@metamask-previews/kyc-controller 0.0.0-preview-8bfa290fb → 0.0.0-preview-ec24abb79

package/dist/index.d.cts

@@ -2,13 +2,13 @@ export { KycController, getDefaultKycControllerState, controllerName, } from "./
 export type { KycControllerActions, KycControllerEvents, KycControllerGetStateAction, KycControllerMessenger, KycControllerOptions, KycControllerState, KycControllerStateChangeEvent, KycControllerStatusChangedEvent, } from "./KycController.cjs";
 export type { KycControllerAcceptTermsAndStartSessionAction, KycControllerBuildAuthFrameUrlAction, KycControllerBuildCheckFrameUrlAction, KycControllerBuildResetFrameUrlAction, KycControllerCheckKycRequiredAction, KycControllerClearSavedTermsAction, KycControllerClearStateAction, KycControllerCreateVendorCustomerAction, KycControllerGetCustomerIdentityAction, KycControllerGetKycStatusAction, KycControllerGetSessionStatusAction, KycControllerHandleFrameMessageAction, KycControllerInitializeAction, KycControllerLoadDisclaimersAction, KycControllerRefreshKycStatusAction, KycControllerResetAction, KycControllerStartSumSubAction, } from "./KycController-method-action-types.cjs";
 export { KycService, serviceName } from "./KycService.cjs";
-export type { ApplicantAccessTokenResponse, CapabilityAuthorization, CheckKycRequiredParams, CreateVendorCustomerParams, CreateSessionParams, CreateUkycSessionParams, EncryptionSchema, FetchDisclaimersCatalogParams, FetchSessionDisclaimersParams, GetSessionStatusParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SetAuthorizationsParams, SubmitSessionDisclaimersParams, SubmitVendorDisclaimersParams, UkycSessionResponse, } from "./KycService.cjs";
-export type { KycServiceCheckKycRequiredAction, KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchVendorDisclaimersAction, KycServiceFetchDisclaimersCatalogAction, KycServiceFetchIdosEnclaveJwksAction, KycServiceFetchIdosRelayJwksAction, KycServiceFetchKycStatusAction, KycServiceFetchSessionDisclaimersAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceSetAuthorizationsAction, KycServiceSubmitSessionDisclaimersAction, KycServiceSubmitVendorDisclaimersAction, } from "./KycService-method-action-types.cjs";
+export type { ApplicantAccessTokenResponse, CapabilityAuthorization, CheckKycRequiredParams, CreateVendorCustomerParams, CreateSessionParams, CreateUkycSessionParams, EncryptionSchema, FetchSessionDisclaimersParams, GetSessionStatusParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SetAuthorizationsParams, SubmitSessionDisclaimersParams, SubmitVendorDisclaimersParams, UkycSessionResponse, } from "./KycService.cjs";
+export type { KycServiceCheckKycRequiredAction, KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchDisclaimersAction, KycServiceFetchIdosEnclaveJwksAction, KycServiceFetchIdosRelayJwksAction, KycServiceFetchKycStatusAction, KycServiceFetchSessionDisclaimersAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceSetAuthorizationsAction, KycServiceSubmitSessionDisclaimersAction, KycServiceSubmitVendorDisclaimersAction, } from "./KycService-method-action-types.cjs";
 export { selectIsKycRequiredForProduct, selectKycPhase, selectKycSumSub, } from "./selectors.cjs";
 export { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from "./countryCodes.cjs";
 export { decryptCredentials, generateKeyPair } from "./crypto.cjs";
 export type { DecryptedCredentials, DecryptResult, EncryptedCredentialsEnvelope, X25519KeyPair, } from "./crypto.cjs";
-export type { KycConsentDocument, KycConsentRecord, KycCustomerIdentity, KycDisclaimer, KycDisclaimersCatalog, KycPhase, KycProduct, KycSessionDisclaimers, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, KycVendorSigning, } from "./types.cjs";
+export type { KycConsentDocument, KycConsentRecord, KycCustomerIdentity, KycDisclaimer, KycPhase, KycProduct, KycSessionDisclaimers, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, KycVendorSigning, } from "./types.cjs";
 export { UKYC_CAPABILITY_AUTH_SCHEME, UKYC_KWIL_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES, UKYC_STORAGE_ACCESS_TOKEN_VERSION, } from "./ukyc/constants.cjs";
 export { deriveClientMaterial, encodeClientMaterial, } from "./ukyc/deriveClientMaterial.cjs";
 export type { EncodedUkycClientMaterial, UkycClientMaterial, } from "./ukyc/deriveClientMaterial.cjs";

