@xkova/sdk 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/member-action-intents.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { isAllowedProtocol } from './url.js';
 export class XKOVAMemberIntentError extends Error {
     code;
     status;
@@ -33,8 +34,7 @@ export class XKOVAMemberActionIntents {
             location.username ||
             location.password ||
             location.hash ||
-            (location.protocol !== 'https:' &&
-                !(location.protocol === 'http:' && location.hostname === 'localhost')))
+            !isAllowedProtocol(location))
             throw new TypeError('Action review requires the exact application origin');
         const snapshot = JSON.parse(canonicalJson({
             request: input.request,

package/dist/member-bff.d.ts

@@ -350,20 +350,6 @@ export declare class XKOVAMemberBffClient {
         readonly redirectUri: string;
         readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
     }): Promise<XKOVAHostedMemberAuthorizationStart>;
-    /**
-     * Available only to sandbox applications enabled for demo sign-in. The stored
-     * Hosted transaction determines the demo account and callback. An uncertain
-     * response preserves the key so a retry recovers the same reservation.
-     * Complete the returned callback using
-     * completeHostedAuthorization and the original browser flow cookie.
-     */
-    completeSandboxDemoAuthorization<TApplicationData>(input: {
-        readonly state: string;
-        readonly transactionStore: XKOVAMemberAuthorizationTransactionStore<TApplicationData>;
-    }): Promise<{
-        readonly callbackUrl: string;
-        readonly expiresAt: string;
-    }>;
     /**
      * Completes the one-time Hosted Auth result-code exchange and persists the
      * provider-neutral XKOVA member session. The returned projection is safe for
@@ -492,8 +478,6 @@ export declare class XKOVAMemberBffClient {
     private readSessionMaterial;
     private requestSignal;
 }
-/** Only confirmed admission rejections may release a customer's pending demo reservation. */
-export declare function isDefinitiveXKOVASandboxDemoAdmissionFailure(error: unknown): boolean;
 export declare function projectXKOVAMemberSession(session: XKOVAMemberContext): XKOVABrowserMemberProjection;
 export declare function serializeXKOVAMemberSessionCookie(input: {
     readonly cookieName: string;

