@fun-xyz/fiat-contract 0.23.0 → 0.24.0

package/README.md

@@ -19,7 +19,7 @@ Four things, zero runtime logic beyond validation:
 | --- | --- | --- | --- |
 | `@fun-xyz/fiat-contract/types` | **0.1 KB** (types erase) | every type; no runtime values | production, both repos |
 | `@fun-xyz/fiat-contract/table` | **13.8 KB**, zero deps | `TRANSITION_TABLE`, `stateKey`, `tableEntry`, `isTerminal`, `walkTable`, `TABLE_VERSION`, `TERMINAL_ORDER_STATUSES`, `DOCUMENTED_ENDPOINTS`, `UNOFFERED_ENDPOINTS`, `UNREACHABLE_STATES`, `unofferedEndpoints`, `unreachableStates` | **production frontend** + backend |
-| `@fun-xyz/fiat-contract/moonpay` | zero deps | the MoonPay provider-owned flow: `intent` request kinds, response statuses and fault types, and `MOONPAY_ENDPOINTS` | **production frontend** (MoonPay adapter) + backend |
+| `@fun-xyz/fiat-contract/moonpay` | zero deps | the MoonPay flow on `POST /fiat/next`: action requests, prompts, responses, fault types, and `MOONPAY_ENDPOINTS` | **production frontend** (MoonPay adapter) + backend |
 | `@fun-xyz/fiat-contract/terms` | zero deps | the platform terms route: `TermsDocument`, `FiatTermsRequest`, `FiatTermsResponse`, fault types, and `FIAT_TERMS_ENDPOINT` | **production frontend** + backend |
 | `@fun-xyz/fiat-contract/routing` | zero deps | the routing table and routing quote: `FiatRoutingTableQuery`, `FiatRoutingTableResponse`, `FiatRoutingQuoteRequest`, both routes' error bodies, and `ROUTING_ENDPOINTS` | **production frontend** + backend |
 | `@fun-xyz/fiat-contract` | 47.6 KB, needs zod | the above + 77 zod schemas + assertions + 18 fixtures | tests, and backend dev/test guards |
@@ -102,7 +102,7 @@ A provider can run its own flow instead of the shared step machine. `POST /fiat/
 and prices. When the request's `handoffs` lists the winning provider, the response carries
 `handoff: { provider }` and no transitions. The client shows that provider's `CHECKOUT` documents
 from `PROVIDER_CHECKOUT_DOCUMENTS`, records them with `POST /fiat/terms` on Continue, and then calls
-`POST /fiat/providers/{provider}/intent`. The schema refuses a handoff on any state but `QUOTE`, a
+`POST /fiat/next`. The schema refuses a handoff on any state but `QUOTE`, a
 handoff to a provider other than the response's own, and a handoff that still offers transitions.
 
 **Terms (`./terms`).** Every provider records acceptances through the platform `POST /fiat/terms`
@@ -156,51 +156,51 @@ Both routes take geo under the `POST /fiat/quote` rules: a known `CountryCode`,
 region for a US buyer, and an empty `region` or `ip` read as absent. The quote route's `geo` is the
 Fun geo endpoint's response forwarded as is. The request schemas are strict like every schema here,
 so a client sends only the declared keys and no blank strings. `provider` is one of the five
-providers the backend routes (`RoutingProvider`). The quote route is temporary: each provider's
-`intent` route replaces it.
+providers the backend routes (`RoutingProvider`). The quote route is temporary: `POST /fiat/next`
+replaces it for each provider that moves there.
 
-**MoonPay (`./moonpay`).** One route, `MOONPAY_ENDPOINTS.intent`. A `MoonPayIntentRequest` is one of
-three kinds:
+**MoonPay (`./moonpay`).** MoonPay runs on the shared `POST /fiat/next` (`MOONPAY_ENDPOINTS.next`).
+Every `/next` body is a `FiatNextRequest`: `provider`, `geo` (a `FiatGeo`, the geo endpoint's
+response), and the provider's own request, which names its `action`. The orchestrator reads
+`provider` and `geo`; the provider's action schema reads the rest. MoonPay's body is a
+`MoonPayNextRequest`, and every MoonPay request also carries the context `checkout` and, after
+`connect`, `credentials` (`customerId`, `accessToken`).
 
-| `kind` | Carries | A repeat |
-| --- | --- | --- |
-| `observe` | `checkout`, and `credentials` (`customerId`, `accessToken`) once the SDK has them | writes nothing new |
-| `kyc` | `checkout`, `credentials`, `values` keyed by `KycFieldId` (no form id) | drops values MoonPay no longer asks for |
-| `order` | `orderId`, `transactionId?`, `quotedAmount`, `geo?` (the checkout's) | returns the recorded order |
-
-`observe` and `kyc` answer a `MoonPayStepResponse`, which says what the backend needs next:
-
-| `status` | Carries | The client then |
-| --- | --- | --- |
-| `TERMS` | `stage`, `documents` (at least one, all at `stage`) | sends `POST /fiat/terms`, then `observe` |
-| `SDK_AUTH` | `sessionToken`, `quoteInput`, `resetConnection?` (`true` when the device's MoonPay connection is another buyer's) | resets the connection when asked, runs the MoonPay connection check, then `observe` with credentials |
-| `KYC` | `fields`, `fieldErrors?` (each naming a field in `fields`, with `code?` `PHONE_IN_USE` on `PHONE_NUMBER` or `TAX_ID_IN_USE` on `TAX_IDENTIFIER` when another MoonPay customer holds the value) | shows the shared form, then sends `kyc` |
-| `PENDING` | `retryAfterMs` (at most 60 s) | sends `observe` after the delay, never `kyc` again |
-| `READY` | `orderId`, `quoteInput` | mounts Apple Pay, then sends `order` after the charge |
-| `REFUSED` | `reason` (`NOT_ELIGIBLE`, `DOCUMENTS_REQUIRED`, `FINAL_REJECTION`, `CUSTOMER_MISMATCH`), `recovery: REQUOTE \| NONE` | exits the provider flow |
-
-`order` runs after every charge attempt, a failed one too, and answers a `MoonPayOrderResponse`.
-`transactionId` is optional because a failed charge may have none; without it the backend records the
-failed charges MoonPay lists for `orderId`. `quotedAmount` is the fiat amount the quote showed.
-`geo` is the same object `observe` sends in `checkout`; the order records its `alpha2` as its
-country, and no country without it. A
-failed charge answers `DONE` with the order in `FAILED`, and the client requotes for a new `orderId`.
-After a failed charge with no `transactionId`, the client caps its `PENDING` polls.
-
-| `status` | Carries | The client then |
-| --- | --- | --- |
-| `DONE` | `order`, the `GET /fiat/orders/:orderId` response | shows the shared order status |
-| `PENDING` | `retryAfterMs` (at most 60 s) | sends the same `order` after the delay |
-| `REFUSED` | `reason` (`CUSTOMER_MISMATCH`, `WALLET_MISMATCH`, `UNRECORDABLE`), `recovery: NONE` | exits the provider flow |
+Each `MoonPayAction` has one name. A response's prompt names it in `next` and carries what the
+client needs; the client's request names it in `action` and carries the result:
 
-`MoonPayIntentResponseFor` maps each `kind` to its union, and `MoonPayIntentResponse` is both.
+| Action | Prompt carries | Request carries | A repeat |
+| --- | --- | --- | --- |
+| `observe` | no prompt: the answer is the current prompt | nothing | writes nothing |
+| `consent` | `documents` (at least one, unique ids) | `acceptances`, the `POST /fiat/terms` items | writes nothing new |
+| `connect` | `sessionToken`, `quoteInput`, `resetConnection?` (`true` when the device's MoonPay connection is another buyer's) | `customerId`, `accessToken` | rebinds the same customer |
+| `kyc` | `fields`, `fieldErrors?` (each naming a field in `fields`, with `code?` `PHONE_IN_USE` on `PHONE_NUMBER` or `TAX_ID_IN_USE` on `TAX_IDENTIFIER` when another MoonPay customer holds the value) | `credentials`, `values` keyed by `KycFieldId` (no form id) | drops values MoonPay no longer asks for |
+| `wait` | `retryAfterMs` (at most 60 s) | no request: the client sends `observe` after the delay | |
+| `order` | `orderId`, `quoteInput` | `orderId`, `quotedAmount`, `transactionId?` | returns the recorded order |
+
+Every response is the next prompt, `done`, or `refused` (`MoonPayRefused`), and
+`MoonPayResponseFor` maps each request action to its union. `observe`, `consent`, `connect` and `kyc`
+answer a `MoonPayStepResponse`: any `MoonPayPrompt`, or `refused` with `reason` (`NOT_ELIGIBLE`,
+`DOCUMENTS_REQUIRED`, `FINAL_REJECTION`, `CUSTOMER_MISMATCH`) and `recovery: REQUOTE | NONE`.
+
+`order` runs after every charge attempt, a failed one too, and answers a `MoonPayOrderResponse`:
+`done` with `order`, the `GET /fiat/orders/:orderId` response; `order` again while MoonPay does not
+list the transaction yet; or `refused` with `reason` (`CUSTOMER_MISMATCH`, `WALLET_MISMATCH`,
+`UNRECORDABLE`) and `recovery: NONE`. `transactionId` is optional because a failed charge may have
+none; without it the backend records the failed charges MoonPay lists for `orderId`. `quotedAmount`
+is the fiat amount the device quote showed. The order records the body's `geo.alpha2` as its country.
+A failed charge answers `done` with the order in `FAILED`, and the client requotes for a new `orderId`.
+
+A first-time buyer goes `observe` → `consent` → `connect` → `kyc` → `wait` → `observe` → `order` →
+`done`; a returning buyer `observe` → `connect` → `order` → `done`. Both walks are recorded in
+`test/fixtures/moonpay-next/`.
 
