@fun-xyz/fiat-contract 0.12.0 → 0.13.0

package/README.md

@@ -82,6 +82,8 @@ this package is [ENG-5268](https://linear.app/funxyz/issue/ENG-5268).
     legitimately deferred for provider auth or activation. Transitions echo that opaque reference in
     `params`; clients submit it unchanged. `Quote.quoteRef` remains required whenever a real `Quote`
     is present, and PAY must never be exposed without real current economics.
+15. **KYC may precede pricing.** Provider auth or activation may legitimately defer pricing, so a
+    KYC state may omit `quote`. A real `Quote` still requires `quoteRef`, and PAY is never quote-less.
 
 ## KYC SDK hints, results, and client delivery
 

package/dist/{chunk-PHLBEDMK.mjs → chunk-AI66DLZT.mjs}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.12.0";
+var version = "0.13.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -514,4 +514,4 @@ export {
   tableEntry,
   isTerminal
 };
-//# sourceMappingURL=chunk-PHLBEDMK.mjs.map
+//# sourceMappingURL=chunk-AI66DLZT.mjs.map

package/dist/index.js

@@ -555,6 +555,7 @@ var STANDARD_KYC_FIELD_IDS = [
   "RESIDENTIAL_ADDRESS_POSTAL_CODE",
   "RESIDENTIAL_ADDRESS_COUNTRY",
   "TAX_IDENTIFIER",
+  "US_SSN_LAST_FOUR",
   "TAX_RESIDENCE_COUNTRY",
   "EMPLOYMENT_STATUS",
   "OCCUPATION_INDUSTRY",
@@ -777,7 +778,7 @@ var SessionAuthStateSchema = $sessionAuthState;
 var $kycCaptureState = obj({
   kind: import_zod.z.literal("KYC"),
   phase: import_zod.z.literal("CAPTURE"),
-  quote: $quote,
+  quote: $quote.optional(),
   surface: $surface,
   error: $failureReason.optional()
 });
@@ -785,7 +786,7 @@ var KycCaptureStateSchema = $kycCaptureState;
 var $kycInputRequiredState = obj({
   kind: import_zod.z.literal("KYC"),
   phase: import_zod.z.literal("INPUT_REQUIRED"),
-  quote: $quote,
+  quote: $quote.optional(),
   form: $formDescriptor,
   error: $failureReason.optional()
 });
@@ -793,7 +794,7 @@ var KycInputRequiredStateSchema = $kycInputRequiredState;
 var $kycNoActionRequiredState = obj({
   kind: import_zod.z.literal("KYC"),
   phase: import_zod.z.literal("NO_ACTION_REQUIRED"),
-  quote: $quote,
+  quote: $quote.optional(),
   reason: import_zod.z.enum(["IN_REVIEW", "ON_HOLD", "REJECTED"]),
   retryAfter: import_zod.z.string().optional(),
   failureReason: $failureReason.optional(),
@@ -875,6 +876,10 @@ var $providerBoundStepResponse = obj({
   provider: $provider,
   transitions: import_zod.z.array($transition),
   routingSessionRef: import_zod.z.string().optional(),
+  providerAuthToken: obj({
+    clientSecret: import_zod.z.string(),
+    expiresAt: import_zod.z.string()
+  }).optional(),
   orderId: import_zod.z.string().optional()
 });
 var $blockedStepResponse = obj({
@@ -882,13 +887,17 @@ var $blockedStepResponse = obj({
   provider: $provider.optional(),
   transitions: import_zod.z.array($transition),
   routingSessionRef: import_zod.z.string().optional(),
+  providerAuthToken: obj({
+    clientSecret: import_zod.z.string(),
+    expiresAt: import_zod.z.string()
+  }).optional(),
   orderId: import_zod.z.string().optional()
 });
 var $stepResponse = import_zod.z.union([$providerBoundStepResponse, $blockedStepResponse]);
 var FiatStepResponseSchema = $stepResponse;
 
 // package.json
-var version = "0.12.0";
+var version = "0.13.0";
 
 // src/table.ts
 var TABLE_VERSION = version;

package/dist/index.mjs

@@ -12,7 +12,7 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-PHLBEDMK.mjs";
+} from "./chunk-AI66DLZT.mjs";
 
