@fun-xyz/fiat-contract 0.25.0 → 0.28.0

package/README.md

@@ -19,7 +19,7 @@ Four things, zero runtime logic beyond validation:
 | --- | --- | --- | --- |
 | `@fun-xyz/fiat-contract/types` | **0.1 KB** (types erase) | every type; no runtime values | production, both repos |
 | `@fun-xyz/fiat-contract/table` | **13.8 KB**, zero deps | `TRANSITION_TABLE`, `stateKey`, `tableEntry`, `isTerminal`, `walkTable`, `TABLE_VERSION`, `TERMINAL_ORDER_STATUSES`, `DOCUMENTED_ENDPOINTS`, `UNOFFERED_ENDPOINTS`, `UNREACHABLE_STATES`, `unofferedEndpoints`, `unreachableStates` | **production frontend** + backend |
-| `@fun-xyz/fiat-contract/moonpay` | zero deps | the MoonPay flow on `POST /fiat/next`: action requests, prompts, responses, fault types, and `MOONPAY_ENDPOINTS` | **production frontend** (MoonPay adapter) + backend |
+| `@fun-xyz/fiat-contract/moonpay` | zero deps | the MoonPay flow on `POST /fiat/next`: action requests, next actions, responses, fault types, and `MOONPAY_ENDPOINTS` | **production frontend** (MoonPay adapter) + backend |
 | `@fun-xyz/fiat-contract/terms` | zero deps | the platform terms route: `TermsDocument`, `FiatTermsRequest`, `FiatTermsResponse`, fault types, and `FIAT_TERMS_ENDPOINT` | **production frontend** + backend |
 | `@fun-xyz/fiat-contract/routing` | zero deps | the routing table and routing quote: `FiatRoutingTableQuery`, `FiatRoutingTableResponse`, `FiatRoutingQuoteRequest`, both routes' error bodies, and `ROUTING_ENDPOINTS` | **production frontend** + backend |
 | `@fun-xyz/fiat-contract` | 47.6 KB, needs zod | the above + 77 zod schemas + assertions + 18 fixtures | tests, and backend dev/test guards |
@@ -121,7 +121,8 @@ text. `PROVIDER_CHECKOUT_DOCUMENTS` maps each provider to its current `CHECKOUT`
 stays valid: the backend refuses only an unknown version, a wrong digest, or an `acceptedAt` older
 than 5 minutes. A repeat of a version the login already holds writes nothing and returns the ids.
 
-**Routing table (`./routing`).** `ROUTING_ENDPOINTS.table` (`GET /fiat/routing/table`) answers,
+**Routing table (`./routing`).** `ROUTING_ENDPOINTS.table` (`POST /fiat/routing/table`) takes a
+`FiatRoutingTableRequest` body and answers,
 for each requested method, every amount interval and its providers best first, each with `next`
 (`READY`, `AUTH`, `DECLARATIVE_KYC`, `DOCUMENTARY_KYC`, `PENDING_REVIEW`) and `visibility`. The
 client shows min, max, provider and the Continue label for an amount with no call. A method with no
@@ -133,14 +134,27 @@ cause is unknown. Refetch the table at `expiresAt`, on `refreshLimits: true`, an
 a `REQUOTE`. The schemas hold the table's invariants: each method once, sorted, non-overlapping
 intervals, at least one provider each and none twice, and a reason only on an empty method.
 
+`ROUTING_ENDPOINTS.table` (`POST /fiat/routing/table`) accepts `FiatRoutingTableRequest`:
+`cryptoCurrencyCode`, `chainId`, `country`, optional `region` (required for US), `methods` (array),
+optional `fiatCurrencyCode` (default `USD`), and optional `providers`.
+See [`FiatRoutingTableMoonPayInputs`](src/routing.ts) for MoonPay credential handling.
+Blank tokens, malformed inputs and unknown keys return 400: omit unavailable credentials and
+deploy backend support before sending new provider keys.
+`GET /fiat/routing/table` is deprecated but still works without provider inputs.
+
 `ROUTING_ENDPOINTS.quote` (`POST /fiat/routing/quote`) takes the `POST /fiat/quote` body
-(`FiatRoutingQuoteTerms`), never `routingOverrides`, plus one of two forms:
+(`FiatRoutingQuoteTerms`), plus one of two forms:
 
 - `providers`: the interval's providers, best first. The backend prices them in order, falls
   through on the refusals marked "next provider" below, and answers the first that prices or the
   last provider's refusal.
 - `provider`: one provider only. The client falls through itself.
 
+Routing quotes may include `routingOverrides: { providers: [...] }` with the host’s full allowlist.
+The selected `provider` or ordered `providers` must be a subset. The server preserves the allowlist
+through later KYC rerouting; the amount-specific candidate list alone does not restrict rediscovery.
+Omitting the field preserves existing behavior. An empty allowlist permits no quote candidate.
+
 It answers the same `FiatStepResponse`, whose `provider` names the one that priced. A refusal is a
 `FiatRoutingQuoteErrorBody`, and it decides whether the next provider may still price:
 
@@ -173,21 +187,21 @@ response), and the provider's own request, which names its `action`. The orchest
 `MoonPayNextRequest`, and every MoonPay request also carries the context `checkout` and, after
 `connect`, `credentials` (`customerId`, `accessToken`).
 
-Each `MoonPayAction` has one name. A response's prompt names it in `next` and carries what the
+Each `MoonPayAction` has one name. A response names the next action in `next` and carries what the
 client needs; the client's request names it in `action` and carries the result:
 
-| Action | Prompt carries | Request carries | A repeat |
+| Action | Next action carries | Request carries | A repeat |
 | --- | --- | --- | --- |
-| `observe` | no prompt: the answer is the current prompt | nothing | writes nothing |
+| `observe` | no next action of its own: the answer is the current next action | nothing | writes nothing |
 | `consent` | `documents` (at least one, unique ids) | `acceptances`, the `POST /fiat/terms` items | writes nothing new |
 | `connect` | `sessionToken`, `quoteInput`, `resetConnection?` (`true` when the device's MoonPay connection is another buyer's) | `customerId`, `accessToken` | rebinds the same customer |
 | `kyc` | `fields`, `fieldErrors?` (each naming a field in `fields`, with `code?` `PHONE_IN_USE` on `PHONE_NUMBER` or `TAX_ID_IN_USE` on `TAX_IDENTIFIER` when another MoonPay customer holds the value) | `credentials`, `values` keyed by `KycFieldId` (no form id) | drops values MoonPay no longer asks for |
 | `wait` | `retryAfterMs` (at most 60 s) | no request: the client sends `observe` after the delay | |
 | `order` | `orderId`, `quoteInput` | `orderId`, `quotedAmount`, `transactionId?` | returns the recorded order |
 
-Every response is the next prompt, `done`, or `refused` (`MoonPayRefused`), and
+Every response is the next action, `done`, or `refused` (`MoonPayRefused`), and
 `MoonPayResponseFor` maps each request action to its union. `observe`, `consent`, `connect` and `kyc`
-answer a `MoonPayStepResponse`: any `MoonPayPrompt`, or `refused` with `reason` (`NOT_ELIGIBLE`,
+answer a `MoonPayStepResponse`: any `MoonPayNextAction`, or `refused` with `reason` (`NOT_ELIGIBLE`,
 `DOCUMENTS_REQUIRED`, `FINAL_REJECTION`, `CUSTOMER_MISMATCH`) and `recovery: REQUOTE | NONE`.
 
