@xkova/sdk 0.1.0-alpha.4 → 0.1.0-alpha.6

package/README.md

@@ -491,39 +491,11 @@ idempotency, and settlement. It links the public customer OpenAPI and expanded
 documentation. Installed declarations determine the methods available in your
 version; live documentation may describe a newer release.
 
-## Writing checks for contributors
+## Contributing
 
-Use plain verbs, concrete examples, and comments that explain non-obvious
-decisions. Vary section length, remove repeated conclusions, and write each
-guide for its reader. Test failure and recovery cases alongside successful
-calls. Keep commits small and omit attribution or co-author trailers.
-
-The local pre-push hook checks both public SDKs before the existing test gates.
-It reads each pushed branch or tag's committed files, plus new commit messages
-that touch either package. Uncommitted edits cannot change that result. No
-build or network access is needed. Use the repository's pinned Node version,
-then install workspace dependencies with `pnpm install` to set up the hook.
-
-To check edits before committing:
-
-```sh
-pnpm --filter @xkova/sdk writing:check
-```
-
-The check covers package guides, examples, public source and generated types,
-and descriptive package metadata. It rejects stock wording, emoji, em dashes,
-attribution, internal decision narratives, and implementation-provider details.
-Describe installation, supported methods, inputs, results, and the steps an
-application developer needs. Do not turn release planning or maintainer
-conversations into package documentation. Standard license text, rule
-definitions, and negative test fixtures are checked separately.
-
-A pass is a mechanical check, not a judgment of authorship. Before pushing,
-reread the result for sentence rhythm, repeated structures, useful comments,
-accurate examples, and test quality. This gate does not scan historical file
-contents or replace secret scanning. It checks commit messages locally;
-review PR descriptions separately. Run `pnpm --filter @xkova/sdk writing:test`
-when changing the rules or hook.
+Run `pnpm check` from the source repository root before committing. The
+[contributor guide](https://github.com/XKOVA/typescript-sdk/blob/main/CONTRIBUTING.md)
+covers generated files, local pre-push checks, writing rules, and packaging.
 
 ## License
 

package/dist/abi.d.ts

@@ -336,6 +336,14 @@ export declare const erc20XGaslessAbi: readonly [{
         readonly name: "";
         readonly type: "string";
         readonly internalType: "string";
+    }, {
+        readonly name: "";
+        readonly type: "uint8";
+        readonly internalType: "uint8";
+    }, {
+        readonly name: "";
+        readonly type: "address";
+        readonly internalType: "address";
     }, {
         readonly name: "";
         readonly type: "address";
@@ -362,6 +370,10 @@ export declare const erc20XGaslessAbi: readonly [{
         readonly name: "_symbol";
         readonly type: "string";
         readonly internalType: "string";
+    }, {
+        readonly name: "decimals_";
+        readonly type: "uint8";
+        readonly internalType: "uint8";
     }, {
         readonly name: "defaultAdmin";
         readonly type: "address";
@@ -370,6 +382,10 @@ export declare const erc20XGaslessAbi: readonly [{
         readonly name: "minter";
         readonly type: "address";
         readonly internalType: "address";
+    }, {
+        readonly name: "burner";
+        readonly type: "address";
+        readonly internalType: "address";
     }, {
         readonly name: "pauser";
         readonly type: "address";
@@ -1062,6 +1078,10 @@ export declare const erc20XGaslessAbi: readonly [{
     readonly type: "error";
     readonly name: "InvalidAddress";
     readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "InvalidDecimals";
+    readonly inputs: readonly [];
 }, {
     readonly type: "error";
     readonly name: "InvalidImplementation";
@@ -5482,6 +5502,14 @@ export declare const tokenizationAbis: {
             readonly name: "";
             readonly type: "string";
             readonly internalType: "string";
+        }, {
+            readonly name: "";
+            readonly type: "uint8";
+            readonly internalType: "uint8";
+        }, {
+            readonly name: "";
+            readonly type: "address";
+            readonly internalType: "address";
         }, {
             readonly name: "";
             readonly type: "address";
@@ -5508,6 +5536,10 @@ export declare const tokenizationAbis: {
             readonly name: "_symbol";
             readonly type: "string";
             readonly internalType: "string";
+        }, {
+            readonly name: "decimals_";
+            readonly type: "uint8";
+            readonly internalType: "uint8";
         }, {
             readonly name: "defaultAdmin";
             readonly type: "address";
@@ -5516,6 +5548,10 @@ export declare const tokenizationAbis: {
             readonly name: "minter";
             readonly type: "address";
             readonly internalType: "address";
+        }, {
+            readonly name: "burner";
+            readonly type: "address";
+            readonly internalType: "address";
         }, {
             readonly name: "pauser";
             readonly type: "address";
@@ -6208,6 +6244,10 @@ export declare const tokenizationAbis: {
         readonly type: "error";
         readonly name: "InvalidAddress";
         readonly inputs: readonly [];
+    }, {
+        readonly type: "error";
+        readonly name: "InvalidDecimals";
+        readonly inputs: readonly [];
     }, {
         readonly type: "error";
         readonly name: "InvalidImplementation";

