@metamask-previews/kyc-controller 0.0.0-preview-4f4c98e → 0.0.0-preview-eb263b0ee

package/dist/KycService.cjs

@@ -0,0 +1,628 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _KycService_instances, _KycService_fetch, _KycService_baseUrl, _KycService_fractalEncryptionBaseUrl, _KycService_validateResponse, _KycService_requestJson;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KycService = exports.serviceName = void 0;
+const base_data_service_1 = require("@metamask/base-data-service");
+const controller_utils_1 = require("@metamask/controller-utils");
+const superstruct_1 = require("@metamask/superstruct");
+const utils_1 = require("@metamask/utils");
+const countryCodes_js_1 = require("./countryCodes.cjs");
+const constants_js_1 = require("./ukyc/constants.cjs");
+// === GENERAL ===
+/**
+ * The name of the {@link KycService}, used to namespace the service's actions.
+ */
+exports.serviceName = 'KycService';
+// === MESSENGER ===
+const MESSENGER_EXPOSED_METHODS = [
+    'getGeoCountry',
+    'fetchDisclaimers',
+    'createSession',
+    'checkKycRequired',
+    'createVendorCustomer',
+    'submitVendorDisclaimers',
+    'fetchSessionDisclaimers',
+    'submitSessionDisclaimers',
+    'fetchKycStatus',
+    'fetchJwks',
+    'createUkycSession',
+    'setAuthorizations',
+    'createJourney',
+    'getSessionStatus',
+];
+// === API RESPONSE SCHEMAS ===
+const DisclaimerStruct = (0, superstruct_1.type)({
+    id: (0, superstruct_1.string)(),
+    display_name: (0, superstruct_1.string)(),
+    url: (0, superstruct_1.string)(),
+});
+const DisclaimersResponseStruct = (0, superstruct_1.array)(DisclaimerStruct);
+const VendorSigningStruct = (0, superstruct_1.type)({
+    id: (0, superstruct_1.string)(),
+    customer_id: (0, superstruct_1.string)(),
+    content_id: (0, superstruct_1.optional)((0, superstruct_1.string)()),
+});
+const VendorSigningsResponseStruct = (0, superstruct_1.array)(VendorSigningStruct);
+const CreateSessionResponseStruct = (0, superstruct_1.type)({ sessionToken: (0, superstruct_1.string)() });
+// The live KYC API returns the flag under `required`; the service normalizes
+// this to `kycRequired` for consumers (see `checkKycRequired`).
+const KycRequiredResponseStruct = (0, superstruct_1.type)({ required: (0, superstruct_1.boolean)() });
+// The session server's public key, in JWK-like form, returned inside an
+// encryption schema from `POST /sessions`. `x` is the base64url public key
+// used to wrap a secret for that schema.
+const ServerPublicKeyStruct = (0, superstruct_1.type)({
+    kty: (0, superstruct_1.string)(),
+    crv: (0, superstruct_1.string)(),
+    x: (0, superstruct_1.string)(),
+    kid: (0, superstruct_1.optional)((0, superstruct_1.string)()),
+    alg: (0, superstruct_1.optional)((0, superstruct_1.string)()),
+    use: (0, superstruct_1.optional)((0, superstruct_1.string)()),
+});
+const EncryptionSchemaStruct = (0, superstruct_1.type)({
+    serverPublicKey: ServerPublicKeyStruct,
+    jwtChain: (0, superstruct_1.string)(),
+});
+// A single Ed25519 (OKP) JWK. `type` (not `object`) keeps optional/extra JWK
+// fields (`use`, `alg`) from failing validation.
+const JwkStruct = (0, superstruct_1.type)({
+    kty: (0, superstruct_1.string)(),
+    crv: (0, superstruct_1.string)(),
+    x: (0, superstruct_1.string)(),
+    kid: (0, superstruct_1.string)(),
+});
+const JwksResponseStruct = (0, superstruct_1.type)({ keys: (0, superstruct_1.array)(JwkStruct) });
+const UkycSessionResponseStruct = (0, superstruct_1.type)({
+    sessionId: (0, superstruct_1.string)(),
+    // Per-secret wrapping material so the client can seal the
+    // `data_encryption_key` and the `ukyc_capability_token` independently.
