps = Array.isArray(plan.steps) ? plan.steps : [];
+      if (steps.length === 0) throw unsignable(plan);
+      for (const entry of steps) {
+        const step = asRecord(entry);
+        const wallet = step.walletAddress;
+        const deployment = planOf({ steps: [step] }, { confirmIndex: 0 });
+        if (typeof wallet !== "string" || !deployment || deployment.steps[0].transaction.to !== void 0) throw unsignable(plan);
+        const executed = await executeAfter(chain, deployment, options, transactions);
+        transactions.push(...executed.transactions);
+        const hash = executed.confirmHash;
+        let recorded;
+        try {
+          recorded = await spec.recordIdentity(wallet, hash);
+        } catch (err) {
+          throw new ConfirmationError(
+            `The ONCHAINID of ${wallet} was deployed in ${hash}, but Trusset has not recorded it: ${messageOf(err)}. Record it with identity.deployOnchainId('${wallet}', { txHash: '${hash}' }), then run this call again`,
+            "CONFIRMATION_FAILED",
+            [...transactions],
+            hash,
+            err
+          );
+        }
+        if (typeof recorded?.identity === "string") carry.identities[wallet] = recorded.identity;
+      }
+      continue;
+    }
+    if (plan.action === "SIGN_MESSAGES") {
+      const messages = Array.isArray(plan.messages) ? plan.messages : [];
+      if (messages.length === 0) throw unsignable(plan);
+      for (const entry of messages) {
+        const message = asRecord(entry);
+        const hash = message.messageHash;
+        if (message.scheme !== void 0 && message.scheme !== "eip191" || typeof hash !== "string" || !HASH_RE.test(hash) || typeof message.walletAddress !== "string") {
+          throw new TrussetError("The register asks for a claim signature in a form the SDK does not produce. Nothing was signed", "UNSIGNABLE_MESSAGE", 0);
+        }
+        const key = hash.toLowerCase();
+        if (signedMessages.has(key)) {
+          throw new TrussetError(`The register asked again for the claim of ${message.walletAddress} the signer already signed, so the signer is not accepted as a claim key of the trusted issuer. Nothing further was signed`, "CLAIM_SIGNATURE_REFUSED", 0);
+        }
+        const signature = await signMessage(chain, options, bytesOf(hash));
+        signedMessages.add(key);
+        carry.claimSignatures.push({
+          walletAddress: message.walletAddress,
+          signature,
+          ...typeof message.claimType === "string" ? { claimType: message.claimType } : {}
+        });
+      }
+      continue;
+    }
+    const resolved = planOf(plan, spec.plan);
+    if (!resolved) throw unsignable(plan);
+    const final = await executeAfter(chain, resolved, options, transactions);
+    return { plan, steps: resolved.steps, final, transactions: [...transactions, ...final.transactions] };
+  }
+  throw new TrussetError(`The register plan did not settle into transactions after ${MAX_ROUNDS} rounds; nothing further was signed`, "PLAN_DID_NOT_SETTLE", 0);
+}
+async function settle(run, hash, retryWith, confirm) {
+  try {
+    const result = await confirm();
+    const base = result && typeof result === "object" ? result : { result };
+    return { ...base, transactions: run.transactions };
+  } catch (err) {
+    throw new ConfirmationError(
+      `${hash ? `Transaction ${hash} is` : "The signed transactions are"} on chain but Trusset has not recorded ${hash ? "it" : "them"}: ${messageOf(err)}. Confirm again with ${retryWith}`,
+      "CONFIRMATION_FAILED",
+      run.transactions,
+      hash,
+      err
+    );
+  }
+}
+async function confirmRun(run, confirm) {
+  const hash = run.final.confirmHash;
+  if (!hash) {
+    throw new ConfirmationError("The plan finished without a transaction to confirm. See err.transactions", "CONFIRMATION_FAILED", run.transactions, null, null);
+  }
+  return settle(run, hash, `{ txHash: '${hash}' }`, () => confirm(hash));
+}
