@bloque/sdk-compliance 0.2.7 → 0.4.0

package/dist/compliance-client.d.ts

@@ -1,7 +1,16 @@
 import type { HttpClient } from '@bloque/sdk-core';
 import { BaseClient } from '@bloque/sdk-core';
 import { KycClient } from './kyc/kyc-client';
+import { TiersClient } from './tiers/tiers-client';
+import { TosGateClient } from './tos-gate/tos-gate-client';
+import { VerificationGateClient } from './verification-gate/verification-gate-client';
 export declare class ComplianceClient extends BaseClient {
     readonly kyc: KycClient;
+    /** Read an identity's effective tier and requirement status. */
+    readonly tiers: TiersClient;
+    /** Level 0 TOS gate — hosted acceptance flow. */
+    readonly tosGate: TosGateClient;
+    /** Phase 3 hosted verification gate — document/form submission flow. */
+    readonly verificationGate: VerificationGateClient;
     constructor(httpClient: HttpClient);
 }

package/dist/index.cjs

@@ -1 +1 @@
-"use strict";const __rslib_import_meta_url__="u"<typeof document?new(require("url".replace("",""))).URL("file:"+__filename).href:document.currentScript&&document.currentScript.src||new URL("main.js",document.baseURI).href;var __webpack_require__={};__webpack_require__.d=(e,t)=>{for(var _ in t)__webpack_require__.o(t,_)&&!__webpack_require__.o(e,_)&&Object.defineProperty(e,_,{enumerable:!0,get:t[_]})},__webpack_require__.o=(e,t)=>Object.prototype.hasOwnProperty.call(e,t),__webpack_require__.r=e=>{"u">typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})};var __webpack_exports__={};__webpack_require__.r(__webpack_exports__),__webpack_require__.d(__webpack_exports__,{KycClient:()=>KycClient,ComplianceClient:()=>ComplianceClient});const sdk_core_namespaceObject=require("@bloque/sdk-core");class KycClient extends sdk_core_namespaceObject.BaseClient{async startVerification(e){let t=await this.httpClient.request({method:"POST",path:"/api/compliance",body:{urn:e.urn,type:"kyc",accompliceType:"person"}});return{url:t.url,status:t.status,completedAt:null}}async getVerification(e){let t=await this.httpClient.request({method:"GET",path:`/api/compliance/${e.urn}`});return{status:t.status,url:t.verification_url,completedAt:t.completed_at,result:t.result,documentsStatus:t.documents_status}}async getDocuments(e){let t=await this.httpClient.request({method:"GET",path:`/api/compliance/${e.urn}/documents`});return{documentsStatus:t.documents_status,documents:t.documents.map(e=>({documentType:e.document_type,side:e.side,imageBase64:e.image_base64,imageSizeBytes:e.image_size_bytes}))}}}class ComplianceClient extends sdk_core_namespaceObject.BaseClient{kyc;constructor(e){super(e),this.kyc=new KycClient(this.httpClient)}}for(var __rspack_i in exports.ComplianceClient=__webpack_exports__.ComplianceClient,exports.KycClient=__webpack_exports__.KycClient,__webpack_exports__)-1===["ComplianceClient","KycClient"].indexOf(__rspack_i)&&(exports[__rspack_i]=__webpack_exports__[__rspack_i]);Object.defineProperty(exports,"__esModule",{value:!0});
+"use strict";const __rslib_import_meta_url__="u"<typeof document?new(require("url".replace("",""))).URL("file:"+__filename).href:document.currentScript&&document.currentScript.src||new URL("main.js",document.baseURI).href;var __webpack_require__={};__webpack_require__.d=(e,t)=>{for(var i in t)__webpack_require__.o(t,i)&&!__webpack_require__.o(e,i)&&Object.defineProperty(e,i,{enumerable:!0,get:t[i]})},__webpack_require__.o=(e,t)=>Object.prototype.hasOwnProperty.call(e,t),__webpack_require__.r=e=>{"u">typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})};var __webpack_exports__={};__webpack_require__.r(__webpack_exports__),__webpack_require__.d(__webpack_exports__,{VerificationGateClient:()=>VerificationGateClient,mapVerificationFlow:()=>mapVerificationFlow,KycClient:()=>KycClient,ComplianceClient:()=>ComplianceClient,mapRequirementField:()=>mapRequirementField,TiersClient:()=>TiersClient,TosGateClient:()=>TosGateClient});const sdk_core_namespaceObject=require("@bloque/sdk-core");class KycClient extends sdk_core_namespaceObject.BaseClient{async startVerification(e){let t=await this.httpClient.request({method:"POST",path:"/api/compliance",body:{urn:e.urn,type:"kyc",accompliceType:"person"}});return{url:t.url,status:t.status,completedAt:null}}async getVerification(e){let t=await this.httpClient.request({method:"GET",path:`/api/compliance/${e.urn}`});return{status:t.status,url:t.verification_url,completedAt:t.completed_at,result:t.result,documentsStatus:t.documents_status}}async getDocuments(e){let t=await this.httpClient.request({method:"GET",path:`/api/compliance/${e.urn}/documents`});return{documentsStatus:t.documents_status,documents:t.documents.map(e=>({documentType:e.document_type,side:e.side,imageBase64:e.image_base64,imageSizeBytes:e.image_size_bytes}))}}}function