+    encryptionDataKey: EncryptionSchemaStruct,
+    ukycCapabilityToken: EncryptionSchemaStruct,
+});
+const ApplicantAccessTokenResponseStruct = (0, superstruct_1.type)({
+    status: (0, superstruct_1.string)(),
+    applicantAccessToken: (0, superstruct_1.string)(),
+});
+const SessionStatusResponseStruct = (0, superstruct_1.type)({
+    finalStatus: (0, superstruct_1.string)(),
+    statusMessage: (0, superstruct_1.optional)((0, superstruct_1.string)()),
+    externalUserId: (0, superstruct_1.string)(),
+    kycStatus: (0, superstruct_1.string)(),
+    vendor: (0, superstruct_1.string)(),
+    vendorStatus: (0, superstruct_1.string)(),
+});
+// Vendor customer subset — `type` (not `object`) keeps extra vendor fields from
+// failing validation while still requiring the fields the controller needs.
+const VendorCustomerResponseStruct = (0, superstruct_1.type)({
+    id: (0, superstruct_1.string)(),
+    email: (0, superstruct_1.string)(),
+    status: (0, superstruct_1.string)(),
+});
+const KYC_USER_STATUSES = [
+    'not-started',
+    'pending',
+    'need-more-information',
+    'terminal-failure',
+    'completed',
+];
+const KycUserStatusResponseStruct = (0, superstruct_1.type)({
+    status: (0, superstruct_1.enums)([...KYC_USER_STATUSES]),
+    sumsubSessionId: (0, superstruct_1.optional)((0, superstruct_1.string)()),
+    errorCode: (0, superstruct_1.optional)((0, superstruct_1.string)()),
+});
+const ConsentDocumentStruct = (0, superstruct_1.type)({
+    key: (0, superstruct_1.string)(),
+    version: (0, superstruct_1.string)(),
+    title: (0, superstruct_1.string)(),
+    url: (0, superstruct_1.string)(),
+    consented: (0, superstruct_1.boolean)(),
+});
+const SessionDisclaimersResponseStruct = (0, superstruct_1.type)({
+    idOS: (0, superstruct_1.array)(ConsentDocumentStruct),
+    kycProvider: (0, superstruct_1.array)(ConsentDocumentStruct),
+    credentialReusabilityConsentGiven: (0, superstruct_1.boolean)(),
+});
+// === SERVICE DEFINITION ===
+/**
+ * `KycService` communicates with the Universal KYC (UKYC) backend to drive the
+ * identity + document-verification flow. It is stateless and platform-agnostic:
+ * HTTP is performed through the runtime's native `fetch` (or an injected
+ * `fetch` when provided), and the auth bearer token and geolocation come from
+ * other controllers via the messenger.
+ *
+ * It extends {@link BaseDataService}, so every request is routed through
+ * `fetchQuery`: it is wrapped in the shared service policy (retries, circuit
+ * breaker) and its result is exposed via the service's `QueryClient`. Read-only
+ * endpoints (`fetchDisclaimers`, `fetchJwks`) are cached with a `staleTime`;
+ * vendor-disclaimer, session-scoped disclaimer, session-creating, and
+ * status-polling endpoints opt out of caching (`staleTime`/`gcTime` of `0`)
+ * so they never serve a stale result.
+ */
+class KycService extends base_data_service_1.BaseDataService {
+    /**
+     * Constructs a new KycService.
+     *
+     * @param options - The constructor options.
+     * @param options.messenger - The messenger suited for this service.
+     * @param options.fetch - A function used to make HTTP requests. Defaults to
+     * the runtime's native `fetch`.
+     * @param options.baseUrl - Base URL of the KYC API
+     * @param options.fractalEncryptionBaseUrl - Base URL of the Fractal
+     * encryption service, from which the JWKS used to verify encryption-schema
+     * `jwtChain`s is fetched.
+     * @param options.queryClientConfig - Shared configuration for all queries
+     * exposed by the service.
+     * @param options.policyOptions - Options for the request service policy.