 // src/codes.ts
 var COUNTRY_CURRENCY_LIST = [
@@ -454,6 +454,7 @@ var STANDARD_KYC_FIELD_IDS = [
   "RESIDENTIAL_ADDRESS_POSTAL_CODE",
   "RESIDENTIAL_ADDRESS_COUNTRY",
   "TAX_IDENTIFIER",
+  "US_SSN_LAST_FOUR",
   "TAX_RESIDENCE_COUNTRY",
   "EMPLOYMENT_STATUS",
   "OCCUPATION_INDUSTRY",
@@ -676,7 +677,7 @@ var SessionAuthStateSchema = $sessionAuthState;
 var $kycCaptureState = obj({
   kind: z.literal("KYC"),
   phase: z.literal("CAPTURE"),
-  quote: $quote,
+  quote: $quote.optional(),
   surface: $surface,
   error: $failureReason.optional()
 });
@@ -684,7 +685,7 @@ var KycCaptureStateSchema = $kycCaptureState;
 var $kycInputRequiredState = obj({
   kind: z.literal("KYC"),
   phase: z.literal("INPUT_REQUIRED"),
-  quote: $quote,
+  quote: $quote.optional(),
   form: $formDescriptor,
   error: $failureReason.optional()
 });
@@ -692,7 +693,7 @@ var KycInputRequiredStateSchema = $kycInputRequiredState;
 var $kycNoActionRequiredState = obj({
   kind: z.literal("KYC"),
   phase: z.literal("NO_ACTION_REQUIRED"),
-  quote: $quote,
+  quote: $quote.optional(),
   reason: z.enum(["IN_REVIEW", "ON_HOLD", "REJECTED"]),
   retryAfter: z.string().optional(),
   failureReason: $failureReason.optional(),
@@ -774,6 +775,10 @@ var $providerBoundStepResponse = obj({
   provider: $provider,
   transitions: z.array($transition),
   routingSessionRef: z.string().optional(),
+  providerAuthToken: obj({
+    clientSecret: z.string(),
+    expiresAt: z.string()
+  }).optional(),
   orderId: z.string().optional()
 });
 var $blockedStepResponse = obj({
@@ -781,6 +786,10 @@ var $blockedStepResponse = obj({
   provider: $provider.optional(),
   transitions: z.array($transition),
   routingSessionRef: z.string().optional(),
+  providerAuthToken: obj({
+    clientSecret: z.string(),
+    expiresAt: z.string()
+  }).optional(),
   orderId: z.string().optional()
 });
 var $stepResponse = z.union([$providerBoundStepResponse, $blockedStepResponse]);

