@metamask-previews/kyc-controller 0.0.0-preview-7cfd8be → 0.0.0-preview-a3cea003b

package/dist/KycController.mjs

@@ -9,7 +9,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_localUserSecretStore, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_fail;
+var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_hasTermsForVendor, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_fail;
 import { BaseController } from "@metamask/base-controller";
 import { x25519 } from "@noble/curves/ed25519";
 import { decryptCredentials, generateKeyPair } from "./crypto.mjs";
@@ -84,6 +84,12 @@ const SUCCESSFUL_SESSION_STATUSES = new Set([
 // to do, so the sub-flow stops before launching the SDK and surfaces this
 // message.
 const VENDOR_PROCESSING_MESSAGE = 'Your KYC has been submitted and is being processed by the vendor.';
+// UKYC / relay error indicating the applicant already finished KYC. Mapped to
+// the simplified `completed` user status for the Money toast surface.
+const SESSION_NOT_IN_VALID_STATE = 'session_not_in_valid_state';
+// How often to refresh the user-keyed `GET /kyc/status` while the simplified
+// status is still `pending`. Overridable via the constructor.
+const DEFAULT_USER_STATUS_POLL_INTERVAL_MS = 15000;
 const kycControllerMetadata = {
     phase: {
         includeInDebugSnapshot: true,
@@ -121,6 +127,24 @@ const kycControllerMetadata = {
         persist: true,
         usedInUi: false,
     },
+    termsAcceptedVendor: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
+    sumsubTncAccepted: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
+    idosTncAccepted: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
     disclaimers: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
@@ -157,6 +181,12 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
+    activeVendor: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: false,
+        usedInUi: true,
+    },
     activeProduct: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
@@ -175,6 +205,24 @@ const kycControllerMetadata = {
         persist: true,
         usedInUi: false,
     },
+    userStatus: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: true,
+    },
+    userStatusSumsubSessionId: {
+        includeInDebugSnapshot: false,
+        includeInStateLogs: false,
+        persist: true,
+        usedInUi: true,
+    },
+    userStatusErrorCode: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: true,
+    },
     sumsub: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
@@ -195,15 +243,22 @@ export function getDefaultKycControllerState() {
         email: null,
         termsAcceptedAt: null,
         acceptedDisclaimerIds: [],
+        termsAcceptedVendor: null,
+        sumsubTncAccepted: null,
+        idosTncAccepted: null,
         disclaimers: [],
         disclaimersError: null,
         geoCountry: null,
         sessionToken: null,
         accessToken: null,
         moonpayCustomerId: null,
+        activeVendor: 'moonpay',
         activeProduct: null,
         kycRequiredByProduct: {},
         lastCheckedAt: null,
+        userStatus: null,
+        userStatusSumsubSessionId: null,
+        userStatusErrorCode: null,
         sumsub: {
             status: 'idle',
             result: null,
@@ -213,11 +268,34 @@ export function getDefaultKycControllerState() {
         },
     };
 }
+/**
+ * Whether an error indicates the applicant already finished KYC — the UKYC /
+ * relay `session_not_in_valid_state` signal — which the controller maps to the
+ * simplified `completed` user status.
+ *
+ * @param error - The caught error.
+ * @returns `true` when the error carries the `session_not_in_valid_state`
+ * marker.
+ */
+function isSessionAlreadyCompletedError(error) {
+    return String(error).includes(SESSION_NOT_IN_VALID_STATE);
+}
+/**
+ * Vendors other than MoonPay skip Check/Auth frames and use the empty-shell
+ * customer + consents path instead.
+ *
+ * @param vendor - The identity vendor for the current flow.
+ * @returns `true` when the vendor uses the consents session path.
+ */
+function usesConsentsFlow(vendor) {
+    return vendor !== 'moonpay';
+}
 // === MESSENGER ===
 const MESSENGER_EXPOSED_METHODS = [
     'initialize',
     'loadDisclaimers',
     'acceptTermsAndStartSession',
+    'createVendorCustomer',
     'clearSavedTerms',
     'handleFrameMessage',
     'buildCheckFrameUrl',
@@ -225,6 +303,8 @@ const MESSENGER_EXPOSED_METHODS = [
     'buildResetFrameUrl',
     'checkKycRequired',
     'getKycStatus',
+    'getCustomerIdentity',
+    'refreshKycStatus',
     'startSumSub',
     'getSessionStatus',
     'reset',
@@ -247,8 +327,10 @@ export class KycController extends BaseController {
      * @param options.sumsubLauncher - The platform SumSub launcher adapter.