 `order` runs after every charge attempt, a failed one too, and answers a `MoonPayOrderResponse`:
@@ -203,10 +217,11 @@ A first-time buyer goes `observe` → `consent` → `connect` → `kyc` → `wai
 `test/fixtures/moonpay-next/`.
 
 A fault is a 4xx or 5xx with a `MoonPayErrorBody`: the shared `errorCode`, `errorMsg` and `reqId`,
-plus `reason` (`SESSION_BUDGET_SPENT`, `RATE_LIMITED`, `PROVIDER_UNAVAILABLE`, `INVALID_REQUEST`)
-and `recovery`:
+plus `reason` and `recovery`. The reasons are `SESSION_BUDGET_SPENT`, `RATE_LIMITED`,
+`PROVIDER_UNAVAILABLE` (MoonPay is down), `KYC_PROVIDER_UNAVAILABLE` (Sumsub is down),
+`SERVICE_UNAVAILABLE` (one of Fun's own stores is down) and `INVALID_REQUEST`. The recoveries are
 `RETRY` (send the same request again), `REQUOTE`, or `NONE`. A field error is a `kyc`
-prompt, not a fault. The zod schemas (`MoonPay*Schema`, `FiatGeoSchema`, `FiatNextRequestSchema`,
+next action, not a fault. The zod schemas (`MoonPay*Schema`, `FiatGeoSchema`, `FiatNextRequestSchema`,
 `TermsDocumentSchema`, `FiatTerms*Schema`) are exported from the root only.
 
 ## KYC SDK hints, results, and client delivery

package/dist/{chunk-WEXD7UEE.mjs → chunk-3SZPKXVL.mjs}

@@ -1,6 +1,6 @@
 // src/routing.ts
 var ROUTING_ENDPOINTS = {
-  table: "GET /fiat/routing/table",
+  table: "POST /fiat/routing/table",
   /** Temporary: `POST /fiat/next` replaces it for each provider that moves there. */
   quote: "POST /fiat/routing/quote"
 };
@@ -8,4 +8,4 @@ var ROUTING_ENDPOINTS = {
 export {
   ROUTING_ENDPOINTS
 };
-//# sourceMappingURL=chunk-WEXD7UEE.mjs.map
+//# sourceMappingURL=chunk-3SZPKXVL.mjs.map

package/dist/{chunk-T5JAYOWY.mjs → chunk-F4NRKWF5.mjs}

@@ -6,4 +6,4 @@ var MOONPAY_ENDPOINTS = {
 export {
   MOONPAY_ENDPOINTS
 };
-//# sourceMappingURL=chunk-T5JAYOWY.mjs.map
+//# sourceMappingURL=chunk-F4NRKWF5.mjs.map

package/dist/{chunk-CRNKRIKR.mjs → chunk-XKI5XTUO.mjs}

@@ -41,4 +41,4 @@ export {
   FUN_KYC_CONSENT_DOCUMENTS,
   PUBLISHED_TERMS_DOCUMENTS
 };
-//# sourceMappingURL=chunk-CRNKRIKR.mjs.map
+//# sourceMappingURL=chunk-XKI5XTUO.mjs.map

package/dist/{chunk-LHCED3AP.mjs → chunk-YNVLBTT7.mjs}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.25.0";
+var version = "0.28.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -514,4 +514,4 @@ export {
   tableEntry,
   isTerminal
 };
-//# sourceMappingURL=chunk-LHCED3AP.mjs.map
+//# sourceMappingURL=chunk-YNVLBTT7.mjs.map

package/dist/index.js

@@ -50,6 +50,7 @@ __export(index_exports, {
   FiatRoutingQuoteTermsSchema: () => FiatRoutingQuoteTermsSchema,
   FiatRoutingTableErrorBodySchema: () => FiatRoutingTableErrorBodySchema,
   FiatRoutingTableQuerySchema: () => FiatRoutingTableQuerySchema,
+  FiatRoutingTableRequestSchema: () => FiatRoutingTableRequestSchema,
   FiatRoutingTableResponseSchema: () => FiatRoutingTableResponseSchema,
   FiatStepResponseSchema: () => FiatStepResponseSchema,
   FiatTermsErrorBodySchema: () => FiatTermsErrorBodySchema,
@@ -75,28 +76,28 @@ __export(index_exports, {
   KycSdkResultReportSchema: () => KycSdkResultReportSchema,
   MOONPAY_ENDPOINTS: () => MOONPAY_ENDPOINTS,
   MoonPayCheckoutSchema: () => MoonPayCheckoutSchema,
-  MoonPayConnectPromptSchema: () => MoonPayConnectPromptSchema,
+  MoonPayConnectNextActionSchema: () => MoonPayConnectNextActionSchema,
   MoonPayConnectRequestSchema: () => MoonPayConnectRequestSchema,
-  MoonPayConsentPromptSchema: () => MoonPayConsentPromptSchema,
+  MoonPayConsentNextActionSchema: () => MoonPayConsentNextActionSchema,
   MoonPayConsentRequestSchema: () => MoonPayConsentRequestSchema,
   MoonPayDoneSchema: () => MoonPayDoneSchema,
   MoonPayErrorBodySchema: () => MoonPayErrorBodySchema,
   MoonPayFaultSchema: () => MoonPayFaultSchema,
-  MoonPayKycPromptSchema: () => MoonPayKycPromptSchema,
+  MoonPayKycNextActionSchema: () => MoonPayKycNextActionSchema,
   MoonPayKycRequestSchema: () => MoonPayKycRequestSchema,
+  MoonPayNextActionSchema: () => MoonPayNextActionSchema,
   MoonPayNextRequestSchema: () => MoonPayNextRequestSchema,
   MoonPayObserveRequestSchema: () => MoonPayObserveRequestSchema,
-  MoonPayOrderPromptSchema: () => MoonPayOrderPromptSchema,
+  MoonPayOrderNextActionSchema: () => MoonPayOrderNextActionSchema,
   MoonPayOrderRequestSchema: () => MoonPayOrderRequestSchema,
   MoonPayOrderResponseSchema: () => MoonPayOrderResponseSchema,
-  MoonPayPromptSchema: () => MoonPayPromptSchema,
   MoonPayQuoteInputSchema: () => MoonPayQuoteInputSchema,
   MoonPayRequestContextSchema: () => MoonPayRequestContextSchema,
   MoonPayRequestSchema: () => MoonPayRequestSchema,
   MoonPayResponseSchemaFor: () => MoonPayResponseSchemaFor,
   MoonPaySdkCredentialsSchema: () => MoonPaySdkCredentialsSchema,
   MoonPayStepResponseSchema: () => MoonPayStepResponseSchema,
-  MoonPayWaitPromptSchema: () => MoonPayWaitPromptSchema,
+  MoonPayWaitNextActionSchema: () => MoonPayWaitNextActionSchema,
   OrderAwaitingConfirmationStateSchema: () => OrderAwaitingConfirmationStateSchema,
   OrderCreatedStateSchema: () => OrderCreatedStateSchema,
   OrderRefSchema: () => OrderRefSchema,
@@ -1059,6 +1060,20 @@ var $routingTableQuery = obj({
   )
 }).refine((query) => hasUsRegion(query.country, query.region), { message: US_REGION_REQUIRED, path: ["region"] });
 var FiatRoutingTableQuerySchema = $routingTableQuery;
+var $routingTableProviderInputs = obj({
+  MOONPAY: obj({ accessToken: $nonBlank.optional() }).optional()
+});
+var $routingTableRequest = obj({
+  fiatCurrencyCode: import_zod.z.enum(FIAT_CURRENCY_CODES).optional(),
+  cryptoCurrencyCode: $nonBlank,
+  chainId: $nonBlank,
+  country: $countryCode,
+  region: $optionalGeoField,
+  // Duplicates are allowed; the response lists each method once.
+  methods: import_zod.z.array(import_zod.z.enum(PAYMENT_METHOD_CATEGORIES)).min(1),
+  providers: $routingTableProviderInputs.optional()
+}).refine((request) => hasUsRegion(request.country, request.region), { message: US_REGION_REQUIRED, path: ["region"] });
+var FiatRoutingTableRequestSchema = $routingTableRequest;
 var $routingTableProvider = obj({
   provider: $routingProvider,
   next: import_zod.z.enum(["READY", "AUTH", "DECLARATIVE_KYC", "DOCUMENTARY_KYC", "PENDING_REVIEW"]),
@@ -1099,7 +1114,8 @@ var $routingQuoteTermsShape = {
     (geo) => hasUsRegion(geo.alpha2, geo.region),
     { message: US_REGION_REQUIRED, path: ["region"] }
   ),
-  prepareSessionAuth: import_zod.z.boolean().optional()
+  prepareSessionAuth: import_zod.z.boolean().optional(),
+  routingOverrides: obj({ providers: import_zod.z.array($routingProvider) }).optional()
 };
 var $routingQuoteTerms = obj($routingQuoteTermsShape);
 var FiatRoutingQuoteTermsSchema = $routingQuoteTerms;
@@ -1109,7 +1125,14 @@ var $routingQuoteRequest = import_zod.z.union([
     providers: import_zod.z.array($routingProvider).min(1).refine((providers) => hasUniqueIds(providers), "each provider is listed once")
   }),
   obj({ ...$routingQuoteTermsShape, provider: $routingProvider })
-]);
+]).refine(
+  (request) => {
+    const allowed = request.routingOverrides?.providers;
+    const selected = "providers" in request ? request.providers : [request.provider];
+    return allowed === void 0 || selected.every((provider) => allowed.includes(provider));
+  },
+  { message: "requested providers must be allowed by routingOverrides", path: ["routingOverrides"] }
+);
 var FiatRoutingQuoteRequestSchema = $routingQuoteRequest;
 var $routingServiceableRange = obj({ min: $money, max: $money, userMax: $money.nullable().optional() });
 var $noRouteFields = {
@@ -1209,7 +1232,7 @@ var $stepResponse = import_zod.z.union([$providerBoundStepResponse, $blockedStep
 var FiatStepResponseSchema = $stepResponse;
 