package/dist/member-bff.js

@@ -1,5 +1,6 @@
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { XKOVAApiError } from './errors.js';
+import { isAllowedProtocol } from './url.js';
 import { XKOVAClient } from './client.js';
 import { XKOVAMemberResources } from './member-resources.js';
 import { XKOVAMemberActionIntents, } from './member-action-intents.js';
@@ -195,54 +196,6 @@ export class XKOVAMemberBffClient {
             throw error;
         }
     }
-    /**
-     * Available only to sandbox applications enabled for demo sign-in. The stored
-     * Hosted transaction determines the demo account and callback. An uncertain
-     * response preserves the key so a retry recovers the same reservation.
-     * Complete the returned callback using
-     * completeHostedAuthorization and the original browser flow cookie.
-     */
-    async completeSandboxDemoAuthorization(input) {
-        if (!this.options.apiKey.startsWith('xkv_test_') ||
-            !this.options.publishableKey.startsWith('xkova_pk_sandbox_')) {
-            throw new XKOVAMemberAuthorizationTerminalError('provider_rejected', 'Demo admission requires a sandbox application');
-        }
-        const stateHash = hashOpaque(input.state);
-        return input.transactionStore.runExclusive(stateHash, async () => {
-            const transaction = await input.transactionStore.get(stateHash);
-            if (!transaction || transaction.expiresAt <= Date.now()) {
-                throw new XKOVAMemberAuthorizationTerminalError('transaction_unavailable', 'Demo admission requires an active Hosted transaction');
-            }
-            assertMemberBffClientFingerprint(transaction.clientFingerprint, this.clientFingerprint);
-            if (transaction.status !== 'pending' ||
-                transaction.completionMode !== 'hosted_result_code' ||
-                !transaction.authorizationUrl) {
-                throw new XKOVAMemberAuthorizationTerminalError('transaction_unavailable', 'Demo admission requires a completed Hosted start');
-            }
-            const authorization = new URL(normalizeHostedAuthorizationUrl(transaction.authorizationUrl));
-            const capability = authorization.searchParams.get('transaction');
-            if (!/^\/authorize\/?$/.test(authorization.pathname) ||
-                !capability ||
-                !/^[A-Za-z0-9_-]{43}$/.test(capability)) {
-                throw new XKOVAMemberAuthorizationTerminalError('transaction_unavailable', 'Demo admission capability is invalid');
-            }
-            const value = await this.postJson('/member-auth/hosted/authorizations/sandbox-demo', { transaction: capability }, undefined, `sandbox-demo-${stateHash}`);
-            const body = requireObject(value, 'Sandbox demo admission');
-            const { expiresAt } = boundedAuthorizationExpiry(body, transaction.expiresAt, 'Sandbox demo admission');
-            const callback = new URL(requireString(body, 'redirect_url', 'Sandbox demo admission'));
-            const code = callback.searchParams.get('code');
-            if (!sameCallback(callback, new URL(transaction.redirectUri)) ||
-                callback.searchParams.getAll('state').length !== 1 ||
-                callback.searchParams.get('state') !== input.state ||
-                callback.searchParams.getAll('code').length !== 1 ||
-                !code ||
-                callback.searchParams.has('error')) {
-                throw new Error('Sandbox demo admission returned the wrong callback binding');
-            }
-            assertHostedAuthorizationResultCode(code);
-            return { callbackUrl: callback.toString(), expiresAt };
-        });
-    }
     /**
      * Completes the one-time Hosted Auth result-code exchange and persists the
      * provider-neutral XKOVA member session. The returned projection is safe for
@@ -560,7 +513,7 @@ export class XKOVAMemberBffClient {
                 clientFingerprint: this.clientFingerprint,
                 codeVerifier,
                 redirectUri: returnUri,
-                exchangeAttemptId: generateXKOVAMemberOperationAttemptId(),
+                exchangeAttemptId: randomUUID(),
                 sessionReference: input.sessionReference,
                 intent: 'action',
                 ...(applicationReturnUri !== undefined && { applicationReturnUri }),
@@ -1210,14 +1163,6 @@ export class XKOVAMemberBffClient {
             : AbortSignal.timeout(this.options.timeoutMs);
     }
 }
-/** Only confirmed admission rejections may release a customer's pending demo reservation. */
-export function isDefinitiveXKOVASandboxDemoAdmissionFailure(error) {
-    return (error instanceof XKOVAMemberAuthorizationTerminalError ||
-        (error instanceof XKOVAApiError &&
-            (error.status < 500 ||
-                error.code === 'demo_persona_unavailable' ||
-                error.code === 'demo_login_disabled')));
-}
 export function projectXKOVAMemberSession(session) {
     return {
         signedIn: true,
@@ -1339,8 +1284,8 @@ function normalizeApiBaseUrl(baseUrl) {
     if (url.username || url.password || url.search || url.hash) {
         throw new TypeError('XKOVA member BFF baseUrl must be an API origin or /v1 base URL');
     }
-    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && url.hostname === 'localhost')) {
-        throw new TypeError('XKOVA member BFF baseUrl must use HTTPS or localhost HTTP');
+    if (!isAllowedProtocol(url)) {
+        throw new TypeError('XKOVA member BFF baseUrl must use HTTPS or loopback HTTP');
     }
     const pathname = url.pathname.replace(/\/+$/, '');
     if (pathname !== '' && pathname !== '/v1') {
@@ -1353,16 +1298,15 @@ function normalizeCallbackUri(value) {
     if (url.username || url.password || url.search || url.hash) {
         throw new TypeError('member authorization redirectUri must not contain credentials, query, or fragment');
     }
-    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && url.hostname === 'localhost')) {
-        throw new TypeError('member authorization redirectUri must use HTTPS or localhost HTTP');
+    if (!isAllowedProtocol(url)) {
+        throw new TypeError('member authorization redirectUri must use HTTPS or loopback HTTP');
     }
     return url.toString();
 }
 function normalizeBrowserOrigin(value) {
     const url = new URL(value);
-    if (url.origin !== value ||
-        (url.protocol !== 'https:' && !(url.protocol === 'http:' && url.hostname === 'localhost'))) {
-        throw new TypeError('member authorization browserOrigin must be an exact HTTPS or localhost origin');
+    if (url.origin !== value || !isAllowedProtocol(url)) {
+        throw new TypeError('member authorization browserOrigin must be an exact HTTPS or loopback origin');
     }
     return value;
 }
@@ -1372,18 +1316,14 @@ function normalizeApplicationReturnUri(value, browserOrigin) {
         url.username ||
         url.password ||
         url.hash ||
-        (url.protocol !== 'https:' && !(url.protocol === 'http:' && url.hostname === 'localhost'))) {
+        !isAllowedProtocol(url)) {
         throw new TypeError('member action applicationReturnUri must use the exact browser origin');
     }
     return url.toString();
 }
 function normalizeHostedAuthorizationUrl(value) {
     const url = new URL(value);
-    if (url.username ||
-        url.password ||
-        url.hash ||
-        (url.protocol !== 'https:' &&
-            !(url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1')))) {
+    if (url.username || url.password || url.hash || !isAllowedProtocol(url)) {
         throw new Error('XKOVA member Hosted authorization URL must use HTTPS or loopback HTTP without credentials or a fragment');
     }
     return url.toString();