package/dist/abi.js

@@ -443,6 +443,16 @@ export const erc20XGaslessAbi = [
                 "type": "string",
                 "internalType": "string"
             },
+            {
+                "name": "",
+                "type": "uint8",
+                "internalType": "uint8"
+            },
+            {
+                "name": "",
+                "type": "address",
+                "internalType": "address"
+            },
             {
                 "name": "",
                 "type": "address",
@@ -476,6 +486,11 @@ export const erc20XGaslessAbi = [
                 "type": "string",
                 "internalType": "string"
             },
+            {
+                "name": "decimals_",
+                "type": "uint8",
+                "internalType": "uint8"
+            },
             {
                 "name": "defaultAdmin",
                 "type": "address",
@@ -486,6 +501,11 @@ export const erc20XGaslessAbi = [
                 "type": "address",
                 "internalType": "address"
             },
+            {
+                "name": "burner",
+                "type": "address",
+                "internalType": "address"
+            },
             {
                 "name": "pauser",
                 "type": "address",
@@ -1376,6 +1396,11 @@ export const erc20XGaslessAbi = [
         "name": "InvalidAddress",
         "inputs": []
     },
+    {
+        "type": "error",
+        "name": "InvalidDecimals",
+        "inputs": []
+    },
     {
         "type": "error",
         "name": "InvalidImplementation",