 // package.json
-var version = "0.25.0";
+var version = "0.28.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -2814,7 +2837,7 @@ var PUBLISHED_TERMS_DOCUMENTS = [MOONPAY_TERMS, ...Object.values(FUN_KYC_CONSENT
 
 // src/routing.ts
 var ROUTING_ENDPOINTS = {
-  table: "GET /fiat/routing/table",
+  table: "POST /fiat/routing/table",
   /** Temporary: `POST /fiat/next` replaces it for each provider that moves there. */
   quote: "POST /fiat/routing/quote"
 };
@@ -2885,44 +2908,44 @@ var MoonPayNextRequestSchema = $nextRequest2;
 var FIELD_OF_CODE = { PHONE_IN_USE: "PHONE_NUMBER", TAX_ID_IN_USE: "TAX_IDENTIFIER" };
 var $fieldError = obj2({ fieldId: $nonEmpty, message: $nonEmpty, code: import_zod2.z.enum(["PHONE_IN_USE", "TAX_ID_IN_USE"]).optional() });
 var $consentShape = obj2({ next: import_zod2.z.literal("consent"), documents: import_zod2.z.array(TermsDocumentSchema).min(1) });
-var $connectPrompt = obj2({
+var $connectNextAction = obj2({
   next: import_zod2.z.literal("connect"),
   sessionToken: $nonEmpty,
   quoteInput: $quoteInput,
   resetConnection: import_zod2.z.literal(true).optional()
 });
 var $kycShape = obj2({ next: import_zod2.z.literal("kyc"), fields: import_zod2.z.array(FormFieldSchema).min(1), fieldErrors: import_zod2.z.array($fieldError).min(1).optional() });
-var $waitPrompt = obj2({ next: import_zod2.z.literal("wait"), retryAfterMs: import_zod2.z.number().int().positive().max(6e4) });
-var $orderPrompt = obj2({ next: import_zod2.z.literal("order"), orderId: $nonEmpty, quoteInput: $quoteInput });
-var checkConsent = (prompt, context) => {
-  if (!hasUniqueIds2(prompt.documents.map((document) => document.id))) {
+var $waitNextAction = obj2({ next: import_zod2.z.literal("wait"), retryAfterMs: import_zod2.z.number().int().positive().max(6e4) });
+var $orderNextAction = obj2({ next: import_zod2.z.literal("order"), orderId: $nonEmpty, quoteInput: $quoteInput });
+var checkConsent = (nextAction, context) => {
+  if (!hasUniqueIds2(nextAction.documents.map((document) => document.id))) {
     context.addIssue({ code: "custom", path: ["documents"], message: "document ids must be unique" });
   }
 };
-var checkKyc = (prompt, context) => {
-  const fieldIds = prompt.fields.map((field) => field.id);
+var checkKyc = (nextAction, context) => {
+  const fieldIds = nextAction.fields.map((field) => field.id);
   if (!hasUniqueIds2(fieldIds)) {
     context.addIssue({ code: "custom", path: ["fields"], message: "field ids must be unique" });
   }
-  if (prompt.fieldErrors?.some((error) => !fieldIds.includes(error.fieldId))) {
-    context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error must name a field in this prompt" });
+  if (nextAction.fieldErrors?.some((error) => !fieldIds.includes(error.fieldId))) {
+    context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error must name a field in this next action" });
   }
-  if (prompt.fieldErrors?.some((error) => error.code && FIELD_OF_CODE[error.code] !== error.fieldId)) {
+  if (nextAction.fieldErrors?.some((error) => error.code && FIELD_OF_CODE[error.code] !== error.fieldId)) {
     context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error code must match its field" });
   }
 };
-var MoonPayConsentPromptSchema = $consentShape.superRefine(checkConsent);
-var MoonPayConnectPromptSchema = $connectPrompt;
-var MoonPayKycPromptSchema = $kycShape.superRefine(checkKyc);
-var MoonPayWaitPromptSchema = $waitPrompt;
-var MoonPayOrderPromptSchema = $orderPrompt;
-var checkPrompt = (response, context) => {
+var MoonPayConsentNextActionSchema = $consentShape.superRefine(checkConsent);
+var MoonPayConnectNextActionSchema = $connectNextAction;
+var MoonPayKycNextActionSchema = $kycShape.superRefine(checkKyc);
+var MoonPayWaitNextActionSchema = $waitNextAction;
+var MoonPayOrderNextActionSchema = $orderNextAction;
+var checkNextAction = (response, context) => {
   if (response.next === "consent") checkConsent(response, context);
   if (response.next === "kyc") checkKyc(response, context);
 };
-var $promptOptions = [$consentShape, $connectPrompt, $kycShape, $waitPrompt, $orderPrompt];
-var $prompt = import_zod2.z.discriminatedUnion("next", [...$promptOptions]).superRefine(checkPrompt);
-var MoonPayPromptSchema = $prompt;
+var $nextActionOptions = [$consentShape, $connectNextAction, $kycShape, $waitNextAction, $orderNextAction];
+var $nextAction = import_zod2.z.discriminatedUnion("next", [...$nextActionOptions]).superRefine(checkNextAction);
+var MoonPayNextActionSchema = $nextAction;
 var $done = obj2({ next: import_zod2.z.literal("done"), order: FiatStepResponseSchema });
 var MoonPayDoneSchema = $done;
 var $stepRefused = obj2({
@@ -2935,9 +2958,9 @@ var $orderRefused = obj2({
   reason: import_zod2.z.enum(["CUSTOMER_MISMATCH", "WALLET_MISMATCH", "UNRECORDABLE"]),
   recovery: import_zod2.z.literal("NONE")
 });
-var $stepResponse2 = import_zod2.z.discriminatedUnion("next", [...$promptOptions, $stepRefused]).superRefine(checkPrompt);
+var $stepResponse2 = import_zod2.z.discriminatedUnion("next", [...$nextActionOptions, $stepRefused]).superRefine(checkNextAction);
 var MoonPayStepResponseSchema = $stepResponse2;
-var $orderResponse = import_zod2.z.discriminatedUnion("next", [$done, $orderPrompt, $orderRefused]);
+var $orderResponse = import_zod2.z.discriminatedUnion("next", [$done, $orderNextAction, $orderRefused]);
 var MoonPayOrderResponseSchema = $orderResponse;
 var MoonPayResponseSchemaFor = {
   observe: MoonPayStepResponseSchema,
@@ -2947,7 +2970,14 @@ var MoonPayResponseSchemaFor = {
   order: MoonPayOrderResponseSchema
 };
 var $faultFields = {
-  reason: import_zod2.z.enum(["SESSION_BUDGET_SPENT", "RATE_LIMITED", "PROVIDER_UNAVAILABLE", "INVALID_REQUEST"]),
+  reason: import_zod2.z.enum([
+    "SESSION_BUDGET_SPENT",
+    "RATE_LIMITED",
+    "PROVIDER_UNAVAILABLE",
+    "KYC_PROVIDER_UNAVAILABLE",
+    "SERVICE_UNAVAILABLE",
+    "INVALID_REQUEST"
+  ]),
   recovery: import_zod2.z.enum(["RETRY", "REQUOTE", "NONE"])
 };
 var $fault = obj2($faultFields);