mapRequirementField(e){return{key:e.key,label:e.label,type:e.type,required:e.required,options:e.options}}function mapRequirementStatus(e){return{key:e.key,kind:e.kind,status:e.status,description:e.description,fields:e.fields?.map(mapRequirementField),submittedAt:e.submitted_at}}function mapVerificationFlow(e){if(e)return{type:e.type,method:e.method,startEndpoint:e.start_endpoint,responseUrlField:e.response_url_field}}class TiersClient extends sdk_core_namespaceObject.BaseClient{async getStatus(e){let t=await this.httpClient.request({method:"GET",path:`/api/compliance/${e.urn}/tier-status`});return{identityUrn:t.identity_urn,effectiveLevel:t.effective_level,policyVersion:t.policy_version,levels:t.levels.map(e=>({level:e.level,name:e.name,satisfied:e.satisfied,requirements:e.requirements.map(mapRequirementStatus)})),nextLevel:t.next_level,missingRequirements:t.missing_requirements??[],pendingRequirements:t.pending_requirements??[],verificationFlow:mapVerificationFlow(t.verification_flow)}}}function mapAcceptance(e){return{id:e.id,identityUrn:e.identity_urn,documentVersionId:e.document_version_id,documentVersionLabel:e.document_version_label,documentHash:e.document_hash,acceptedAt:e.accepted_at,authAssurance:e.auth_assurance}}class TosGateClient extends sdk_core_namespaceObject.BaseClient{async start(e){let t=await this.httpClient.request({method:"POST",path:"/api/tos-gate/start",body:{return_url:e.returnUrl}});return{token:t.token,url:t.url,expiresIn:t.expires_in}}async init(e){let t=await this.httpClient.request({method:"GET",path:"/api/tos-gate/init",authorizationOverride:`Bearer ${e.token}`});return{document:{documentVersionId:t.document.document_version_id,versionLabel:t.document.version_label,contentHash:t.document.content_hash,content:t.document.content},csrfToken:t.csrf_token,returnUrl:t.return_url,showHome:t.show_home}}async accept(e){let t={csrf_token:e.csrfToken,...e.deviceAttestation&&{device_attestation:e.deviceAttestation}},i=await this.httpClient.request({method:"POST",path:"/api/tos-gate/accept",body:t,authorizationOverride:`Bearer ${e.token}`});return{acceptance:mapAcceptance(i.acceptance),returnUrl:i.return_url}}}function mapUploadIntent(e){return{contentType:e.content_type,key:e.key,uploadUrl:e.upload_url,maxSizeBytes:e.max_size_bytes}}function mapRequirement(e){return{key:e.key,kind:e.kind,description:e.description,fields:e.fields?.map(mapRequirementField),uploadable:e.uploadable,uploadIntents:e.upload_intents?.map(mapUploadIntent)}}function mapDocumentToWire(e){return{requirement_key:e.requirementKey,s3_key:e.s3Key,document_type:e.documentType,side:e.side,original_filename:e.originalFilename}}function mapAnswerToWire(e){return{requirement_key:e.requirementKey,values:e.values}}class VerificationGateClient extends sdk_core_namespaceObject.BaseClient{async start(e){let t=await this.httpClient.request({method:"POST",path:"/api/verification-gate/start",body:{return_url:e.returnUrl}});return{token:t.token,url:t.url,expiresIn:t.expires_in}}async init(e){let t=await this.httpClient.request({method:"GET",path:"/api/verification-gate/init",authorizationOverride:`Bearer ${e.token}`});return{requirements:t.requirements.map(mapRequirement),pendingRequirements:(t.pending_requirements??[]).map(e=>({key:e.key,description:e.description,submittedAt:e.submitted_at})),csrfToken:t.csrf_token,returnUrl:t.return_url}}async submit(e){let t={csrf_token:e.csrfToken,documents:e.documents?.map(mapDocumentToWire),answers:e.answers?.map(mapAnswerToWire)},i=await this.httpClient.request({method:"POST",path:"/api/verification-gate/submit",body:t,authorizationOverride:`Bearer ${e.token}`});return{returnUrl:i.return_url,documents:i.documents,answers:i.answers}}}class ComplianceClient extends sdk_core_namespaceObject.BaseClient{kyc;tiers;tosGate;verificationGate;constructor(e){super(e),this.kyc=new KycClient(this.httpClient),this.tiers=new TiersClient(this.httpClient),this.tosGate=new TosGateClient(this.httpClient),this.verificationGate=new VerificationGateClient(this.httpClient)}}for(var __rspack_i in exports.ComplianceClient=__webpack_exports__.ComplianceClient,exports.KycClient=__webpack_exports__.KycClient,exports.TiersClient=__webpack_exports__.TiersClient,exports.TosGateClient=__webpack_exports__.TosGateClient,exports.VerificationGateClient=__webpack_exports__.VerificationGateClient,exports.mapRequirementField=__webpack_exports__.mapRequirementField,exports.mapVerificationFlow=__webpack_exports__.mapVerificationFlow,__webpack_exports__)-1===["ComplianceClient","KycClient","TiersClient","TosGateClient","VerificationGateClient","mapRequirementField","mapVerificationFlow"].indexOf(__rspack_i)&&(exports[__rspack_i]=__webpack_exports__[__rspack_i]);Object.defineProperty(exports,"__esModule",{value:!0});