      * @param options.sessionStatusPollIntervalMs - How often to poll the UKYC
      * session status after the SumSub SDK completes.
+     * @param options.userStatusPollIntervalMs - How often to refresh the
+     * user-keyed KYC status while it is still `pending`.
      */
-    constructor({ messenger, state, sumsubLauncher, sessionStatusPollIntervalMs = DEFAULT_SESSION_STATUS_POLL_INTERVAL_MS, }) {
+    constructor({ messenger, state, sumsubLauncher, sessionStatusPollIntervalMs = DEFAULT_SESSION_STATUS_POLL_INTERVAL_MS, userStatusPollIntervalMs = DEFAULT_USER_STATUS_POLL_INTERVAL_MS, }) {
         super({
             messenger,
             metadata: kycControllerMetadata,
@@ -279,8 +361,23 @@ export class KycController extends BaseController {
          * let an already-awaiting request finish and reschedule.
          */
         _KycController_pollToken.set(this, 0);
+        /** Interval, in milliseconds, between user-keyed status polls. */
+        _KycController_userStatusPollIntervalMs.set(this, void 0);
+        /** Handle for the scheduled next user-status poll, or `null`. */
+        _KycController_userStatusPollTimer.set(this, null);
+        /**
+         * Whether a user-status poll loop is currently active. Tracked separately
+         * from {@link #userStatusPollTimer} because a scheduled tick clears the timer
+         * handle before awaiting `fetchKycStatus`; relying on the handle alone would
+         * let a concurrent {@link refreshKycStatus} start a second loop on the same
+         * token during that in-flight window.
+         */
+        _KycController_userStatusPolling.set(this, false);
+        /** Monotonic token for the user-status poll loop (see `#pollToken`). */
+        _KycController_userStatusPollToken.set(this, 0);
         __classPrivateFieldSet(this, _KycController_sumsubLauncher, sumsubLauncher, "f");
         __classPrivateFieldSet(this, _KycController_sessionStatusPollIntervalMs, sessionStatusPollIntervalMs, "f");
+        __classPrivateFieldSet(this, _KycController_userStatusPollIntervalMs, userStatusPollIntervalMs, "f");
         __classPrivateFieldSet(this, _KycController_keypair, generateKeyPair(), "f");
         this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
@@ -295,6 +392,8 @@ export class KycController extends BaseController {
      * authentication completes (and chains into document verification when KYC
      * is required). When omitted, the flow stops at `form` and the consumer must
      * call `checkKycRequired` manually.
+     * @param params.vendor - Identity vendor for this flow. Non-MoonPay vendors
+     * skip Check/Auth frames and use the consents path. Defaults to `moonpay`.
      */
     async initialize(params) {
         // A repeat `initialize` while a session flow is already in progress must
@@ -305,6 +404,7 @@ export class KycController extends BaseController {
         if (IN_PROGRESS_PHASES.includes(this.state.phase)) {
             return;
         }
+        const vendor = params?.vendor ?? 'moonpay';
         // `initialize` starts a fresh flow, so `activeProduct` is always reset to
         // this call's product (or `null`). Otherwise a prior run's product could
         // linger and cause `#continueAfterAuthentication` to auto-run the check /
@@ -313,6 +413,19 @@ export class KycController extends BaseController {
             if (params?.email) {
                 state.email = params.email;
             }
+            // Terms acceptance is vendor-scoped: reusing another vendor's saved
+            // acceptance would skip loading this vendor's disclaimers and submit its
+            // ids to the wrong vendor.
+            if (!__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_hasTermsForVendor).call(this, vendor)) {
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+            }
+            state.activeVendor = vendor;
+            // `moonpayCustomerId` is only ever issued by the MoonPay Check / Auth
+            // frames. Leaving it set while the flow switches to another vendor would
+            // make `getCustomerIdentity` report a MoonPay id under the wrong vendor.