 A fault is a 4xx or 5xx with a `MoonPayErrorBody`: the shared `errorCode`, `errorMsg` and `reqId`,
 plus `reason` (`SESSION_BUDGET_SPENT`, `RATE_LIMITED`, `PROVIDER_UNAVAILABLE`, `INVALID_REQUEST`)
 and `recovery`:
-`RETRY` (send the same request again), `REQUOTE`, or `NONE`. A field error is a `KYC`
-response, not a fault. The zod schemas (`MoonPay*Schema`, `TermsDocumentSchema`, `FiatTerms*Schema`)
-are exported from the root only.
+`RETRY` (send the same request again), `REQUOTE`, or `NONE`. A field error is a `kyc`
+prompt, not a fault. The zod schemas (`MoonPay*Schema`, `FiatGeoSchema`, `FiatNextRequestSchema`,
+`TermsDocumentSchema`, `FiatTerms*Schema`) are exported from the root only.
 
 ## KYC SDK hints, results, and client delivery
 

package/dist/{chunk-KYE2HYV5.mjs → chunk-5UEPWL7B.mjs}

@@ -1,11 +1,11 @@
 // src/routing.ts
 var ROUTING_ENDPOINTS = {
   table: "GET /fiat/routing/table",
-  /** Temporary: each provider's `intent` route replaces it. */
+  /** Temporary: `POST /fiat/next` replaces it for each provider that moves there. */
   quote: "POST /fiat/routing/quote"
 };
 
 export {
   ROUTING_ENDPOINTS
 };
-//# sourceMappingURL=chunk-KYE2HYV5.mjs.map
+//# sourceMappingURL=chunk-5UEPWL7B.mjs.map

package/dist/{chunk-5GRPYE2U.mjs → chunk-CRNKRIKR.mjs}

@@ -41,4 +41,4 @@ export {
   FUN_KYC_CONSENT_DOCUMENTS,
   PUBLISHED_TERMS_DOCUMENTS
 };
-//# sourceMappingURL=chunk-5GRPYE2U.mjs.map
+//# sourceMappingURL=chunk-CRNKRIKR.mjs.map

package/dist/{chunk-EI56NQ7K.mjs → chunk-IPOPANXS.mjs}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.23.0";
+var version = "0.24.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -514,4 +514,4 @@ export {
   tableEntry,
   isTerminal
 };
-//# sourceMappingURL=chunk-EI56NQ7K.mjs.map
+//# sourceMappingURL=chunk-IPOPANXS.mjs.map

package/dist/chunk-T5JAYOWY.mjs

@@ -0,0 +1,9 @@
+// src/providers/moonpay.ts
+var MOONPAY_ENDPOINTS = {
+  next: "POST /fiat/next"
+};
+
+export {
+  MOONPAY_ENDPOINTS
+};
+//# sourceMappingURL=chunk-T5JAYOWY.mjs.map

package/dist/index.js

@@ -42,6 +42,8 @@ __export(index_exports, {
   FiatAmountSchema: () => FiatAmountSchema,
   FiatCurrencyCode: () => FiatCurrencyCode,
   FiatEndpointSchema: () => FiatEndpointSchema,
+  FiatGeoSchema: () => FiatGeoSchema,
+  FiatNextRequestSchema: () => FiatNextRequestSchema,
   FiatProviderSchema: () => FiatProviderSchema,
   FiatRoutingQuoteErrorBodySchema: () => FiatRoutingQuoteErrorBodySchema,
   FiatRoutingQuoteRequestSchema: () => FiatRoutingQuoteRequestSchema,
@@ -72,14 +74,28 @@ __export(index_exports, {
   KycSdkResultReportSchema: () => KycSdkResultReportSchema,
   MOONPAY_ENDPOINTS: () => MOONPAY_ENDPOINTS,
   MoonPayCheckoutSchema: () => MoonPayCheckoutSchema,
+  MoonPayConnectPromptSchema: () => MoonPayConnectPromptSchema,
+  MoonPayConnectRequestSchema: () => MoonPayConnectRequestSchema,
+  MoonPayConsentPromptSchema: () => MoonPayConsentPromptSchema,
+  MoonPayConsentRequestSchema: () => MoonPayConsentRequestSchema,
+  MoonPayDoneSchema: () => MoonPayDoneSchema,
   MoonPayErrorBodySchema: () => MoonPayErrorBodySchema,
   MoonPayFaultSchema: () => MoonPayFaultSchema,
-  MoonPayIntentRequestSchema: () => MoonPayIntentRequestSchema,
-  MoonPayIntentResponseSchema: () => MoonPayIntentResponseSchema,
+  MoonPayKycPromptSchema: () => MoonPayKycPromptSchema,
+  MoonPayKycRequestSchema: () => MoonPayKycRequestSchema,
+  MoonPayNextRequestSchema: () => MoonPayNextRequestSchema,
+  MoonPayObserveRequestSchema: () => MoonPayObserveRequestSchema,
+  MoonPayOrderPromptSchema: () => MoonPayOrderPromptSchema,
+  MoonPayOrderRequestSchema: () => MoonPayOrderRequestSchema,
   MoonPayOrderResponseSchema: () => MoonPayOrderResponseSchema,
+  MoonPayPromptSchema: () => MoonPayPromptSchema,
   MoonPayQuoteInputSchema: () => MoonPayQuoteInputSchema,
+  MoonPayRequestContextSchema: () => MoonPayRequestContextSchema,
+  MoonPayRequestSchema: () => MoonPayRequestSchema,
+  MoonPayResponseSchemaFor: () => MoonPayResponseSchemaFor,
   MoonPaySdkCredentialsSchema: () => MoonPaySdkCredentialsSchema,
   MoonPayStepResponseSchema: () => MoonPayStepResponseSchema,
+  MoonPayWaitPromptSchema: () => MoonPayWaitPromptSchema,
   OrderAwaitingConfirmationStateSchema: () => OrderAwaitingConfirmationStateSchema,
   OrderCreatedStateSchema: () => OrderCreatedStateSchema,
   OrderRefSchema: () => OrderRefSchema,
@@ -1121,6 +1137,10 @@ var $routingTableErrorBody = import_zod.z.union([$routingRateLimitedErrorBody, $
 var FiatRoutingTableErrorBodySchema = $routingTableErrorBody;
 var $routingQuoteErrorBody = import_zod.z.union([$routingNoRouteErrorBody, $routingAmountErrorBody, $routingFaultErrorBody]);
 var FiatRoutingQuoteErrorBodySchema = $routingQuoteErrorBody;
+var $fiatGeo = obj({ alpha2: import_zod.z.string().regex(/^[A-Z]{2}$/), region: $nonBlank.optional(), ip: $nonBlank.optional() });
+var FiatGeoSchema = $fiatGeo;
+var $nextRequest = import_zod.z.object({ provider: $provider, action: $nonBlank, geo: $fiatGeo }).catchall(import_zod.z.unknown());
+var FiatNextRequestSchema = $nextRequest;
 var $providerBoundStepResponse = obj({
   state: $providerBoundFlowState,
   provider: $provider,
@@ -1180,7 +1200,7 @@ var $stepResponse = import_zod.z.union([$providerBoundStepResponse, $blockedStep
 var FiatStepResponseSchema = $stepResponse;
 
 // package.json
-var version = "0.23.0";
+var version = "0.24.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -2786,13 +2806,13 @@ var PUBLISHED_TERMS_DOCUMENTS = [MOONPAY_TERMS, ...Object.values(FUN_KYC_CONSENT
 // src/routing.ts
 var ROUTING_ENDPOINTS = {
   table: "GET /fiat/routing/table",
-  /** Temporary: each provider's `intent` route replaces it. */
+  /** Temporary: `POST /fiat/next` replaces it for each provider that moves there. */
   quote: "POST /fiat/routing/quote"
 };
 
 // src/providers/moonpay.ts
 var MOONPAY_ENDPOINTS = {
-  intent: "POST /fiat/providers/moonpay/intent"
+  next: "POST /fiat/next"
 };
 