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,sCAAsC,EACtC,uCAAuC,EACvC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,uCAAuC,EACvC,6BAA6B,EAC7B,gCAAgC,EAChC,iCAAiC,EACjC,wCAAwC,EACxC,uCAAuC,GACxC,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,gBAAgB,GACjB,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}
+{"version":3,"file":"index.d.cts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,uCAAuC,EACvC,6BAA6B,EAC7B,gCAAgC,EAChC,iCAAiC,EACjC,wCAAwC,EACxC,uCAAuC,GACxC,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,gBAAgB,GACjB,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}

package/dist/index.d.mts

@@ -2,13 +2,13 @@ export { KycController, getDefaultKycControllerState, controllerName, } from "./
 export type { KycControllerActions, KycControllerEvents, KycControllerGetStateAction, KycControllerMessenger, KycControllerOptions, KycControllerState, KycControllerStateChangeEvent, KycControllerStatusChangedEvent, } from "./KycController.mjs";
 export type { KycControllerAcceptTermsAndStartSessionAction, KycControllerBuildAuthFrameUrlAction, KycControllerBuildCheckFrameUrlAction, KycControllerBuildResetFrameUrlAction, KycControllerCheckKycRequiredAction, KycControllerClearSavedTermsAction, KycControllerClearStateAction, KycControllerCreateVendorCustomerAction, KycControllerGetCustomerIdentityAction, KycControllerGetKycStatusAction, KycControllerGetSessionStatusAction, KycControllerHandleFrameMessageAction, KycControllerInitializeAction, KycControllerLoadDisclaimersAction, KycControllerRefreshKycStatusAction, KycControllerResetAction, KycControllerStartSumSubAction, } from "./KycController-method-action-types.mjs";
 export { KycService, serviceName } from "./KycService.mjs";
-export type { ApplicantAccessTokenResponse, CapabilityAuthorization, CheckKycRequiredParams, CreateVendorCustomerParams, CreateSessionParams, CreateUkycSessionParams, EncryptionSchema, FetchDisclaimersCatalogParams, FetchSessionDisclaimersParams, GetSessionStatusParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SetAuthorizationsParams, SubmitSessionDisclaimersParams, SubmitVendorDisclaimersParams, UkycSessionResponse, } from "./KycService.mjs";
-export type { KycServiceCheckKycRequiredAction, KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchVendorDisclaimersAction, KycServiceFetchDisclaimersCatalogAction, KycServiceFetchIdosEnclaveJwksAction, KycServiceFetchIdosRelayJwksAction, KycServiceFetchKycStatusAction, KycServiceFetchSessionDisclaimersAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceSetAuthorizationsAction, KycServiceSubmitSessionDisclaimersAction, KycServiceSubmitVendorDisclaimersAction, } from "./KycService-method-action-types.mjs";
+export type { ApplicantAccessTokenResponse, CapabilityAuthorization, CheckKycRequiredParams, CreateVendorCustomerParams, CreateSessionParams, CreateUkycSessionParams, EncryptionSchema, FetchSessionDisclaimersParams, GetSessionStatusParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SetAuthorizationsParams, SubmitSessionDisclaimersParams, SubmitVendorDisclaimersParams, UkycSessionResponse, } from "./KycService.mjs";
+export type { KycServiceCheckKycRequiredAction, KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateSessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchDisclaimersAction, KycServiceFetchIdosEnclaveJwksAction, KycServiceFetchIdosRelayJwksAction, KycServiceFetchKycStatusAction, KycServiceFetchSessionDisclaimersAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceSetAuthorizationsAction, KycServiceSubmitSessionDisclaimersAction, KycServiceSubmitVendorDisclaimersAction, } from "./KycService-method-action-types.mjs";
 export { selectIsKycRequiredForProduct, selectKycPhase, selectKycSumSub, } from "./selectors.mjs";
 export { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from "./countryCodes.mjs";
 export { decryptCredentials, generateKeyPair } from "./crypto.mjs";
 export type { DecryptedCredentials, DecryptResult, EncryptedCredentialsEnvelope, X25519KeyPair, } from "./crypto.mjs";
-export type { KycConsentDocument, KycConsentRecord, KycCustomerIdentity, KycDisclaimer, KycDisclaimersCatalog, KycPhase, KycProduct, KycSessionDisclaimers, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, KycVendorSigning, } from "./types.mjs";
+export type { KycConsentDocument, KycConsentRecord, KycCustomerIdentity, KycDisclaimer, KycPhase, KycProduct, KycSessionDisclaimers, KycSessionStatus, KycSumSubLaunchParams, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycUserStatusResponse, KycVendor, KycVendorSigning, } from "./types.mjs";
 export { UKYC_CAPABILITY_AUTH_SCHEME, UKYC_KWIL_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE, UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES, UKYC_STORAGE_ACCESS_TOKEN_VERSION, } from "./ukyc/constants.mjs";
 export { deriveClientMaterial, encodeClientMaterial, } from "./ukyc/deriveClientMaterial.mjs";
 export type { EncodedUkycClientMaterial, UkycClientMaterial, } from "./ukyc/deriveClientMaterial.mjs";