package/dist/schemas.d.ts

@@ -53,7 +53,7 @@ export declare const TxSchema: z.ZodType<Tx>;
 export declare const RefundSchema: z.ZodType<Refund>;
 export declare const SurfaceKindSchema: z.ZodType<SurfaceKind>;
 export declare const PreferredIdentityDocumentSchema: z.ZodType<PreferredIdentityDocument>;
-export declare const STANDARD_KYC_FIELD_IDS: readonly ["LEGAL_FIRST_NAME", "LEGAL_MIDDLE_NAME", "LEGAL_LAST_NAME", "DATE_OF_BIRTH", "COUNTRY_OF_BIRTH", "CITY_OF_BIRTH", "NATIONALITY", "EMAIL_ADDRESS", "EMAIL_OWNERSHIP_VERIFICATION", "PHONE_NUMBER", "PHONE_OWNERSHIP_VERIFICATION", "RESIDENTIAL_ADDRESS_LINE_1", "RESIDENTIAL_ADDRESS_LINE_2", "RESIDENTIAL_ADDRESS_CITY", "RESIDENTIAL_ADDRESS_REGION", "RESIDENTIAL_ADDRESS_POSTAL_CODE", "RESIDENTIAL_ADDRESS_COUNTRY", "TAX_IDENTIFIER", "TAX_RESIDENCE_COUNTRY", "EMPLOYMENT_STATUS", "OCCUPATION_INDUSTRY", "OCCUPATION_TITLE", "SOURCE_OF_FUNDS_DECLARATION", "SOURCE_OF_INCOME_DECLARATION", "SOURCE_OF_WEALTH_DECLARATION", "PURPOSE_OF_SERVICE", "PURPOSE_OF_TRANSACTION", "CUSTOMER_CATEGORY"];
+export declare const STANDARD_KYC_FIELD_IDS: readonly ["LEGAL_FIRST_NAME", "LEGAL_MIDDLE_NAME", "LEGAL_LAST_NAME", "DATE_OF_BIRTH", "COUNTRY_OF_BIRTH", "CITY_OF_BIRTH", "NATIONALITY", "EMAIL_ADDRESS", "EMAIL_OWNERSHIP_VERIFICATION", "PHONE_NUMBER", "PHONE_OWNERSHIP_VERIFICATION", "RESIDENTIAL_ADDRESS_LINE_1", "RESIDENTIAL_ADDRESS_LINE_2", "RESIDENTIAL_ADDRESS_CITY", "RESIDENTIAL_ADDRESS_REGION", "RESIDENTIAL_ADDRESS_POSTAL_CODE", "RESIDENTIAL_ADDRESS_COUNTRY", "TAX_IDENTIFIER", "US_SSN_LAST_FOUR", "TAX_RESIDENCE_COUNTRY", "EMPLOYMENT_STATUS", "OCCUPATION_INDUSTRY", "OCCUPATION_TITLE", "SOURCE_OF_FUNDS_DECLARATION", "SOURCE_OF_INCOME_DECLARATION", "SOURCE_OF_WEALTH_DECLARATION", "PURPOSE_OF_SERVICE", "PURPOSE_OF_TRANSACTION", "CUSTOMER_CATEGORY"];
 export declare const KYC_ACKNOWLEDGEMENT_FIELD_IDS: readonly ["RISK_ACKNOWLEDGEMENT", "COOLING_OFF_ACKNOWLEDGEMENT", "TERMS_ACCEPTANCE"];
 export declare const ClientExecutedDeliverySchema: z.ZodType<ClientExecutedDelivery>;
 export declare const SurfaceSchema: z.ZodType<Surface>;

package/dist/table.js

@@ -36,7 +36,7 @@ __export(table_exports, {
 module.exports = __toCommonJS(table_exports);
 
 // package.json
-var version = "0.12.0";
+var version = "0.13.0";
 
 // src/table.ts
 var TABLE_VERSION = version;

package/dist/table.mjs

@@ -11,7 +11,7 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-PHLBEDMK.mjs";
+} from "./chunk-AI66DLZT.mjs";
 export {
   DOCUMENTED_ENDPOINTS,
   STATE_KEYS,