+async function confirmRunSteps(run, confirm, retryWith) {
+  if (!run.final.transactions.some((t) => t.txHash !== null)) {
+    throw new ConfirmationError("The plan finished without a transaction to confirm. See err.transactions", "CONFIRMATION_FAILED", run.transactions, null, null);
+  }
+  return settle(run, null, retryWith, confirm);
+}
+
+// src/modules/customers/identity.ts
+var ONCHAIN_WRITE_TIMEOUT_MS = 6e4;
+var PROOF_CLAIMS_TIMEOUT_MS = 18e4;
+var BUILD = { timeoutMs: ONCHAIN_WRITE_TIMEOUT_MS };
+var CONFIRM = BUILD;
+var PROOF_BUILD = { timeoutMs: PROOF_CLAIMS_TIMEOUT_MS };
+var PROOF_CONFIRM = PROOF_BUILD;
+var SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
+var BASE64_SIG_RE = /^[A-Za-z0-9+/]{86}(==)?$/;
+var HEX_SIG_RE = /^(0x)?[0-9a-fA-F]{128}$/;
+function hasSigner(options) {
+  return Boolean(options && typeof options === "object" && "signer" in options);
+}
+function hasTxHash(options) {
+  return Boolean(options && typeof options === "object" && "txHash" in options && !("signer" in options));
+}
+function planFields(input) {
+  const out = {};
+  if (!input) return out;
+  const signerAddress2 = optionalAddress(input.signerAddress, "signerAddress");
+  if (signerAddress2) out.signerAddress = signerAddress2;
+  if (input.claimSignatures !== void 0) {
+    if (!Array.isArray(input.claimSignatures)) throw new ValidationError("claimSignatures must be a list of { walletAddress, signature, claimType }");
+    out.claimSignatures = input.claimSignatures.map((entry) => {
+      requireAddress(entry?.walletAddress, "claimSignatures[].walletAddress");
+      if (typeof entry.signature !== "string" || !SIGNATURE_RE.test(entry.signature)) {
+        throw new ValidationError("claimSignatures[].signature must be a 65-byte hex signature (0x + 130 hex chars)");
+      }
+      return entry.claimType === void 0 ? { walletAddress: entry.walletAddress, signature: entry.signature } : { walletAddress: entry.walletAddress, signature: entry.signature, claimType: entry.claimType };
+    });
+  }
+  if (input.identities !== void 0) {
+    if (!input.identities || typeof input.identities !== "object" || Array.isArray(input.identities)) {
+      throw new ValidationError("identities must map each wallet address to its ONCHAINID address");
+    }
+    const identities = {};
+    for (const [wallet, identity] of Object.entries(input.identities)) {
+      identities[requireAddress(wallet, "identities key")] = requireAddress(identity, `identities[${wallet}]`);
+    }
+    out.identities = identities;
+  }
+  return out;
+}
+function withoutPlanFields(input) {
+  const rest = { ...input };
+  delete rest.signerAddress;
+  delete rest.claimSignatures;
+  delete rest.identities;
+  return rest;
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+function hexToBytes(hex) {
+  const body = hex.startsWith("0x") ? hex.slice(2) : hex;
+  const out = new Uint8Array(body.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(body.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function manifestSigOf(value) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  const hint = "manifestSig must be the bundle's 64-byte manifest.sig: pass readFileSync(path) or readFileSync(path).toString('base64'), not the file read as text";
+  if (value instanceof Uint8Array) {
+    if (value.length !== 64) throw new ValidationError(`${hint}. These bytes are ${value.length} long`);
+    return bytesToBase64(value);
+  }
+  if (typeof value !== "string") throw new ValidationError(hint);
+  const s = value.trim();
+  if (BASE64_SIG_RE.test(s)) return s;
+  if (HEX_SIG_RE.test(s)) return bytesToBase64(hexToBytes(s));
+  throw new ValidationError(hint);
+}
+function proofBody(input) {
+  const { manifestSig, ...rest } = withoutPlanFields(input);
+  const sig = manifestSigOf(manifestSig);
+  return sig === void 0 ? rest : { ...rest, manifestSig: sig };
+}
+var CustomerIdentity = class {
+  constructor(http, chain) {
+    this.http = http;