package/dist/index.mjs

@@ -12,19 +12,19 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-LHCED3AP.mjs";
+} from "./chunk-YNVLBTT7.mjs";
 import {
   MOONPAY_ENDPOINTS
-} from "./chunk-T5JAYOWY.mjs";
+} from "./chunk-F4NRKWF5.mjs";
 import {
   FIAT_TERMS_ENDPOINT,
   FUN_KYC_CONSENT_DOCUMENTS,
   PROVIDER_CHECKOUT_DOCUMENTS,
   PUBLISHED_TERMS_DOCUMENTS
-} from "./chunk-CRNKRIKR.mjs";
+} from "./chunk-XKI5XTUO.mjs";
 import {
   ROUTING_ENDPOINTS
-} from "./chunk-WEXD7UEE.mjs";
+} from "./chunk-3SZPKXVL.mjs";
 
 // src/codes.ts
 var US_STATE_CODES = [
@@ -923,6 +923,20 @@ var $routingTableQuery = obj({
   )
 }).refine((query) => hasUsRegion(query.country, query.region), { message: US_REGION_REQUIRED, path: ["region"] });
 var FiatRoutingTableQuerySchema = $routingTableQuery;
+var $routingTableProviderInputs = obj({
+  MOONPAY: obj({ accessToken: $nonBlank.optional() }).optional()
+});
+var $routingTableRequest = obj({
+  fiatCurrencyCode: z.enum(FIAT_CURRENCY_CODES).optional(),
+  cryptoCurrencyCode: $nonBlank,
+  chainId: $nonBlank,
+  country: $countryCode,
+  region: $optionalGeoField,
+  // Duplicates are allowed; the response lists each method once.
+  methods: z.array(z.enum(PAYMENT_METHOD_CATEGORIES)).min(1),
+  providers: $routingTableProviderInputs.optional()
+}).refine((request) => hasUsRegion(request.country, request.region), { message: US_REGION_REQUIRED, path: ["region"] });
+var FiatRoutingTableRequestSchema = $routingTableRequest;
 var $routingTableProvider = obj({
   provider: $routingProvider,
   next: z.enum(["READY", "AUTH", "DECLARATIVE_KYC", "DOCUMENTARY_KYC", "PENDING_REVIEW"]),
@@ -963,7 +977,8 @@ var $routingQuoteTermsShape = {
     (geo) => hasUsRegion(geo.alpha2, geo.region),
     { message: US_REGION_REQUIRED, path: ["region"] }
   ),
-  prepareSessionAuth: z.boolean().optional()
+  prepareSessionAuth: z.boolean().optional(),
+  routingOverrides: obj({ providers: z.array($routingProvider) }).optional()
 };
 var $routingQuoteTerms = obj($routingQuoteTermsShape);
 var FiatRoutingQuoteTermsSchema = $routingQuoteTerms;
@@ -973,7 +988,14 @@ var $routingQuoteRequest = z.union([
     providers: z.array($routingProvider).min(1).refine((providers) => hasUniqueIds(providers), "each provider is listed once")
   }),
   obj({ ...$routingQuoteTermsShape, provider: $routingProvider })
-]);
+]).refine(
+  (request) => {
+    const allowed = request.routingOverrides?.providers;
+    const selected = "providers" in request ? request.providers : [request.provider];
+    return allowed === void 0 || selected.every((provider) => allowed.includes(provider));
+  },
+  { message: "requested providers must be allowed by routingOverrides", path: ["routingOverrides"] }
+);
 var FiatRoutingQuoteRequestSchema = $routingQuoteRequest;
 var $routingServiceableRange = obj({ min: $money, max: $money, userMax: $money.nullable().optional() });
 var $noRouteFields = {
@@ -2198,44 +2220,44 @@ var MoonPayNextRequestSchema = $nextRequest2;
 var FIELD_OF_CODE = { PHONE_IN_USE: "PHONE_NUMBER", TAX_ID_IN_USE: "TAX_IDENTIFIER" };
 var $fieldError = obj2({ fieldId: $nonEmpty, message: $nonEmpty, code: z2.enum(["PHONE_IN_USE", "TAX_ID_IN_USE"]).optional() });
 var $consentShape = obj2({ next: z2.literal("consent"), documents: z2.array(TermsDocumentSchema).min(1) });
-var $connectPrompt = obj2({
+var $connectNextAction = obj2({
   next: z2.literal("connect"),
   sessionToken: $nonEmpty,
   quoteInput: $quoteInput,
   resetConnection: z2.literal(true).optional()
 });
 var $kycShape = obj2({ next: z2.literal("kyc"), fields: z2.array(FormFieldSchema).min(1), fieldErrors: z2.array($fieldError).min(1).optional() });
-var $waitPrompt = obj2({ next: z2.literal("wait"), retryAfterMs: z2.number().int().positive().max(6e4) });
-var $orderPrompt = obj2({ next: z2.literal("order"), orderId: $nonEmpty, quoteInput: $quoteInput });
-var checkConsent = (prompt, context) => {
-  if (!hasUniqueIds2(prompt.documents.map((document) => document.id))) {
+var $waitNextAction = obj2({ next: z2.literal("wait"), retryAfterMs: z2.number().int().positive().max(6e4) });
+var $orderNextAction = obj2({ next: z2.literal("order"), orderId: $nonEmpty, quoteInput: $quoteInput });
+var checkConsent = (nextAction, context) => {
+  if (!hasUniqueIds2(nextAction.documents.map((document) => document.id))) {
     context.addIssue({ code: "custom", path: ["documents"], message: "document ids must be unique" });
   }
 };
-var checkKyc = (prompt, context) => {
-  const fieldIds = prompt.fields.map((field) => field.id);
+var checkKyc = (nextAction, context) => {
+  const fieldIds = nextAction.fields.map((field) => field.id);
   if (!hasUniqueIds2(fieldIds)) {
     context.addIssue({ code: "custom", path: ["fields"], message: "field ids must be unique" });