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,sCAAsC,EACtC,uCAAuC,EACvC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,uCAAuC,EACvC,6BAA6B,EAC7B,gCAAgC,EAChC,iCAAiC,EACjC,wCAAwC,EACxC,uCAAuC,GACxC,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,gBAAgB,GACjB,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,GACf,4BAA2B;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,+BAA+B,GAChC,4BAA2B;AAC5B,YAAY,EACV,6CAA6C,EAC7C,oCAAoC,EACpC,qCAAqC,EACrC,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,uCAAuC,EACvC,sCAAsC,EACtC,+BAA+B,EAC/B,mCAAmC,EACnC,qCAAqC,EACrC,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,wBAAwB,EACxB,8BAA8B,GAC/B,gDAA+C;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AAC1D,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,GACpB,yBAAwB;AACzB,YAAY,EACV,gCAAgC,EAChC,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,oCAAoC,EACpC,kCAAkC,EAClC,8BAA8B,EAC9B,uCAAuC,EACvC,6BAA6B,EAC7B,gCAAgC,EAChC,iCAAiC,EACjC,wCAAwC,EACxC,uCAAuC,GACxC,6CAA4C;AAE7C,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,GAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,qBAAoB;AAErB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,gBAAgB,GACjB,oBAAmB;AAIpB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,wCAAuC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,wCAAuC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,sCAAqC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,sCAAqC;AACtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,6BAA4B"}