package/dist/member-resources.d.ts

@@ -18,6 +18,56 @@ export declare class XKOVAMemberResources {
     get paymentRequests(): import("./resources/index.js").PaymentRequestsResource;
     get wallets(): import("./resources/index.js").WalletsResource;
     readonly self: {
+        profile: () => Promise<{
+            id: import("./generated/types.js").components["schemas"]["AccountHolderId"];
+            tenant_id?: string;
+            state: "active" | "held" | "closed" | "closed_uncooperative" | "provisioning_failed";
+            state_reason?: string | null;
+            state_changed_at?: import("./generated/types.js").components["schemas"]["TimestampUtc"] | null;
+            tier: "tier_1" | "tier_2";
+            tier_2_uplift_status?: "not_requested" | "pending" | "passed" | "failed";
+            first_use_completed: boolean;
+            cip_payload?: {
+                name_hash?: string;
+                dob_hash?: string;
+                id_hash?: string;
+                address_hash?: string;
+            } | null;
+            cip_accepted_at?: import("./generated/types.js").components["schemas"]["TimestampUtc"] | null;
+            merchant_role_state?: "none" | "pending_review" | "approved" | "rejected" | "revoked";
+            auto_save_contacts?: boolean;
+            created_at: import("./generated/types.js").components["schemas"]["TimestampUtc"];
+            updated_at?: import("./generated/types.js").components["schemas"]["TimestampUtc"];
+            email?: string | null;
+            first_name?: string | null;
+            last_name?: string | null;
+            phone?: string | null;
+            avatar_url?: string | null;
+        }>;
+        productEnrollment: (product: string, control?: XKOVARequestControl) => Promise<{
+            product: string;
+            status: "not_opened" | "setup_required" | "opening" | "active" | "requires_review";
+            terms_version: string | null;
+            accepted_at: string | null;
+            credit: {
+                amount: string;
+                token_deployment_id: string;
+                status: "pending" | "submitted" | "settled" | "requires_review";
+                transaction_hash: string | null;
+            } | null;
+        }>;
+        acceptProductEnrollment: (product: string, body: ReqBody<"acceptAccountHolderSelfProductEnrollment">, opts?: XKOVAMutationOptions) => Promise<{
+            product: string;
+            status: "not_opened" | "setup_required" | "opening" | "active" | "requires_review";
+            terms_version: string | null;
+            accepted_at: string | null;
+            credit: {
+                amount: string;
+                token_deployment_id: string;
+                status: "pending" | "submitted" | "settled" | "requires_review";
+                transaction_hash: string | null;
+            } | null;
+        }>;
         actionReadiness: (control?: XKOVARequestControl) => Promise<{
             authorization_method: "hosted_passkey" | "external_oidc";
             setup_status: "passkey_required" | "recovery_acknowledgement_required" | "recovery_required" | "ready" | "externally_managed";