+            if (vendor !== 'moonpay') {
+                state.moonpayCustomerId = null;
+            }
             state.activeProduct = params?.product ?? null;
         });
         // Capture the flow generation so a `reset()` landing while the async
@@ -329,10 +442,48 @@ export class KycController extends BaseController {
         catch {
             // Ignore; disclaimers loading will surface a country error if needed.
         }
+        if (usesConsentsFlow(vendor) && this.state.email) {
+            try {
+                await this.messenger.call('KycService:createVendorCustomer', {
+                    vendor,
+                    email: this.state.email,
+                });
+                if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                    return;
+                }
+            }
+            catch (error) {
+                if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                    return;
+                }
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Vendor customer creation failed: ${String(error)}`);
+                return;
+            }
+        }
         const hasTerms = Boolean(this.state.termsAcceptedAt) &&
             this.state.acceptedDisclaimerIds.length > 0;
         if (hasTerms && this.state.email) {
-            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
+            if (usesConsentsFlow(vendor)) {
+                // Consents-path vendors require T&C2 flags; if they weren't persisted
+                // (i.e. null from pre-migration state), require reacceptance.
+                const sumsubTncSigned = this.state.sumsubTncAccepted;
+                const idosTncSigned = this.state.idosTncAccepted;
+                if (sumsubTncSigned === null || idosTncSigned === null) {
+                    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+                        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+                        state.phase = 'terms';
+                    });
+                    await this.loadDisclaimers();
+                    return;
+                }
+                await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
+                    sumsubTncSigned,
+                    idosTncSigned,
+                });
+            }
+            else {
+                await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
+            }
             return;
         }
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
@@ -340,6 +491,43 @@ export class KycController extends BaseController {
         });
         await this.loadDisclaimers();
     }
+    /**
+     * Creates (or resumes) an empty-shell customer for the given identity
+     * vendor. Exposed so a consumer can ensure the customer exists before
+     * showing T&C screens independently of {@link initialize}.
+     *
+     * @param params - The parameters.
+     * @param params.vendor - Identity vendor for the customer.
+     * @param params.email - Email for the vendor customer.
+     */
+    async createVendorCustomer(params) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            state.email = params.email;
+            // See `initialize`: acceptance recorded for another vendor cannot carry
+            // over, and a MoonPay-issued customer id must not survive a switch to
+            // another vendor or `getCustomerIdentity` reports the wrong vendor.
+            if (!__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_hasTermsForVendor).call(this, params.vendor)) {
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+            }
+            state.activeVendor = params.vendor;
+            if (params.vendor !== 'moonpay') {
+                state.moonpayCustomerId = null;
+            }
+        });
+        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
+        try {
+            await this.messenger.call('KycService:createVendorCustomer', {
+                vendor: params.vendor,
+                email: params.email,
+            });
+        }
+        catch (error) {
+            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                return;
+            }
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Vendor customer creation failed: ${String(error)}`);
+        }
+    }
     /**
      * Loads the disclaimers for the resolved (or provided) country.
      *
@@ -360,7 +548,10 @@ export class KycController extends BaseController {
                     state.geoCountry = country;
                 });
             }
-            const disclaimers = await this.messenger.call('KycService:fetchDisclaimers', { country });
+            const disclaimers = await this.messenger.call('KycService:fetchDisclaimers', {
+                vendor: this.state.activeVendor,
+                country,
+            });
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
                 state.disclaimers = disclaimers;
                 state.disclaimersError = null;
@@ -376,25 +567,43 @@ export class KycController extends BaseController {
      * Captures terms acceptance for the currently loaded disclaimers and creates
      * a session.
      *
-     * @param params - Optional parameters.
+     * @param params - The parameters.
      * @param params.email - The account email to associate with the session.
      * @param params.product - The consuming feature the flow runs for. See
      * {@link initialize} for how the product drives the automatic post
      * authentication continuation.
+     * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).
+     * Required for every vendor so callers explicitly declare acceptance.
+     * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
+     * Required for every vendor so callers explicitly declare acceptance.