+    this.chain = chain ?? new InstanceChain(http);
+  }
+  async verify(input, options) {
+    requireAddress(input.walletAddress, "walletAddress");
+    requireCountry(input.country, "country");
+    optionalHash(input.kycHash, "kycHash");
+    const plan = planFields(input);
+    const base = withoutPlanFields(input);
+    if (hasTxHash(options)) {
+      requireHash(options.txHash, "txHash");
+      return this.confirmVerify({ ...base, txHash: options.txHash });
+    }
+    if (!hasSigner(options)) {
+      return this.http.post("/customers/api/identity/verify", { ...base, ...plan }, BUILD);
+    }
+    let pinned = base.kycHash;
+    const run = await runRegisterPlan(this.chain, options, {
+      build: async (carry) => {
+        const prepared = await this.http.post("/customers/api/identity/verify", { ...base, ...pinned ? { kycHash: pinned } : {}, ...carry }, BUILD);
+        if (!pinned && typeof prepared?.kycHash === "string") pinned = prepared.kycHash;
+        return prepared;
+      },
+      recordIdentity: (wallet, txHash) => this.confirmOnchainId(wallet, txHash),
+      seed: plan
+    });
+    const kycHash = typeof run.plan.kycHash === "string" ? run.plan.kycHash : pinned;
+    return confirmRun(run, (txHash) => this.confirmVerify({ ...base, kycHash, txHash }));
+  }
+  async verifyFromManifest(manifest, overrides, options) {
+    const input = { ...manifestToVerifyInput(manifest, overrides), ...planFields(overrides) };
+    return options ? this.verify(input, options) : this.verify(input);
+  }
+  async batchVerify(entries, options) {
+    if (!Array.isArray(entries) || entries.length === 0 || entries.length > 500) {
+      throw new ValidationError("Provide 1-500 entries for batch verification");
+    }
+    for (const e of entries) {
+      requireAddress(e.walletAddress, "walletAddress");
+      requireCountry(e.country, "country");
+      optionalHash(e.kycHash, "kycHash");
+    }
+    if (hasTxHash(options)) {
+      requireHash(options.txHash, "txHash");
+      return this.confirmBatchVerify(entries, options.txHash);
+    }
+    if (!hasSigner(options)) {
+      return this.http.post("/customers/api/identity/batch-verify", { entries, ...planFields(options) }, BUILD);
+    }
+    let pinned = entries;
+    const run = await runRegisterPlan(this.chain, options, {
+      build: async (carry) => {
+        const prepared2 = await this.http.post("/customers/api/identity/batch-verify", { entries: pinned, ...carry }, BUILD);
+        pinned = pinEntryHashes(pinned, prepared2);
+        return prepared2;
+      },
+      recordIdentity: (wallet, txHash) => this.confirmOnchainId(wallet, txHash)
+    });
+    const prepared = run.plan;
+    const merged = mergePreparedEntries(entries, prepared);
+    return confirmRun(run, async (txHash) => withPrepareRejections(await this.confirmBatchVerify(merged.entries, txHash), prepared, merged.origin));
+  }
+  async revoke(walletAddress, options) {
+    requireAddress(walletAddress, "walletAddress");
+    if (hasTxHash(options)) {
+      requireHash(options.txHash, "txHash");
+      return this.confirmRevoke(walletAddress, options.txHash);
+    }
+    if (!hasSigner(options)) {
+      return this.http.post("/customers/api/identity/revoke", { walletAddress }, BUILD);
+    }
+    const run = await runRegisterPlan(this.chain, options, {
+      build: () => this.http.post("/customers/api/identity/revoke", { walletAddress }, BUILD),
+      recordIdentity: (wallet, txHash) => this.confirmOnchainId(wallet, txHash)
+    });
+    return confirmRun(run, (txHash) => this.confirmRevoke(walletAddress, txHash));
+  }
+  /**
+   * Get combined on-chain and off-chain identity status.
+   */
+  async getStatus(walletAddress) {
+    requireAddress(walletAddress, "walletAddress");
+    return this.http.get(`/customers/api/identity/status/${walletAddress}`);
+  }
+  /**
+   * Check whether a token transfer between two addresses is compliant.
+   * Runs identity checks + all registered compliance modules.