package/dist/generated/types.d.ts

@@ -1150,6 +1150,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/account-holders/self/wallet-auth": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Connect the current member's registered wallet */
+        post: operations["issueAccountHolderSelfWalletAuth"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/account-holders/self/wallet-provision": {
         parameters: {
             query?: never;
@@ -1235,6 +1252,23 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/account-holders/self": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get the current account holder's profile */
+        get: operations["getAccountHolderSelf"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/account-holders/self/balance": {
         parameters: {
             query?: never;
@@ -1440,6 +1474,58 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/account-holders/self/avatar/upload-url": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Create a short-lived avatar upload URL */
+        post: operations["presignAccountHolderSelfAvatarUpload"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/account-holders/self/avatar/confirm": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Confirm an avatar upload for the account holder */
+        post: operations["confirmAccountHolderSelfAvatar"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/account-holders/self/avatar": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a short-TTL presigned GET URL for the holder's avatar */
+        get: operations["getAccountHolderSelfAvatarUrl"];
+        put?: never;
+        post?: never;
+        /** Delete the account holder avatar */
+        delete: operations["deleteAccountHolderSelfAvatar"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/account-holders/{id}/avatar/upload-url": {
         parameters: {
             query?: never;
@@ -4385,6 +4471,18 @@ export interface components {
                 transaction_hash: string | null;
             } | null;
         };
+        WalletAdmissionBootstrap: {
+            /** @enum {string} */
+            strategy: "auth_endpoint";
+            payload: string;
+            client_id: string;
+            /** Format: uuid */
+            project_id: string;
+            external_user_id: string;
+            /** Format: date-time */
+            expires_at: string;
+            expected_address?: string;
+        };
         CuPayoutAccountRef: {
             routing_number: string;
             account_number: string;
@@ -4478,6 +4576,7 @@ export interface components {
             /** @enum {string} */
             purpose: "operator" | "service_account";
             safe_purpose: ("fund_vault" | "token_control" | "multi_purpose") | null;
+            managed_safe_state: ("deploying" | "active" | "decommissioned") | null;
             address: string;
             label: string | null;
             managed_safe_id: components["schemas"]["ManagedSafeId"] | null;
@@ -5022,6 +5121,8 @@ export interface components {
             code_challenge_method: "S256";
         };
         MemberAuthHostedAuthorizationStart: {
+            /** Format: uri */
+            hosted_origin: string;
             /** Format: uri */
             authorization_url: string;
             expires_at: components["schemas"]["TimestampUtc"];
@@ -5077,6 +5178,8 @@ export interface components {
         AccountCenterHandoffStart: {
             /** Format: uri */
             handoff_url: string;
+            /** Format: uri */
+            hosted_origin: string;
             expires_at: components["schemas"]["TimestampUtc"];
         };
         AccountCenterHandoffExchange: {
@@ -5846,7 +5949,7 @@ export interface components {
         AccountCenterIntent: "security" | "sessions" | "wallet_readiness";
         MemberActionReadiness: {
             /** @enum {string} */
-            authorization_method: "hosted_passkey" | "external_oidc";
+            authorization_method: "hosted_passkey" | "external_oidc" | "xkova_webauthn";
             /** @enum {string} */
             setup_status: "passkey_required" | "recovery_acknowledgement_required" | "recovery_required" | "ready" | "externally_managed";
             action_authorization_enabled: boolean;
@@ -8261,6 +8364,30 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    issueAccountHolderSelfWalletAuth: {
+        parameters: {
+            query?: never;
+            header: {
+                "X-Member-Session-Id": components["parameters"]["xMemberSessionId"];
+                "X-XKOVA-Publishable-Key": components["parameters"]["xXkovaPublishableKey"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WalletAdmissionBootstrap"] & Record<string, never>;
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+        };
+    };
     ensureAccountHolderSelfWalletProvisioning: {
         parameters: {
             query?: never;
@@ -8411,6 +8538,30 @@ export interface operations {
             403: components["responses"]["Forbidden"];
         };
     };
+    getAccountHolderSelf: {
+        parameters: {
+            query?: never;
+            header: {
+                "X-Member-Session-Id": components["parameters"]["xMemberSessionId"];
+                "X-XKOVA-Publishable-Key": components["parameters"]["xXkovaPublishableKey"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AccountHolder"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     getAccountHolderSelfBalance: {
         parameters: {
             query?: never;
@@ -8820,6 +8971,118 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
+    presignAccountHolderSelfAvatarUpload: {
+        parameters: {
+            query?: never;
+            header: {
+                "X-Member-Session-Id": components["parameters"]["xMemberSessionId"];
+                "X-XKOVA-Publishable-Key": components["parameters"]["xXkovaPublishableKey"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AccountHolderAvatarUploadUrl"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AccountHolderAvatarUploadUrlResponse"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            422: components["responses"]["UnprocessableEntity"];
+        };
+    };
+    confirmAccountHolderSelfAvatar: {
+        parameters: {
+            query?: never;
+            header: {
+                "X-Member-Session-Id": components["parameters"]["xMemberSessionId"];
+                "X-XKOVA-Publishable-Key": components["parameters"]["xXkovaPublishableKey"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AccountHolderAvatarConfirm"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AccountHolder"];
+                };
+            };
+            400: components["responses"]["BadRequest"];
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+            422: components["responses"]["UnprocessableEntity"];
+        };
+    };
+    getAccountHolderSelfAvatarUrl: {
+        parameters: {
+            query?: never;
+            header: {
+                "X-Member-Session-Id": components["parameters"]["xMemberSessionId"];
+                "X-XKOVA-Publishable-Key": components["parameters"]["xXkovaPublishableKey"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AccountHolderAvatarUrl"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    deleteAccountHolderSelfAvatar: {
+        parameters: {
+            query?: never;
+            header: {
+                "X-Member-Session-Id": components["parameters"]["xMemberSessionId"];
+                "X-XKOVA-Publishable-Key": components["parameters"]["xXkovaPublishableKey"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AccountHolder"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     presignAccountHolderAvatarUpload: {
         parameters: {
             query?: never;