 // src/providers/moonpay.schemas.ts
@@ -2801,33 +2821,17 @@ var FIAT_CURRENCY_CODES2 = Object.keys(FIAT_CURRENCY_NAMES);
 var obj2 = (shape) => import_zod2.z.object(shape).strict();
 var $nonEmpty = import_zod2.z.string().refine((value) => value.trim().length > 0, "must not be blank");
 var hasUniqueIds2 = (ids) => new Set(ids).size === ids.length;
-var $geo = obj2({ alpha2: import_zod2.z.string().regex(/^[A-Z]{2}$/), region: $nonEmpty.optional(), ip: $nonEmpty.optional() });
 var $checkout = obj2({
   amount: FiatAmountSchema,
   destination: obj2({ asset: $nonEmpty, network: $nonEmpty }),
-  paymentMethod: import_zod2.z.literal("apple_pay"),
-  geo: $geo
+  paymentMethod: import_zod2.z.literal("apple_pay")
 });
 var MoonPayCheckoutSchema = $checkout;
 var $credentials = obj2({ customerId: $nonEmpty, accessToken: $nonEmpty });
 var MoonPaySdkCredentialsSchema = $credentials;
-var $intentRequest = import_zod2.z.discriminatedUnion("kind", [
-  obj2({ kind: import_zod2.z.literal("observe"), checkout: $checkout, credentials: $credentials.optional() }),
-  obj2({
-    kind: import_zod2.z.literal("kyc"),
-    checkout: $checkout,
-    credentials: $credentials,
-    values: import_zod2.z.record(KycFieldIdSchema, import_zod2.z.string()).refine((values) => Object.keys(values).length > 0, "values must not be empty")
-  }),
-  obj2({
-    kind: import_zod2.z.literal("order"),
-    orderId: $nonEmpty,
-    transactionId: $nonEmpty.optional(),
-    quotedAmount: FiatAmountSchema,
-    geo: $geo.optional()
-  })
-]);
-var MoonPayIntentRequestSchema = $intentRequest;
+var $context = { checkout: $checkout, credentials: $credentials.optional() };
+var $requestContext = obj2($context);
+var MoonPayRequestContextSchema = $requestContext;
 var $quoteInput = obj2({
   source: obj2({ asset: obj2({ code: import_zod2.z.enum(FIAT_CURRENCY_CODES2) }), amount: $nonEmpty }),
   destination: obj2({ asset: obj2({ code: $nonEmpty }) }),
@@ -2836,50 +2840,103 @@ var $quoteInput = obj2({
   feeBehavior: import_zod2.z.literal("inclusive")
 });
 var MoonPayQuoteInputSchema = $quoteInput;
-var $stepRefusal = import_zod2.z.enum(["NOT_ELIGIBLE", "DOCUMENTS_REQUIRED", "FINAL_REJECTION", "CUSTOMER_MISMATCH"]);
-var $orderRefusal = import_zod2.z.enum(["CUSTOMER_MISMATCH", "WALLET_MISMATCH", "UNRECORDABLE"]);
+var $observeFields = { action: import_zod2.z.literal("observe") };
+var $consentFields = {
+  action: import_zod2.z.literal("consent"),
+  acceptances: import_zod2.z.array(TermsDocumentAcceptanceSchema).min(1).refine((acceptances) => hasUniqueIds2(acceptances.map((acceptance) => acceptance.documentId)), "each document is accepted once")
+};
+var $connectFields = { action: import_zod2.z.literal("connect"), customerId: $nonEmpty, accessToken: $nonEmpty };
+var $kycFields = {
+  action: import_zod2.z.literal("kyc"),
+  credentials: $credentials,
+  values: import_zod2.z.record(KycFieldIdSchema, import_zod2.z.string()).refine((values) => Object.keys(values).length > 0, "values must not be empty")
+};
+var $orderFields = { action: import_zod2.z.literal("order"), orderId: $nonEmpty, quotedAmount: FiatAmountSchema, transactionId: $nonEmpty.optional() };
+var $observeRequest = obj2({ ...$context, ...$observeFields });
+var $consentRequest = obj2({ ...$context, ...$consentFields });
+var $connectRequest = obj2({ ...$context, ...$connectFields });
+var $kycRequest = obj2({ ...$context, ...$kycFields });
+var $orderRequest = obj2({ ...$context, ...$orderFields });
+var MoonPayObserveRequestSchema = $observeRequest;
+var MoonPayConsentRequestSchema = $consentRequest;
+var MoonPayConnectRequestSchema = $connectRequest;
+var MoonPayKycRequestSchema = $kycRequest;
+var MoonPayOrderRequestSchema = $orderRequest;
+var $request = import_zod2.z.discriminatedUnion("action", [$observeRequest, $consentRequest, $connectRequest, $kycRequest, $orderRequest]);
+var MoonPayRequestSchema = $request;
+var $envelope = { provider: import_zod2.z.literal("MOONPAY"), geo: FiatGeoSchema, ...$context };
+var $nextRequest2 = import_zod2.z.discriminatedUnion("action", [
+  obj2({ ...$envelope, ...$observeFields }),
+  obj2({ ...$envelope, ...$consentFields }),
+  obj2({ ...$envelope, ...$connectFields }),
+  obj2({ ...$envelope, ...$kycFields }),
+  obj2({ ...$envelope, ...$orderFields })
+]);
+var MoonPayNextRequestSchema = $nextRequest2;
 var FIELD_OF_CODE = { PHONE_IN_USE: "PHONE_NUMBER", TAX_ID_IN_USE: "TAX_IDENTIFIER" };
 var $fieldError = obj2({ fieldId: $nonEmpty, message: $nonEmpty, code: import_zod2.z.enum(["PHONE_IN_USE", "TAX_ID_IN_USE"]).optional() });
-var $pending = obj2({ status: import_zod2.z.literal("PENDING"), retryAfterMs: import_zod2.z.number().int().positive().max(6e4) });
-var $stepStatus = import_zod2.z.discriminatedUnion("status", [
-  obj2({ status: import_zod2.z.literal("TERMS"), stage: import_zod2.z.enum(["CHECKOUT", "KYC"]), documents: import_zod2.z.array(TermsDocumentSchema).min(1) }),
-  obj2({ status: import_zod2.z.literal("SDK_AUTH"), sessionToken: $nonEmpty, quoteInput: $quoteInput, resetConnection: import_zod2.z.literal(true).optional() }),
-  obj2({ status: import_zod2.z.literal("KYC"), fields: import_zod2.z.array(FormFieldSchema).min(1), fieldErrors: import_zod2.z.array($fieldError).min(1).optional() }),
-  $pending,
-  obj2({ status: import_zod2.z.literal("READY"), orderId: $nonEmpty, quoteInput: $quoteInput }),
-  obj2({ status: import_zod2.z.literal("REFUSED"), reason: $stepRefusal, recovery: import_zod2.z.enum(["REQUOTE", "NONE"]) })
-]);
-var $stepResponse2 = $stepStatus.superRefine((response, context) => {
-  if (response.status === "TERMS") {
-    if (!hasUniqueIds2(response.documents.map((document) => document.id))) {
-      context.addIssue({ code: "custom", path: ["documents"], message: "document ids must be unique" });
-    }
-    if (response.documents.some((document) => document.stage !== response.stage)) {
-      context.addIssue({ code: "custom", path: ["documents"], message: "every document must be at the response stage" });
-    }
+var $consentShape = obj2({ next: import_zod2.z.literal("consent"), documents: import_zod2.z.array(TermsDocumentSchema).min(1) });
+var $connectPrompt = obj2({
+  next: import_zod2.z.literal("connect"),
+  sessionToken: $nonEmpty,
+  quoteInput: $quoteInput,
+  resetConnection: import_zod2.z.literal(true).optional()
+});
+var $kycShape = obj2({ next: import_zod2.z.literal("kyc"), fields: import_zod2.z.array(FormFieldSchema).min(1), fieldErrors: import_zod2.z.array($fieldError).min(1).optional() });
+var $waitPrompt = obj2({ next: import_zod2.z.literal("wait"), retryAfterMs: import_zod2.z.number().int().positive().max(6e4) });
+var $orderPrompt = obj2({ next: import_zod2.z.literal("order"), orderId: $nonEmpty, quoteInput: $quoteInput });
+var checkConsent = (prompt, context) => {
+  if (!hasUniqueIds2(prompt.documents.map((document) => document.id))) {
+    context.addIssue({ code: "custom", path: ["documents"], message: "document ids must be unique" });
   }
-  if (response.status === "KYC") {
-    const fieldIds = response.fields.map((field) => field.id);
-    if (!hasUniqueIds2(fieldIds)) {
-      context.addIssue({ code: "custom", path: ["fields"], message: "field ids must be unique" });
-    }
-    if (response.fieldErrors?.some((error) => !fieldIds.includes(error.fieldId))) {
-      context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error must name a field in this response" });
-    }
-    if (response.fieldErrors?.some((error) => error.code && FIELD_OF_CODE[error.code] !== error.fieldId)) {
-      context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error code must match its field" });
-    }
+};
+var checkKyc = (prompt, context) => {
+  const fieldIds = prompt.fields.map((field) => field.id);
+  if (!hasUniqueIds2(fieldIds)) {
+    context.addIssue({ code: "custom", path: ["fields"], message: "field ids must be unique" });
+  }
+  if (prompt.fieldErrors?.some((error) => !fieldIds.includes(error.fieldId))) {
+    context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error must name a field in this prompt" });
+  }
+  if (prompt.fieldErrors?.some((error) => error.code && FIELD_OF_CODE[error.code] !== error.fieldId)) {
+    context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error code must match its field" });
   }
+};
+var MoonPayConsentPromptSchema = $consentShape.superRefine(checkConsent);
+var MoonPayConnectPromptSchema = $connectPrompt;
+var MoonPayKycPromptSchema = $kycShape.superRefine(checkKyc);
+var MoonPayWaitPromptSchema = $waitPrompt;
+var MoonPayOrderPromptSchema = $orderPrompt;
+var checkPrompt = (response, context) => {
+  if (response.next === "consent") checkConsent(response, context);
+  if (response.next === "kyc") checkKyc(response, context);
+};
+var $promptOptions = [$consentShape, $connectPrompt, $kycShape, $waitPrompt, $orderPrompt];
+var $prompt = import_zod2.z.discriminatedUnion("next", [...$promptOptions]).superRefine(checkPrompt);
+var MoonPayPromptSchema = $prompt;
+var $done = obj2({ next: import_zod2.z.literal("done"), order: FiatStepResponseSchema });
+var MoonPayDoneSchema = $done;
+var $stepRefused = obj2({
+  next: import_zod2.z.literal("refused"),
+  reason: import_zod2.z.enum(["NOT_ELIGIBLE", "DOCUMENTS_REQUIRED", "FINAL_REJECTION", "CUSTOMER_MISMATCH"]),
+  recovery: import_zod2.z.enum(["REQUOTE", "NONE"])
+});
+var $orderRefused = obj2({
+  next: import_zod2.z.literal("refused"),
+  reason: import_zod2.z.enum(["CUSTOMER_MISMATCH", "WALLET_MISMATCH", "UNRECORDABLE"]),
+  recovery: import_zod2.z.literal("NONE")
 });
+var $stepResponse2 = import_zod2.z.discriminatedUnion("next", [...$promptOptions, $stepRefused]).superRefine(checkPrompt);
 var MoonPayStepResponseSchema = $stepResponse2;
-var $orderResponse = import_zod2.z.discriminatedUnion("status", [
-  obj2({ status: import_zod2.z.literal("DONE"), order: FiatStepResponseSchema }),
-  $pending,
-  obj2({ status: import_zod2.z.literal("REFUSED"), reason: $orderRefusal, recovery: import_zod2.z.literal("NONE") })
-]);
+var $orderResponse = import_zod2.z.discriminatedUnion("next", [$done, $orderPrompt, $orderRefused]);
 var MoonPayOrderResponseSchema = $orderResponse;
-var $intentResponse = import_zod2.z.union([$stepResponse2, $orderResponse]);
-var MoonPayIntentResponseSchema = $intentResponse;
+var MoonPayResponseSchemaFor = {
+  observe: MoonPayStepResponseSchema,
+  consent: MoonPayStepResponseSchema,
+  connect: MoonPayStepResponseSchema,
+  kyc: MoonPayStepResponseSchema,
+  order: MoonPayOrderResponseSchema
+};
 var $faultFields = {
   reason: import_zod2.z.enum(["SESSION_BUDGET_SPENT", "RATE_LIMITED", "PROVIDER_UNAVAILABLE", "INVALID_REQUEST"]),
   recovery: import_zod2.z.enum(["RETRY", "REQUOTE", "NONE"])