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACf,4BAA2B;AA+B5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AA6C1D,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,EAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AA2BlE,iFAAiF;AACjF,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,EAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,wCAAuC;AAKxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACvB,sCAAqC;AAQtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B","sourcesContent":["export {\n  KycController,\n  getDefaultKycControllerState,\n  controllerName,\n} from './KycController.js';\nexport type {\n  KycControllerActions,\n  KycControllerEvents,\n  KycControllerGetStateAction,\n  KycControllerMessenger,\n  KycControllerOptions,\n  KycControllerState,\n  KycControllerStateChangeEvent,\n  KycControllerStatusChangedEvent,\n} from './KycController.js';\nexport type {\n  KycControllerAcceptTermsAndStartSessionAction,\n  KycControllerBuildAuthFrameUrlAction,\n  KycControllerBuildCheckFrameUrlAction,\n  KycControllerBuildResetFrameUrlAction,\n  KycControllerCheckKycRequiredAction,\n  KycControllerClearSavedTermsAction,\n  KycControllerClearStateAction,\n  KycControllerCreateVendorCustomerAction,\n  KycControllerGetCustomerIdentityAction,\n  KycControllerGetKycStatusAction,\n  KycControllerGetSessionStatusAction,\n  KycControllerHandleFrameMessageAction,\n  KycControllerInitializeAction,\n  KycControllerLoadDisclaimersAction,\n  KycControllerRefreshKycStatusAction,\n  KycControllerResetAction,\n  KycControllerStartSumSubAction,\n} from './KycController-method-action-types.js';\n\nexport { KycService, serviceName } from './KycService.js';\nexport type {\n  ApplicantAccessTokenResponse,\n  CapabilityAuthorization,\n  CheckKycRequiredParams,\n  CreateVendorCustomerParams,\n  CreateSessionParams,\n  CreateUkycSessionParams,\n  EncryptionSchema,\n  FetchDisclaimersCatalogParams,\n  FetchSessionDisclaimersParams,\n  GetSessionStatusParams,\n  VendorCustomerResponse,\n  JwksResponse,\n  KycServiceActions,\n  KycServiceCacheUpdatedEvent,\n  KycServiceEvents,\n  KycServiceGranularCacheUpdatedEvent,\n  KycServiceInvalidateQueriesAction,\n  KycServiceMessenger,\n  KycServiceOptions,\n  SetAuthorizationsParams,\n  SubmitSessionDisclaimersParams,\n  SubmitVendorDisclaimersParams,\n  UkycSessionResponse,\n} from './KycService.js';\nexport type {\n  KycServiceCheckKycRequiredAction,\n  KycServiceCreateVendorCustomerAction,\n  KycServiceCreateJourneyAction,\n  KycServiceCreateSessionAction,\n  KycServiceCreateUkycSessionAction,\n  KycServiceFetchVendorDisclaimersAction,\n  KycServiceFetchDisclaimersCatalogAction,\n  KycServiceFetchIdosEnclaveJwksAction,\n  KycServiceFetchIdosRelayJwksAction,\n  KycServiceFetchKycStatusAction,\n  KycServiceFetchSessionDisclaimersAction,\n  KycServiceGetGeoCountryAction,\n  KycServiceGetSessionStatusAction,\n  KycServiceSetAuthorizationsAction,\n  KycServiceSubmitSessionDisclaimersAction,\n  KycServiceSubmitVendorDisclaimersAction,\n} from './KycService-method-action-types.js';\n\nexport {\n  selectIsKycRequiredForProduct,\n  selectKycPhase,\n  selectKycSumSub,\n} from './selectors.js';\n\nexport { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from './countryCodes.js';\nexport { decryptCredentials, generateKeyPair } from './crypto.js';\nexport type {\n  DecryptedCredentials,\n  DecryptResult,\n  EncryptedCredentialsEnvelope,\n  X25519KeyPair,\n} from './crypto.js';\n\nexport type {\n  KycConsentDocument,\n  KycConsentRecord,\n  KycCustomerIdentity,\n  KycDisclaimer,\n  KycDisclaimersCatalog,\n  KycPhase,\n  KycProduct,\n  KycSessionDisclaimers,\n  KycSessionStatus,\n  KycSumSubLaunchParams,\n  KycSumSubLauncher,\n  KycSumSubStatus,\n  KycUserStatus,\n  KycUserStatusResponse,\n  KycVendor,\n  KycVendorSigning,\n} from './types.js';\n\n// UKYC storage-access-token utilities. Exported so a signed capability token can\n// be minted for testing UKYC Storage (see `mintUkycTestToken`).\nexport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_KWIL_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './ukyc/constants.js';\nexport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport type {\n  EncodedUkycClientMaterial,\n  UkycClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nexport type {\n  SignStorageAccessTokenParams,\n  UkycStorageAccessToken,\n  UkycStorageAccessTokenPayload,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './ukyc/storageAccessToken.js';\nexport { mintUkycTestToken } from './ukyc/testToken.js';\nexport type {\n  MintedUkycTestToken,\n  MintUkycTestTokenParams,\n} from './ukyc/testToken.js';\n"]}