package/dist/member-resources.js

@@ -31,6 +31,9 @@ export class XKOVAMemberResources {
         return this.client.wallets;
     }
     self = {
+        profile: () => this.client.accountHolders.retrieve(this.accountHolderId),
+        productEnrollment: (product, control) => this.client.accountHolders.selfProductEnrollment(this.context, product, control),
+        acceptProductEnrollment: (product, body, opts) => this.client.accountHolders.acceptSelfProductEnrollment(this.context, product, body, opts),
         actionReadiness: (control) => this.client.accountHolders.selfActionReadiness({ ...this.context, accountHolderId: this.accountHolderId }, control),
         sandboxBankingContext: (control) => this.client.accountHolders.selfSandboxBankingContext(this.context, control),
         verification: (control) => this.client.accountHolders.selfVerification(this.context, control),

package/dist/resources/account-holders.d.ts

@@ -118,6 +118,30 @@ export declare class AccountHoldersResource extends Resource {
         }[];
         verification_url: string | null;
     }>;
+    selfProductEnrollment(context: XKOVAMemberSessionContext, product: string, control?: XKOVARequestControl): Promise<{
+        product: string;
+        status: "not_opened" | "setup_required" | "opening" | "active" | "requires_review";
+        terms_version: string | null;
+        accepted_at: string | null;
+        credit: {
+            amount: string;
+            token_deployment_id: string;
+            status: "pending" | "submitted" | "settled" | "requires_review";
+            transaction_hash: string | null;
+        } | null;
+    }>;
+    acceptSelfProductEnrollment(context: XKOVAMemberSessionContext, product: string, body: ReqBody<'acceptAccountHolderSelfProductEnrollment'>, opts?: XKOVAMutationOptions): Promise<{
+        product: string;
+        status: "not_opened" | "setup_required" | "opening" | "active" | "requires_review";
+        terms_version: string | null;
+        accepted_at: string | null;
+        credit: {
+            amount: string;
+            token_deployment_id: string;
+            status: "pending" | "submitted" | "settled" | "requires_review";
+            transaction_hash: string | null;
+        } | null;
+    }>;
     selfBalance(context: XKOVAMemberSessionContext, control?: XKOVARequestControl): Promise<{
         balances: import("../generated/types.js").components["schemas"]["AccountHolderSelfBalanceEntry"][];
     }>;

package/dist/resources/account-holders.js

@@ -1,5 +1,6 @@
 import { Resource } from './base.js';
 import { XKOVAUploadError } from '../errors.js';
+import { isAllowedProtocol } from '../url.js';
 function memberSessionHeaders(context) {
     return {
         'X-Member-Session-Id': context.memberSessionId,
@@ -30,6 +31,12 @@ export class AccountHoldersResource extends Resource {
     selfVerification(context, control) {
         return this.getJson('/account-holders/self/verification', undefined, control, memberSessionHeaders(context));
     }
+    selfProductEnrollment(context, product, control) {
+        return this.getJson(`/account-holders/self/product-enrollments/${this.enc(product)}`, undefined, control, memberSessionHeaders(context));
+    }
+    acceptSelfProductEnrollment(context, product, body, opts) {
+        return this.postJson(`/account-holders/self/product-enrollments/${this.enc(product)}`, body, opts, undefined, memberSessionHeaders(context));
+    }
     selfBalance(context, control) {
         return this.getJson('/account-holders/self/balance', undefined, control, memberSessionHeaders(context));
     }
@@ -115,8 +122,7 @@ export class AccountHoldersResource extends Resource {
         if (target.username ||
             target.password ||
             target.hash ||
-            (target.protocol !== 'https:' &&
-                !(target.protocol === 'http:' && target.hostname === 'localhost')) ||
+            !isAllowedProtocol(target) ||
             !Number.isFinite(Date.parse(upload.expires_at)) ||
             Date.parse(upload.expires_at) <= Date.now()) {
             throw new XKOVAUploadError('The avatar upload capability is invalid or expired');

