@fun-xyz/fiat-contract 0.25.0 → 0.27.0

package/README.md

@@ -134,13 +134,18 @@ a `REQUOTE`. The schemas hold the table's invariants: each method once, sorted,
 intervals, at least one provider each and none twice, and a reason only on an empty method.
 
 `ROUTING_ENDPOINTS.quote` (`POST /fiat/routing/quote`) takes the `POST /fiat/quote` body
-(`FiatRoutingQuoteTerms`), never `routingOverrides`, plus one of two forms:
+(`FiatRoutingQuoteTerms`), plus one of two forms:
 
 - `providers`: the interval's providers, best first. The backend prices them in order, falls
   through on the refusals marked "next provider" below, and answers the first that prices or the
   last provider's refusal.
 - `provider`: one provider only. The client falls through itself.
 
+Routing quotes may include `routingOverrides: { providers: [...] }` with the host’s full allowlist.
+The selected `provider` or ordered `providers` must be a subset. The server preserves the allowlist
+through later KYC rerouting; the amount-specific candidate list alone does not restrict rediscovery.
+Omitting the field preserves existing behavior. An empty allowlist permits no quote candidate.
+
 It answers the same `FiatStepResponse`, whose `provider` names the one that priced. A refusal is a
 `FiatRoutingQuoteErrorBody`, and it decides whether the next provider may still price:
 
@@ -203,8 +208,9 @@ A first-time buyer goes `observe` → `consent` → `connect` → `kyc` → `wai
 `test/fixtures/moonpay-next/`.
 
 A fault is a 4xx or 5xx with a `MoonPayErrorBody`: the shared `errorCode`, `errorMsg` and `reqId`,
-plus `reason` (`SESSION_BUDGET_SPENT`, `RATE_LIMITED`, `PROVIDER_UNAVAILABLE`, `INVALID_REQUEST`)
-and `recovery`:
+plus `reason` and `recovery`. The reasons are `SESSION_BUDGET_SPENT`, `RATE_LIMITED`,
+`PROVIDER_UNAVAILABLE` (MoonPay is down), `KYC_PROVIDER_UNAVAILABLE` (Sumsub is down),
+`SERVICE_UNAVAILABLE` (one of Fun's own stores is down) and `INVALID_REQUEST`. The recoveries are
 `RETRY` (send the same request again), `REQUOTE`, or `NONE`. A field error is a `kyc`
 prompt, not a fault. The zod schemas (`MoonPay*Schema`, `FiatGeoSchema`, `FiatNextRequestSchema`,
 `TermsDocumentSchema`, `FiatTerms*Schema`) are exported from the root only.

package/dist/{chunk-WEXD7UEE.mjs → chunk-7ZIZANFX.mjs}

@@ -8,4 +8,4 @@ var ROUTING_ENDPOINTS = {
 export {
   ROUTING_ENDPOINTS
 };
-//# sourceMappingURL=chunk-WEXD7UEE.mjs.map
+//# sourceMappingURL=chunk-7ZIZANFX.mjs.map

package/dist/{chunk-LHCED3AP.mjs → chunk-K573F2ON.mjs}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.25.0";
+var version = "0.27.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -514,4 +514,4 @@ export {
   tableEntry,
   isTerminal
 };
-//# sourceMappingURL=chunk-LHCED3AP.mjs.map
+//# sourceMappingURL=chunk-K573F2ON.mjs.map

package/dist/{chunk-T5JAYOWY.mjs → chunk-W5HOOK34.mjs}

@@ -6,4 +6,4 @@ var MOONPAY_ENDPOINTS = {
 export {
   MOONPAY_ENDPOINTS
 };
-//# sourceMappingURL=chunk-T5JAYOWY.mjs.map
+//# sourceMappingURL=chunk-W5HOOK34.mjs.map