package/dist/member-bff.d.ts

@@ -116,7 +116,7 @@ export type XKOVAMemberAuthorizationTransaction<TApplicationData = unknown> = {
     readonly sessionReference: string;
     readonly intent: XKOVAAccountCenterIntent;
     readonly actionAuthorization?: {
-        readonly method: 'hosted_passkey';
+        readonly method: 'hosted_passkey' | 'xkova_webauthn';
     } | {
         readonly method: 'external_oidc';
         readonly actionToken: string;
@@ -239,7 +239,7 @@ export interface XKOVAAccountCenterHandoffCompletion {
     readonly applicationReturnUri?: string;
 }
 export type XKOVAMemberActionAuthorizationStart = {
-    readonly authorizationMethod: 'hosted_passkey';
+    readonly authorizationMethod: 'hosted_passkey' | 'xkova_webauthn';
     readonly authorizationUrl: string;
     readonly state: string;
     readonly expiresAt: string;
@@ -455,6 +455,11 @@ export declare class XKOVAMemberBffClient {
     resolveResources<TApplicationData>(input: {
         readonly reference: string;
         readonly sessionStore: XKOVAMemberSessionStore<TApplicationData>;
+        /**
+         * Defaults true. Set false only when the bound resource request executes
+         * immediately and therefore performs the same exact-session validation.
+         */
+        readonly validateWithXkova?: boolean;
     }): Promise<{
         readonly session: StoredXKOVAMemberSession<TApplicationData>;
         readonly resources: XKOVAMemberResources;

package/dist/member-bff.js

@@ -536,15 +536,15 @@ export class XKOVAMemberBffClient {
                 const object = requireObject(value, 'member action authorization start');
                 const method = requireString(object, 'authorization_method', 'member action authorization start');
                 const { expiresAt, expiresAtMillis } = boundedAuthorizationExpiry(object, provisionalExpiresAt, 'member action authorization start');
-                if (method === 'hosted_passkey') {
+                if (method === 'hosted_passkey' || method === 'xkova_webauthn') {
                     const authorizationUrl = normalizeHostedAuthorizationUrl(requireString(object, 'authorization_url', 'member action authorization start'));
                     await input.transactionStore.replace(stateHash, {
                         ...transaction,
-                        actionAuthorization: { method: 'hosted_passkey' },
+                        actionAuthorization: { method },
                         expiresAt: expiresAtMillis,
                     });
                     return {
-                        authorizationMethod: 'hosted_passkey',
+                        authorizationMethod: method,
                         authorizationUrl,
                         state,
                         expiresAt,
@@ -606,7 +606,7 @@ export class XKOVAMemberBffClient {
         if (initial?.completionMode === 'account_center_result_code' &&
             initial.status === 'pending' &&
             initial.intent === 'action' &&
-            initial.actionAuthorization?.method === 'hosted_passkey') {
+            ['hosted_passkey', 'xkova_webauthn'].includes(initial.actionAuthorization?.method ?? '')) {
             const completion = await this.completeAccountCenterHandoff(input);
             if (!completion.signingExchangeCode || !completion.signingUrl) {
                 throw new Error('XKOVA Hosted action completion omitted its signing projection');

package/dist/member-resources.d.ts

@@ -69,7 +69,7 @@ export declare class XKOVAMemberResources {
             } | null;
         }>;
         actionReadiness: (control?: XKOVARequestControl) => Promise<{
-            authorization_method: "hosted_passkey" | "external_oidc";
+            authorization_method: "hosted_passkey" | "external_oidc" | "xkova_webauthn";
             setup_status: "passkey_required" | "recovery_acknowledgement_required" | "recovery_required" | "ready" | "externally_managed";
             action_authorization_enabled: boolean;
             requires_fresh_proof: true;
@@ -107,6 +107,15 @@ export declare class XKOVAMemberResources {
         wallets: (control?: XKOVARequestControl) => Promise<{
             data: import("./generated/types.js").components["schemas"]["Wallet"][];
         }>;
+        walletAuth: (control?: XKOVARequestControl) => Promise<{
+            strategy: "auth_endpoint";
+            payload: string;
+            client_id: string;
+            project_id: string;
+            external_user_id: string;
+            expires_at: string;
+            expected_address?: string;
+        } & Record<string, never>>;
         walletReadiness: (control?: XKOVARequestControl) => Promise<{
             status: "not_registered" | "provisioning" | "ready";
             wallets: import("./generated/types.js").components["schemas"]["Wallet"][];