   }
-  if (prompt.fieldErrors?.some((error) => !fieldIds.includes(error.fieldId))) {
-    context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error must name a field in this prompt" });
+  if (nextAction.fieldErrors?.some((error) => !fieldIds.includes(error.fieldId))) {
+    context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error must name a field in this next action" });
   }
-  if (prompt.fieldErrors?.some((error) => error.code && FIELD_OF_CODE[error.code] !== error.fieldId)) {
+  if (nextAction.fieldErrors?.some((error) => error.code && FIELD_OF_CODE[error.code] !== error.fieldId)) {
     context.addIssue({ code: "custom", path: ["fieldErrors"], message: "a field error code must match its field" });
   }
 };
-var MoonPayConsentPromptSchema = $consentShape.superRefine(checkConsent);
-var MoonPayConnectPromptSchema = $connectPrompt;
-var MoonPayKycPromptSchema = $kycShape.superRefine(checkKyc);
-var MoonPayWaitPromptSchema = $waitPrompt;
-var MoonPayOrderPromptSchema = $orderPrompt;
-var checkPrompt = (response, context) => {
+var MoonPayConsentNextActionSchema = $consentShape.superRefine(checkConsent);
+var MoonPayConnectNextActionSchema = $connectNextAction;
+var MoonPayKycNextActionSchema = $kycShape.superRefine(checkKyc);
+var MoonPayWaitNextActionSchema = $waitNextAction;
+var MoonPayOrderNextActionSchema = $orderNextAction;
+var checkNextAction = (response, context) => {
   if (response.next === "consent") checkConsent(response, context);
   if (response.next === "kyc") checkKyc(response, context);
 };
-var $promptOptions = [$consentShape, $connectPrompt, $kycShape, $waitPrompt, $orderPrompt];
-var $prompt = z2.discriminatedUnion("next", [...$promptOptions]).superRefine(checkPrompt);
-var MoonPayPromptSchema = $prompt;
+var $nextActionOptions = [$consentShape, $connectNextAction, $kycShape, $waitNextAction, $orderNextAction];
+var $nextAction = z2.discriminatedUnion("next", [...$nextActionOptions]).superRefine(checkNextAction);
+var MoonPayNextActionSchema = $nextAction;
 var $done = obj2({ next: z2.literal("done"), order: FiatStepResponseSchema });
 var MoonPayDoneSchema = $done;
 var $stepRefused = obj2({
@@ -2248,9 +2270,9 @@ var $orderRefused = obj2({
   reason: z2.enum(["CUSTOMER_MISMATCH", "WALLET_MISMATCH", "UNRECORDABLE"]),
   recovery: z2.literal("NONE")
 });
-var $stepResponse2 = z2.discriminatedUnion("next", [...$promptOptions, $stepRefused]).superRefine(checkPrompt);
+var $stepResponse2 = z2.discriminatedUnion("next", [...$nextActionOptions, $stepRefused]).superRefine(checkNextAction);
 var MoonPayStepResponseSchema = $stepResponse2;
-var $orderResponse = z2.discriminatedUnion("next", [$done, $orderPrompt, $orderRefused]);
+var $orderResponse = z2.discriminatedUnion("next", [$done, $orderNextAction, $orderRefused]);
 var MoonPayOrderResponseSchema = $orderResponse;
 var MoonPayResponseSchemaFor = {
   observe: MoonPayStepResponseSchema,
@@ -2260,7 +2282,14 @@ var MoonPayResponseSchemaFor = {
   order: MoonPayOrderResponseSchema
 };
 var $faultFields = {
-  reason: z2.enum(["SESSION_BUDGET_SPENT", "RATE_LIMITED", "PROVIDER_UNAVAILABLE", "INVALID_REQUEST"]),
+  reason: z2.enum([
+    "SESSION_BUDGET_SPENT",
+    "RATE_LIMITED",
+    "PROVIDER_UNAVAILABLE",
+    "KYC_PROVIDER_UNAVAILABLE",
+    "SERVICE_UNAVAILABLE",
+    "INVALID_REQUEST"
+  ]),
   recovery: z2.enum(["RETRY", "REQUOTE", "NONE"])
 };
 var $fault = obj2($faultFields);
@@ -2298,6 +2327,7 @@ export {
   FiatRoutingQuoteTermsSchema,
   FiatRoutingTableErrorBodySchema,
   FiatRoutingTableQuerySchema,
+  FiatRoutingTableRequestSchema,
   FiatRoutingTableResponseSchema,
   FiatStepResponseSchema,
   FiatTermsErrorBodySchema,
@@ -2323,28 +2353,28 @@ export {
   KycSdkResultReportSchema,
   MOONPAY_ENDPOINTS,
   MoonPayCheckoutSchema,
-  MoonPayConnectPromptSchema,
+  MoonPayConnectNextActionSchema,
   MoonPayConnectRequestSchema,
-  MoonPayConsentPromptSchema,
+  MoonPayConsentNextActionSchema,
   MoonPayConsentRequestSchema,
   MoonPayDoneSchema,
   MoonPayErrorBodySchema,
   MoonPayFaultSchema,
-  MoonPayKycPromptSchema,
+  MoonPayKycNextActionSchema,
   MoonPayKycRequestSchema,
+  MoonPayNextActionSchema,
   MoonPayNextRequestSchema,
   MoonPayObserveRequestSchema,
-  MoonPayOrderPromptSchema,
+  MoonPayOrderNextActionSchema,
   MoonPayOrderRequestSchema,
   MoonPayOrderResponseSchema,
-  MoonPayPromptSchema,
   MoonPayQuoteInputSchema,
   MoonPayRequestContextSchema,
   MoonPayRequestSchema,
   MoonPayResponseSchemaFor,
   MoonPaySdkCredentialsSchema,
   MoonPayStepResponseSchema,
-  MoonPayWaitPromptSchema,
+  MoonPayWaitNextActionSchema,
   OrderAwaitingConfirmationStateSchema,
   OrderCreatedStateSchema,
   OrderRefSchema,