package/dist/types.d.ts

@@ -265,7 +265,7 @@ export interface PreferredIdentityDocument {
     country: string;
 }
 /** Canonical KYC values a declarative form or current-session delivery may name. */
-export type StandardKycFieldId = 'LEGAL_FIRST_NAME' | 'LEGAL_MIDDLE_NAME' | 'LEGAL_LAST_NAME' | 'DATE_OF_BIRTH' | 'COUNTRY_OF_BIRTH' | 'CITY_OF_BIRTH' | 'NATIONALITY' | 'EMAIL_ADDRESS' | 'EMAIL_OWNERSHIP_VERIFICATION' | 'PHONE_NUMBER' | 'PHONE_OWNERSHIP_VERIFICATION' | 'RESIDENTIAL_ADDRESS_LINE_1' | 'RESIDENTIAL_ADDRESS_LINE_2' | 'RESIDENTIAL_ADDRESS_CITY' | 'RESIDENTIAL_ADDRESS_REGION' | 'RESIDENTIAL_ADDRESS_POSTAL_CODE' | 'RESIDENTIAL_ADDRESS_COUNTRY' | 'TAX_IDENTIFIER' | 'TAX_RESIDENCE_COUNTRY' | 'EMPLOYMENT_STATUS' | 'OCCUPATION_INDUSTRY' | 'OCCUPATION_TITLE' | 'SOURCE_OF_FUNDS_DECLARATION' | 'SOURCE_OF_INCOME_DECLARATION' | 'SOURCE_OF_WEALTH_DECLARATION' | 'PURPOSE_OF_SERVICE' | 'PURPOSE_OF_TRANSACTION' | 'CUSTOMER_CATEGORY';
+export type StandardKycFieldId = 'LEGAL_FIRST_NAME' | 'LEGAL_MIDDLE_NAME' | 'LEGAL_LAST_NAME' | 'DATE_OF_BIRTH' | 'COUNTRY_OF_BIRTH' | 'CITY_OF_BIRTH' | 'NATIONALITY' | 'EMAIL_ADDRESS' | 'EMAIL_OWNERSHIP_VERIFICATION' | 'PHONE_NUMBER' | 'PHONE_OWNERSHIP_VERIFICATION' | 'RESIDENTIAL_ADDRESS_LINE_1' | 'RESIDENTIAL_ADDRESS_LINE_2' | 'RESIDENTIAL_ADDRESS_CITY' | 'RESIDENTIAL_ADDRESS_REGION' | 'RESIDENTIAL_ADDRESS_POSTAL_CODE' | 'RESIDENTIAL_ADDRESS_COUNTRY' | 'TAX_IDENTIFIER' | 'US_SSN_LAST_FOUR' | 'TAX_RESIDENCE_COUNTRY' | 'EMPLOYMENT_STATUS' | 'OCCUPATION_INDUSTRY' | 'OCCUPATION_TITLE' | 'SOURCE_OF_FUNDS_DECLARATION' | 'SOURCE_OF_INCOME_DECLARATION' | 'SOURCE_OF_WEALTH_DECLARATION' | 'PURPOSE_OF_SERVICE' | 'PURPOSE_OF_TRANSACTION' | 'CUSTOMER_CATEGORY';
 export type KycAcknowledgementFieldId = 'RISK_ACKNOWLEDGEMENT' | 'COOLING_OFF_ACKNOWLEDGEMENT' | 'TERMS_ACCEPTANCE';
 export type QuestionnaireKycFieldId = `QUESTIONNAIRE_RESPONSE:${string}:${string}`;
 export type KycFieldId = StandardKycFieldId | KycAcknowledgementFieldId | QuestionnaireKycFieldId;
@@ -544,23 +544,26 @@ export type FlowState =
     surface?: Surface;
     error?: FailureReason;
 }
-/** Pre-order KYC states carry the routed quote so the entry screen can keep price visible. */
+/**
+ * Pre-order KYC normally carries the routed quote so the entry screen can keep price visible.
+ * `quote` may be absent when provider auth or activation gates pricing.
+ */
  | {
     kind: 'KYC';
     phase: 'CAPTURE';
-    quote: Quote;
+    quote?: Quote;
     surface: Surface;
     error?: FailureReason;
 } | {
     kind: 'KYC';
     phase: 'INPUT_REQUIRED';
-    quote: Quote;
+    quote?: Quote;
     form: FormDescriptor;
     error?: FailureReason;
 } | {
     kind: 'KYC';
     phase: 'NO_ACTION_REQUIRED';
-    quote: Quote;
+    quote?: Quote;
     /**
      * Note the deliberate name collision (Charles's nit, review 2026-08-14): `ON_HOLD` appears
      * here as a KYC reason *and* in `OrderStatus`. They are different things and both names come
@@ -649,6 +652,14 @@ type FiatStepResponseBase = {
      * the committed provider path independently from the quote binding.
      */
     routingSessionRef?: string;
+    /**
+     * Short-lived provider credential the client redeems for a silent sign-in before it renders the
+     * state. Absent means no silent path; the interactive `SESSION_AUTH` flow still applies.
+     */
+    providerAuthToken?: {
+        clientSecret: string;
+        expiresAt: string;
+    };
     /** TODO(open-decision): `orderId` placement — see `PAYMENT{INSTRUCT}.orderId` above. */
     orderId?: string;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fun-xyz/fiat-contract",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Published conformance contract for Fun's headless fiat onramp: FlowState/Transition types, zod schemas, the transition table as data, recorded fixtures, assertion helpers.",
   "license": "MIT",
   "repository": {