package/dist/member-resources.js

@@ -31,7 +31,7 @@ export class XKOVAMemberResources {
         return this.client.wallets;
     }
     self = {
-        profile: () => this.client.accountHolders.retrieve(this.accountHolderId),
+        profile: () => this.client.accountHolders.selfProfile(this.context),
         productEnrollment: (product, control) => this.client.accountHolders.selfProductEnrollment(this.context, product, control),
         acceptProductEnrollment: (product, body, opts) => this.client.accountHolders.acceptSelfProductEnrollment(this.context, product, body, opts),
         actionReadiness: (control) => this.client.accountHolders.selfActionReadiness({ ...this.context, accountHolderId: this.accountHolderId }, control),
@@ -39,6 +39,7 @@ export class XKOVAMemberResources {
         verification: (control) => this.client.accountHolders.selfVerification(this.context, control),
         balance: (control) => this.client.accountHolders.selfBalance(this.context, control),
         wallets: (control) => this.client.accountHolders.listSelfWallets(this.context, control),
+        walletAuth: (control) => this.client.accountHolders.selfWalletAuth(this.context, control),
         walletReadiness: (control) => this.client.accountHolders.selfWalletReadiness(this.context, control),
         ensureWalletProvisioning: (opts) => this.client.accountHolders.ensureSelfWalletProvisioning(this.context, opts),
         bankBalance: (control) => this.client.accountHolders.selfBankBalance(this.context, control),
@@ -50,10 +51,10 @@ export class XKOVAMemberResources {
         requestDataExport: (opts) => this.client.accountHolders.requestSelfDataExport(this.context, opts),
         dataExport: (id, control) => this.client.accountHolders.selfDataExport(this.context, id, control),
         transactions: (query, control) => this.client.accountHolders.listSelfTransactions(this.context, query, control),
-        avatar: () => this.client.accountHolders.avatarUrl(this.accountHolderId),
-        uploadAvatar: (image, control) => this.client.accountHolders.uploadAvatar(this.accountHolderId, image, control),
-        deleteAvatar: (opts) => this.client.accountHolders.deleteAvatar(this.accountHolderId, opts),
-        confirmAvatar: (body, opts) => this.client.accountHolders.confirmAvatar(this.accountHolderId, body, opts),
-        presignAvatarUpload: (body, opts) => this.client.accountHolders.presignAvatarUpload(this.accountHolderId, body, opts),
+        avatar: () => this.client.accountHolders.selfAvatarUrl(this.context),
+        uploadAvatar: (image, control) => this.client.accountHolders.uploadSelfAvatar(this.context, image, control),
+        deleteAvatar: (opts) => this.client.accountHolders.deleteSelfAvatar(this.context, opts),
+        confirmAvatar: (body, opts) => this.client.accountHolders.confirmSelfAvatar(this.context, body, opts),
+        presignAvatarUpload: (body, opts) => this.client.accountHolders.presignSelfAvatarUpload(this.context, body, opts),
     };
 }