+     */
+    constructor({ messenger, fetch: fetchFunction, baseUrl, fractalEncryptionBaseUrl, queryClientConfig = {}, policyOptions = {}, }) {
+        super({
+            name: exports.serviceName,
+            messenger,
+            queryClientConfig,
+            policyOptions,
+        });
+        _KycService_instances.add(this);
+        _KycService_fetch.set(this, void 0);
+        _KycService_baseUrl.set(this, void 0);
+        _KycService_fractalEncryptionBaseUrl.set(this, void 0);
+        // Fall back to the runtime's native `fetch`, bound to `globalThis` so it
+        // can be invoked as a method of this instance without an illegal-invocation
+        // error on platforms that check the receiver.
+        if (fetchFunction) {
+            __classPrivateFieldSet(this, _KycService_fetch, fetchFunction, "f");
+        }
+        else if (typeof globalThis.fetch === 'function') {
+            __classPrivateFieldSet(this, _KycService_fetch, globalThis.fetch.bind(globalThis), "f");
+        }
+        else {
+            throw new Error('KycService: fetch is not available globally and was not provided in options. Please inject a fetch implementation.');
+        }
+        if (!baseUrl) {
+            throw new Error('KycService: baseUrl is required');
+        }
+        __classPrivateFieldSet(this, _KycService_baseUrl, baseUrl, "f");
+        __classPrivateFieldSet(this, _KycService_fractalEncryptionBaseUrl, fractalEncryptionBaseUrl ?? '', "f");
+        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
+    }
+    /**
+     * Resolves the customer's country from the geolocation source and converts it
+     * to an ISO 3166-1 alpha-3 code.
+     *
+     * @returns The alpha-3 country code.
+     * @throws If the country cannot be determined or mapped.
+     */
+    async getGeoCountry() {
+        const location = await this.messenger.call('GeolocationController:getGeolocation');
+        // Guard nullish/empty geolocation with the documented domain error rather
+        // than letting `assert(location, string())` surface a superstruct
+        // assertion error (which would change how the failure reads in
+        // `disclaimersError`).
+        const alpha2 = typeof location === 'string' ? location.split('-')[0].toUpperCase() : '';
+        if (!alpha2 || alpha2 === 'UNKNOWN') {
+            throw new Error(`Unable to determine country from geolocation (got "${String(location)}").`);
+        }
+        const alpha3 = (0, countryCodes_js_1.alpha2ToAlpha3)(alpha2);
+        if (!alpha3) {
+            throw new Error(`Unable to map country code "${alpha2}" to an ISO 3166-1 alpha-3 code.`);
+        }
+        return alpha3;
+    }
+    /**
+     * Fetches the disclaimers the customer must accept before a session is
+     * created.
+     *
+     * @param params - The parameters.
+     * @param params.vendor - Identity vendor. Defaults to `moonpay`.
+     * @param params.country - ISO 3166-1 alpha-3 country code.
+     * @returns The disclaimers.
+     */
+    async fetchDisclaimers({ vendor = 'moonpay', country, }) {
+        const url = new URL(`/vendors/${vendor}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        url.searchParams.set('country', country);
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:fetchDisclaimers`, vendor, country],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            staleTime: (0, utils_1.inMilliseconds)(5, utils_1.Duration.Minute),
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, DisclaimersResponseStruct, 'disclaimers');
+    }
+    /**
+     * Creates a vendor session via the UKYC backend.
+     *
+     * @param params - The session parameters.
+     * @returns The created session token.
+     */
+    async createSession(params) {
+        const url = new URL('/vendors/moonpay/sessions', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [
+                `${this.name}:createSession`,
+                params.email,
+                params.termsAcceptedAt,
+                params.disclaimerIds,
+            ],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+                method: 'POST',
+                body: JSON.stringify(params),
+            }),
+            // A session-creating mutation must never serve a stale/cached result.
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, CreateSessionResponseStruct, 'sessions');
+    }
+    /**
+     * Checks whether KYC is required for the given vendor, country, and
+     * capabilities.
+     *
+     * @param params - The check parameters.
+     * @returns Whether KYC is required.