package/dist/index.d.ts

@@ -1,3 +1,9 @@
 export * from './compliance-client';
 export * from './kyc/kyc-client';
 export * from './kyc/types';
+export * from './tiers/tiers-client';
+export * from './tiers/types';
+export * from './tos-gate/tos-gate-client';
+export * from './tos-gate/types';
+export * from './verification-gate/types';
+export * from './verification-gate/verification-gate-client';

package/dist/index.js

@@ -1 +1 @@
-import{BaseClient as t}from"@bloque/sdk-core";class e extends t{async startVerification(t){let e=await this.httpClient.request({method:"POST",path:"/api/compliance",body:{urn:t.urn,type:"kyc",accompliceType:"person"}});return{url:e.url,status:e.status,completedAt:null}}async getVerification(t){let e=await this.httpClient.request({method:"GET",path:`/api/compliance/${t.urn}`});return{status:e.status,url:e.verification_url,completedAt:e.completed_at,result:e.result,documentsStatus:e.documents_status}}async getDocuments(t){let e=await this.httpClient.request({method:"GET",path:`/api/compliance/${t.urn}/documents`});return{documentsStatus:e.documents_status,documents:e.documents.map(t=>({documentType:t.document_type,side:t.side,imageBase64:t.image_base64,imageSizeBytes:t.image_size_bytes}))}}}class s extends t{kyc;constructor(t){super(t),this.kyc=new e(this.httpClient)}}export{s as ComplianceClient,e as KycClient};
+import{BaseClient as e}from"@bloque/sdk-core";class t extends e{async startVerification(e){let t=await this.httpClient.request({method:"POST",path:"/api/compliance",body:{urn:e.urn,type:"kyc",accompliceType:"person"}});return{url:t.url,status:t.status,completedAt:null}}async getVerification(e){let t=await this.httpClient.request({method:"GET",path:`/api/compliance/${e.urn}`});return{status:t.status,url:t.verification_url,completedAt:t.completed_at,result:t.result,documentsStatus:t.documents_status}}async getDocuments(e){let t=await this.httpClient.request({method:"GET",path:`/api/compliance/${e.urn}/documents`});return{documentsStatus:t.documents_status,documents:t.documents.map(e=>({documentType:e.document_type,side:e.side,imageBase64:e.image_base64,imageSizeBytes:e.image_size_bytes}))}}}function n(e){return{key:e.key,label:e.label,type:e.type,required:e.required,options:e.options}}function i(e){return{key:e.key,kind:e.kind,status:e.status,description:e.description,fields:e.fields?.map(n),submittedAt:e.submitted_at}}function r(e){if(e)return{type:e.type,method:e.method,startEndpoint:e.start_endpoint,responseUrlField:e.response_url_field}}class s extends e{async getStatus(e){let t=await this.httpClient.request({method:"GET",path:`/api/compliance/${e.urn}/tier-status`});return{identityUrn:t.identity_urn,effectiveLevel:t.effective_level,policyVersion:t.policy_version,levels:t.levels.map(e=>({level:e.level,name:e.name,satisfied:e.satisfied,requirements:e.requirements.map(i)})),nextLevel:t.next_level,missingRequirements:t.missing_requirements??