package/dist/resources/account-holders.d.ts

@@ -100,6 +100,32 @@ export declare class AccountHoldersResource extends Resource {
         next_cursor?: string | null;
         has_more: boolean;
     }>;
+    selfProfile(context: XKOVAMemberSessionContext, control?: XKOVARequestControl): Promise<{
+        id: import("../generated/types.js").components["schemas"]["AccountHolderId"];
+        tenant_id?: string;
+        state: "active" | "held" | "closed" | "closed_uncooperative" | "provisioning_failed";
+        state_reason?: string | null;
+        state_changed_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        tier: "tier_1" | "tier_2";
+        tier_2_uplift_status?: "not_requested" | "pending" | "passed" | "failed";
+        first_use_completed: boolean;
+        cip_payload?: {
+            name_hash?: string;
+            dob_hash?: string;
+            id_hash?: string;
+            address_hash?: string;
+        } | null;
+        cip_accepted_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        merchant_role_state?: "none" | "pending_review" | "approved" | "rejected" | "revoked";
+        auto_save_contacts?: boolean;
+        created_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        updated_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        email?: string | null;
+        first_name?: string | null;
+        last_name?: string | null;
+        phone?: string | null;
+        avatar_url?: string | null;
+    }>;
     selfVerification(context: XKOVAMemberSessionContext, control?: XKOVARequestControl): Promise<{
         required: boolean;
         status: string;
@@ -148,6 +174,15 @@ export declare class AccountHoldersResource extends Resource {
     listSelfWallets(context: XKOVAMemberSessionContext, control?: XKOVARequestControl): Promise<{
         data: import("../generated/types.js").components["schemas"]["Wallet"][];
     }>;
+    selfWalletAuth(context: XKOVAMemberSessionContext, control?: XKOVARequestControl): Promise<{
+        strategy: "auth_endpoint";
+        payload: string;
+        client_id: string;
+        project_id: string;
+        external_user_id: string;
+        expires_at: string;
+        expected_address?: string;
+    } & Record<string, never>>;
     selfWalletReadiness(context: XKOVAMemberSessionContext, control?: XKOVARequestControl): Promise<{
         status: "not_registered" | "provisioning" | "ready";
         wallets: import("../generated/types.js").components["schemas"]["Wallet"][];
@@ -173,7 +208,7 @@ export declare class AccountHoldersResource extends Resource {
     selfActionReadiness(context: XKOVAMemberSessionContext & {
         accountHolderId: string;
     }, control?: XKOVARequestControl): Promise<{
-        authorization_method: "hosted_passkey" | "external_oidc";
+        authorization_method: "hosted_passkey" | "external_oidc" | "xkova_webauthn";
         setup_status: "passkey_required" | "recovery_acknowledgement_required" | "recovery_required" | "ready" | "externally_managed";
         action_authorization_enabled: boolean;
         requires_fresh_proof: true;
@@ -253,6 +288,70 @@ export declare class AccountHoldersResource extends Resource {
     uploadAvatar(id: string, image: Blob, control?: XKOVARequestControl): Promise<{
         url: string | null;
     }>;
+    uploadSelfAvatar(context: XKOVAMemberSessionContext, image: Blob, control?: XKOVARequestControl): Promise<{
+        url: string | null;
+    }>;
+    private uploadAvatarImage;
+    selfAvatarUrl(context: XKOVAMemberSessionContext): Promise<{
+        url: string | null;
+    }>;
+    deleteSelfAvatar(context: XKOVAMemberSessionContext, opts?: XKOVAMutationOptions): Promise<{
+        id: import("../generated/types.js").components["schemas"]["AccountHolderId"];
+        tenant_id?: string;
+        state: "active" | "held" | "closed" | "closed_uncooperative" | "provisioning_failed";
+        state_reason?: string | null;
+        state_changed_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        tier: "tier_1" | "tier_2";
+        tier_2_uplift_status?: "not_requested" | "pending" | "passed" | "failed";
+        first_use_completed: boolean;
+        cip_payload?: {
+            name_hash?: string;
+            dob_hash?: string;
+            id_hash?: string;
+            address_hash?: string;
+        } | null;
+        cip_accepted_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        merchant_role_state?: "none" | "pending_review" | "approved" | "rejected" | "revoked";
+        auto_save_contacts?: boolean;
+        created_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        updated_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        email?: string | null;
+        first_name?: string | null;
+        last_name?: string | null;
+        phone?: string | null;
+        avatar_url?: string | null;
+    }>;
+    confirmSelfAvatar(context: XKOVAMemberSessionContext, body: ReqBody<'confirmAccountHolderSelfAvatar'>, opts?: XKOVAMutationOptions): Promise<{
+        id: import("../generated/types.js").components["schemas"]["AccountHolderId"];
+        tenant_id?: string;
+        state: "active" | "held" | "closed" | "closed_uncooperative" | "provisioning_failed";
+        state_reason?: string | null;
+        state_changed_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        tier: "tier_1" | "tier_2";
+        tier_2_uplift_status?: "not_requested" | "pending" | "passed" | "failed";
+        first_use_completed: boolean;
+        cip_payload?: {
+            name_hash?: string;
+            dob_hash?: string;
+            id_hash?: string;
+            address_hash?: string;
+        } | null;
+        cip_accepted_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"] | null;
+        merchant_role_state?: "none" | "pending_review" | "approved" | "rejected" | "revoked";
+        auto_save_contacts?: boolean;
+        created_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        updated_at?: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+        email?: string | null;
+        first_name?: string | null;
+        last_name?: string | null;
+        phone?: string | null;
+        avatar_url?: string | null;
+    }>;
+    presignSelfAvatarUpload(context: XKOVAMemberSessionContext, body: ReqBody<'presignAccountHolderSelfAvatarUpload'>, opts?: XKOVAMutationOptions): Promise<{
+        upload_url: string;
+        object_key: string;
+        expires_at: import("../generated/types.js").components["schemas"]["TimestampUtc"];
+    }>;
     avatarUrl(id: string): Promise<{
         url: string | null;
     }>;