+     */
+    async checkKycRequired(params) {
+        const vendor = params.vendor ?? 'moonpay';
+        const url = new URL(`/vendors/${vendor}/kyc-required`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const capabilities = params.capabilities ?? [{ product: 'ramps' }];
+        const body = vendor === 'moonpay'
+            ? {
+                accessToken: params.accessToken,
+                country: params.country,
+                capabilities,
+            }
+            : {};
+        // MoonPay requires accessToken and country; validate before making the request.
+        if (vendor === 'moonpay') {
+            if (!params.accessToken) {
+                throw new Error('checkKycRequired: accessToken is required for vendor "moonpay".');
+            }
+            if (!params.country) {
+                throw new Error('checkKycRequired: country is required for vendor "moonpay".');
+            }
+        }
+        const data = await this.fetchQuery({
+            queryKey: [
+                `${this.name}:checkKycRequired`,
+                vendor,
+                params.accessToken ?? null,
+                params.country ?? null,
+                capabilities,
+            ],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+                method: 'POST',
+                body: JSON.stringify(body),
+            }),
+            // The requirement can change server-side, so always re-check.
+            staleTime: 0,
+            gcTime: 0,
+        });
+        const { required } = __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, KycRequiredResponseStruct, 'kyc-required');
+        return { kycRequired: required };
+    }
+    /**
+     * Creates (or resumes) an empty-shell customer for the authenticated
+     * canonical user on the given identity vendor. Must run before showing
+     * vendor T&C so the customer exists and resume logic can key off vendor
+     * status.
+     *
+     * @param params - The parameters.
+     * @param params.vendor - Identity vendor (e.g. `iron` for Money/VBA).
+     * @param params.email - Email associated with the customer.
+     * @returns The vendor customer record (subset validated for controller use).
+     */
+    async createVendorCustomer(params) {
+        const url = new URL(`/vendors/${params.vendor}/customers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [
+                `${this.name}:createVendorCustomer`,
+                params.vendor,
+                params.email,
+            ],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+                method: 'POST',
+                body: JSON.stringify({ email: params.email }),
+            }),
+            // Customer creation/resume must never serve a stale/cached result.
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, VendorCustomerResponseStruct, 'vendor customers');
+    }
+    /**
+     * Records vendor T&C acceptance (`POST /vendors/{vendor}/disclaimers`).
+     * For Iron this creates content signings from the disclaimer ids the
+     * customer accepted. Session-scoped idOS / KYC-provider consents are
+     * recorded separately via {@link submitSessionDisclaimers}. Retries re-POST
+     * the same ids, matching the legacy `POST /consents` signing step.
+     *
+     * @param params - The parameters.
+     * @param params.vendor - Identity vendor (e.g. `iron`).
+     * @param params.disclaimerIds - Accepted vendor T&C ids.
+     * @returns The vendor signing records.
+     */
+    async submitVendorDisclaimers(params) {
+        const url = new URL(`/vendors/${encodeURIComponent(params.vendor)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [
+                `${this.name}:submitVendorDisclaimers`,
+                params.vendor,
+                params.disclaimerIds,
+            ],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+                method: 'POST',
+                body: JSON.stringify({ disclaimerIds: params.disclaimerIds }),
+            }),
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, VendorSigningsResponseStruct, 'vendor disclaimers');
+    }
+    /**
+     * Fetches the session-scoped idOS + KYC-provider disclaimer catalog
+     * (`GET /sessions/{sessionId}/disclaimers`). Requires an existing UKYC
+     * session; vendor T&Cs continue to come from {@link fetchDisclaimers}.
+     *
+     * @param params - The parameters.
+     * @param params.sessionId - The UKYC session id.
+     * @returns The catalog, including which documents are already consented.
+     */
+    async fetchSessionDisclaimers(params) {
+        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:fetchSessionDisclaimers`, params.sessionId],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            // Consent state can change after a POST, so always re-fetch.
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionDisclaimersResponseStruct, 'session disclaimers');
+    }
+    /**
+     * Records idOS + KYC-provider consents for a UKYC session
+     * (`POST /sessions/{sessionId}/disclaimers`). `key`/`version` pairs must
+     * match the current catalog from {@link fetchSessionDisclaimers}. A 409
+     * means those document versions were already recorded for the session.
+     *
+     * @param params - The consent parameters.
+     * @returns The updated catalog after recording.