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACf,4BAA2B;AA+B5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAwB;AA2C1D,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,eAAe,EAChB,wBAAuB;AAExB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,2BAA0B;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,qBAAoB;AA0BlE,iFAAiF;AACjF,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,EAClC,6BAA4B;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,wCAAuC;AAKxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,EACvB,sCAAqC;AAQtC,OAAO,EAAE,iBAAiB,EAAE,6BAA4B","sourcesContent":["export {\n  KycController,\n  getDefaultKycControllerState,\n  controllerName,\n} from './KycController.js';\nexport type {\n  KycControllerActions,\n  KycControllerEvents,\n  KycControllerGetStateAction,\n  KycControllerMessenger,\n  KycControllerOptions,\n  KycControllerState,\n  KycControllerStateChangeEvent,\n  KycControllerStatusChangedEvent,\n} from './KycController.js';\nexport type {\n  KycControllerAcceptTermsAndStartSessionAction,\n  KycControllerBuildAuthFrameUrlAction,\n  KycControllerBuildCheckFrameUrlAction,\n  KycControllerBuildResetFrameUrlAction,\n  KycControllerCheckKycRequiredAction,\n  KycControllerClearSavedTermsAction,\n  KycControllerClearStateAction,\n  KycControllerCreateVendorCustomerAction,\n  KycControllerGetCustomerIdentityAction,\n  KycControllerGetKycStatusAction,\n  KycControllerGetSessionStatusAction,\n  KycControllerHandleFrameMessageAction,\n  KycControllerInitializeAction,\n  KycControllerLoadDisclaimersAction,\n  KycControllerRefreshKycStatusAction,\n  KycControllerResetAction,\n  KycControllerStartSumSubAction,\n} from './KycController-method-action-types.js';\n\nexport { KycService, serviceName } from './KycService.js';\nexport type {\n  ApplicantAccessTokenResponse,\n  CapabilityAuthorization,\n  CheckKycRequiredParams,\n  CreateVendorCustomerParams,\n  CreateSessionParams,\n  CreateUkycSessionParams,\n  EncryptionSchema,\n  FetchSessionDisclaimersParams,\n  GetSessionStatusParams,\n  VendorCustomerResponse,\n  JwksResponse,\n  KycServiceActions,\n  KycServiceCacheUpdatedEvent,\n  KycServiceEvents,\n  KycServiceGranularCacheUpdatedEvent,\n  KycServiceInvalidateQueriesAction,\n  KycServiceMessenger,\n  KycServiceOptions,\n  SetAuthorizationsParams,\n  SubmitSessionDisclaimersParams,\n  SubmitVendorDisclaimersParams,\n  UkycSessionResponse,\n} from './KycService.js';\nexport type {\n  KycServiceCheckKycRequiredAction,\n  KycServiceCreateVendorCustomerAction,\n  KycServiceCreateJourneyAction,\n  KycServiceCreateSessionAction,\n  KycServiceCreateUkycSessionAction,\n  KycServiceFetchDisclaimersAction,\n  KycServiceFetchIdosEnclaveJwksAction,\n  KycServiceFetchIdosRelayJwksAction,\n  KycServiceFetchKycStatusAction,\n  KycServiceFetchSessionDisclaimersAction,\n  KycServiceGetGeoCountryAction,\n  KycServiceGetSessionStatusAction,\n  KycServiceSetAuthorizationsAction,\n  KycServiceSubmitSessionDisclaimersAction,\n  KycServiceSubmitVendorDisclaimersAction,\n} from './KycService-method-action-types.js';\n\nexport {\n  selectIsKycRequiredForProduct,\n  selectKycPhase,\n  selectKycSumSub,\n} from './selectors.js';\n\nexport { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from './countryCodes.js';\nexport { decryptCredentials, generateKeyPair } from './crypto.js';\nexport type {\n  DecryptedCredentials,\n  DecryptResult,\n  EncryptedCredentialsEnvelope,\n  X25519KeyPair,\n} from './crypto.js';\n\nexport type {\n  KycConsentDocument,\n  KycConsentRecord,\n  KycCustomerIdentity,\n  KycDisclaimer,\n  KycPhase,\n  KycProduct,\n  KycSessionDisclaimers,\n  KycSessionStatus,\n  KycSumSubLaunchParams,\n  KycSumSubLauncher,\n  KycSumSubStatus,\n  KycUserStatus,\n  KycUserStatusResponse,\n  KycVendor,\n  KycVendorSigning,\n} from './types.js';\n\n// UKYC storage-access-token utilities. Exported so a signed capability token can\n// be minted for testing UKYC Storage (see `mintUkycTestToken`).\nexport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_KWIL_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './ukyc/constants.js';\nexport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport type {\n  EncodedUkycClientMaterial,\n  UkycClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nexport type {\n  SignStorageAccessTokenParams,\n  UkycStorageAccessToken,\n  UkycStorageAccessTokenPayload,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './ukyc/storageAccessToken.js';\nexport { mintUkycTestToken } from './ukyc/testToken.js';\nexport type {\n  MintedUkycTestToken,\n  MintUkycTestTokenParams,\n} from './ukyc/testToken.js';\n"]}