package/dist/resources/account-holders.js

@@ -28,6 +28,9 @@ export class AccountHoldersResource extends Resource {
     history(id, query = {}) {
         return this.getJson(`/account-holders/${this.enc(id)}/history`, query);
     }
+    selfProfile(context, control) {
+        return this.getJson('/account-holders/self', undefined, control, memberSessionHeaders(context));
+    }
     selfVerification(context, control) {
         return this.getJson('/account-holders/self/verification', undefined, control, memberSessionHeaders(context));
     }
@@ -43,6 +46,9 @@ export class AccountHoldersResource extends Resource {
     listSelfWallets(context, control) {
         return this.getJson('/account-holders/self/wallets', undefined, control, memberSessionHeaders(context));
     }
+    selfWalletAuth(context, control) {
+        return this.postJson('/account-holders/self/wallet-auth', undefined, control, undefined, memberSessionHeaders(context));
+    }
     selfWalletReadiness(context, control) {
         return this.getJson('/account-holders/self/wallet-readiness', undefined, control, memberSessionHeaders(context));
     }
@@ -64,7 +70,7 @@ export class AccountHoldersResource extends Resource {
         }
         const readiness = status.action_readiness;
         if (!readiness ||
-            !['hosted_passkey', 'external_oidc'].includes(readiness.authorization_method) ||
+            !['hosted_passkey', 'external_oidc', 'xkova_webauthn'].includes(readiness.authorization_method) ||
             ![
                 'passkey_required',
                 'recovery_acknowledgement_required',
@@ -109,15 +115,26 @@ export class AccountHoldersResource extends Resource {
      * member context and cookies never follow the presigned URL or a redirect.
      */
     async uploadAvatar(id, image, control = {}) {
+        return this.uploadAvatarImage(image, control, {
+            presign: (body) => this.presignAvatarUpload(id, body, control),
+            confirm: (object_key) => this.confirmAvatar(id, { object_key }, control),
+            read: () => this.avatarUrl(id),
+        });
+    }
+    async uploadSelfAvatar(context, image, control = {}) {
+        return this.uploadAvatarImage(image, control, {
+            presign: (body) => this.presignSelfAvatarUpload(context, body, control),
+            confirm: (object_key) => this.confirmSelfAvatar(context, { object_key }, control),
+            read: () => this.selfAvatarUrl(context),
+        });
+    }
+    async uploadAvatarImage(image, control, operations) {
         if (!['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(image.type) ||
             image.size === 0 ||
             image.size > 5 * 1024 * 1024) {
             throw new TypeError('Avatar must be a PNG, JPEG, WebP, or GIF image of at most 5 MiB');
         }
-        const upload = await this.presignAvatarUpload(id, {
-            content_type: image.type,
-            content_length: image.size,
-        }, control);
+        const upload = await operations.presign({ content_type: image.type, content_length: image.size });
         const target = new URL(upload.upload_url);
         if (target.username ||
             target.password ||
@@ -151,8 +168,20 @@ export class AccountHoldersResource extends Resource {
         }
         if (!response.ok)
             throw new XKOVAUploadError('Object storage rejected the avatar upload', response.status);
-        await this.confirmAvatar(id, { object_key: upload.object_key }, control);
-        return this.avatarUrl(id);
+        await operations.confirm(upload.object_key);
+        return operations.read();
+    }
+    selfAvatarUrl(context) {
+        return this.getJson('/account-holders/self/avatar', undefined, {}, memberSessionHeaders(context));
+    }
+    deleteSelfAvatar(context, opts) {
+        return this.deleteJson('/account-holders/self/avatar', opts, undefined, memberSessionHeaders(context));
+    }
+    confirmSelfAvatar(context, body, opts) {
+        return this.postJson('/account-holders/self/avatar/confirm', body, opts, undefined, memberSessionHeaders(context));
+    }
+    presignSelfAvatarUpload(context, body, opts) {
+        return this.postJson('/account-holders/self/avatar/upload-url', body, opts, undefined, memberSessionHeaders(context));
     }
     avatarUrl(id) {
         return this.getJson(`/account-holders/${this.enc(id)}/avatar`);