package/dist/resources/payments.d.ts

@@ -178,5 +178,18 @@ export declare class PaymentsResource extends Resource {
         created_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
         finalized_at: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
     }>;
+    /** Requires a resolved member session. Only the sender can continue or cancel. */
+    recovery(id: string): Promise<{
+        payment: import("../generated/types.js").components["schemas"]["Payment"];
+        state: "awaiting_approval" | "approval_expired" | "on_hold" | "processing" | "completed" | "cancelled" | "failed";
+        can_continue: boolean;
+        can_cancel: boolean;
+    }>;
+    cancelForMember(id: string, opts?: XKOVAMutationOptions): Promise<{
+        payment: import("../generated/types.js").components["schemas"]["Payment"];
+        state: "awaiting_approval" | "approval_expired" | "on_hold" | "processing" | "completed" | "cancelled" | "failed";
+        can_continue: boolean;
+        can_cancel: boolean;
+    }>;
 }
 export {};

package/dist/resources/payments.js

@@ -30,4 +30,11 @@ export class PaymentsResource extends Resource {
     cancel(id, opts) {
         return this.postJson(`/payments/${this.enc(id)}/cancel`, undefined, opts);
     }
+    /** Requires a resolved member session. Only the sender can continue or cancel. */
+    recovery(id) {
+        return this.getJson(`/account-holders/self/payments/${this.enc(id)}/recovery`);
+    }
+    cancelForMember(id, opts) {
+        return this.postJson(`/account-holders/self/payments/${this.enc(id)}/cancel`, undefined, opts);
+    }
 }

