createTinV1IdentityEnvelope — Encrypt a TIN identity

Create the encrypted identity envelope and lookup commitment accepted by the legacy CreateTinV1 registry instruction.

What it does

This SDK helper derives a lookup commitment from the supplied TIN, encrypts the display name and TIN with AES-GCM, and returns the ciphertext envelope. It does not create an on-chain TIN account.

How the flow works

1. Caller invokes the function

   The caller supplies the TIN lookup material and display name.
2. Validation

   The function converts both values to UTF-8 bytes and prepares deterministic commitment/key material.
3. Main work

   It derives the lookup commitment, generates a random AES-GCM nonce, and encrypts the JSON identity payload.
4. Result

   It returns lookupCommitment and an envelope containing nonce bytes followed by ciphertext bytes.

Signature

export async function createTinV1IdentityEnvelope(params: {
  tin: bigint | number | string;
  displayName: string;
}): Promise<{ lookupCommitment: Uint8Array; encryptedIdentityEnvelope: Uint8Array }>

tin · bigint | number | string · required

TIN lookup material.

displayName · string · required

Name placed inside the encrypted JSON payload.

Result and errors

The helper returns a 32-byte lookup commitment and AES-GCM envelope. It throws if the runtime does not expose WebCrypto AES-GCM support.

const envelope = await createTinV1IdentityEnvelope({ tin: "1234567890", displayName: "Example" });

Source: tins.ts:1289-1304