package/dist/resources/tokenization.d.ts

@@ -56,6 +56,7 @@ export declare class TokenizationResource extends Resource {
         kind: "server_key" | "safe";
         purpose: "operator" | "service_account";
         safe_purpose: ("fund_vault" | "token_control" | "multi_purpose") | null;
+        managed_safe_state: ("deploying" | "active" | "decommissioned") | null;
         address: string;
         label: string | null;
         managed_safe_id: import("../generated/types.js").components["schemas"]["ManagedSafeId"] | null;
@@ -68,6 +69,7 @@ export declare class TokenizationResource extends Resource {
         kind: "server_key" | "safe";
         purpose: "operator" | "service_account";
         safe_purpose: ("fund_vault" | "token_control" | "multi_purpose") | null;
+        managed_safe_state: ("deploying" | "active" | "decommissioned") | null;
         address: string;
         label: string | null;
         managed_safe_id: import("../generated/types.js").components["schemas"]["ManagedSafeId"] | null;
@@ -82,6 +84,7 @@ export declare class TokenizationResource extends Resource {
         kind: "server_key" | "safe";
         purpose: "operator" | "service_account";
         safe_purpose: ("fund_vault" | "token_control" | "multi_purpose") | null;
+        managed_safe_state: ("deploying" | "active" | "decommissioned") | null;
         address: string;
         label: string | null;
         managed_safe_id: import("../generated/types.js").components["schemas"]["ManagedSafeId"] | null;
@@ -100,6 +103,7 @@ export declare class TokenizationResource extends Resource {
         kind: "server_key" | "safe";
         purpose: "operator" | "service_account";
         safe_purpose: ("fund_vault" | "token_control" | "multi_purpose") | null;
+        managed_safe_state: ("deploying" | "active" | "decommissioned") | null;
         address: string;
         label: string | null;
         managed_safe_id: import("../generated/types.js").components["schemas"]["ManagedSafeId"] | null;

package/llms.txt

@@ -5,12 +5,12 @@ Use this package on a Node.js 22+ server. Read the installed declarations before
 ## Read first
 
 - [Package guide](README.md): installation, production signing, Hosted Auth, member sessions, durable stores, cancellation, errors, webhooks, and proof verification.
-- [Client declarations](dist/client.d.ts): exact resource properties and client options for this installed release.
-- [Customer API types](dist/generated/types.d.ts): exact request bodies, responses, parameters, and operation IDs. Import types through @xkova/sdk/types.
-- [Member BFF declarations](dist/member-bff.d.ts): authorization, session persistence, refresh, logout, action reviews, and human authorization.
-- [Member resources](dist/member-resources.d.ts): typed resources bound to the exact authenticated member.
+- `dist/client.d.ts`: exact resource properties and client options for this installed release.
+- `dist/generated/types.d.ts`: exact request bodies, responses, parameters, and operation IDs. Import types through @xkova/sdk/types.
+- `dist/member-bff.d.ts`: authorization, session persistence, refresh, logout, action reviews, and human authorization.
+- `dist/member-resources.d.ts`: typed resources bound to the exact authenticated member.
 - [Quickstart](https://docs.xkova.com/getting-started.html): sandbox access and first authenticated call.
-- [Customer OpenAPI](https://docs.xkova.com/data/openapi-customer.json): machine-readable customer contract for the current published documentation.
+- [Customer OpenAPI](https://github.com/XKOVA/typescript-sdk/blob/main/schema/customer-api.json): machine-readable contract for the public SDK source. For an installed release, use its generated declarations.
 - [SDK guide](https://docs.xkova.com/sdk-overview.html): client and resource examples.
 - [Workflow guide](https://docs.xkova.com/sdk-workflows.html): supported workflow helpers.
 - [Member integration](https://docs.xkova.com/embedded-member.html): browser, BFF, identity, and signing boundaries.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xkova/sdk",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.6",
   "description": "TypeScript SDK for the XKOVA API.",
   "homepage": "https://docs.xkova.com",
   "repository": {