package/dist/index.mjs

@@ -12,19 +12,19 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-EI56NQ7K.mjs";
+} from "./chunk-IPOPANXS.mjs";
 import {
   MOONPAY_ENDPOINTS
-} from "./chunk-3HCZ6JBJ.mjs";
+} from "./chunk-T5JAYOWY.mjs";
 import {
   FIAT_TERMS_ENDPOINT,
   FUN_KYC_CONSENT_DOCUMENTS,
   PROVIDER_CHECKOUT_DOCUMENTS,
   PUBLISHED_TERMS_DOCUMENTS
-} from "./chunk-5GRPYE2U.mjs";
+} from "./chunk-CRNKRIKR.mjs";
 import {
   ROUTING_ENDPOINTS
-} from "./chunk-KYE2HYV5.mjs";
+} from "./chunk-5UEPWL7B.mjs";
 
 // src/codes.ts
 var US_STATE_CODES = [
@@ -1002,6 +1002,10 @@ var $routingTableErrorBody = z.union([$routingRateLimitedErrorBody, $routingFaul
 var FiatRoutingTableErrorBodySchema = $routingTableErrorBody;
 var $routingQuoteErrorBody = z.union([$routingNoRouteErrorBody, $routingAmountErrorBody, $routingFaultErrorBody]);
 var FiatRoutingQuoteErrorBodySchema = $routingQuoteErrorBody;
+var $fiatGeo = obj({ alpha2: z.string().regex(/^[A-Z]{2}$/), region: $nonBlank.optional(), ip: $nonBlank.optional() });
+var FiatGeoSchema = $fiatGeo;
+var $nextRequest = z.object({ provider: $provider, action: $nonBlank, geo: $fiatGeo }).catchall(z.unknown());
+var FiatNextRequestSchema = $nextRequest;
 var $providerBoundStepResponse = obj({
   state: $providerBoundFlowState,
   provider: $provider,
@@ -2131,33 +2135,17 @@ var FIAT_CURRENCY_CODES2 = Object.keys(FIAT_CURRENCY_NAMES);
 var obj2 = (shape) => z2.object(shape).strict();
 var $nonEmpty = z2.string().refine((value) => value.trim().length > 0, "must not be blank");
 var hasUniqueIds2 = (ids) => new Set(ids).size === ids.length;
-var $geo = obj2({ alpha2: z2.string().regex(/^[A-Z]{2}$/), region: $nonEmpty.optional(), ip: $nonEmpty.optional() });
 var $checkout = obj2({
   amount: FiatAmountSchema,
   destination: obj2({ asset: $nonEmpty, network: $nonEmpty }),
-  paymentMethod: z2.literal("apple_pay"),
-  geo: $geo
+  paymentMethod: z2.literal("apple_pay")
 });
 var MoonPayCheckoutSchema = $checkout;
 var $credentials = obj2({ customerId: $nonEmpty, accessToken: $nonEmpty });
 var MoonPaySdkCredentialsSchema = $credentials;
-var $intentRequest = z2.discriminatedUnion("kind", [
-  obj2({ kind: z2.literal("observe"), checkout: $checkout, credentials: $credentials.optional() }),
-  obj2({
-    kind: z2.literal("kyc"),
-    checkout: $checkout,
-    credentials: $credentials,
-    values: z2.record(KycFieldIdSchema, z2.string()).refine((values) => Object.keys(values).length > 0, "values must not be empty")
-  }),
-  obj2({
-    kind: z2.literal("order"),
-    orderId: $nonEmpty,
-    transactionId: $nonEmpty.optional(),
-    quotedAmount: FiatAmountSchema,
-    geo: $geo.optional()
-  })
-]);
-var MoonPayIntentRequestSchema = $intentRequest;
+var $context = { checkout: $checkout, credentials: $credentials.optional() };
+var $requestContext = obj2($context);
+var MoonPayRequestContextSchema = $requestContext;
 var $quoteInput = obj2({
   source: obj2({ asset: obj2({ code: z2.enum(FIAT_CURRENCY_CODES2) }), amount: $nonEmpty }),
   destination: obj2({ asset: obj2({ code: $nonEmpty }) }),
@@ -2166,50 +2154,103 @@ var $quoteInput = obj2({
   feeBehavior: z2.literal("inclusive")
 });
 var MoonPayQuoteInputSchema = $quoteInput;
-var $stepRefusal = z2.enum(["NOT_ELIGIBLE", "DOCUMENTS_REQUIRED", "FINAL_REJECTION", "CUSTOMER_MISMATCH"]);
-var $orderRefusal = z2.enum(["CUSTOMER_MISMATCH", "WALLET_MISMATCH", "UNRECORDABLE"]);
+var $observeFields = { action: z2.literal("observe") };
+var $consentFields = {
+  action: z2.literal("consent"),
+  acceptances: z2.array(TermsDocumentAcceptanceSchema).min(1).refine((acceptances) => hasUniqueIds2(acceptances.map((acceptance) => acceptance.documentId)), "each document is accepted once")
+};
+var $connectFields = { action: z2.literal("connect"), customerId: $nonEmpty, accessToken: $nonEmpty };
+var $kycFields = {
+  action: z2.literal("kyc"),
+  credentials: $credentials,
+  values: z2.record(KycFieldIdSchema, z2.string()).refine((values) => Object.keys(values).length > 0, "values must not be empty")
+};
+var $orderFields = { action: z2.literal("order"), orderId: $nonEmpty, quotedAmount: FiatAmountSchema, transactionId: $nonEmpty.optional() };
+var $observeRequest = obj2({ ...$context, ...$observeFields });
+var $consentRequest = obj2({ ...$context, ...$consentFields });
+var $connectRequest = obj2({ ...$context, ...$connectFields });
+var $kycRequest = obj2({ ...$context, ...$kycFields });
+var $orderRequest = obj2({ ...$context, ...$orderFields });
+var MoonPayObserveRequestSchema = $observeRequest;
+var MoonPayConsentRequestSchema = $consentRequest;
+var MoonPayConnectRequestSchema = $connectRequest;
+var MoonPayKycRequestSchema = $kycRequest;
+var MoonPayOrderRequestSchema = $orderRequest;
+var $request = z2.discriminatedUnion("action", [$observeRequest, $consentRequest, $connectRequest, $kycRequest, $orderRequest]);
+var MoonPayRequestSchema = $request;
+var $envelope = { provider: z2.literal("MOONPAY"), geo: FiatGeoSchema, ...$context };
+var $nextRequest2 = z2.discriminatedUnion("action", [
+  obj2({ ...$envelope, ...$observeFields }),
+  obj2({ ...$envelope, ...$consentFields }),
+  obj2({ ...$envelope, ...$connectFields }),
+  obj2({ ...$envelope, ...$kycFields }),
+  obj2({ ...$envelope, ...$orderFields })
+]);
+var MoonPayNextRequestSchema = $nextRequest2;
 var FIELD_OF_CODE = { PHONE_IN_USE: "PHONE_NUMBER", TAX_ID_IN_USE: "TAX_IDENTIFIER" };
 var $fieldError = obj2({ fieldId: $nonEmpty, message: $nonEmpty, code: z2.enum(["PHONE_IN_USE", "TAX_ID_IN_USE"]).optional() });
-var $pending = obj2({ status: z2.literal("PENDING"), retryAfterMs: z2.number().int().positive().max(6e4) });
-var $stepStatus = z2.discriminatedUnion("status", [
-  obj2({ status: z2.literal("TERMS"), stage: z2.enum(["CHECKOUT", "KYC"]), documents: z2.array(TermsDocumentSchema).min(1) }),
-  obj2({ status: z2.literal("SDK_AUTH"), sessionToken: $nonEmpty, quoteInput: $quoteInput, resetConnection: z2.literal(true).optional() }),
-  obj2({ status: z2.literal("KYC"), fields: z2.array(FormFieldSchema).min(1), fieldErrors: z2.array($fieldError).min(1).optional() }),
-  $pending,
-  obj2({ status: z2.literal("READY"), orderId: $nonEmpty, quoteInput: $quoteInput }),