[],pendingRequirements:t.pending_requirements??[],verificationFlow:r(t.verification_flow)}}}class a extends e{async start(e){let t=await this.httpClient.request({method:"POST",path:"/api/tos-gate/start",body:{return_url:e.returnUrl}});return{token:t.token,url:t.url,expiresIn:t.expires_in}}async init(e){let t=await this.httpClient.request({method:"GET",path:"/api/tos-gate/init",authorizationOverride:`Bearer ${e.token}`});return{document:{documentVersionId:t.document.document_version_id,versionLabel:t.document.version_label,contentHash:t.document.content_hash,content:t.document.content},csrfToken:t.csrf_token,returnUrl:t.return_url,showHome:t.show_home}}async accept(e){var t;let n={csrf_token:e.csrfToken,...e.deviceAttestation&&{device_attestation:e.deviceAttestation}},i=await this.httpClient.request({method:"POST",path:"/api/tos-gate/accept",body:n,authorizationOverride:`Bearer ${e.token}`});return{acceptance:{id:(t=i.acceptance).id,identityUrn:t.identity_urn,documentVersionId:t.document_version_id,documentVersionLabel:t.document_version_label,documentHash:t.document_hash,acceptedAt:t.accepted_at,authAssurance:t.auth_assurance},returnUrl:i.return_url}}}function o(e){return{contentType:e.content_type,key:e.key,uploadUrl:e.upload_url,maxSizeBytes:e.max_size_bytes}}function u(e){return{key:e.key,kind:e.kind,description:e.description,fields:e.fields?.map(n),uploadable:e.uploadable,uploadIntents:e.upload_intents?.map(o)}}function c(e){return{requirement_key:e.requirementKey,s3_key:e.s3Key,document_type:e.documentType,side:e.side,original_filename:e.originalFilename}}function l(e){return{requirement_key:e.requirementKey,values:e.values}}class d extends e{async start(e){let t=await this.httpClient.request({method:"POST",path:"/api/verification-gate/start",body:{return_url:e.returnUrl}});return{token:t.token,url:t.url,expiresIn:t.expires_in}}async init(e){let t=await this.httpClient.request({method:"GET",path:"/api/verification-gate/init",authorizationOverride:`Bearer ${e.token}`});return{requirements:t.requirements.map(u),pendingRequirements:(t.pending_requirements??[]).map(e=>({key:e.key,description:e.description,submittedAt:e.submitted_at})),csrfToken:t.csrf_token,returnUrl:t.return_url}}async submit(e){let t={csrf_token:e.csrfToken,documents:e.documents?.map(c),answers:e.answers?.map(l)},n=await this.httpClient.request({method:"POST",path:"/api/verification-gate/submit",body:t,authorizationOverride:`Bearer ${e.token}`});return{returnUrl:n.return_url,documents:n.documents,answers:n.answers}}}class p extends e{kyc;tiers;tosGate;verificationGate;constructor(e){super(e),this.kyc=new t(this.httpClient),this.tiers=new s(this.httpClient),this.tosGate=new a(this.httpClient),this.verificationGate=new d(this.httpClient)}}export{p as ComplianceClient,t as KycClient,s as TiersClient,a as TosGateClient,d as VerificationGateClient,n as mapRequirementField,r as mapVerificationFlow};