package/dist/providers/moonpay.d.ts

@@ -1,10 +1,10 @@
 /**
  * The MoonPay flow on `POST /fiat/next`.
  *
- * Each action has one name and two types. A response's prompt names it in `next` and carries what
+ * Each action has one name and two types. A response names the next action in `next` and carries what
  * the client needs to do it. The client's request names it in `action` and carries the result. Every
- * response is the next prompt, `done`, or `refused` (`MoonPayResponseFor`). `observe` carries no
- * result and answers the current prompt. `wait` has no request: the client sends `observe` after it.
+ * response is the next action, `done`, or `refused` (`MoonPayResponseFor`). `observe` carries no
+ * result and answers the current next action. `wait` has no request: the client sends `observe` after it.
  *
  * The body is `MoonPayNextRequest`: `provider`, the shared `geo`, the context (`checkout`, and
  * `credentials` after `connect`), and the action's result. Identity and the deposit wallet always
@@ -69,12 +69,12 @@ export interface MoonPayQuoteInput {
     };
     feeBehavior: 'inclusive';
 }
-/** No prompt of its own: the answer is the current prompt. Writes nothing. */
+/** No next action of its own: the answer is the current next action. Writes nothing. */
 export type MoonPayObserveRequest = {
     action: 'observe';
 };
 /** MoonPay's terms first. Later, before `kyc`, Fun's KYC consent if the buyer has not accepted it. */
-export type MoonPayConsentPrompt = {
+export type MoonPayConsentNextAction = {
     next: 'consent';
     documents: TermsDocument[];
 };
@@ -87,7 +87,7 @@ export type MoonPayConsentRequest = {
  * Run MoonPay's connection check with `sessionToken`; it asks for an OTP only if the hidden check
  * fails. `resetConnection`: the device's connection is another buyer's, so reset it first.
  */
-export type MoonPayConnectPrompt = {
+export type MoonPayConnectNextAction = {
     next: 'connect';
     sessionToken: string;
     quoteInput: MoonPayQuoteInput;
@@ -101,7 +101,7 @@ export type MoonPayConnectRequest = {
 /** Another MoonPay customer already holds the value; only a different one goes through. */
 export type MoonPayFieldErrorCode = 'PHONE_IN_USE' | 'TAX_ID_IN_USE';
 /**
- * A reason on one field of a `kyc` prompt. `fieldId` names a field in that prompt. `code` is set
+ * A reason on one field of a `kyc` next action. `fieldId` names a field in that next action. `code` is set
  * only for a refusal the client words itself: `PHONE_IN_USE` on `PHONE_NUMBER`, `TAX_ID_IN_USE` on `TAX_IDENTIFIER`.
  */
 export interface MoonPayFieldError {
@@ -110,24 +110,24 @@ export interface MoonPayFieldError {
     code?: MoonPayFieldErrorCode;
 }
 /** Show the shared form. */
-export type MoonPayKycPrompt = {
+export type MoonPayKycNextAction = {
     next: 'kyc';
     fields: FormField[];
     fieldErrors?: MoonPayFieldError[];
 };
-/** Keyed by the ids of the prompt's fields; there is no form id. Needs `credentials`: the backend reads the customer. */
+/** Keyed by the ids of the next action's fields; there is no form id. Needs `credentials`: the backend reads the customer. */
 export type MoonPayKycRequest = {
     action: 'kyc';
     credentials: MoonPaySdkCredentials;
     values: Partial<Record<KycFieldId, string>>;
 };
 /** MoonPay is reviewing. No request of its own: send `observe` after the delay. */
-export type MoonPayWaitPrompt = {
+export type MoonPayWaitNextAction = {
     next: 'wait';
     retryAfterMs: number;
 };
 /** Get the device quote from `quoteInput`, mount Apple Pay with `externalTransactionId = orderId`. */
-export type MoonPayOrderPrompt = {
+export type MoonPayOrderNextAction = {
     next: 'order';
     orderId: string;
     quoteInput: MoonPayQuoteInput;
@@ -157,7 +157,7 @@ export type MoonPayStepRefusal = 'NOT_ELIGIBLE' | 'DOCUMENTS_REQUIRED' | 'FINAL_
  * assertion's. `UNRECORDABLE`: a charge no retry can record, held for refund review.
  */
 export type MoonPayOrderRefusal = 'CUSTOMER_MISMATCH' | 'WALLET_MISMATCH' | 'UNRECORDABLE';
-export type MoonPayPrompt = MoonPayConsentPrompt | MoonPayConnectPrompt | MoonPayKycPrompt | MoonPayWaitPrompt | MoonPayOrderPrompt;
+export type MoonPayNextAction = MoonPayConsentNextAction | MoonPayConnectNextAction | MoonPayKycNextAction | MoonPayWaitNextAction | MoonPayOrderNextAction;
 /** `order` is the `GET /fiat/orders/:orderId` body; the shared order screen renders it. */
 export type MoonPayDone = {
     next: 'done';
@@ -170,13 +170,13 @@ export type MoonPayRefused<R, V> = {
     recovery: V;
 };
 /** The answer to `observe`, `consent`, `connect` and `kyc`. */
-export type MoonPayStepResponse = MoonPayPrompt | MoonPayRefused<MoonPayStepRefusal, 'REQUOTE' | 'NONE'>;
+export type MoonPayStepResponse = MoonPayNextAction | MoonPayRefused<MoonPayStepRefusal, 'REQUOTE' | 'NONE'>;
 /**
  * The answer to `order`. A failed charge is recorded too: `done` with the order in `FAILED`, and the
  * client requotes for a new `orderId`. `order` again while MoonPay does not list the transaction
  * yet. A refusal after a charge never requotes: that would start a second payment.
  */
-export type MoonPayOrderResponse = MoonPayDone | MoonPayOrderPrompt | MoonPayRefused<MoonPayOrderRefusal, 'NONE'>;
+export type MoonPayOrderResponse = MoonPayDone | MoonPayOrderNextAction | MoonPayRefused<MoonPayOrderRefusal, 'NONE'>;
 export type MoonPayResponseFor = {
     observe: MoonPayStepResponse;
     consent: MoonPayStepResponse;
@@ -188,10 +188,11 @@ export type MoonPayResponseFor = {
 export type MoonPayRecovery = 'RETRY' | 'REQUOTE' | 'NONE';
 /**
  * `SESSION_BUDGET_SPENT`: the per-login SDK session mint budget (429). `RATE_LIMITED`: the action's
- * request budget (429). `PROVIDER_UNAVAILABLE`: MoonPay or Sumsub is down. `INVALID_REQUEST`: a bad
- * body (400).
+ * request budget (429). `PROVIDER_UNAVAILABLE`: MoonPay is down (503). `KYC_PROVIDER_UNAVAILABLE`:
+ * the KYC provider (Sumsub) is down (503). `SERVICE_UNAVAILABLE`: one of Fun's own stores is down
+ * (503). `INVALID_REQUEST`: a bad body (400).
  */
-export type MoonPayFaultReason = 'SESSION_BUDGET_SPENT' | 'RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'INVALID_REQUEST';
+export type MoonPayFaultReason = 'SESSION_BUDGET_SPENT' | 'RATE_LIMITED' | 'PROVIDER_UNAVAILABLE' | 'KYC_PROVIDER_UNAVAILABLE' | 'SERVICE_UNAVAILABLE' | 'INVALID_REQUEST';
 /** The fields a MoonPay fault adds to the shared error body. */
 export interface MoonPayFault {
     reason: MoonPayFaultReason;