-  obj2({ status: z2.literal("REFUSED"), reason: $stepRefusal, recovery: z2.enum(["REQUOTE", "NONE"]) })
-]);
-var $stepResponse2 = $stepStatus.superRefine((response, context) => {
-  if (response.status === "TERMS") {
-    if (!hasUniqueIds2(response.documents.map((document) => document.id))) {
-      context.addIssue({ code: "custom", path: ["documents"], message: "document ids must be unique" });
-    }
-    if (response.documents.some((document) => document.stage !== response.stage)) {
-      context.addIssue({ code: "custom", path: ["documents"], message: "every document must be at the response stage" });
-    }
+var $consentShape = obj2({ next: z2.literal("consent"), documents: z2.array(TermsDocumentSchema).min(1) });
+var $connectPrompt = obj2({
+  next: z2.literal("connect"),
+  sessionToken: $nonEmpty,
+  quoteInput: $quoteInput,
+  resetConnection: z2.literal(true).optional()
+});
+var $kycShape = obj2({ next: z2.literal("kyc"), fields: z2.array(FormFieldSchema).min(1), fieldErrors: z2.array($fieldError).min(1).optional() });
+var $waitPrompt = obj2({ next: z2.literal("wait"), retryAfterMs: z2.number().int().positive().max(6e4) });
+var $orderPrompt = obj2({ next: z2.literal("order"), orderId: $nonEmpty, quoteInput: $quoteInput });
+var checkConsent = (prompt, context) => {
+  if (!hasUniqueIds2(prompt.documents.map((document) => document.id))) {
+    context.addIssue({ code: "custom", path: ["documents"], message: "document ids must be unique" });
   }
-  if (response.status === "KYC") {
-    const fieldIds = response.fields.map((field) => field.id);
-    if (!hasUniqueIds2(fieldIds)) {
-      context.addIssue({ code: "custom", path: ["fields"], message: "field ids must be unique" });
-    }
-    if (response.fieldErrors?.some((error) => !fieldIds.includes(error.fieldId))) {
-      context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error must name a field in this response" });
-    }
-    if (response.fieldErrors?.some((error) => error.code && FIELD_OF_CODE[error.code] !== error.fieldId)) {
-      context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error code must match its field" });
-    }
+};
+var checkKyc = (prompt, context) => {
+  const fieldIds = prompt.fields.map((field) => field.id);
+  if (!hasUniqueIds2(fieldIds)) {
+    context.addIssue({ code: "custom", path: ["fields"], message: "field ids must be unique" });
+  }
+  if (prompt.fieldErrors?.some((error) => !fieldIds.includes(error.fieldId))) {
+    context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error must name a field in this prompt" });
+  }
+  if (prompt.fieldErrors?.some((error) => error.code && FIELD_OF_CODE[error.code] !== error.fieldId)) {
+    context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error code must match its field" });
   }
+};
+var MoonPayConsentPromptSchema = $consentShape.superRefine(checkConsent);
+var MoonPayConnectPromptSchema = $connectPrompt;
+var MoonPayKycPromptSchema = $kycShape.superRefine(checkKyc);
+var MoonPayWaitPromptSchema = $waitPrompt;
+var MoonPayOrderPromptSchema = $orderPrompt;
+var checkPrompt = (response, context) => {
+  if (response.next === "consent") checkConsent(response, context);
+  if (response.next === "kyc") checkKyc(response, context);
+};
+var $promptOptions = [$consentShape, $connectPrompt, $kycShape, $waitPrompt, $orderPrompt];
+var $prompt = z2.discriminatedUnion("next", [...$promptOptions]).superRefine(checkPrompt);
+var MoonPayPromptSchema = $prompt;
+var $done = obj2({ next: z2.literal("done"), order: FiatStepResponseSchema });
+var MoonPayDoneSchema = $done;
+var $stepRefused = obj2({
+  next: z2.literal("refused"),
+  reason: z2.enum(["NOT_ELIGIBLE", "DOCUMENTS_REQUIRED", "FINAL_REJECTION", "CUSTOMER_MISMATCH"]),
+  recovery: z2.enum(["REQUOTE", "NONE"])
+});
+var $orderRefused = obj2({
+  next: z2.literal("refused"),
+  reason: z2.enum(["CUSTOMER_MISMATCH", "WALLET_MISMATCH", "UNRECORDABLE"]),
+  recovery: z2.literal("NONE")
 });
+var $stepResponse2 = z2.discriminatedUnion("next", [...$promptOptions, $stepRefused]).superRefine(checkPrompt);
 var MoonPayStepResponseSchema = $stepResponse2;
-var $orderResponse = z2.discriminatedUnion("status", [
-  obj2({ status: z2.literal("DONE"), order: FiatStepResponseSchema }),
-  $pending,
-  obj2({ status: z2.literal("REFUSED"), reason: $orderRefusal, recovery: z2.literal("NONE") })
-]);
+var $orderResponse = z2.discriminatedUnion("next", [$done, $orderPrompt, $orderRefused]);
 var MoonPayOrderResponseSchema = $orderResponse;
-var $intentResponse = z2.union([$stepResponse2, $orderResponse]);
-var MoonPayIntentResponseSchema = $intentResponse;
+var MoonPayResponseSchemaFor = {
+  observe: MoonPayStepResponseSchema,
+  consent: MoonPayStepResponseSchema,
+  connect: MoonPayStepResponseSchema,
+  kyc: MoonPayStepResponseSchema,
+  order: MoonPayOrderResponseSchema
+};
 var $faultFields = {
   reason: z2.enum(["SESSION_BUDGET_SPENT", "RATE_LIMITED", "PROVIDER_UNAVAILABLE", "INVALID_REQUEST"]),
   recovery: z2.enum(["RETRY", "REQUOTE", "NONE"])
@@ -2241,6 +2282,8 @@ export {
   FiatAmountSchema,
   FiatCurrencyCode,
   FiatEndpointSchema,
+  FiatGeoSchema,
+  FiatNextRequestSchema,
   FiatProviderSchema,
   FiatRoutingQuoteErrorBodySchema,
   FiatRoutingQuoteRequestSchema,
@@ -2271,14 +2314,28 @@ export {
   KycSdkResultReportSchema,
   MOONPAY_ENDPOINTS,
   MoonPayCheckoutSchema,
+  MoonPayConnectPromptSchema,
+  MoonPayConnectRequestSchema,
+  MoonPayConsentPromptSchema,
+  MoonPayConsentRequestSchema,
+  MoonPayDoneSchema,
   MoonPayErrorBodySchema,
   MoonPayFaultSchema,
-  MoonPayIntentRequestSchema,
-  MoonPayIntentResponseSchema,
+  MoonPayKycPromptSchema,
+  MoonPayKycRequestSchema,
+  MoonPayNextRequestSchema,
+  MoonPayObserveRequestSchema,
+  MoonPayOrderPromptSchema,
+  MoonPayOrderRequestSchema,
   MoonPayOrderResponseSchema,
+  MoonPayPromptSchema,
   MoonPayQuoteInputSchema,
+  MoonPayRequestContextSchema,
+  MoonPayRequestSchema,
+  MoonPayResponseSchemaFor,
   MoonPaySdkCredentialsSchema,
   MoonPayStepResponseSchema,
+  MoonPayWaitPromptSchema,
   OrderAwaitingConfirmationStateSchema,
   OrderCreatedStateSchema,
   OrderRefSchema,