package/dist/resources/ramps.d.ts

@@ -11,31 +11,34 @@ export declare class RampsResource extends Resource {
         has_more: boolean;
     }>;
     createFunding(body: ReqBody<'createFundingRequest'>, opts?: RampRequestOptions): Promise<{
-        id?: import("../generated/types.js").components["schemas"]["FundingRequestId"];
-        tenant_id?: string;
-        workspace_id?: string;
+        id: import("../generated/types.js").components["schemas"]["FundingRequestId"];
+        tenant_id: string;
+        workspace_id: string;
         chain: import("../generated/types.js").components["schemas"]["ChainDescriptor"];
-        account_holder_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"];
-        amount?: import("../generated/types.js").components["schemas"]["Money"];
-        currency?: string;
-        state?: "pending_compliance" | "pending_issuance" | "settled" | "failed";
-        failure_reason_code?: string | null;
-        x_partner_reference?: string | null;
-        quote_id?: string | null;
-        bank_debit_transfer_id?: string | null;
-        partner_status?: string | null;
-        last_event_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
-        metadata?: {
+        account_holder_id: import("../generated/types.js").components["schemas"]["AccountHolderId"];
+        amount: import("../generated/types.js").components["schemas"]["Money"];
+        currency: string;
+        state: "pending_compliance" | "pending_issuance" | "settled" | "failed";
+        failure_reason_code: string | null;
+        x_partner_reference: string | null;
+        quote_id: string | null;
+        quote_rate: string | null;
+        quote_stablecoin_amount: import("../generated/types.js").components["schemas"]["Money"] | null;
+        quote_partner_fee_fiat: import("../generated/types.js").components["schemas"]["Money"] | null;
+        bank_debit_transfer_id: string | null;
+        partner_status: string | null;
+        last_event_at: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        metadata: {
             [key: string]: unknown;
         } | null;
         settlement_order: "hold_first" | "debit_first" | null;
-        idempotency_key?: string;
-        correlation_id?: string;
-        ramp_profile?: "mock" | "sandbox" | "coinbase";
-        hosted_redirect_url?: string | null;
-        created_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
-        updated_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
-        settled_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        idempotency_key: string;
+        correlation_id: string;
+        ramp_profile: "mock" | "sandbox" | "coinbase";
+        hosted_redirect_url: string | null;
+        created_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        updated_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        settled_at: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
     }>;
     /**
      * One-call sandbox funding convenience. This invokes the normal funding
@@ -43,58 +46,64 @@ export declare class RampsResource extends Resource {
      * resource, state transitions, webhooks, and idempotency behavior.
      */
     fundSandboxWallet(body: SandboxFundingBody, opts?: RampRequestOptions): Promise<{
-        id?: import("../generated/types.js").components["schemas"]["FundingRequestId"];
-        tenant_id?: string;
-        workspace_id?: string;
+        id: import("../generated/types.js").components["schemas"]["FundingRequestId"];
+        tenant_id: string;
+        workspace_id: string;
         chain: import("../generated/types.js").components["schemas"]["ChainDescriptor"];
-        account_holder_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"];
-        amount?: import("../generated/types.js").components["schemas"]["Money"];
-        currency?: string;
-        state?: "pending_compliance" | "pending_issuance" | "settled" | "failed";
-        failure_reason_code?: string | null;
-        x_partner_reference?: string | null;
-        quote_id?: string | null;
-        bank_debit_transfer_id?: string | null;
-        partner_status?: string | null;
-        last_event_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
-        metadata?: {
+        account_holder_id: import("../generated/types.js").components["schemas"]["AccountHolderId"];
+        amount: import("../generated/types.js").components["schemas"]["Money"];
+        currency: string;
+        state: "pending_compliance" | "pending_issuance" | "settled" | "failed";
+        failure_reason_code: string | null;
+        x_partner_reference: string | null;
+        quote_id: string | null;
+        quote_rate: string | null;
+        quote_stablecoin_amount: import("../generated/types.js").components["schemas"]["Money"] | null;
+        quote_partner_fee_fiat: import("../generated/types.js").components["schemas"]["Money"] | null;
+        bank_debit_transfer_id: string | null;
+        partner_status: string | null;
+        last_event_at: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        metadata: {
             [key: string]: unknown;
         } | null;
         settlement_order: "hold_first" | "debit_first" | null;
-        idempotency_key?: string;
-        correlation_id?: string;
-        ramp_profile?: "mock" | "sandbox" | "coinbase";
-        hosted_redirect_url?: string | null;
-        created_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
-        updated_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
-        settled_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        idempotency_key: string;
+        correlation_id: string;
+        ramp_profile: "mock" | "sandbox" | "coinbase";
+        hosted_redirect_url: string | null;
+        created_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        updated_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        settled_at: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
     }>;
     getFunding(id: string): Promise<{
-        id?: import("../generated/types.js").components["schemas"]["FundingRequestId"];
-        tenant_id?: string;
-        workspace_id?: string;
+        id: import("../generated/types.js").components["schemas"]["FundingRequestId"];
+        tenant_id: string;
+        workspace_id: string;
         chain: import("../generated/types.js").components["schemas"]["ChainDescriptor"];
-        account_holder_id?: import("../generated/types.js").components["schemas"]["AccountHolderId"];
-        amount?: import("../generated/types.js").components["schemas"]["Money"];
-        currency?: string;
-        state?: "pending_compliance" | "pending_issuance" | "settled" | "failed";
-        failure_reason_code?: string | null;
-        x_partner_reference?: string | null;
-        quote_id?: string | null;
-        bank_debit_transfer_id?: string | null;
-        partner_status?: string | null;
-        last_event_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
-        metadata?: {
+        account_holder_id: import("../generated/types.js").components["schemas"]["AccountHolderId"];
+        amount: import("../generated/types.js").components["schemas"]["Money"];
+        currency: string;
+        state: "pending_compliance" | "pending_issuance" | "settled" | "failed";
+        failure_reason_code: string | null;
+        x_partner_reference: string | null;
+        quote_id: string | null;
+        quote_rate: string | null;
+        quote_stablecoin_amount: import("../generated/types.js").components["schemas"]["Money"] | null;
+        quote_partner_fee_fiat: import("../generated/types.js").components["schemas"]["Money"] | null;
+        bank_debit_transfer_id: string | null;
+        partner_status: string | null;
+        last_event_at: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        metadata: {
             [key: string]: unknown;
         } | null;
         settlement_order: "hold_first" | "debit_first" | null;
-        idempotency_key?: string;
-        correlation_id?: string;
-        ramp_profile?: "mock" | "sandbox" | "coinbase";
-        hosted_redirect_url?: string | null;
-        created_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
-        updated_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
-        settled_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        idempotency_key: string;
+        correlation_id: string;
+        ramp_profile: "mock" | "sandbox" | "coinbase";
+        hosted_redirect_url: string | null;
+        created_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        updated_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        settled_at: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
     }>;
     listOffRamp(query?: Query<'listOffRampRequests'>): Promise<{
         data: import("../generated/types.js").components["schemas"]["OffRampRequest"][];

