feat(kyc-controller): Add ukycCapabilityToken refresh

[jiexi]

• BREAKING: Makes refreshSessionStatus() async
• Adds ukycCapabilityToken expiry check via SessionStatus.capabilityAuthorizationStatus
• Refreshes the token/authorization if expired when startSession() or refreshSessionStatus() is called
• Refreshes the token/authorization if expired during the polling loop
• Updates RampsController to await refreshSessionStatus()

Note this is purposely not included during polling for simplicity's sake. Note this is not included during polling due to race conditions introduced with clearState() / reset() which can be resolved with a separate explicit call to resume/init. The ukycCapabilityToken lives for 72h which will far exceed the time the wallet is kept alive in the onboarding screens

See: https://consensyssoftware.atlassian.net/browse/KYC-29?atlOrigin=eyJpIjoiODU1NTA2ODg5YjBmNGNkZWE4M2ZmZDVkMWRkZmQzZWEiLCJwIjoiaiJ9

Screen.Recording.2026-10-07.at.11.42.48.AM.mov

---

Note

High Risk
Changes KYC session resume, cryptographic wrapping-key rotation, and when authorizations are submitted—security-sensitive identity flows with altered startSession and provider-launch assumptions.

Overview
Adds UKYC capability authorization refresh when resuming a session: startSession now loads the latest session status and, when capabilityAuthorizationStatus is new or expired (and KYC is not already approved/rejected), mints a new X25519 keypair, calls KycService.resetWrappingKeys (POST /sessions/{id}/wrapping-keys), and resubmits wrapped secrets via setAuthorizations.

refreshSessionStatus is narrowed to return the persisted session and only start polling for non-terminal statuses—it no longer fetches status or refreshes capability auth. Polling likewise updates status only and does not trigger authorization refresh (tests lock this in). The SumSub provider launch path is simplified to assume authorizations are already valid on state.

The package exports capability/KYC status helpers (needsCapabilityAuthorizationRefresh, related constants), parses optional capabilityAuthorizationStatus on session status responses, and documents the changes in the changelog.

^{Reviewed by Cursor Bugbot for commit fe7a3cd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[ggprod]

@metamaskbot update-changelogs

INFRA-4093 test. This checks token exchange for the changelog update on a PR that already changes a changelog. It is not a review request. This PR will be left open.

[metamask-ci]

✅ No changelog changes needed.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a92889a. Configure here.}