package/dist/providers/moonpay.d.ts

@@ -1,28 +1,31 @@
 /**
- * The MoonPay provider-owned flow: one route, `POST /fiat/providers/moonpay/intent`.
+ * The MoonPay flow on `POST /fiat/next`.
  *
- * Each request carries evidence or a user action (`kind`), and each response says what the backend
- * needs next (`status`). `observe` and `kyc` answer a `MoonPayStepResponse`, and `order` answers a
- * `MoonPayOrderResponse` (`MoonPayIntentResponseFor`). Terms and consents go through
- * the platform `POST /fiat/terms` (`./terms`). Identity and the deposit wallet always come from the
- * verified partner assertion, never from a request body.
+ * Each action has one name and two types. A response's prompt names it in `next` and carries what
+ * the client needs to do it. The client's request names it in `action` and carries the result. Every
+ * response is the next prompt, `done`, or `refused` (`MoonPayResponseFor`). `observe` carries no
+ * result and answers the current prompt. `wait` has no request: the client sends `observe` after it.
+ *
+ * The body is `MoonPayNextRequest`: `provider`, the shared `geo`, the context (`checkout`, and
+ * `credentials` after `connect`), and the action's result. Identity and the deposit wallet always
+ * come from the verified partner assertion, never from a request body.
  *
  * A retry sends the same request. Each write is idempotent on data the request carries, and every
  * call, a retry too, returns the current response.
  *
- * A fault is a 4xx/5xx whose body is `MoonPayErrorBody`. Anything the user can act on is a 200
- * `MoonPayIntentResponse`.
+ * A fault is a 4xx/5xx whose body is `MoonPayErrorBody`. Anything the user can act on is a 200.
  *
  * Zero runtime dependencies, so production React Native code can import it. The zod schemas are in
  * `./moonpay.schemas`, exported from the package root.
  */
 import type { FiatCurrencyCode } from '../codes';
-import type { TermsDocument, TermsStage } from '../terms';
-import type { FiatAmount, FiatStepResponse, FormField, KycFieldId } from '../types';
+import type { FiatTermsRequest, TermsDocument } from '../terms';
+import type { FiatAmount, FiatGeo, FiatStepResponse, FormField, KycFieldId } from '../types';
 export declare const MOONPAY_ENDPOINTS: {
-    readonly intent: "POST /fiat/providers/moonpay/intent";
+    readonly next: "POST /fiat/next";
 };
-/** The checkout terms. The client holds them and sends them on every `observe` and `kyc`. */
+export type MoonPayAction = 'observe' | 'consent' | 'connect' | 'kyc' | 'wait' | 'order';
+/** The checkout terms. The client holds them and sends them on every request. */
 export interface MoonPayCheckout {
     amount: FiatAmount;
     /** The quote's `crypto.currency` and `crypto.network`, unchanged. */
@@ -31,46 +34,17 @@ export interface MoonPayCheckout {
         network: string;
     };
     paymentMethod: 'apple_pay';
-    /** The geo endpoint's response, as sent to `POST /fiat/quote`. `alpha2` is ISO 3166-1 alpha-2. */
-    geo: {
-        alpha2: string;
-        region?: string;
-        ip?: string;
-    };
 }
 /** From the SDK's `active` connection. `accessToken` is a credential: the backend never logs it. */
 export interface MoonPaySdkCredentials {
     customerId: string;
     accessToken: string;
 }
-export type MoonPayIntentRequest = 
-/** No effect. Without credentials, the answer past the gates is `SDK_AUTH`. */
-{
-    kind: 'observe';
+/** On every request, not part of the result. `credentials` is present after `connect`. */
+export type MoonPayRequestContext = {
     checkout: MoonPayCheckout;
     credentials?: MoonPaySdkCredentials;
-}
-/** Only after a `KYC` response. `values` is keyed by the ids of that response's fields; there is no form id. */
- | {
-    kind: 'kyc';
-    checkout: MoonPayCheckout;
-    credentials: MoonPaySdkCredentials;
-    values: Partial<Record<KycFieldId, string>>;
-}
-/**
- * After every charge attempt, a failed one too. `transactionId` is from the Apple Pay event when it
- * has one; without it the backend records the failed charges MoonPay lists for `orderId`.
- * `quotedAmount` is the fiat amount the buyer saw on the quote. `geo` is the checkout's, as sent on
- * `observe`; the order records its `alpha2`, and no country when it is absent.
- */
- | {
-    kind: 'order';
-    orderId: string;
-    transactionId?: string;
-    quotedAmount: FiatAmount;
-    geo?: MoonPayCheckout['geo'];
 };
-export type MoonPayIntentKind = MoonPayIntentRequest['kind'];
 /**
  * The parameters for the device `client.getQuote`, not a quote. The backend builds them because the
  * wallet must be the verified one and MoonPay's currency codes differ by environment.
@@ -95,18 +69,39 @@ export interface MoonPayQuoteInput {
     };
     feeBehavior: 'inclusive';
 }
-/** `REQUOTE` for `NOT_ELIGIBLE` and `DOCUMENTS_REQUIRED`, `NONE` for the others. */
-export type MoonPayStepRefusal = 'NOT_ELIGIBLE' | 'DOCUMENTS_REQUIRED' | 'FINAL_REJECTION' | 'CUSTOMER_MISMATCH';
+/** No prompt of its own: the answer is the current prompt. Writes nothing. */
+export type MoonPayObserveRequest = {
+    action: 'observe';
+};
+/** MoonPay's terms first. Later, before `kyc`, Fun's KYC consent if the buyer has not accepted it. */
+export type MoonPayConsentPrompt = {
+    next: 'consent';
+    documents: TermsDocument[];
+};
+/** The `POST /fiat/terms` items, recorded under the same rules. */
+export type MoonPayConsentRequest = {
+    action: 'consent';
+    acceptances: FiatTermsRequest['acceptances'];
+};
 /**
- * After a charge, always with `recovery: NONE`. `CUSTOMER_MISMATCH`: the transaction's customer is
- * not bound to this buyer. `WALLET_MISMATCH`: the transaction pays another wallet than the
- * assertion's. `UNRECORDABLE`: a charge no retry can record, held for refund review.
+ * Run MoonPay's connection check with `sessionToken`; it asks for an OTP only if the hidden check
+ * fails. `resetConnection`: the device's connection is another buyer's, so reset it first.
  */
-export type MoonPayOrderRefusal = 'CUSTOMER_MISMATCH' | 'WALLET_MISMATCH' | 'UNRECORDABLE';
+export type MoonPayConnectPrompt = {
+    next: 'connect';
+    sessionToken: string;
+    quoteInput: MoonPayQuoteInput;
+    resetConnection?: true;
+};
+export type MoonPayConnectRequest = {
+    action: 'connect';
+    customerId: string;
+    accessToken: string;
+};
 /** Another MoonPay customer already holds the value; only a different one goes through. */
 export type MoonPayFieldErrorCode = 'PHONE_IN_USE' | 'TAX_ID_IN_USE';
 /**
- * A reason on one field of a `KYC` response. `fieldId` names a field in that response. `code` is set
+ * A reason on one field of a `kyc` prompt. `fieldId` names a field in that prompt. `code` is set
  * only for a refusal the client words itself: `PHONE_IN_USE` on `PHONE_NUMBER`, `TAX_ID_IN_USE` on `TAX_IDENTIFIER`.
  */
 export interface MoonPayFieldError {
@@ -114,82 +109,85 @@ export interface MoonPayFieldError {
     message: string;
     code?: MoonPayFieldErrorCode;
 }
-/** The answer to `observe` and `kyc`. */
-export type MoonPayStepResponse = 
-/** Show `documents` (every one at `stage`), send `POST /fiat/terms`, then `observe`. */
-{
-    status: 'TERMS';
-    stage: TermsStage;
-    documents: TermsDocument[];
-}
-/**
- * Run the MoonPay connection check with `sessionToken`, then `observe` with the credentials.
- * `resetConnection`: the device's connection is another buyer's, so reset it before the check.
- */
- | {
-    status: 'SDK_AUTH';
-    sessionToken: string;
-    quoteInput: MoonPayQuoteInput;
-    resetConnection?: true;
-}
-/** Show the shared form, then send `kyc`. */
- | {
-    status: 'KYC';
+/** Show the shared form. */
+export type MoonPayKycPrompt = {
+    next: 'kyc';
     fields: FormField[];
     fieldErrors?: MoonPayFieldError[];
-}
-/** Send `observe` after the delay. Never `kyc` again: its write is done. */
- | {
-    status: 'PENDING';
+};
+/** Keyed by the ids of the prompt's fields; there is no form id. Needs `credentials`: the backend reads the customer. */
+export type MoonPayKycRequest = {
+    action: 'kyc';
+    credentials: MoonPaySdkCredentials;
+    values: Partial<Record<KycFieldId, string>>;
+};
+/** MoonPay is reviewing. No request of its own: send `observe` after the delay. */
+export type MoonPayWaitPrompt = {
+    next: 'wait';
     retryAfterMs: number;
-}
-/** Mount Apple Pay with `externalTransactionId = orderId`, then send `order` after the charge. */
- | {
-    status: 'READY';
+};
+/** Get the device quote from `quoteInput`, mount Apple Pay with `externalTransactionId = orderId`. */
+export type MoonPayOrderPrompt = {
+    next: 'order';
     orderId: string;
     quoteInput: MoonPayQuoteInput;
-}
-/** Exit the provider flow. `REQUOTE` goes back to `POST /fiat/quote`; `NONE` ends the flow. */
- | {
-    status: 'REFUSED';
-    reason: MoonPayStepRefusal;
-    recovery: 'REQUOTE' | 'NONE';
 };
 /**
- * The answer to `order`, which runs after each charge attempt. A failed charge is recorded too: it
- * answers `DONE` with the order in `FAILED`, and the client requotes for a new `orderId`.
+ * After every charge attempt, a failed one too. `quotedAmount` is the fiat amount the device quote
+ * showed. `transactionId` is from the Apple Pay event when it has one; without it the backend
+ * records the failed charges MoonPay lists for `orderId`.
  */
-export type MoonPayOrderResponse = 
-/** The `GET /fiat/orders/:orderId` response; the shared order screen renders it. */
-{
-    status: 'DONE';
-    order: FiatStepResponse;
-}
+export type MoonPayOrderRequest = {
+    action: 'order';
+    orderId: string;
+    quotedAmount: FiatAmount;
+    transactionId?: string;
+};
+export type MoonPayRequest = MoonPayRequestContext & (MoonPayObserveRequest | MoonPayConsentRequest | MoonPayConnectRequest | MoonPayKycRequest | MoonPayOrderRequest);
+/** The wire body. The orchestrator reads `provider` and `geo`; MoonPay's action schemas read the rest. */
+export type MoonPayNextRequest = {
+    provider: 'MOONPAY';
+    geo: FiatGeo;
+} & MoonPayRequest;
+/** `REQUOTE` for `NOT_ELIGIBLE` and `DOCUMENTS_REQUIRED`, `NONE` for the others. */
+export type MoonPayStepRefusal = 'NOT_ELIGIBLE' | 'DOCUMENTS_REQUIRED' | 'FINAL_REJECTION' | 'CUSTOMER_MISMATCH';
 /**
- * MoonPay does not list the transaction yet. Send the same `order` after the delay. After a failed
- * charge with no `transactionId`, the client caps these polls.
+ * After a charge, always with `recovery: NONE`. `CUSTOMER_MISMATCH`: the transaction's customer is
+ * not bound to this buyer. `WALLET_MISMATCH`: the transaction pays another wallet than the
+ * assertion's. `UNRECORDABLE`: a charge no retry can record, held for refund review.
  */
- | {
-    status: 'PENDING';
-    retryAfterMs: number;
-}
-/** Exit the provider flow. A requote after a charge would start a second payment. */
- | {
-    status: 'REFUSED';
-    reason: MoonPayOrderRefusal;
-    recovery: 'NONE';
+export type MoonPayOrderRefusal = 'CUSTOMER_MISMATCH' | 'WALLET_MISMATCH' | 'UNRECORDABLE';
+export type MoonPayPrompt = MoonPayConsentPrompt | MoonPayConnectPrompt | MoonPayKycPrompt | MoonPayWaitPrompt | MoonPayOrderPrompt;
+/** `order` is the `GET /fiat/orders/:orderId` body; the shared order screen renders it. */
+export type MoonPayDone = {
+    next: 'done';
+    order: FiatStepResponse;
 };
-export type MoonPayIntentResponseFor = {
+/** Exit the provider flow. `REQUOTE` goes back to routing; `NONE` ends the flow. */
+export type MoonPayRefused<R, V> = {
+    next: 'refused';
+    reason: R;
+    recovery: V;
+};
+/** The answer to `observe`, `consent`, `connect` and `kyc`. */
+export type MoonPayStepResponse = MoonPayPrompt | MoonPayRefused<MoonPayStepRefusal, 'REQUOTE' | 'NONE'>;
+/**
+ * The answer to `order`. A failed charge is recorded too: `done` with the order in `FAILED`, and the
+ * client requotes for a new `orderId`. `order` again while MoonPay does not list the transaction
+ * yet. A refusal after a charge never requotes: that would start a second payment.
+ */
+export type MoonPayOrderResponse = MoonPayDone | MoonPayOrderPrompt | MoonPayRefused<MoonPayOrderRefusal, 'NONE'>;
+export type MoonPayResponseFor = {
     observe: MoonPayStepResponse;
+    consent: MoonPayStepResponse;
+    connect: MoonPayStepResponse;
     kyc: MoonPayStepResponse;
     order: MoonPayOrderResponse;
 };
-export type MoonPayIntentResponse = MoonPayStepResponse | MoonPayOrderResponse;
-export type MoonPayIntentStatus = MoonPayIntentResponse['status'];
-/** `RETRY` sends the same request again. `REQUOTE` goes back to `POST /fiat/quote`. `NONE` ends the flow. */
+/** `RETRY` sends the same request again. `REQUOTE` goes back to routing. `NONE` ends the flow. */
 export type MoonPayRecovery = 'RETRY' | 'REQUOTE' | 'NONE';
 /**
- * `SESSION_BUDGET_SPENT`: the per-login SDK session mint budget (429). `RATE_LIMITED`: the kind's
+ * `SESSION_BUDGET_SPENT`: the per-login SDK session mint budget (429). `RATE_LIMITED`: the action's
  * request budget (429). `PROVIDER_UNAVAILABLE`: MoonPay or Sumsub is down. `INVALID_REQUEST`: a bad
  * body (400).
  */