package/dist/resources/rwa.d.ts

@@ -75,10 +75,10 @@ export declare class RwaResource extends Resource {
         bound_at: string;
     }>;
     proposeSchemaRebind(body: ReqBody<'proposeRwaSchemaRebind'>, opts?: XKOVAMutationOptions): Promise<{
-        ceremony_id: string;
+        ceremony_id: import("../generated/types.js").components["schemas"]["SchemaRebindId"];
     }>;
     getSchemaRebind(id: string): Promise<{
-        id: string;
+        id: import("../generated/types.js").components["schemas"]["SchemaRebindId"];
         status: "proposed" | "dry_run_passed" | "dry_run_failed" | "attested" | "committed" | "failed";
         asset_schema_id: string;
         from_version: number;
@@ -119,7 +119,7 @@ export declare class RwaResource extends Resource {
     submitAttestedEntry(tokenId: string, fieldPath: string, body: ReqBody<'submitRwaAttestedEntry'>, opts?: XKOVAMutationOptions): Promise<{
         committed: boolean;
         deduped: boolean;
-        attester_id: string;
+        attester_id: import("../generated/types.js").components["schemas"]["RwaAttesterId"];
         attester_address: string;
         attested_digest: string;
     }>;
@@ -183,7 +183,7 @@ export declare class RwaResource extends Resource {
         created_at: string;
     }>;
     createCorporateAction(tokenId: string, body: ReqBody<'createRwaCorporateAction'>, opts?: XKOVAMutationOptions): Promise<{
-        id: string;
+        id: import("../generated/types.js").components["schemas"]["CorporateActionId"];
         customer_token_id: string;
         kind: "redemption" | "split" | "consolidation" | "additional_issuance" | "capital_call" | "mandatory_conversion";
         state: string;
@@ -201,7 +201,7 @@ export declare class RwaResource extends Resource {
         created_at: string;
     }>;
     getCorporateAction(tokenId: string, caId: string): Promise<{
-        id: string;
+        id: import("../generated/types.js").components["schemas"]["CorporateActionId"];
         customer_token_id: string;
         kind: "redemption" | "split" | "consolidation" | "additional_issuance" | "capital_call" | "mandatory_conversion";
         state: string;
@@ -219,7 +219,7 @@ export declare class RwaResource extends Resource {
         created_at: string;
     }>;
     advanceCorporateAction(tokenId: string, caId: string, opts?: XKOVAMutationOptions): Promise<{
-        id: string;
+        id: import("../generated/types.js").components["schemas"]["CorporateActionId"];
         customer_token_id: string;
         kind: "redemption" | "split" | "consolidation" | "additional_issuance" | "capital_call" | "mandatory_conversion";
         state: string;
@@ -285,7 +285,7 @@ export declare class RwaResource extends Resource {
         reason: string;
     }>;
     listAttesters(tokenId: string): Promise<{
-        id: string;
+        id: import("../generated/types.js").components["schemas"]["RwaAttesterId"];
         customer_token_id: string | null;
         display_name: string;
         attester_address: string;
@@ -294,7 +294,7 @@ export declare class RwaResource extends Resource {
         created_at: string;
     }[]>;
     registerAttester(tokenId: string, body: ReqBody<'registerRwaAttester'>, opts?: XKOVAMutationOptions): Promise<{
-        id: string;
+        id: import("../generated/types.js").components["schemas"]["RwaAttesterId"];
         customer_token_id: string | null;
         display_name: string;
         attester_address: string;
@@ -303,7 +303,7 @@ export declare class RwaResource extends Resource {
         created_at: string;
     }>;
     revokeAttester(tokenId: string, attesterId: string, opts?: XKOVAMutationOptions): Promise<{
-        id: string;
+        id: import("../generated/types.js").components["schemas"]["RwaAttesterId"];
         customer_token_id: string | null;
         display_name: string;
         attester_address: string;