      */
     async acceptTermsAndStartSession(params) {
+        const sumsubTncSigned = params?.sumsubTncSigned;
+        const idosTncSigned = params?.idosTncSigned;
+        if (typeof sumsubTncSigned !== 'boolean' ||
+            typeof idosTncSigned !== 'boolean') {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing T&C2 acceptance flags.');
+            return;
+        }
         const termsAcceptedAt = new Date().toISOString();
         const disclaimerIds = this.state.disclaimers.map((disclaimer) => disclaimer.id);
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            if (params?.email) {
+            if (params.email) {
                 state.email = params.email;
             }
-            if (params?.product) {
+            if (params.product) {
                 state.activeProduct = params.product;
             }
             state.termsAcceptedAt = termsAcceptedAt;
             state.acceptedDisclaimerIds = disclaimerIds;
+            state.termsAcceptedVendor = state.activeVendor;
+            state.sumsubTncAccepted = sumsubTncSigned;
+            state.idosTncAccepted = idosTncSigned;
         });
+        if (usesConsentsFlow(this.state.activeVendor)) {
+            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, { sumsubTncSigned, idosTncSigned });
+            return;
+        }
         await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
     }
     /**
@@ -576,6 +785,25 @@ export class KycController extends BaseController {
     getKycStatus(params) {
         return this.state.kycRequiredByProduct[params.product];
     }
+    /**
+     * Returns the vendor-scoped identity for the currently authenticated
+     * customer, or `null` when the flow has not yet captured a vendor customer
+     * id (before authentication or after {@link reset}).
+     *
+     * Exposed so consumers (e.g. ramps autoramp creation) can attach the vendor
+     * customer id to downstream calls without reading the full KYC state, which
+     * also holds session/access tokens. The id is session-scoped and never
+     * persisted.
+     *
+     * @returns The current {@link KycCustomerIdentity}, or `null`.
+     */
+    getCustomerIdentity() {
+        const { moonpayCustomerId, activeVendor } = this.state;
+        if (!moonpayCustomerId) {
+            return null;
+        }
+        return { vendor: activeVendor, id: moonpayCustomerId };
+    }
     /**
      * Runs the SumSub document-verification sub-flow end to end:
      *
@@ -656,10 +884,7 @@ export class KycController extends BaseController {
             });
             const { sessionId, kycStatus, finalStatus } = await this.messenger.call('KycService:createUkycSession', {
                 jwtToken,
-                vendorMetadata: {
-                    moonPayAccessToken: this.state.accessToken,
-                    moonPayUserId: this.state.moonpayCustomerId,
-                },
+                ...__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_buildUkycSessionVendorFields).call(this),
                 wrappedEncryptionKey,
                 ukycCapabilityToken,
             });
@@ -749,6 +974,28 @@ export class KycController extends BaseController {
             return result;
         }
         catch (error) {
+            // Applicant already finished KYC — treat as completed for Money toast.
+            if (isSessionAlreadyCompletedError(error)) {
+                // A reset() may have landed while `launch` was in flight; forcing
+                // `completed` (and publishing `statusChanged`) on an idle controller
+                // would resurrect a flow the consumer already tore down.
+                if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                    return { alreadyCompleted: true };
+                }
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUserStatus).call(this, {
+                    status: 'completed',
+                    sumsubSessionId: null,
+                    errorCode: null,
+                });
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
+                    state.sumsub.status = 'complete';
+                    state.sumsub.result = { alreadyCompleted: true };
+                    state.statusMessage = 'KYC already completed.';
+                    state.phase = 'done';
+                    state.error = null;
+                });
+                return { alreadyCompleted: true };
+            }
             const result = { error: String(error) };
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
                 state.sumsub.status = 'failed';
@@ -757,6 +1004,31 @@ export class KycController extends BaseController {
             return result;
         }
     }
+    /**
+     * Refreshes the user-keyed simplified KYC status from `GET /kyc/status`,
+     * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and
+     * schedules short-interval polling while the status is `pending`.
+     *
+     * @returns The latest status payload.
+     */
+    async refreshKycStatus() {
+        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
+        const payload = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fetchAndApplyUserStatus).call(this);
+        // A `reset()` landing while the request was in flight already stopped
+        // polling and left the flow idle, and the payload above is the pre-reset
+        // cached status. Starting a loop from it would poll — and publish
+        // `statusChanged` — on a torn-down flow.
+        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+            return payload;
+        }
+        if (payload.status === 'pending') {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_ensureUserStatusPolling).call(this);
+        }
+        else {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
+        }
+        return payload;
+    }
     /**
      * Fetches the current UKYC session status for the active sub-flow and records
      * it on state. Useful for a one-off refresh outside the automatic polling
@@ -788,6 +1060,7 @@ export class KycController extends BaseController {
         // Stop any session-status polling so a late poll cannot write onto the
         // now-idle controller.