package/dist/providers/moonpay.mjs

@@ -1,6 +1,6 @@
 import {
   MOONPAY_ENDPOINTS
-} from "../chunk-T5JAYOWY.mjs";
+} from "../chunk-F4NRKWF5.mjs";
 export {
   MOONPAY_ENDPOINTS
 };

package/dist/providers/moonpay.schemas.d.ts

@@ -3,7 +3,7 @@
  * exported from the package root, never from `./moonpay`, so the production entry stays free of zod.
  */
 import { z } from 'zod';
-import type { MoonPayCheckout, MoonPayConnectPrompt, MoonPayConnectRequest, MoonPayConsentPrompt, MoonPayConsentRequest, MoonPayDone, MoonPayErrorBody, MoonPayFault, MoonPayKycPrompt, MoonPayKycRequest, MoonPayNextRequest, MoonPayObserveRequest, MoonPayOrderPrompt, MoonPayOrderRequest, MoonPayOrderResponse, MoonPayPrompt, MoonPayQuoteInput, MoonPayRequest, MoonPayRequestContext, MoonPayResponseFor, MoonPaySdkCredentials, MoonPayStepResponse, MoonPayWaitPrompt } from './moonpay';
+import type { MoonPayCheckout, MoonPayConnectNextAction, MoonPayConnectRequest, MoonPayConsentNextAction, MoonPayConsentRequest, MoonPayDone, MoonPayErrorBody, MoonPayFault, MoonPayKycNextAction, MoonPayKycRequest, MoonPayNextRequest, MoonPayObserveRequest, MoonPayOrderNextAction, MoonPayOrderRequest, MoonPayOrderResponse, MoonPayNextAction, MoonPayQuoteInput, MoonPayRequest, MoonPayRequestContext, MoonPayResponseFor, MoonPaySdkCredentials, MoonPayStepResponse, MoonPayWaitNextAction } from './moonpay';
 export declare const MoonPayCheckoutSchema: z.ZodType<MoonPayCheckout>;
 export declare const MoonPaySdkCredentialsSchema: z.ZodType<MoonPaySdkCredentials>;
 export declare const MoonPayRequestContextSchema: z.ZodType<MoonPayRequestContext>;
@@ -15,12 +15,12 @@ export declare const MoonPayKycRequestSchema: z.ZodType<MoonPayRequestContext &
 export declare const MoonPayOrderRequestSchema: z.ZodType<MoonPayRequestContext & MoonPayOrderRequest>;
 export declare const MoonPayRequestSchema: z.ZodType<MoonPayRequest>;
 export declare const MoonPayNextRequestSchema: z.ZodType<MoonPayNextRequest>;
-export declare const MoonPayConsentPromptSchema: z.ZodType<MoonPayConsentPrompt>;
-export declare const MoonPayConnectPromptSchema: z.ZodType<MoonPayConnectPrompt>;
-export declare const MoonPayKycPromptSchema: z.ZodType<MoonPayKycPrompt>;
-export declare const MoonPayWaitPromptSchema: z.ZodType<MoonPayWaitPrompt>;
-export declare const MoonPayOrderPromptSchema: z.ZodType<MoonPayOrderPrompt>;
-export declare const MoonPayPromptSchema: z.ZodType<MoonPayPrompt>;
+export declare const MoonPayConsentNextActionSchema: z.ZodType<MoonPayConsentNextAction>;
+export declare const MoonPayConnectNextActionSchema: z.ZodType<MoonPayConnectNextAction>;
+export declare const MoonPayKycNextActionSchema: z.ZodType<MoonPayKycNextAction>;
+export declare const MoonPayWaitNextActionSchema: z.ZodType<MoonPayWaitNextAction>;
+export declare const MoonPayOrderNextActionSchema: z.ZodType<MoonPayOrderNextAction>;
+export declare const MoonPayNextActionSchema: z.ZodType<MoonPayNextAction>;
 export declare const MoonPayDoneSchema: z.ZodType<MoonPayDone>;
 export declare const MoonPayStepResponseSchema: z.ZodType<MoonPayStepResponse>;
 export declare const MoonPayOrderResponseSchema: z.ZodType<MoonPayOrderResponse>;

package/dist/routing.d.ts

@@ -1,5 +1,5 @@
 /**
- * The routing table: `GET /fiat/routing/table` and `POST /fiat/routing/quote`.
+ * The routing table: `POST /fiat/routing/table` and `POST /fiat/routing/quote`.
  *
  * The client loads the table when the sheet opens. For each payment method it lists every amount
  * interval and the providers that serve it, best first, each with what it needs from the buyer next.
@@ -10,6 +10,9 @@
  * The table is advisory: every routing quote checks the named provider's eligibility again. Refetch it
  * at `expiresAt`, on `refreshLimits: true`, and after auth, KYC or a `REQUOTE` refusal.
  *
+ * Provider inputs are optional; see `FiatRoutingTableMoonPayInputs` for credential handling.
+ * Malformed inputs and unknown keys return 400. Deploy backend support before new provider keys.
+ *
  * Changes to both routes only add fields and enum values. Map an unknown `next` to the generic
  * Continue label.
  *
@@ -20,15 +23,45 @@
 import type { CountryCode, FiatCurrencyCode, PaymentMethodCategory } from './codes';
 import type { FiatAmount, FiatProvider, QuoteLimitRange } from './types';
 export declare const ROUTING_ENDPOINTS: {
-    readonly table: "GET /fiat/routing/table";
+    readonly table: "POST /fiat/routing/table";
     /** Temporary: `POST /fiat/next` replaces it for each provider that moves there. */
     readonly quote: "POST /fiat/routing/quote";
 };
 /**
- * The query string of `GET /fiat/routing/table`. `country` and `region` are the geo endpoint's
- * `alpha2` and `region`, held to the `POST /fiat/quote` geo rules: a US buyer's `region` must be a
+ * MoonPay SDK access token (`client.getCredentials().accessToken`). The backend uses the
+ * authenticated quote's remaining limits, bounded by corridor limits. Missing, expired or
+ * provider-rejected tokens use corridor limits. Omit blank tokens. Sent in the body; never logged.
+ */
+export interface FiatRoutingTableMoonPayInputs {
+    accessToken?: string;
+}
+/** Provider-specific inputs, keyed by `RoutingProvider`. All keys and fields are optional. */
+export interface FiatRoutingTableProviderInputs {
+    MOONPAY?: FiatRoutingTableMoonPayInputs;
+}
+/**
+ * The body of `POST /fiat/routing/table`. `country` and `region` are the geo endpoint's `alpha2`
+ * and `region`, held to the `POST /fiat/quote` geo rules: a US buyer's `region` must be a
  * `UsStateCode`, and an empty `region` counts as absent.
  */
+export interface FiatRoutingTableRequest {
+    /** Defaults to `USD`. */
+    fiatCurrencyCode?: FiatCurrencyCode;
+    cryptoCurrencyCode: string;
+    chainId: string;
+    country: CountryCode;
+    region?: string;
+    /** At least one. The response lists each once, in this order. */
+    methods: PaymentMethodCategory[];
+    /** Optional provider-specific inputs. */
+    providers?: FiatRoutingTableProviderInputs;
+}
+/**
+ * The query string of `GET /fiat/routing/table`, which `POST /fiat/routing/table` replaces.
+ *
+ * @deprecated Send a `FiatRoutingTableRequest` to `ROUTING_ENDPOINTS.table`. The GET route still
+ * answers while clients move, with no provider inputs.
+ */
 export interface FiatRoutingTableQuery {
     /** Defaults to `USD`. */
     fiatCurrencyCode?: FiatCurrencyCode;
@@ -82,7 +115,7 @@ export interface FiatRoutingTableResponse {
     /** In request order, duplicates removed. */
     methods: RoutingTableMethod[];
 }
-/** The `POST /fiat/quote` body without `routingOverrides`: everything but which providers to price. */
+/** The purchase terms and optional host restriction, independent of the current ordered candidates. */
 export interface FiatRoutingQuoteTerms {
     fiatCurrency: FiatCurrencyCode;
     /** A positive decimal string with no leading zero, exponent or sign (`"20"`, `"20.5"`). */
@@ -101,6 +134,10 @@ export interface FiatRoutingQuoteTerms {
         city?: string;
     };
     prepareSessionAuth?: boolean;
+    /** Host allowlist, retained for later KYC rerouting. Omitted allows every eligible provider. */
+    routingOverrides?: {
+        providers: RoutingProvider[];
+    };
 }
 /**
  * `POST /fiat/routing/quote`: the terms plus which providers to price, in one of two forms.
@@ -170,7 +207,7 @@ export type RoutingRateLimitedErrorBody = ErrorBodyFields & {
 export type RoutingFaultErrorBody = ErrorBodyFields & {
     errorCode: string;
 };
-/** `GET /fiat/routing/table` refusals. */
+/** Error bodies for the routing table endpoint (POST and deprecated GET). */
 export type FiatRoutingTableErrorBody = RoutingRateLimitedErrorBody | RoutingFaultErrorBody;
 /**
  * `POST /fiat/routing/quote` refusals. A `FiatNoRouteError` (any `reason`) or either amount error is