package/dist/url.d.ts

@@ -0,0 +1 @@
+export declare function isAllowedProtocol(url: URL): boolean;

package/dist/url.js

@@ -0,0 +1,4 @@
+export function isAllowedProtocol(url) {
+    return (url.protocol === 'https:' ||
+        (url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1')));
+}

package/llms.txt

@@ -74,6 +74,26 @@ API availability does not grant permission. Product entitlement, selected API-ke
 - Reuse one createMemberActionReference() from @xkova/browser for a durable review. Save the draft before setup detours. Expired or missing reviews require checking activity and an explicit new review.
 - Setup readiness is advisory. beginMemberAction() and completeMemberAction() obtain fresh approval for the exact resource. Browser code must not receive provider wallet credentials or internal signing capabilities. Completion of authorization is distinct from execution and settlement.
 
+## Payment recovery
+
+Use resolved.resources.payments.recovery(paymentId) to read the current
+member's payment and available actions. Only the sender can continue or cancel.
+On explicit cancellation, call cancelForMember(paymentId) after BFF session,
+Origin and CSRF checks. The principal needs payment.read and payment.cancel.
+Cancellation sends no value and does not require a passkey.
+
+Continue only when can_continue is true. Begin a fresh member action for the
+same payment resourceId with action sign, then complete the registered proof
+ceremony. Never create another payment, change its fees or deadline, or reuse
+an expired signing credential. A new session for the same member can recover
+the payment without its original draft. Expired approvals remain cancellable;
+accepted signatures close cancellation. Keep cancelled payments in history.
+After a conflict or uncertain cancellation, re-read state before another action.
+
 ## Before handing off code
 
 List the Console setup and stores the application needs. Test denied access, uncertain writes, pagination, cancellation, and terminal outcomes. Report a missing method or setup requirement explicitly. Do not invent methods, suppress type errors, or bypass authorization to make an example run.
+
+## Product opt-in
+
+Use resolveResources().self.productEnrollment(product) to read acceptance and credit status. After explicit consent, call self.acceptProductEnrollment(product, { terms_version, sandbox_credit? }). The BFF chooses the product, terms, amount, and token. Reads do not enroll members. Acceptance needs no Idempotency-Key header; reuse the same product and parameters when retrying. Sandbox credits are dUSDC only and issued once per workspace/member/product; the workspace daily budget is 1000 dUSDC. Poll opening until active. Treat requires_review as unresolved delivery, never as permission to request a second product credit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xkova/sdk",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.4",
   "description": "TypeScript SDK for the XKOVA API.",
   "homepage": "https://docs.xkova.com",
   "repository": {