package/dist/internal/wire-types.d.ts

@@ -61,3 +61,209 @@ export interface GetKycDocumentsResponse {
     documents_status: string;
     documents: ComplianceDocumentImage[];
 }
+/**
+ * @internal
+ * A form field a `document`/`manual_review` requirement may ask for.
+ */
+export interface RequirementFieldWire {
+    key: string;
+    label: string;
+    type: 'text' | 'number' | 'date' | 'select' | 'boolean';
+    required?: boolean;
+    options?: string[];
+}
+/**
+ * @internal
+ * Status of a single requirement within a tier level.
+ */
+export interface TierRequirementStatusWire {
+    key: string;
+    kind: string;
+    status: 'satisfied' | 'not_satisfied' | 'expired' | 'revoked' | 'pending_review';
+    description?: string;
+    fields?: RequirementFieldWire[];
+    submitted_at?: string;
+}
+/**
+ * @internal
+ * Status of a single tier level, including all of its requirements.
+ */
+export interface TierLevelStatusWire {
+    level: number;
+    name: string;
+    satisfied: boolean;
+    requirements: TierRequirementStatusWire[];
+}
+/**
+ * @internal
+ * Handoff pointing a client at the Level 0 TOS gate.
+ */
+export interface TosHostedAcceptanceFlowHandoffWire {
+    type: 'tos_hosted_acceptance';
+    method: 'POST';
+    start_endpoint: string;
+    response_url_field: string;
+}
+/**
+ * @internal
+ * Handoff pointing a client at the Phase 3 hosted verification gate.
+ */
+export interface DocumentSubmissionFlowHandoffWire {
+    type: 'document_submission';
+    method: 'POST';
+    start_endpoint: string;
+    response_url_field: string;
+}
+/**
+ * @internal
+ * Machine-readable handoff describing which hosted gate to open next.
+ */
+export type VerificationFlowHandoffWire = TosHostedAcceptanceFlowHandoffWire | DocumentSubmissionFlowHandoffWire;
+/**
+ * @internal
+ * `GET /api/compliance/:urn/tier-status` response.
+ */
+export interface GetTierStatusResponse {
+    identity_urn: string;
+    effective_level: number;
+    policy_version: string;
+    levels: TierLevelStatusWire[];
+    next_level?: number;
+    missing_requirements?: string[];
+    pending_requirements?: string[];
+    verification_flow?: VerificationFlowHandoffWire;
+}
+/**
+ * @internal
+ * `POST /api/tos-gate/start` and `POST /api/verification-gate/start`
+ * share this exact response shape.
+ */
+export interface StartGateResponse {
+    token: string;
+    url: string;
+    expires_in: string;
+}
+/**
+ * @internal
+ * `GET /api/tos-gate/init` document payload.
+ */
+export interface TosGateDocumentWire {
+    document_version_id: string;
+    version_label: string;
+    content_hash: string;
+    content: string;
+}
+/**
+ * @internal
+ * `GET /api/tos-gate/init` response.
+ */
+export interface TosGateInitResponse {
+    document: TosGateDocumentWire;
+    csrf_token: string;
+    return_url: string;
+    show_home: boolean;
+}
+/**
+ * @internal
+ * `POST /api/tos-gate/accept` request body.
+ */
+export interface TosGateAcceptRequest {
+    csrf_token: string;
+    device_attestation?: string;
+}
+/**
+ * @internal
+ * Recorded TOS acceptance, as returned by `POST /api/tos-gate/accept`.
+ */
+export interface TosAcceptanceRecordWire {
+    id: string;
+    identity_urn: string;
+    document_version_id: string;
+    document_version_label: string;
+    document_hash: string;
+    accepted_at: string;
+    auth_assurance: string;
+}
+/**
+ * @internal
+ * `POST /api/tos-gate/accept` response.
+ */
+export interface TosGateAcceptResponse {
+    acceptance: TosAcceptanceRecordWire;
+    return_url: string;
+}
+/**
+ * @internal
+ * One presigned upload URL for a requirement, for a single content type.
+ */
+export interface VerificationUploadIntentWire {
+    content_type: string;
+    key: string;
+    upload_url: string;
+    max_size_bytes: number;
+}
+/**
+ * @internal
+ * One outstanding requirement, as surfaced by `GET /api/verification-gate/init`.
+ */
+export interface VerificationRequirementWire {
+    key: string;
+    kind: string;
+    description?: string;
+    fields?: RequirementFieldWire[];
+    uploadable: boolean;
+    upload_intents?: VerificationUploadIntentWire[];
+}
+/**
+ * @internal
+ * `GET /api/verification-gate/init` response.
+ */
+export interface PendingVerificationRequirementWire {
+    key: string;
+    description?: string;
+    submitted_at?: string;
+}
+export interface VerificationGateInitResponse {
+    requirements: VerificationRequirementWire[];
+    pending_requirements?: PendingVerificationRequirementWire[];
+    csrf_token: string;
+    return_url: string;
+}
+/**
+ * @internal
+ * A single confirmed document upload in a submit request.
+ */
+export interface VerificationGateSubmitDocumentWire {
+    requirement_key: string;
+    s3_key: string;
+    document_type?: string;
+    side?: string;
+    original_filename?: string | null;
+}
+/**
+ * @internal
+ * A single form answer in a submit request.
+ */
+export interface VerificationGateSubmitAnswerWire {
+    requirement_key: string;
+    values: Record<string, unknown>;
+}
+/**
+ * @internal
+ * `POST /api/verification-gate/submit` request body.
+ */
+export interface VerificationGateSubmitRequest {
+    csrf_token: string;
+    documents?: VerificationGateSubmitDocumentWire[];
+    answers?: VerificationGateSubmitAnswerWire[];
+}
+/**
+ * @internal
+ * `POST /api/verification-gate/submit` response. `documents`/`answers` are
+ * untyped provider-passthrough results — not consumed by the SDK today.
+ */
+export interface VerificationGateSubmitResponse {
+    return_url: string;
+    documents: unknown[];
+    answers: unknown[];
+}