+   */
+  async canTransfer(input) {
+    requireAddress(input.from, "from");
+    requireAddress(input.to, "to");
+    return this.http.post("/customers/api/identity/can-transfer", input);
+  }
+  async deployOnchainId(walletAddress, options) {
+    requireAddress(walletAddress, "walletAddress");
+    if (hasTxHash(options)) {
+      requireHash(options.txHash, "txHash");
+      return this.confirmOnchainId(walletAddress, options.txHash);
+    }
+    if (!hasSigner(options)) {
+      return this.http.post("/customers/api/identity/onchainid", { walletAddress, ...planFields(options) }, BUILD);
+    }
+    await preflightChain(this.chain, options);
+    const signer = await signerAddress(requireSigner(options.signer));
+    const prepared = await this.http.post("/customers/api/identity/onchainid", { walletAddress, signerAddress: signer }, BUILD);
+    if (prepared.exists) return attachTransactions(prepared, []);
+    const plan = planOf(prepared, { confirmIndex: 0 });
+    if (!plan || plan.steps[0].transaction.to !== void 0) {
+      throw new TrussetError("The ONCHAINID build carries no identity deployment the SDK can sign, so nothing was signed", "UNSIGNABLE_PLAN", 0);
+    }
+    const executed = await execute(this.chain, plan, options);
+    return confirmExecuted(executed, (txHash) => this.confirmOnchainId(walletAddress, txHash));
+  }
+  // -----------------------------------------------------------------------
+  // On-chain claims
+  // -----------------------------------------------------------------------
+  /**
+   * List the active on-chain claims of a wallet.
+   */
+  async getClaims(walletAddress) {
+    requireAddress(walletAddress, "walletAddress");
+    return this.http.get(`/customers/api/identity/claims/${walletAddress}`);
+  }
+  async addClaimsFromProof(input, options) {
+    requireAddress(input.walletAddress, "walletAddress");
+    if (!input.manifest || typeof input.manifest !== "object" || Array.isArray(input.manifest)) {
+      throw new ValidationError("manifest must be the manifest.json object produced by the KYC proof tool");
+    }
+    const plan = planFields(input);
+    const body = proofBody(input);
+    if (options && !hasSigner(options)) {
+      if (!Array.isArray(options.txResults) || options.txResults.length === 0) {
+        throw new ValidationError("txResults must list the signed claims as [{ claimType, txHash }]");
+      }
+      for (const r of options.txResults) requireHash(r?.txHash, "txResults[].txHash");
+      return this.confirmProofClaims(body, options.txResults);
+    }
+    if (!options) {
+      return this.http.post("/customers/api/identity/claims/from-proof", { ...body, ...plan }, PROOF_BUILD);
+    }
+    const run = await runRegisterPlan(this.chain, options, {
+      build: (carry) => this.http.post("/customers/api/identity/claims/from-proof", { ...body, ...carry }, PROOF_BUILD),
+      recordIdentity: (wallet, txHash) => this.confirmOnchainId(wallet, txHash),
+      seed: plan,
+      plan: { confirmIndex: null }
+    });
+    const planned = Array.isArray(run.plan.steps) ? run.plan.steps : [];
+    const txResults = [];
+    run.final.transactions.forEach((sent, i) => {
+      const claimType = planned[i]?.claimType;
+      if (claimType && sent.txHash) txResults.push({ claimType, txHash: sent.txHash });
+    });
+    return confirmRunSteps(run, () => this.confirmProofClaims(body, txResults), "{ txResults }");
+  }
+  async addClaim(input, options) {
+    requireAddress(input.walletAddress, "walletAddress");
+    if (input.claimType === void 0 || input.claimType === null) {
+      throw new ValidationError("claimType is required");
+    }
+    if (!input.dataHash && !input.dataInput) {
+      throw new ValidationError("Provide dataHash (32-byte hex) or dataInput (string) for the claim");
+    }
+    optionalHash(input.dataHash, "dataHash");
+    const plan = planFields(input);
+    const base = withoutPlanFields(input);
+    if (hasTxHash(options)) {
+      requireHash(options.txHash, "txHash");
+      return this.confirmAddClaim({ ...base, txHash: options.txHash });
+    }
+    if (!hasSigner(options)) {
+      return this.http.post("/customers/api/identity/add-claim", { ...base, ...plan }, BUILD);
+    }
+    const run = await runRegisterPlan(this.chain, options, {
+      build: (carry) => this.http.post("/customers/api/identity/add-claim", { ...base, ...carry }, BUILD),
+      recordIdentity: (wallet, txHash) => this.confirmOnchainId(wallet, txHash),
+      seed: plan
+    });
+    const dataHash = typeof run.plan.dataHash === "string" ? run.plan.dataHash : base.dataHash;
+    return confirmRun(run, (txHash) => this.confirmAddClaim({ ...base, dataHash, txHash }));
+  }
+  async revokeClaim(walletAddress, claimType, options) {
+    requireAddress(walletAddress, "walletAddress");
+    if (claimType === void 0 || claimType === null) {
+      throw new ValidationError("claimType is required");
+    }
+    if (hasTxHash(options)) {
+      requireHash(options.txHash, "txHash");
+      return this.confirmRevokeClaim(walletAddress, claimType, options.txHash);
+    }
+    if (!hasSigner(options)) {
+      return this.http.post("/customers/api/identity/revoke-claim", { walletAddress, claimType }, BUILD);
+    }
+    const run = await runRegisterPlan(this.chain, options, {
+      build: () => this.http.post("/customers/api/identity/revoke-claim", { walletAddress, claimType }, BUILD),
+      recordIdentity: (wallet, txHash) => this.confirmOnchainId(wallet, txHash)
+    });
+    return confirmRun(run, (txHash) => this.confirmRevokeClaim(walletAddress, claimType, txHash));
+  }
+  // -----------------------------------------------------------------------
+  // Confirmations: the backend reads the mined receipt, checks it targets the
+  // identity registry and the wallet it should, and only then records it.