package/dist/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for toast /\n * banner rendering. Collapses vendor + SumSub / relay state into the offsite\n * contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or creating the UKYC\n *   session and recording session-scoped disclaimers (non-MoonPay vendors).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Consents-path vendors skip\n *   this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a vendor session is\n * created (`GET /vendors/{vendor}/disclaimers`).\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * A vendor T&C signing returned by `POST /vendors/{vendor}/disclaimers`.\n */\nexport type KycVendorSigning = {\n  /** Iron signing id. */\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  customer_id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  content_id?: string;\n};\n\n/**\n * A legal document in the idOS / KYC-provider catalog\n * (`GET /disclaimers`, or `GET`/`POST /sessions/{sessionId}/disclaimers`).\n */\nexport type KycConsentDocument = {\n  /** Stable identifier of the legal document. */\n  key: string;\n  /** Version of the document currently in force. */\n  version: string;\n  /** Human-readable document title. */\n  title: string;\n  /** URL the document body is hosted at. */\n  url: string;\n  /**\n   * Whether the document version has already been consented to (session-scoped\n   * fetches). For the global catalog this is typically `false`.\n   */\n  consented: boolean;\n};\n\n/**\n * A consent record posted for a catalog document. `key` and `version` must\n * match the current session catalog.\n */\nexport type KycConsentRecord = {\n  key: string;\n  version: string;\n};\n\n/**\n * idOS / KYC-provider disclaimer catalog returned by\n * `GET /disclaimers?country=` (no session — no credential-reuse consent state).\n */\nexport type KycDisclaimersCatalog = {\n  /** idOS legal documents. */\n  idOS: KycConsentDocument[];\n  /** KYC provider (SumSub) legal documents. */\n  kycProvider: KycConsentDocument[];\n};\n\n/**\n * Session-scoped disclaimer catalog returned by\n * `GET`/`POST /sessions/{sessionId}/disclaimers`.\n */\nexport type KycSessionDisclaimers = KycDisclaimersCatalog & {\n  /** Whether the user consented to reuse existing idOS credentials. */\n  credentialReusabilityConsentGiven: boolean;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}
+{"version":3,"file":"types.cjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for toast /\n * banner rendering. Collapses vendor + SumSub / relay state into the offsite\n * contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or creating the UKYC\n *   session and recording session-scoped disclaimers (non-MoonPay vendors).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Consents-path vendors skip\n *   this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a vendor session is\n * created (`GET /vendors/{vendor}/disclaimers`).\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * A vendor T&C signing returned by `POST /vendors/{vendor}/disclaimers`.\n */\nexport type KycVendorSigning = {\n  /** Iron signing id. */\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  customer_id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  content_id?: string;\n};\n\n/**\n * A legal document in the session-scoped idOS / KYC-provider catalog\n * (`GET`/`POST /sessions/{sessionId}/disclaimers`).\n */\nexport type KycConsentDocument = {\n  /** Stable identifier of the legal document. */\n  key: string;\n  /** Version of the document currently in force. */\n  version: string;\n  /** Human-readable document title. */\n  title: string;\n  /** URL the document body is hosted at. */\n  url: string;\n  /** Whether this session already consented to this document version. */\n  consented: boolean;\n};\n\n/**\n * A consent record posted for a catalog document. `key` and `version` must\n * match the current session catalog.\n */\nexport type KycConsentRecord = {\n  key: string;\n  version: string;\n};\n\n/**\n * Session-scoped disclaimer catalog returned by\n * `GET`/`POST /sessions/{sessionId}/disclaimers`.\n */\nexport type KycSessionDisclaimers = {\n  /** idOS legal documents. */\n  idOS: KycConsentDocument[];\n  /** KYC provider (SumSub) legal documents. */\n  kycProvider: KycConsentDocument[];\n  /** Whether the user consented to reuse existing idOS credentials. */\n  credentialReusabilityConsentGiven: boolean;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}