package/dist/index.js

@@ -1099,7 +1099,8 @@ var $routingQuoteTermsShape = {
     (geo) => hasUsRegion(geo.alpha2, geo.region),
     { message: US_REGION_REQUIRED, path: ["region"] }
   ),
-  prepareSessionAuth: import_zod.z.boolean().optional()
+  prepareSessionAuth: import_zod.z.boolean().optional(),
+  routingOverrides: obj({ providers: import_zod.z.array($routingProvider) }).optional()
 };
 var $routingQuoteTerms = obj($routingQuoteTermsShape);
 var FiatRoutingQuoteTermsSchema = $routingQuoteTerms;
@@ -1109,7 +1110,14 @@ var $routingQuoteRequest = import_zod.z.union([
     providers: import_zod.z.array($routingProvider).min(1).refine((providers) => hasUniqueIds(providers), "each provider is listed once")
   }),
   obj({ ...$routingQuoteTermsShape, provider: $routingProvider })
-]);
+]).refine(
+  (request) => {
+    const allowed = request.routingOverrides?.providers;
+    const selected = "providers" in request ? request.providers : [request.provider];
+    return allowed === void 0 || selected.every((provider) => allowed.includes(provider));
+  },
+  { message: "requested providers must be allowed by routingOverrides", path: ["routingOverrides"] }
+);
 var FiatRoutingQuoteRequestSchema = $routingQuoteRequest;
 var $routingServiceableRange = obj({ min: $money, max: $money, userMax: $money.nullable().optional() });
 var $noRouteFields = {
@@ -1209,7 +1217,7 @@ var $stepResponse = import_zod.z.union([$providerBoundStepResponse, $blockedStep
 var FiatStepResponseSchema = $stepResponse;
 
 // package.json
-var version = "0.25.0";
+var version = "0.27.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -2947,7 +2955,14 @@ var MoonPayResponseSchemaFor = {
   order: MoonPayOrderResponseSchema
 };
 var $faultFields = {
-  reason: import_zod2.z.enum(["SESSION_BUDGET_SPENT", "RATE_LIMITED", "PROVIDER_UNAVAILABLE", "INVALID_REQUEST"]),
+  reason: import_zod2.z.enum([
+    "SESSION_BUDGET_SPENT",
+    "RATE_LIMITED",
+    "PROVIDER_UNAVAILABLE",
+    "KYC_PROVIDER_UNAVAILABLE",
+    "SERVICE_UNAVAILABLE",
+    "INVALID_REQUEST"
+  ]),
   recovery: import_zod2.z.enum(["RETRY", "REQUOTE", "NONE"])
 };
 var $fault = obj2($faultFields);

package/dist/index.mjs

@@ -12,10 +12,10 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-LHCED3AP.mjs";
+} from "./chunk-K573F2ON.mjs";
 import {
   MOONPAY_ENDPOINTS
-} from "./chunk-T5JAYOWY.mjs";
+} from "./chunk-W5HOOK34.mjs";
 import {
   FIAT_TERMS_ENDPOINT,
   FUN_KYC_CONSENT_DOCUMENTS,
@@ -24,7 +24,7 @@ import {
 } from "./chunk-CRNKRIKR.mjs";
 import {
   ROUTING_ENDPOINTS
-} from "./chunk-WEXD7UEE.mjs";
+} from "./chunk-7ZIZANFX.mjs";
 
 // src/codes.ts
 var US_STATE_CODES = [
@@ -963,7 +963,8 @@ var $routingQuoteTermsShape = {
     (geo) => hasUsRegion(geo.alpha2, geo.region),
     { message: US_REGION_REQUIRED, path: ["region"] }
   ),
-  prepareSessionAuth: z.boolean().optional()
+  prepareSessionAuth: z.boolean().optional(),
+  routingOverrides: obj({ providers: z.array($routingProvider) }).optional()
 };
 var $routingQuoteTerms = obj($routingQuoteTermsShape);
 var FiatRoutingQuoteTermsSchema = $routingQuoteTerms;
@@ -973,7 +974,14 @@ var $routingQuoteRequest = z.union([
     providers: z.array($routingProvider).min(1).refine((providers) => hasUniqueIds(providers), "each provider is listed once")
   }),
   obj({ ...$routingQuoteTermsShape, provider: $routingProvider })
-]);
+]).refine(
+  (request) => {
+    const allowed = request.routingOverrides?.providers;
+    const selected = "providers" in request ? request.providers : [request.provider];
+    return allowed === void 0 || selected.every((provider) => allowed.includes(provider));
+  },
+  { message: "requested providers must be allowed by routingOverrides", path: ["routingOverrides"] }
+);
 var FiatRoutingQuoteRequestSchema = $routingQuoteRequest;
 var $routingServiceableRange = obj({ min: $money, max: $money, userMax: $money.nullable().optional() });
 var $noRouteFields = {
@@ -2260,7 +2268,14 @@ var MoonPayResponseSchemaFor = {
   order: MoonPayOrderResponseSchema
 };
 var $faultFields = {
-  reason: z2.enum(["SESSION_BUDGET_SPENT", "RATE_LIMITED", "PROVIDER_UNAVAILABLE", "INVALID_REQUEST"]),
+  reason: z2.enum([
+    "SESSION_BUDGET_SPENT",
+    "RATE_LIMITED",
+    "PROVIDER_UNAVAILABLE",
+    "KYC_PROVIDER_UNAVAILABLE",
+    "SERVICE_UNAVAILABLE",
+    "INVALID_REQUEST"
+  ]),
   recovery: z2.enum(["RETRY", "REQUOTE", "NONE"])
 };
 var $fault = obj2($faultFields);