+  // -----------------------------------------------------------------------
+  confirmVerify(body) {
+    return this.http.post("/customers/api/identity/verify", body, CONFIRM);
+  }
+  confirmBatchVerify(entries, txHash) {
+    return this.http.post("/customers/api/identity/batch-verify", { entries, txHash }, CONFIRM);
+  }
+  confirmRevoke(walletAddress, txHash) {
+    return this.http.post("/customers/api/identity/revoke", { walletAddress, txHash }, CONFIRM);
+  }
+  confirmAddClaim(body) {
+    return this.http.post("/customers/api/identity/add-claim", body, CONFIRM);
+  }
+  confirmRevokeClaim(walletAddress, claimType, txHash) {
+    return this.http.post("/customers/api/identity/revoke-claim", { walletAddress, claimType, txHash }, CONFIRM);
+  }
+  confirmProofClaims(body, txResults) {
+    return this.http.post("/customers/api/identity/claims/from-proof", { ...body, txResults }, PROOF_CONFIRM);
+  }
+  confirmOnchainId(walletAddress, txHash) {
+    return this.http.post("/customers/api/identity/onchainid/confirm", { walletAddress, txHash }, CONFIRM);
+  }
+};
+function mergePreparedEntries(entries, prepared) {
+  const accepted = Array.isArray(prepared.entries) ? prepared.entries : [];
+  const origin = [];
+  const merged = accepted.map((entry) => {
+    const index = entries.findIndex((e) => e.walletAddress.toLowerCase() === entry.walletAddress.toLowerCase());
+    origin.push(index);
+    return {
+      ...index >= 0 ? entries[index] : {},
+      walletAddress: entry.walletAddress,
+      country: entry.country,
+      kycHash: entry.kycHash
+    };
+  });
+  return { entries: merged, origin };
+}
+function pinEntryHashes(entries, prepared) {
+  const derived = new Map((Array.isArray(prepared?.entries) ? prepared.entries : []).map((e) => [e.walletAddress.toLowerCase(), e.kycHash]));
+  return entries.map((e) => {
+    const hash = e.kycHash ?? derived.get(e.walletAddress.toLowerCase());
+    return hash ? { ...e, kycHash: hash } : e;
+  });
+}
+function withPrepareRejections(confirmed, prepared, origin) {
+  const early = Array.isArray(prepared.rejected) ? prepared.rejected : [];
+  const late = (Array.isArray(confirmed.rejected) ? confirmed.rejected : []).map((r) => ({ ...r, index: origin[r.index] ?? r.index }));
+  const rejected = [...early, ...late].sort((a, b) => a.index - b.index);
+  return {
+    ...confirmed,
+    submitted: typeof prepared.submitted === "number" ? prepared.submitted : confirmed.submitted,
+    rejectedCount: rejected.length,
+    rejected
+  };
+}
+
+// src/modules/customers/id-links.ts
+var CustomerIdLinks = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Create a KYC verification link to send to an investor.