package/dist/types.d.cts

@@ -124,8 +124,8 @@ export type KycVendorSigning = {
     content_id?: string;
 };
 /**
- * A legal document in the idOS / KYC-provider catalog
- * (`GET /disclaimers`, or `GET`/`POST /sessions/{sessionId}/disclaimers`).
+ * A legal document in the session-scoped idOS / KYC-provider catalog
+ * (`GET`/`POST /sessions/{sessionId}/disclaimers`).
  */
 export type KycConsentDocument = {
     /** Stable identifier of the legal document. */
@@ -136,10 +136,7 @@ export type KycConsentDocument = {
     title: string;
     /** URL the document body is hosted at. */
     url: string;
-    /**
-     * Whether the document version has already been consented to (session-scoped
-     * fetches). For the global catalog this is typically `false`.
-     */
+    /** Whether this session already consented to this document version. */
     consented: boolean;
 };
 /**
@@ -151,20 +148,14 @@ export type KycConsentRecord = {
     version: string;
 };
 /**
- * idOS / KYC-provider disclaimer catalog returned by
- * `GET /disclaimers?country=` (no session — no credential-reuse consent state).
+ * Session-scoped disclaimer catalog returned by
+ * `GET`/`POST /sessions/{sessionId}/disclaimers`.
  */
-export type KycDisclaimersCatalog = {
+export type KycSessionDisclaimers = {
     /** idOS legal documents. */
     idOS: KycConsentDocument[];
     /** KYC provider (SumSub) legal documents. */
     kycProvider: KycConsentDocument[];
-};
-/**
- * Session-scoped disclaimer catalog returned by
- * `GET`/`POST /sessions/{sessionId}/disclaimers`.
- */
-export type KycSessionDisclaimers = KycDisclaimersCatalog & {
     /** Whether the user consented to reuse existing idOS credentials. */
     credentialReusabilityConsentGiven: boolean;
 };

package/dist/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAGX,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,4BAA4B;IAC5B,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,GAAG;IAC1D,qEAAqE;IACrE,iCAAiC,EAAE,OAAO,CAAC;CAC5C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}
+{"version":3,"file":"types.d.cts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAGX,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,4BAA4B;IAC5B,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,qEAAqE;IACrE,iCAAiC,EAAE,OAAO,CAAC;CAC5C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}

package/dist/types.d.mts

@@ -124,8 +124,8 @@ export type KycVendorSigning = {
     content_id?: string;
 };
 /**
- * A legal document in the idOS / KYC-provider catalog
- * (`GET /disclaimers`, or `GET`/`POST /sessions/{sessionId}/disclaimers`).
+ * A legal document in the session-scoped idOS / KYC-provider catalog
+ * (`GET`/`POST /sessions/{sessionId}/disclaimers`).
  */
 export type KycConsentDocument = {
     /** Stable identifier of the legal document. */
@@ -136,10 +136,7 @@ export type KycConsentDocument = {
     title: string;
     /** URL the document body is hosted at. */
     url: string;
-    /**
-     * Whether the document version has already been consented to (session-scoped
-     * fetches). For the global catalog this is typically `false`.
-     */
+    /** Whether this session already consented to this document version. */
     consented: boolean;
 };
 /**
@@ -151,20 +148,14 @@ export type KycConsentRecord = {
     version: string;
 };
 /**
- * idOS / KYC-provider disclaimer catalog returned by
- * `GET /disclaimers?country=` (no session — no credential-reuse consent state).
+ * Session-scoped disclaimer catalog returned by
+ * `GET`/`POST /sessions/{sessionId}/disclaimers`.
  */
-export type KycDisclaimersCatalog = {
+export type KycSessionDisclaimers = {
     /** idOS legal documents. */
     idOS: KycConsentDocument[];
     /** KYC provider (SumSub) legal documents. */
     kycProvider: KycConsentDocument[];
-};
-/**
- * Session-scoped disclaimer catalog returned by
- * `GET`/`POST /sessions/{sessionId}/disclaimers`.
- */
-export type KycSessionDisclaimers = KycDisclaimersCatalog & {
     /** Whether the user consented to reuse existing idOS credentials. */
     credentialReusabilityConsentGiven: boolean;
 };

package/dist/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAGX,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,4BAA4B;IAC5B,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,GAAG;IAC1D,qEAAqE;IACrE,iCAAiC,EAAE,OAAO,CAAC;CAC5C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}
+{"version":3,"file":"types.d.mts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,sEAAsE;IACtE,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,SAAS,GACT,uBAAuB,GACvB,kBAAkB,GAClB,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,SAAS,GACT,OAAO,GACP,MAAM,GACN,MAAM,GACN,QAAQ,GACR,MAAM,GACN,OAAO,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,iBAAiB,GACjB,eAAe,GACf,WAAW,GACX,YAAY,GACZ,SAAS,GACT,UAAU,GACV,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IAGX,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAGX,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,4BAA4B;IAC5B,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,qEAAqE;IACrE,iCAAiC,EAAE,OAAO,CAAC;CAC5C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;OAEG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjE;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC;IAEvB;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzE,CAAC"}