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopPolling).call(this);
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
         // Invalidate any in-flight async work started before this reset so its
         // results are discarded rather than written onto the now-idle controller.
         __classPrivateFieldSet(this, _KycController_generation, __classPrivateFieldGet(this, _KycController_generation, "f") + 1, "f");
@@ -800,6 +1073,7 @@ export class KycController extends BaseController {
             state.sessionToken = null;
             state.accessToken = null;
             state.moonpayCustomerId = null;
+            state.activeVendor = 'moonpay';
             state.activeProduct = null;
             state.sumsub = {
                 status: 'idle',
@@ -811,11 +1085,91 @@ export class KycController extends BaseController {
         });
     }
 }
-_KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
+_KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPolling = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
     return {
         get: async (path, entropySourceId) => this.messenger.call('UserStorageController:performGetStorage', path, entropySourceId),
         set: async (path, value, entropySourceId) => this.messenger.call('UserStorageController:performSetStorage', path, value, entropySourceId),
     };
+}, _KycController_startConsentsSession = 
+/**
+ * Consents-path vendors: post vendor signings + Sumsub/idOS ack, then
+ * launch SumSub — skipping MoonPay Check/Auth frames.
+ *
+ * @param consents - T&C2 boolean flags.
+ * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
+ * @param consents.idosTncSigned - Whether idOS T&C were accepted.
+ */
+async function _KycController_startConsentsSession(consents) {
+    const { email, acceptedDisclaimerIds } = this.state;
+    if (!email) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for consents session.');
+        return;
+    }
+    if (acceptedDisclaimerIds.length === 0) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing disclaimer acceptance.');
+        return;
+    }
+    const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+        state.error = null;
+        state.phase = 'session';
+        state.statusMessage = 'Submitting consents...';
+        // Consents-path vendors have no MoonPay session/access tokens.
+        state.sessionToken = null;
+        state.accessToken = null;
+    });
+    try {
+        await this.messenger.call('KycService:submitConsents', {
+            disclaimerIds: acceptedDisclaimerIds,
+            sumsubTncSigned: consents.sumsubTncSigned,
+            idosTncSigned: consents.idosTncSigned,
+        });
+        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+            return;
+        }
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            state.phase = 'submit';
+            state.statusMessage = 'Starting document verification...';
+        });
+        const sumsubResult = await this.startSumSub();
+        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+            return;
+        }
+        const sumsubError = sumsubResult?.error;
+        if (typeof sumsubError === 'string') {
+            throw new Error(sumsubError);
+        }
+        // After SumSub, refresh user-keyed status for the Money toast and start
+        // polling while still pending. Soft-fail: toast refresh must not rewind
+        // the consent / SumSub outcome.
+        try {
+            await this.refreshKycStatus();
+        }
+        catch (statusError) {
+            console.error('KYC status refresh failed:', statusError);
+        }
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
+            if (state.phase !== 'error' && state.phase !== 'done') {
+                state.phase = 'done';
+                state.statusMessage = 'KYC submitted.';
+            }
+        });
+    }
+    catch (error) {
+        console.error('Consents session failed:', error);
+        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+            return;
+        }
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+            state.activeProduct = null;
+            state.error = `Consents session failed: ${String(error)}`;
+            state.statusMessage =
+                'Consent / verification failed — accept the terms to try again.';
+            state.phase = 'terms';
+        });
+        await this.loadDisclaimers();
+    }
 }, _KycController_createSession = 
 /**
  * Creates a vendor session from the currently stored terms + email.
@@ -884,6 +1238,14 @@ async function _KycController_createSession() {
 }, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state) {
     state.termsAcceptedAt = null;
     state.acceptedDisclaimerIds = [];
+    state.termsAcceptedVendor = null;
+    state.sumsubTncAccepted = null;
+    state.idosTncAccepted = null;
+}, _KycController_hasTermsForVendor = function _KycController_hasTermsForVendor(vendor) {
+    if (this.state.termsAcceptedVendor === null) {
+        return false;
+    }
+    return this.state.termsAcceptedVendor === vendor;
 }, _KycController_handleCheckOutcome = 
 /**
  * Applies a Check-frame outcome.