+   */
+  async create(input) {
+    if (!input.recipientEmail && !input.recipientWallet && !input.recipientPhone) {
+      throw new ValidationError("At least one of recipientEmail, recipientWallet, or recipientPhone is required");
+    }
+    return this.http.post("/customers/api/id-links", input);
+  }
+  /**
+   * List all verification links for the current instance.
+   */
+  async list(options = {}) {
+    const params = {
+      limit: clampInt(options.limit, 1, 200, 50),
+      offset: clampInt(options.offset, 0, Number.MAX_SAFE_INTEGER, 0),
+      status: options.status
+    };
+    const { data, metadata } = await this.http.getWithMeta("/customers/api/id-links", params);
+    const links = Array.isArray(data) ? data : [];
+    return { links, total: metadata.total ?? links.length };
+  }
+  /**
+   * Revoke (expire) a verification link so it can no longer be used.
+   */
+  async revoke(linkId) {
+    requireString(linkId, "linkId");
+    await this.http.put(`/customers/api/id-links/${encodeURIComponent(linkId)}/revoke`);
+  }
+  /**
+   * Resend a verification link via the specified channels.
+   */
+  async resend(linkId, channels) {
+    requireString(linkId, "linkId");
+    if (!Array.isArray(channels) || channels.length === 0) {
+      throw new ValidationError("channels array is required (email and/or sms)");
+    }
+    return this.http.post(`/customers/api/id-links/${encodeURIComponent(linkId)}/resend`, { channels });
+  }
+};
+
+// src/modules/customers/sync.ts
+var DEFAULT_BATCH_SIZE = 50;
+var MAX_BATCH_SIZE = 200;
+var MAX_VERIFY_BATCH = 500;
+var CustomerSync = class {
+  constructor(http, identity) {
+    this.http = http;
+    this.manage = new CustomerManagement(http);
+    this.identity = identity ?? new CustomerIdentity(http);
+  }
+  /**
+   * Import customer records from an external system.
+   *
+   * Each record is mapped by `externalId`. If a customer with that externalId
+   * already exists, the `onConflict` strategy determines whether to skip or
+   * update.
+   *
+   * When `verifyOnChain` is true, records that include a `walletAddress` and
+   * `country` are batch-verified on-chain after the database import. That
+   * needs `signer`: verification transactions are signed by your wallet, not
+   * by Trusset.
+   */
+  async importRecords(records, options = {}) {
+    if (!Array.isArray(records) || records.length === 0) {
+      throw new ValidationError("records must be a non-empty array");
+    }
+    if (options.verifyOnChain) {
+      requireSigner(options.signer);
+    }
+    const batchSize = clampInt(options.batchSize, 1, MAX_BATCH_SIZE, DEFAULT_BATCH_SIZE);
+    const onConflict = options.onConflict ?? "update";
+    const result = { total: records.length, created: 0, updated: 0, skipped: 0, errors: [] };
+    const verifyQueue = [];
+    const verifyIds = [];
+    for (let i = 0; i < records.length; i += batchSize) {
+      const batch = records.slice(i, i + batchSize);
+      const batchResults = await Promise.allSettled(
+        batch.map((record) => this.processRecord(record, onConflict))
+      );
+      for (let j = 0; j < batchResults.length; j++) {
+        const settled = batchResults[j];
+        const record = batch[j];
+        if (settled.status === "fulfilled") {
+          const outcome = settled.value;
+          if (outcome.action === "created") result.created++;
+          else if (outcome.action === "updated") result.updated++;
+          else result.skipped++;
+          if (options.verifyOnChain && record.walletAddress && record.country && outcome.action !== "skipped") {
+            verifyQueue.push({
+              walletAddress: record.walletAddress,
+              country: record.country,
+              investorType: record.investorType,
+              kycHash: record.kycHash,
+              softExpiryDays: options.verificationDefaults?.softExpiryDays,
+              hardExpiryDays: options.verificationDefaults?.hardExpiryDays
+            });
+            verifyIds.push(record.externalId);
+          }
+        } else {
+          const err = settled.reason;
+          result.errors.push({
+            externalId: record.externalId,
+            code: err?.code ?? "UNKNOWN",
+            message: err?.message ?? "Unknown error"
+          });
+        }
+      }
+      options.onProgress?.(Math.min(i + batchSize, records.length), records.length);
+    }
+    if (verifyQueue.length > 0) {
+      await this.runBatchVerification(verifyQueue, verifyIds, options, result);
+    }
+    return result;
+  }
+  /**
+   * Export all customers from Trusset as flat records.