package/dist/tiers/tiers-client.d.ts

@@ -0,0 +1,27 @@
+import { BaseClient } from '@bloque/sdk-core';
+import type { RequirementFieldWire, VerificationFlowHandoffWire } from '../internal/wire-types';
+import type { GetTierStatusParams, RequirementField, TierStatus, VerificationFlowHandoff } from './types';
+/** @internal Shared by verification-gate-client.ts, which surfaces the same field descriptors. */
+export declare function mapRequirementField(field: RequirementFieldWire): RequirementField;
+/** @internal Shared by verification-gate-client.ts's start()/init() responses. */
+export declare function mapVerificationFlow(flow: VerificationFlowHandoffWire | undefined): VerificationFlowHandoff | undefined;
+/**
+ * Tier status client — the read side of the compliance engine's
+ * verification-tier control plane.
+ */
+export declare class TiersClient extends BaseClient {
+    /**
+     * Get an identity's effective compliance tier, per-level requirement
+     * status, and (if not fully verified) which requirements are missing and
+     * which hosted gate resolves them.
+     *
+     * @example
+     * ```typescript
+     * const status = await bloque.compliance.tiers.getStatus({ urn: user.urn });
+     * if (status.verificationFlow?.type === 'tos_hosted_acceptance') {
+     *   // caller needs to accept TOS — see compliance.tosGate
+     * }
+     * ```
+     */
+    getStatus(params: GetTierStatusParams): Promise<TierStatus>;
+}

package/dist/tiers/types.d.ts

@@ -0,0 +1,66 @@
+export interface GetTierStatusParams {
+    /**
+     * URN (Uniform Resource Name) that uniquely identifies the identity
+     * whose tier status is being read.
+     *
+     * @example "did:bloque:user:123e4567"
+     */
+    urn: string;
+}
+export interface RequirementField {
+    key: string;
+    label: string;
+    type: 'text' | 'number' | 'date' | 'select' | 'boolean';
+    required?: boolean;
+    /** Only meaningful for `type: 'select'`. */
+    options?: string[];
+}
+export interface TierRequirementStatus {
+    key: string;
+    /** e.g. `'tos'`, `'kyc'`, `'document'`, `'manual_review'`, `'provider_check'`. */
+    kind: string;
+    /** `'pending_review'` still blocks the level, but your user has already
+     * submitted it — show it as in progress rather than asking again. */
+    status: 'satisfied' | 'not_satisfied' | 'expired' | 'revoked' | 'pending_review';
+    /** What this requirement means, for display without hardcoding key strings. */
+    description?: string;
+    /** Only present for requirements that collect form answers. */
+    fields?: RequirementField[];
+    /** ISO-8601 timestamp of the submission behind a `'pending_review'`
+     * status, for a "submitted on X" line. */
+    submittedAt?: string;
+}
+export interface TierLevelStatus {
+    level: number;
+    name: string;
+    satisfied: boolean;
+    requirements: TierRequirementStatus[];
+}
+/**
+ * Machine-readable pointer to the hosted gate that resolves the caller's
+ * current verification gap. Feed `startEndpoint`/`method` into a direct
+ * request, or just catch the `BloqueVerificationRequiredError` this maps
+ * onto and call its `getVerificationLink()` instead.
+ */
+export interface VerificationFlowHandoff {
+    type: 'tos_hosted_acceptance' | 'document_submission';
+    method: 'POST';
+    startEndpoint: string;
+    responseUrlField: string;
+}
+export interface TierStatus {
+    identityUrn: string;
+    /** Highest contiguous satisfied level; -1 if even Level 0 is unsatisfied. */
+    effectiveLevel: number;
+    policyVersion: string;
+    levels: TierLevelStatus[];
+    /** The next level that isn't fully satisfied, if any. */
+    nextLevel?: number;
+    /** Requirement keys still outstanding at `nextLevel`, actionable or not. */
+    missingRequirements: string[];
+    /** The subset of `missingRequirements` already submitted and awaiting a
+     * reviewer. When it covers all of them, `verificationFlow` is absent:
+     * there is nothing left for your user to do. */
+    pendingRequirements: string[];
+    verificationFlow?: VerificationFlowHandoff;
+}