package/dist/providers/moonpay.js

@@ -24,6 +24,6 @@ __export(moonpay_exports, {
 });
 module.exports = __toCommonJS(moonpay_exports);
 var MOONPAY_ENDPOINTS = {
-  intent: "POST /fiat/providers/moonpay/intent"
+  next: "POST /fiat/next"
 };
 //# sourceMappingURL=moonpay.js.map

package/dist/providers/moonpay.mjs

@@ -1,6 +1,6 @@
 import {
   MOONPAY_ENDPOINTS
-} from "../chunk-3HCZ6JBJ.mjs";
+} from "../chunk-T5JAYOWY.mjs";
 export {
   MOONPAY_ENDPOINTS
 };

package/dist/providers/moonpay.schemas.d.ts

@@ -1,16 +1,33 @@
 /**
- * zod schemas for the MoonPay provider-owned flow. Test-time and backend-boundary only: exported from
- * the package root, never from `./moonpay`, so the production entry stays free of zod.
+ * zod schemas for the MoonPay flow on `POST /fiat/next`. Test-time and backend-boundary only:
+ * exported from the package root, never from `./moonpay`, so the production entry stays free of zod.
  */
 import { z } from 'zod';
-import type { MoonPayCheckout, MoonPayErrorBody, MoonPayFault, MoonPayIntentRequest, MoonPayIntentResponse, MoonPayOrderResponse, MoonPayQuoteInput, MoonPaySdkCredentials, MoonPayStepResponse } from './moonpay';
+import type { MoonPayCheckout, MoonPayConnectPrompt, MoonPayConnectRequest, MoonPayConsentPrompt, MoonPayConsentRequest, MoonPayDone, MoonPayErrorBody, MoonPayFault, MoonPayKycPrompt, MoonPayKycRequest, MoonPayNextRequest, MoonPayObserveRequest, MoonPayOrderPrompt, MoonPayOrderRequest, MoonPayOrderResponse, MoonPayPrompt, MoonPayQuoteInput, MoonPayRequest, MoonPayRequestContext, MoonPayResponseFor, MoonPaySdkCredentials, MoonPayStepResponse, MoonPayWaitPrompt } from './moonpay';
 export declare const MoonPayCheckoutSchema: z.ZodType<MoonPayCheckout>;
 export declare const MoonPaySdkCredentialsSchema: z.ZodType<MoonPaySdkCredentials>;
-export declare const MoonPayIntentRequestSchema: z.ZodType<MoonPayIntentRequest>;
+export declare const MoonPayRequestContextSchema: z.ZodType<MoonPayRequestContext>;
 export declare const MoonPayQuoteInputSchema: z.ZodType<MoonPayQuoteInput>;
+export declare const MoonPayObserveRequestSchema: z.ZodType<MoonPayRequestContext & MoonPayObserveRequest>;
+export declare const MoonPayConsentRequestSchema: z.ZodType<MoonPayRequestContext & MoonPayConsentRequest>;
+export declare const MoonPayConnectRequestSchema: z.ZodType<MoonPayRequestContext & MoonPayConnectRequest>;
+export declare const MoonPayKycRequestSchema: z.ZodType<MoonPayRequestContext & MoonPayKycRequest>;
+export declare const MoonPayOrderRequestSchema: z.ZodType<MoonPayRequestContext & MoonPayOrderRequest>;
+export declare const MoonPayRequestSchema: z.ZodType<MoonPayRequest>;
+export declare const MoonPayNextRequestSchema: z.ZodType<MoonPayNextRequest>;
+export declare const MoonPayConsentPromptSchema: z.ZodType<MoonPayConsentPrompt>;
+export declare const MoonPayConnectPromptSchema: z.ZodType<MoonPayConnectPrompt>;
+export declare const MoonPayKycPromptSchema: z.ZodType<MoonPayKycPrompt>;
+export declare const MoonPayWaitPromptSchema: z.ZodType<MoonPayWaitPrompt>;
+export declare const MoonPayOrderPromptSchema: z.ZodType<MoonPayOrderPrompt>;
+export declare const MoonPayPromptSchema: z.ZodType<MoonPayPrompt>;
+export declare const MoonPayDoneSchema: z.ZodType<MoonPayDone>;
 export declare const MoonPayStepResponseSchema: z.ZodType<MoonPayStepResponse>;
 export declare const MoonPayOrderResponseSchema: z.ZodType<MoonPayOrderResponse>;
-export declare const MoonPayIntentResponseSchema: z.ZodType<MoonPayIntentResponse>;
+/** The response schema for each request action, as `MoonPayResponseFor` types it. */
+export declare const MoonPayResponseSchemaFor: {
+    readonly [A in keyof MoonPayResponseFor]: z.ZodType<MoonPayResponseFor[A]>;
+};
 export declare const MoonPayFaultSchema: z.ZodType<MoonPayFault>;
 export declare const MoonPayErrorBodySchema: z.ZodType<MoonPayErrorBody>;
 //# sourceMappingURL=moonpay.schemas.d.ts.map