+     */
+    async submitSessionDisclaimers(params) {
+        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [
+                `${this.name}:submitSessionDisclaimers`,
+                params.sessionId,
+                params.idOS,
+                params.kycProvider,
+                params.credentialReusabilityConsentGiven,
+            ],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+                method: 'POST',
+                body: JSON.stringify({
+                    idOS: params.idOS,
+                    kycProvider: params.kycProvider,
+                    credentialReusabilityConsentGiven: params.credentialReusabilityConsentGiven,
+                }),
+            }),
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionDisclaimersResponseStruct, 'session disclaimers');
+    }
+    /**
+     * Fetches the user-keyed simplified KYC status used by Money toast / banner
+     * surfaces (`GET /kyc/status`).
+     *
+     * @returns The simplified status payload.
+     */
+    async fetchKycStatus() {
+        const url = new URL('/kyc/status', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:fetchKycStatus`],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            // Status is polled for toast flips, so it must always be fresh.
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, KycUserStatusResponseStruct, 'kyc status');
+    }
+    /**
+     * Fetches the Fractal encryption service JWKS used to verify the `jwtChain`s
+     * returned inside encryption schemas from {@link KycService.createUkycSession}.
+     *
+     * This is an unauthenticated request to a well-known path on the Fractal
+     * host, distinct from the UKYC base URL.
+     *
+     * @returns The JWKS keys.
+     */
+    async fetchJwks() {
+        if (!__classPrivateFieldGet(this, _KycService_fractalEncryptionBaseUrl, "f")) {
+            throw new Error('KycService: fractalEncryptionBaseUrl is not configured; cannot fetch JWKS to verify encryption schemas.');
+        }
+        const url = new URL(constants_js_1.UKYC_JWKS_PATH, __classPrivateFieldGet(this, _KycService_fractalEncryptionBaseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:fetchJwks`, __classPrivateFieldGet(this, _KycService_fractalEncryptionBaseUrl, "f")],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }, { authenticated: false }),
+            staleTime: (0, utils_1.inMilliseconds)(1, utils_1.Duration.Hour),
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, JwksResponseStruct, 'JWKS');
+    }
+    /**
+     * Creates a UKYC session for the SumSub document-verification sub-flow.
+     *
+     * The response carries per-secret encryption schemas (`encryptionDataKey` and
+     * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and
+     * the read-only `ukyc_capability_token` and submit them via
+     * {@link KycService.setAuthorizations}.
+     *
+     * @param params - The session parameters.
+     * @returns The UKYC session id and encryption schemas.
+     */
+    async createUkycSession(params) {
+        const url = new URL('/sessions', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:createUkycSession`, params.jwtToken],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+                method: 'POST',
+                body: JSON.stringify({
+                    vendorId: params.vendor ?? 'moonpay',
+                    vendorUserId: 'mockedId',
+                    jwtToken: params.jwtToken,
+                    vendorMetadata: params.vendorMetadata ?? {},
+                }),
+            }),
+            // A session-creating mutation must never serve a stale/cached result.
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, UkycSessionResponseStruct, 'UKYC sessions');
+    }
+    /**
+     * Submits the wrapped `data_encryption_key` and wrapped
+     * `ukyc_capability_token` for a UKYC session. Both secrets are sealed with
+     * `wrapEncryptionKey` against the encryption schemas returned by
+     * {@link KycService.createUkycSession}.
+     *
+     * @param params - The wrapped authorizations.
+     * @returns The session status after the authorizations are applied.
+     */
+    async setAuthorizations(params) {
+        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/authorizations`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:setAuthorizations`, params.sessionId],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+                method: 'POST',
+                body: JSON.stringify({
+                    wrappedEncryptionDataKey: params.wrappedEncryptionDataKey,
+                    wrappedUkycCapabilityToken: params.wrappedUkycCapabilityToken,
+                }),
+            }),
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionStatusResponseStruct, 'authorizations');
+    }
+    /**
+     * Creates (or refreshes) the SumSub verification journey for a UKYC session,
+     * returning the applicant access token used to launch the SDK.
+     *
+     * @param sessionId - The UKYC session id from `createUkycSession`.
+     * @returns The applicant access token and status.