package/dist/routing.js

@@ -24,7 +24,7 @@ __export(routing_exports, {
 });
 module.exports = __toCommonJS(routing_exports);
 var ROUTING_ENDPOINTS = {
-  table: "GET /fiat/routing/table",
+  table: "POST /fiat/routing/table",
   /** Temporary: `POST /fiat/next` replaces it for each provider that moves there. */
   quote: "POST /fiat/routing/quote"
 };

package/dist/routing.mjs

@@ -1,6 +1,6 @@
 import {
   ROUTING_ENDPOINTS
-} from "./chunk-WEXD7UEE.mjs";
+} from "./chunk-3SZPKXVL.mjs";
 export {
   ROUTING_ENDPOINTS
 };

package/dist/schemas.d.ts

@@ -30,7 +30,7 @@ import { z } from 'zod';
 import type { UsStateCode } from './codes';
 import type { BlockedReason, CryptoAmount, FailureReason, FeeLine, FiatAmount, FiatEndpoint, FiatProvider, FiatStepResponse, FieldSpec, FlowState, FormDescriptor, FormField, FormFieldType, InstructionField, Instructions, Instrument, JsonValue, KYCProvider, OrderRef, OrderStatus, OrderSummary, PollSpec, PreparedPayment, PaymentSurface, Quote, QuoteLimitRange, QuoteLimits, Recovery, Refund, ReportSpec, SelectOption, StatusHistoryEntry, Surface, PreferredIdentityDocument, KycFieldId, ClientExecutedDelivery, KycSdkResultReport, SurfaceKind, SurfaceProvider, TermsAcceptance, Transition, TransitionInputs, TransitionParams, Tx, FiatGeo, FiatNextRequest } from './types';
 import type { FiatTermsErrorBody, FiatTermsRequest, FiatTermsResponse, TermsDocument, TermsDocumentAcceptance } from './terms';
-import type { FiatRoutingQuoteErrorBody, FiatRoutingQuoteRequest, FiatRoutingQuoteTerms, FiatRoutingTableErrorBody, FiatRoutingTableQuery, FiatRoutingTableResponse } from './routing';
+import type { FiatRoutingQuoteErrorBody, FiatRoutingQuoteRequest, FiatRoutingQuoteTerms, FiatRoutingTableErrorBody, FiatRoutingTableQuery, FiatRoutingTableRequest, FiatRoutingTableResponse } from './routing';
 export declare const JsonSchema: z.ZodType<JsonValue>;
 export declare const HTTP_VERBS: readonly ["GET", "POST"];
 /** `"POST /fiat/session/verify"`, `"GET /fiat/orders/o_31c"` — the verb rides the string. */
@@ -112,7 +112,9 @@ export declare const TermsDocumentAcceptanceSchema: z.ZodType<TermsDocumentAccep
 export declare const FiatTermsRequestSchema: z.ZodType<FiatTermsRequest>;
 export declare const FiatTermsResponseSchema: z.ZodType<FiatTermsResponse>;
 export declare const FiatTermsErrorBodySchema: z.ZodType<FiatTermsErrorBody>;
+/** @deprecated `GET /fiat/routing/table` is replaced by `POST /fiat/routing/table` (`FiatRoutingTableRequestSchema`). */
 export declare const FiatRoutingTableQuerySchema: z.ZodType<FiatRoutingTableQuery>;
+export declare const FiatRoutingTableRequestSchema: z.ZodType<FiatRoutingTableRequest>;
 export declare const FiatRoutingTableResponseSchema: z.ZodType<FiatRoutingTableResponse>;
 export declare const FiatRoutingQuoteTermsSchema: z.ZodType<FiatRoutingQuoteTerms>;
 export declare const FiatRoutingQuoteRequestSchema: z.ZodType<FiatRoutingQuoteRequest>;

package/dist/table.js

@@ -36,7 +36,7 @@ __export(table_exports, {
 module.exports = __toCommonJS(table_exports);
 
 // package.json
-var version = "0.25.0";
+var version = "0.28.0";
 
 // src/table.ts
 var TABLE_VERSION = version;

package/dist/table.mjs

@@ -11,7 +11,7 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-LHCED3AP.mjs";
+} from "./chunk-YNVLBTT7.mjs";
 export {
   DOCUMENTED_ENDPOINTS,
   STATE_KEYS,

package/dist/terms.d.ts

@@ -2,7 +2,7 @@
  * The platform terms route: `POST /fiat/terms`, shared by every provider.
  *
  * A checkout shows the user documents to accept. `CHECKOUT` documents are the constants below;
- * `KYC` documents arrive in a provider flow's consent prompt. The user's Continue tap is the
+ * `KYC` documents arrive in a provider flow's consent next action. The user's Continue tap is the
  * acceptance, and the client records it here before the next provider call. A repeat writes nothing.
  *
  * Zero runtime dependencies, so production React Native code can import it. The zod schemas are

package/dist/terms.mjs

@@ -3,7 +3,7 @@ import {
   FUN_KYC_CONSENT_DOCUMENTS,
   PROVIDER_CHECKOUT_DOCUMENTS,
   PUBLISHED_TERMS_DOCUMENTS
-} from "./chunk-CRNKRIKR.mjs";
+} from "./chunk-XKI5XTUO.mjs";
 export {
   FIAT_TERMS_ENDPOINT,
   FUN_KYC_CONSENT_DOCUMENTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fun-xyz/fiat-contract",
-  "version": "0.25.0",
+  "version": "0.28.0",
   "description": "Published conformance contract for Fun's headless fiat onramp: FlowState/Transition types, zod schemas, the transition table as data, recorded fixtures, assertion helpers.",
   "license": "MIT",
   "repository": {