package/dist/providers/moonpay.d.ts

@@ -188,10 +188,11 @@ export type MoonPayResponseFor = {
 export type MoonPayRecovery = 'RETRY' | 'REQUOTE' | 'NONE';
 /**
  * `SESSION_BUDGET_SPENT`: the per-login SDK session mint budget (429). `RATE_LIMITED`: the action's
- * request budget (429). `PROVIDER_UNAVAILABLE`: MoonPay or Sumsub is down. `INVALID_REQUEST`: a bad
- * body (400).
+ * request budget (429). `PROVIDER_UNAVAILABLE`: MoonPay is down (503). `KYC_PROVIDER_UNAVAILABLE`:
+ * the KYC provider (Sumsub) is down (503). `SERVICE_UNAVAILABLE`: one of Fun's own stores is down
+ * (503). `INVALID_REQUEST`: a bad body (400).
  */
-export type MoonPayFaultReason = 'SESSION_BUDGET_SPENT' | 'RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'INVALID_REQUEST';
+export type MoonPayFaultReason = 'SESSION_BUDGET_SPENT' | 'RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'KYC_PROVIDER_UNAVAILABLE' | 'SERVICE_UNAVAILABLE' | 'INVALID_REQUEST';
 /** The fields a MoonPay fault adds to the shared error body. */
 export interface MoonPayFault {
     reason: MoonPayFaultReason;

package/dist/providers/moonpay.mjs

@@ -1,6 +1,6 @@
 import {
   MOONPAY_ENDPOINTS
-} from "../chunk-T5JAYOWY.mjs";
+} from "../chunk-W5HOOK34.mjs";
 export {
   MOONPAY_ENDPOINTS
 };

package/dist/routing.d.ts

@@ -82,7 +82,7 @@ export interface FiatRoutingTableResponse {
     /** In request order, duplicates removed. */
     methods: RoutingTableMethod[];
 }
-/** The `POST /fiat/quote` body without `routingOverrides`: everything but which providers to price. */
+/** The purchase terms and optional host restriction, independent of the current ordered candidates. */
 export interface FiatRoutingQuoteTerms {
     fiatCurrency: FiatCurrencyCode;
     /** A positive decimal string with no leading zero, exponent or sign (`"20"`, `"20.5"`). */
@@ -101,6 +101,10 @@ export interface FiatRoutingQuoteTerms {
         city?: string;
     };
     prepareSessionAuth?: boolean;
+    /** Host allowlist, retained for later KYC rerouting. Omitted allows every eligible provider. */
+    routingOverrides?: {
+        providers: RoutingProvider[];
+    };
 }
 /**
  * `POST /fiat/routing/quote`: the terms plus which providers to price, in one of two forms.

package/dist/routing.mjs

@@ -1,6 +1,6 @@
 import {
   ROUTING_ENDPOINTS
-} from "./chunk-WEXD7UEE.mjs";
+} from "./chunk-7ZIZANFX.mjs";
 export {
   ROUTING_ENDPOINTS
 };

package/dist/table.js

@@ -36,7 +36,7 @@ __export(table_exports, {
 module.exports = __toCommonJS(table_exports);
 
 // package.json
-var version = "0.25.0";
+var version = "0.27.0";
 
 // src/table.ts
 var TABLE_VERSION = version;

package/dist/table.mjs

@@ -11,7 +11,7 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-LHCED3AP.mjs";
+} from "./chunk-K573F2ON.mjs";
 export {
   DOCUMENTED_ENDPOINTS,
   STATE_KEYS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fun-xyz/fiat-contract",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Published conformance contract for Fun's headless fiat onramp: FlowState/Transition types, zod schemas, the transition table as data, recorded fixtures, assertion helpers.",
   "license": "MIT",
   "repository": {