package/dist/tos-gate/tos-gate-client.d.ts

@@ -0,0 +1,40 @@
+import { BaseClient } from '@bloque/sdk-core';
+import type { StartGateResult, StartTosGateParams, TosGateAcceptParams, TosGateAcceptResult, TosGateInitParams, TosGateInitResult } from './types';
+/**
+ * Level 0 TOS gate (`/api/tos-gate/*`) — the hosted page a user opens to
+ * accept the Terms of Service.
+ *
+ * `start()` authenticates as the SDK's connected session, same as any other
+ * call. `init()`/`accept()` authenticate solely via the capability `token`
+ * `start()` returns — the same bearer credential the hosted page itself
+ * uses — so they work without a live session for that identity (this is
+ * what makes the returned `url` portable to any browser).
+ *
+ * Usually you won't call these directly: catch a
+ * `BloqueVerificationRequiredError` with `reason === 'tos'` and call its
+ * `getVerificationLink()` instead, which calls `start()` for you.
+ */
+export declare class TosGateClient extends BaseClient {
+    /**
+     * Mint a portable TOS gate capability token + hosted page URL.
+     *
+     * @example
+     * ```typescript
+     * const gate = await bloque.compliance.tosGate.start({
+     *   returnUrl: 'https://myapp.com/verification-complete',
+     * });
+     * // Open gate.url in a browser, or drive it programmatically with init()/accept().
+     * ```
+     */
+    start(params: StartTosGateParams): Promise<StartGateResult>;
+    /**
+     * Fetch the active TOS document for the token's identity and mint a
+     * single-use acceptance nonce. Authorized solely by `params.token`.
+     */
+    init(params: TosGateInitParams): Promise<TosGateInitResult>;
+    /**
+     * Record TOS acceptance for the token's identity. Authorized solely by
+     * `params.token`; requires the single-use `csrfToken` from `init()`.
+     */
+    accept(params: TosGateAcceptParams): Promise<TosGateAcceptResult>;
+}

package/dist/tos-gate/types.d.ts

@@ -0,0 +1,59 @@
+export interface StartTosGateParams {
+    /**
+     * Where the hosted TOS gate page redirects back to after acceptance.
+     * Must be present in the backend's `TOS_GATE_RETURN_URL_ALLOWLIST`.
+     */
+    returnUrl: string;
+}
+export interface StartGateResult {
+    /** Capability token — pass as `token` to `init()`/`accept()` (or `verificationGate.init/submit`). */
+    token: string;
+    /** Fully-qualified hosted page URL a browser should open. */
+    url: string;
+    /** Token lifetime, e.g. `"30m"`. */
+    expiresIn: string;
+}
+export interface TosGateInitParams {
+    /** The capability token returned by `start()`. */
+    token: string;
+}
+export interface TosGateDocument {
+    documentVersionId: string;
+    versionLabel: string;
+    contentHash: string;
+    /** Rendered document content (Markdown-templated to HTML server-side). */
+    content: string;
+}
+export interface TosGateInitResult {
+    document: TosGateDocument;
+    /** Single-use acceptance nonce — pass as `csrfToken` to `accept()`. */
+    csrfToken: string;
+    returnUrl: string;
+    /** Whether the hosted page's intro screens should play before the document. */
+    showHome: boolean;
+}
+export interface TosGateAcceptParams {
+    /** The capability token returned by `start()`. */
+    token: string;
+    /** The single-use nonce returned by `init()`. */
+    csrfToken: string;
+    /**
+     * Optional Pass device attestation (0x-hex SCALE-encoded
+     * `PassDeviceAttestation`). When present, accepting the terms also hands
+     * control of the identity's Kreivo PassAccount to that device.
+     */
+    deviceAttestation?: string;
+}
+export interface TosAcceptanceRecord {
+    id: string;
+    identityUrn: string;
+    documentVersionId: string;
+    documentVersionLabel: string;
+    documentHash: string;
+    acceptedAt: string;
+    authAssurance: string;
+}
+export interface TosGateAcceptResult {
+    acceptance: TosAcceptanceRecord;
+    returnUrl: string;
+}