@@ -981,6 +1343,101 @@ async function _KycController_continueAfterAuthentication() {
         state.statusMessage =
             'The vendor updated its Terms of Use — please re-accept.';
     });
+}, _KycController_buildUkycSessionVendorFields = function _KycController_buildUkycSessionVendorFields() {
+    if (this.state.activeVendor === 'moonpay') {
+        return {
+            vendor: 'moonpay',
+            vendorMetadata: {
+                moonPayAccessToken: this.state.accessToken,
+                moonPayUserId: this.state.moonpayCustomerId,
+            },
+        };
+    }
+    return { vendor: this.state.activeVendor };
+}, _KycController_fetchAndApplyUserStatus = 
+/**
+ * Fetches `GET /kyc/status` and applies it to state without managing the
+ * poll loop (used by both {@link refreshKycStatus} and the poll tick).
+ *
+ * @returns The latest status payload.
+ */
+async function _KycController_fetchAndApplyUserStatus() {
+    const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
+    const response = await this.messenger.call('KycService:fetchKycStatus');
+    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+        return {
+            status: this.state.userStatus ?? 'not-started',
+            sumsubSessionId: this.state.userStatusSumsubSessionId,
+            errorCode: this.state.userStatusErrorCode,
+        };
+    }
+    const payload = {
+        status: response.status,
+        sumsubSessionId: response.sumsubSessionId ?? null,
+        errorCode: response.errorCode ?? null,
+    };
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUserStatus).call(this, payload);
+    return payload;
+}, _KycController_applyUserStatus = function _KycController_applyUserStatus(payload) {
+    const previous = this.state.userStatus;
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+        state.userStatus = payload.status;
+        state.userStatusSumsubSessionId = payload.sumsubSessionId;
+        state.userStatusErrorCode = payload.errorCode;
+    });
+    if (previous !== payload.status) {
+        this.messenger.publish(`${controllerName}:statusChanged`, payload);
+    }
+}, _KycController_ensureUserStatusPolling = function _KycController_ensureUserStatusPolling() {
+    if (__classPrivateFieldGet(this, _KycController_userStatusPolling, "f")) {
+        return;
+    }
+    __classPrivateFieldSet(this, _KycController_userStatusPolling, true, "f");
+    const token = __classPrivateFieldGet(this, _KycController_userStatusPollToken, "f");
+    const tick = async () => {
+        try {
+            const payload = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fetchAndApplyUserStatus).call(this);
+            // Race with `reset()` / `#stopUserStatusPolling` while the request was
+            // in flight — do not reschedule onto an idle controller.
+            /* istanbul ignore next */
+            if (__classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") !== token) {
+                return;
+            }
+            if (payload.status !== 'pending') {
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
+                return;
+            }
+        }
+        catch {
+            // Keep polling on transient errors, unless the loop was superseded.
+            /* istanbul ignore next */
+            if (__classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") !== token) {
+                return;
+            }
+        }
+        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, setTimeout(() => {
+            __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
+            // eslint-disable-next-line @typescript-eslint/no-floating-promises
+            tick();
+        }, __classPrivateFieldGet(this, _KycController_userStatusPollIntervalMs, "f")), "f");
+        // Allow the process to exit while a pending-status poll is scheduled.
+        // React Native / browser timers are numbers with no `unref`, hence the
+        // optional call.
+        __classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f").unref?.();
+    };
+    __classPrivateFieldSet(this, _KycController_userStatusPollTimer, setTimeout(() => {
+        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
+        // eslint-disable-next-line @typescript-eslint/no-floating-promises
+        tick();
+    }, __classPrivateFieldGet(this, _KycController_userStatusPollIntervalMs, "f")), "f");
+    __classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f").unref?.();
+}, _KycController_stopUserStatusPolling = function _KycController_stopUserStatusPolling() {
+    __classPrivateFieldSet(this, _KycController_userStatusPollToken, __classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") + 1, "f");
+    __classPrivateFieldSet(this, _KycController_userStatusPolling, false, "f");
+    if (__classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f") !== null) {
+        clearTimeout(__classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f"));
+        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
+    }
 }, _KycController_startSessionStatusPolling = 
 /**
  * Begins polling the UKYC session status until a terminal decision is