package/dist/routing.d.ts

@@ -21,7 +21,7 @@ import type { CountryCode, FiatCurrencyCode, PaymentMethodCategory } from './cod
 import type { FiatAmount, FiatProvider, QuoteLimitRange } from './types';
 export declare const ROUTING_ENDPOINTS: {
     readonly table: "GET /fiat/routing/table";
-    /** Temporary: each provider's `intent` route replaces it. */
+    /** Temporary: `POST /fiat/next` replaces it for each provider that moves there. */
     readonly quote: "POST /fiat/routing/quote";
 };
 /**

package/dist/routing.js

@@ -25,7 +25,7 @@ __export(routing_exports, {
 module.exports = __toCommonJS(routing_exports);
 var ROUTING_ENDPOINTS = {
   table: "GET /fiat/routing/table",
-  /** Temporary: each provider's `intent` route replaces it. */
+  /** Temporary: `POST /fiat/next` replaces it for each provider that moves there. */
   quote: "POST /fiat/routing/quote"
 };
 //# sourceMappingURL=routing.js.map

package/dist/routing.mjs

@@ -1,6 +1,6 @@
 import {
   ROUTING_ENDPOINTS
-} from "./chunk-KYE2HYV5.mjs";
+} from "./chunk-5UEPWL7B.mjs";
 export {
   ROUTING_ENDPOINTS
 };

package/dist/schemas.d.ts

@@ -28,7 +28,7 @@
  */
 import { z } from 'zod';
 import type { UsStateCode } from './codes';
-import type { BlockedReason, CryptoAmount, FailureReason, FeeLine, FiatAmount, FiatEndpoint, FiatProvider, FiatStepResponse, FieldSpec, FlowState, FormDescriptor, FormField, FormFieldType, InstructionField, Instructions, Instrument, JsonValue, KYCProvider, OrderRef, OrderStatus, OrderSummary, PollSpec, PreparedPayment, PaymentSurface, Quote, QuoteLimitRange, QuoteLimits, Recovery, Refund, ReportSpec, SelectOption, StatusHistoryEntry, Surface, PreferredIdentityDocument, KycFieldId, ClientExecutedDelivery, KycSdkResultReport, SurfaceKind, SurfaceProvider, TermsAcceptance, Transition, TransitionInputs, TransitionParams, Tx } from './types';
+import type { BlockedReason, CryptoAmount, FailureReason, FeeLine, FiatAmount, FiatEndpoint, FiatProvider, FiatStepResponse, FieldSpec, FlowState, FormDescriptor, FormField, FormFieldType, InstructionField, Instructions, Instrument, JsonValue, KYCProvider, OrderRef, OrderStatus, OrderSummary, PollSpec, PreparedPayment, PaymentSurface, Quote, QuoteLimitRange, QuoteLimits, Recovery, Refund, ReportSpec, SelectOption, StatusHistoryEntry, Surface, PreferredIdentityDocument, KycFieldId, ClientExecutedDelivery, KycSdkResultReport, SurfaceKind, SurfaceProvider, TermsAcceptance, Transition, TransitionInputs, TransitionParams, Tx, FiatGeo, FiatNextRequest } from './types';
 import type { FiatTermsErrorBody, FiatTermsRequest, FiatTermsResponse, TermsDocument, TermsDocumentAcceptance } from './terms';
 import type { FiatRoutingQuoteErrorBody, FiatRoutingQuoteRequest, FiatRoutingTableErrorBody, FiatRoutingTableQuery, FiatRoutingTableResponse } from './routing';
 export declare const JsonSchema: z.ZodType<JsonValue>;
@@ -117,6 +117,8 @@ export declare const FiatRoutingTableResponseSchema: z.ZodType<FiatRoutingTableR
 export declare const FiatRoutingQuoteRequestSchema: z.ZodType<FiatRoutingQuoteRequest>;
 export declare const FiatRoutingTableErrorBodySchema: z.ZodType<FiatRoutingTableErrorBody>;
 export declare const FiatRoutingQuoteErrorBodySchema: z.ZodType<FiatRoutingQuoteErrorBody>;
+export declare const FiatGeoSchema: z.ZodType<FiatGeo>;
+export declare const FiatNextRequestSchema: z.ZodType<FiatNextRequest>;
 export declare const FiatStepResponseSchema: z.ZodType<FiatStepResponse>;
 export {};
 //# sourceMappingURL=schemas.d.ts.map

package/dist/table.js

@@ -36,7 +36,7 @@ __export(table_exports, {
 module.exports = __toCommonJS(table_exports);
 
 // package.json
-var version = "0.23.0";
+var version = "0.24.0";
 
 // src/table.ts
 var TABLE_VERSION = version;

package/dist/table.mjs

@@ -11,7 +11,7 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-EI56NQ7K.mjs";
+} from "./chunk-IPOPANXS.mjs";
 export {
   DOCUMENTED_ENDPOINTS,
   STATE_KEYS,

package/dist/terms.d.ts

@@ -2,7 +2,7 @@
  * The platform terms route: `POST /fiat/terms`, shared by every provider.
  *
  * A checkout shows the user documents to accept. `CHECKOUT` documents are the constants below;
- * `KYC` documents arrive in a provider flow's `TERMS` response. The user's Continue tap is the
+ * `KYC` documents arrive in a provider flow's consent prompt. The user's Continue tap is the
  * acceptance, and the client records it here before the next provider call. A repeat writes nothing.
  *
  * Zero runtime dependencies, so production React Native code can import it. The zod schemas are
@@ -39,7 +39,7 @@ export interface FiatTermsRequest {
     /** One per document the screen showed, each document at most once. */
     acceptances: TermsDocumentAcceptance[];
 }
-/** The recorded document ids. The client then calls the provider's `intent`. */
+/** The recorded document ids. The client then calls `POST /fiat/next`. */
 export interface FiatTermsResponse {
     recorded: string[];
 }

package/dist/terms.mjs

@@ -3,7 +3,7 @@ import {
   FUN_KYC_CONSENT_DOCUMENTS,
   PROVIDER_CHECKOUT_DOCUMENTS,
   PUBLISHED_TERMS_DOCUMENTS
-} from "./chunk-5GRPYE2U.mjs";
+} from "./chunk-CRNKRIKR.mjs";
 export {
   FIAT_TERMS_ENDPOINT,
   FUN_KYC_CONSENT_DOCUMENTS,

package/dist/types.d.ts

@@ -715,7 +715,7 @@ export type FiatStepResponse = (FiatStepResponseBase & {
     /** Optional future payment artifact; never one of this response's currently active transitions. */
     preparedPayment?: PreparedPayment;
     /**
-     * The provider runs its own flow from here (`POST /fiat/providers/{provider}/intent`). Present
+     * The provider runs its own flow from here (`POST /fiat/next`). Present
      * only on a `QUOTE`, when the request's `handoffs` named this provider; the response then
      * carries no transitions.
      */
@@ -723,5 +723,20 @@ export type FiatStepResponse = (FiatStepResponseBase & {
         provider: FiatProvider;
     };
 });
+/** The geo endpoint's response, sent on every `/next` request. `alpha2` is ISO 3166-1 alpha-2. */
+export type FiatGeo = {
+    alpha2: string;
+    region?: string;
+    ip?: string;
+};
+/**
+ * The body of every `POST /fiat/next`: `provider`, `geo`, and the provider's own request, which
+ * names its `action`. Each provider defines its actions and their fields (`./moonpay`).
+ */
+export type FiatNextRequest = {
+    provider: FiatProvider;
+    action: string;
+    geo: FiatGeo;
+} & Record<string, unknown>;
 export {};
 //# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fun-xyz/fiat-contract",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Published conformance contract for Fun's headless fiat onramp: FlowState/Transition types, zod schemas, the transition table as data, recorded fixtures, assertion helpers.",
   "license": "MIT",
   "repository": {

package/dist/chunk-3HCZ6JBJ.mjs

@@ -1,9 +0,0 @@
-// src/providers/moonpay.ts
-var MOONPAY_ENDPOINTS = {
-  intent: "POST /fiat/providers/moonpay/intent"
-};
-
-export {
-  MOONPAY_ENDPOINTS
-};
-//# sourceMappingURL=chunk-3HCZ6JBJ.mjs.map