package/dist/verification-gate/types.d.ts

@@ -0,0 +1,89 @@
+import type { RequirementField } from '../tiers/types';
+export type { StartGateResult } from '../tos-gate/types';
+export interface StartVerificationGateParams {
+    /**
+     * Where the hosted verification gate page redirects back to after
+     * submission. Must be present in the backend's
+     * `VERIFICATION_GATE_RETURN_URL_ALLOWLIST` (enforced fail-closed).
+     */
+    returnUrl: string;
+}
+export interface VerificationGateInitParams {
+    /** The capability token returned by `start()`. */
+    token: string;
+}
+export interface VerificationUploadIntent {
+    contentType: string;
+    /** The S3 key to confirm in `submit()` once the PUT completes. */
+    key: string;
+    /** Presigned URL for a direct browser `PUT` upload. */
+    uploadUrl: string;
+    maxSizeBytes: number;
+}
+export interface VerificationRequirement {
+    key: string;
+    /** e.g. `'document'` or `'manual_review'` — TOS/KYC never appear here (they have no upload/form). */
+    kind: string;
+    description?: string;
+    /** Only present for requirements that collect form answers. */
+    fields?: RequirementField[];
+    uploadable: boolean;
+    /** One presigned upload URL per allowed content type, only when `uploadable`. */
+    uploadIntents?: VerificationUploadIntent[];
+}
+/** A requirement already submitted and waiting on a reviewer. No fields
+ * and no upload intents: there is nothing to collect, only something to
+ * report. */
+export interface PendingVerificationRequirement {
+    key: string;
+    description?: string;
+    /** ISO-8601 timestamp of the submission. */
+    submittedAt?: string;
+}
+export interface VerificationGateInitResult {
+    /** Requirements the identity can still act on — unsatisfied, non-TOS/
+     * KYC, and not already under review. */
+    requirements: VerificationRequirement[];
+    /** Requirements already submitted and awaiting review. Show these as in
+     * progress; collecting them again would duplicate what a reviewer
+     * already holds. */
+    pendingRequirements: PendingVerificationRequirement[];
+    /** Single-use submit nonce — pass as `csrfToken` to `submit()`. */
+    csrfToken: string;
+    returnUrl: string;
+}
+export interface SubmitDocumentConfirmation {
+    requirementKey: string;
+    /** The `key` from the `VerificationUploadIntent` used for the completed PUT. */
+    s3Key: string;
+    documentType?: string;
+    side?: string;
+    originalFilename?: string | null;
+}
+export interface SubmitFormAnswer {
+    requirementKey: string;
+    /** Answer values keyed by the requirement's `RequirementField.key`. */
+    values: Record<string, unknown>;
+}
+export interface VerificationGateSubmitParams {
+    /** The capability token returned by `start()`. */
+    token: string;
+    /** The single-use nonce from `init()`. */
+    csrfToken: string;
+    documents?: SubmitDocumentConfirmation[];
+    answers?: SubmitFormAnswer[];
+}
+export interface VerificationGateSubmitResult {
+    returnUrl: string;
+    /**
+     * Recording confirms the submission reached compliance — it does not
+     * mean the requirement is now satisfied. A customer's own submission is
+     * always recorded as `pending_review` and requires ops review before it
+     * counts toward the identity's effective tier. Until then the identity
+     * gets `E_VERIFICATION_PENDING` rather than being sent back here.
+     */
+    documents: unknown[];
+    /** One evidence record per submitted requirement key — a requirement's
+     * form answers and its uploaded files land in the same record. */
+    answers: unknown[];
+}

package/dist/verification-gate/verification-gate-client.d.ts

@@ -0,0 +1,42 @@
+import { BaseClient } from '@bloque/sdk-core';
+import type { StartGateResult, StartVerificationGateParams, VerificationGateInitParams, VerificationGateInitResult, VerificationGateSubmitParams, VerificationGateSubmitResult } from './types';
+/**
+ * Phase 3 hosted verification gate (`/api/verification-gate/*`) — the
+ * single hosted page that collects both document uploads and form answers
+ * for any outstanding Level 2+ (non-TOS/non-KYC) requirement.
+ *
+ * Same capability-token shape as {@link TosGateClient}: `start()` uses the
+ * SDK's session auth, `init()`/`submit()` authenticate solely via the
+ * capability `token`.
+ *
+ * Usually you won't call these directly: catch a
+ * `BloqueVerificationRequiredError` with `reason === 'documents'` and call
+ * its `getVerificationLink()` instead, which calls `start()` for you.
+ *
+ * A `BloqueVerificationPendingError` is the one case where you should not
+ * open this gate at all — everything it would collect is already with a
+ * reviewer.
+ */
+export declare class VerificationGateClient extends BaseClient {
+    /**
+     * Mint a portable verification gate capability token + hosted page URL.
+     */
+    start(params: StartVerificationGateParams): Promise<StartGateResult>;
+    /**
+     * Fetch the token identity's actionable requirements — with
+     * descriptions, form field definitions, and presigned upload URLs for
+     * uploadable ones — plus anything already under review (reported
+     * separately, never re-collected) and a single-use submit nonce.
+     * Authorized solely by `params.token`.
+     */
+    init(params: VerificationGateInitParams): Promise<VerificationGateInitResult>;
+    /**
+     * Submit confirmed document uploads and/or form answers for the token's
+     * identity. Authorized solely by `params.token`; requires the single-use
+     * `csrfToken` from `init()`.
+     *
+     * Recording a submission does not satisfy the requirement — see
+     * {@link VerificationGateSubmitResult.documents}.
+     */
+    submit(params: VerificationGateSubmitParams): Promise<VerificationGateSubmitResult>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bloque/sdk-compliance",
-  "version": "0.2.7",
+  "version": "0.4.0",
   "type": "module",
   "keywords": [
     "bloque",
@@ -34,6 +34,6 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@bloque/sdk-core": "0.2.4"
+    "@bloque/sdk-core": "0.4.0"
   }
 }