+   * Useful for syncing data back into your system.
+   */
+  async exportRecords(options = {}) {
+    const allRecords = [];
+    let offset = 0;
+    const limit = 200;
+    while (true) {
+      const { data, metadata } = await this.http.getWithMeta("/customers/api/manage", {
+        limit,
+        offset,
+        includeArchived: options.includeArchived ? "true" : void 0
+      });
+      const customers = Array.isArray(data) ? data : [];
+      if (customers.length === 0) break;
+      for (const c of customers) {
+        allRecords.push({
+          externalId: c.externalId ?? c.id,
+          walletAddress: c.walletAddress ?? void 0,
+          name: c.name ?? void 0,
+          country: c.country ?? void 0,
+          investorType: c.investorType ?? void 0,
+          kycHash: c.kycHash ?? void 0,
+          metadata: c.metadata ?? void 0
+        });
+      }
+      offset += customers.length;
+      if (metadata.total !== void 0 && offset >= metadata.total) break;
+    }
+    return allRecords;
+  }
+  // -----------------------------------------------------------------------
+  // Internal
+  // -----------------------------------------------------------------------
+  async processRecord(record, onConflict) {
+    requireString(record.externalId, "externalId");
+    let existing = null;
+    try {
+      existing = await this.manage.searchByExternalId(record.externalId);
+    } catch (err) {
+      const code = err?.code;
+      const statusCode = err?.statusCode;
+      if (statusCode !== 404 && code !== "NOT_FOUND") throw err;
+    }
+    if (existing) {
+      if (onConflict === "skip") {
+        return { action: "skipped" };
+      }
+      await this.manage.update(existing.id, {
+        name: record.name,
+        country: record.country,
+        investorType: record.investorType,
+        walletAddress: record.walletAddress,
+        metadata: record.metadata
+      });
+      return { action: "updated" };
+    }
+    await this.manage.create({
+      externalId: record.externalId,
+      walletAddress: record.walletAddress,
+      name: record.name,
+      country: record.country,
+      investorType: record.investorType,
+      metadata: record.metadata
+    });
+    return { action: "created" };
+  }
+  async runBatchVerification(queue, ids, options, result) {
+    const signer = requireSigner(options.signer);
+    for (let i = 0; i < queue.length; i += MAX_VERIFY_BATCH) {
+      const batch = queue.slice(i, i + MAX_VERIFY_BATCH);
+      try {
+        const confirmed = await this.identity.batchVerify(batch, {
+          signer,
+          confirmations: options.confirmations
+        });
+        for (const rejection of confirmed.rejected) {
+          result.errors.push({
+            externalId: ids[i + rejection.index] ?? rejection.walletAddress ?? `entry ${i + rejection.index}`,
+            code: rejection.code,
+            message: rejection.message
+          });
+        }
+      } catch (err) {
+        for (const [k, entry] of batch.entries()) {
+          result.errors.push({
+            externalId: ids[i + k] ?? entry.walletAddress,
+            code: "VERIFY_FAILED",
+            message: err?.message ?? "On-chain batch verification failed"
+          });
+        }
+      }
+    }
+  }
+};
+
+// src/modules/customers/verification-profiles.ts
+var CustomerVerificationProfiles = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * List all verification profiles of the current instance,
+   * presets (RETAIL, PROFESSIONAL, ELIGIBLE_COUNTERPARTY) first.
+   */
+  async list() {
+    return this.http.get("/customers/api/verification-profiles");
+  }
+};
+
+// src/modules/customers/index.ts
+var Customers = class {
+  constructor(http, chain) {
+    this.manage = new CustomerManagement(http);
+    this.identity = new CustomerIdentity(http, chain);
+    this.idLinks = new CustomerIdLinks(http);
+    this.profiles = new CustomerVerificationProfiles(http);
+    this.sync = new CustomerSync(http, this.identity);
+  }
+};
+
+export {
+  CustomerManagement,
+  manifestToVerifyInput,
+  CustomerIdentity,
+  CustomerIdLinks,
+  CustomerSync,
+  CustomerVerificationProfiles,
+  Customers
+};