+     */
+    async createJourney(sessionId) {
+        const url = new URL(`/sessions/${encodeURIComponent(sessionId)}/journey`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:createJourney`, sessionId],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'POST' }),
+            // Journeys are (re)created on demand; do not reuse a cached token.
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, ApplicantAccessTokenResponseStruct, 'journey');
+    }
+    /**
+     * Fetches the current status of a UKYC session. Polled after the SumSub SDK
+     * completes to determine the final verification decision.
+     *
+     * @param params - The parameters.
+     * @param params.sessionId - The UKYC session id.
+     * @returns The session status.
+     */
+    async getSessionStatus(params) {
+        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/status`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:getSessionStatus`, params.sessionId],
+            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            // Status is polled for a terminal decision, so it must always be fresh.
+            staleTime: 0,
+            gcTime: 0,
+        });
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionStatusResponseStruct, 'session status');
+    }
+}
+exports.KycService = KycService;
+_KycService_fetch = new WeakMap(), _KycService_baseUrl = new WeakMap(), _KycService_fractalEncryptionBaseUrl = new WeakMap(), _KycService_instances = new WeakSet(), _KycService_validateResponse = function _KycService_validateResponse(data, struct, apiName) {
+    try {
+        (0, superstruct_1.assert)(data, struct);
+        return data;
+    }
+    catch (error) {
+        const detail = error instanceof superstruct_1.StructError
+            ? `${error.message} (received: ${JSON.stringify(data)})`
+            : // `assert` only ever throws `StructError` for the plain structs used
+                // here, so this is a defensive fallback that is not exercised.
+                /* istanbul ignore next */
+                String(error);
+        throw new Error(`Malformed response received from ${apiName} API: ${detail}`);
+    }
+}, _KycService_requestJson = 
+/**
+ * Performs a single JSON request.
+ *
+ * This is meant to be used as the `queryFn` for {@link fetchQuery}, which
+ * wraps it in the shared service policy (retries, circuit breaker). Requests
+ * are authenticated with the wallet bearer token by default; pass
+ * `{ authenticated: false }` for calls to services that do not expect it
+ * (e.g. the Fractal JWKS endpoint).
+ *
+ * @param url - The request URL.
+ * @param init - The request init (method, body).
+ * @param options - Request options.
+ * @param options.authenticated - Whether to attach the bearer token. Defaults
+ * to `true`.
+ * @returns The parsed JSON response.
+ */
+async function _KycService_requestJson(url, init, options = {}) {
+    const { authenticated = true } = options;
+    const headers = {};
+    // Only advertise a JSON body when one is actually sent; bodyless requests
+    // (e.g. `createJourney`) must not carry a `Content-Type`.
+    if (init.body !== undefined && init.body !== null) {
+        headers['Content-Type'] = 'application/json';
+    }
+    if (authenticated) {
+        const bearerToken = await this.messenger.call('AuthenticationController:getBearerToken');
+        if (!bearerToken) {
+            throw new Error('Unable to obtain an authentication bearer token — is the wallet signed in?');
+        }
+        (0, superstruct_1.assert)(bearerToken, (0, superstruct_1.string)());
+        headers.Authorization = `Bearer ${bearerToken}`;
+    }
+    const response = await __classPrivateFieldGet(this, _KycService_fetch, "f").call(this, url.toString(), {
+        ...init,
+        headers,
+    });
+    if (!response.ok) {
+        let detail = '';
+        try {
+            const errorBody = await response.json();
+            if (errorBody && typeof errorBody === 'object') {
+                const record = errorBody;
+                if (typeof record.message === 'string') {
+                    detail = record.message;
+                }
+                else if (typeof record.error === 'string') {
+                    detail = record.error;
+                }
+            }
+        }
+        catch {
+            // Ignore body parse failures; status alone is still useful.
+        }
+        throw new controller_utils_1.HttpError(response.status, `Fetching '${url.toString()}' failed with status '${response.status}'${detail ? `: ${detail}` : ''}`);
+    }
+    // DELETE (and similar) endpoints return 204 No Content.
+    if (response.status === 204) {
+        return null;
+    }
+    return (await response.json());
+};
+//# sourceMappingURL=KycService.cjs.map