package/dist/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for toast /\n * banner rendering. Collapses vendor + SumSub / relay state into the offsite\n * contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or creating the UKYC\n *   session and recording session-scoped disclaimers (non-MoonPay vendors).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Consents-path vendors skip\n *   this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a vendor session is\n * created (`GET /vendors/{vendor}/disclaimers`).\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * A vendor T&C signing returned by `POST /vendors/{vendor}/disclaimers`.\n */\nexport type KycVendorSigning = {\n  /** Iron signing id. */\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  customer_id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  content_id?: string;\n};\n\n/**\n * A legal document in the idOS / KYC-provider catalog\n * (`GET /disclaimers`, or `GET`/`POST /sessions/{sessionId}/disclaimers`).\n */\nexport type KycConsentDocument = {\n  /** Stable identifier of the legal document. */\n  key: string;\n  /** Version of the document currently in force. */\n  version: string;\n  /** Human-readable document title. */\n  title: string;\n  /** URL the document body is hosted at. */\n  url: string;\n  /**\n   * Whether the document version has already been consented to (session-scoped\n   * fetches). For the global catalog this is typically `false`.\n   */\n  consented: boolean;\n};\n\n/**\n * A consent record posted for a catalog document. `key` and `version` must\n * match the current session catalog.\n */\nexport type KycConsentRecord = {\n  key: string;\n  version: string;\n};\n\n/**\n * idOS / KYC-provider disclaimer catalog returned by\n * `GET /disclaimers?country=` (no session — no credential-reuse consent state).\n */\nexport type KycDisclaimersCatalog = {\n  /** idOS legal documents. */\n  idOS: KycConsentDocument[];\n  /** KYC provider (SumSub) legal documents. */\n  kycProvider: KycConsentDocument[];\n};\n\n/**\n * Session-scoped disclaimer catalog returned by\n * `GET`/`POST /sessions/{sessionId}/disclaimers`.\n */\nexport type KycSessionDisclaimers = KycDisclaimersCatalog & {\n  /** Whether the user consented to reuse existing idOS credentials. */\n  credentialReusabilityConsentGiven: boolean;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}
+{"version":3,"file":"types.mjs","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * Shared types for the KYC controller and service.\n *\n * The KYC flow is vendor-backed (currently MoonPay for identity + SumSub for\n * document verification) but the surface exposed to consumers (ramps, card) is\n * intentionally vendor-neutral so a future vendor swap does not ripple out.\n */\n\n/**\n * A MetaMask feature that consumes KYC. Used to key the per-product\n * \"is KYC required\" cache so ramps, card, and money can share one controller.\n */\nexport type KycProduct = 'ramps' | 'card' | 'money';\n\n/**\n * Identity vendors supported behind the KYC surface.\n *\n * - `moonpay` — MoonPay Check/Auth frames + SumSub documents.\n * - `iron` — Iron-only Money/VBA path: empty-shell customer → consents →\n *   SumSub, with no MoonPay Check/Auth frames.\n */\nexport type KycVendor = 'moonpay' | 'iron';\n\n/**\n * Vendor-scoped identity for the currently authenticated KYC customer.\n *\n * Exposed to consumers (e.g. ramps) that must attach the vendor customer id to\n * downstream provider calls without reading the full KYC state, which also\n * holds session/access tokens. The identifier is session-scoped: it is only\n * available once the customer has authenticated through the current flow and\n * is cleared on `reset()`.\n */\nexport type KycCustomerIdentity = {\n  /** The identity vendor that issued {@link KycCustomerIdentity.id}. */\n  vendor: KycVendor;\n  /** The vendor customer id (e.g. MoonPay customer UUID). */\n  id: string;\n};\n\n/**\n * User-keyed KYC status returned by `GET /kyc/status` and stored for toast /\n * banner rendering. Collapses vendor + SumSub / relay state into the offsite\n * contract.\n */\nexport type KycUserStatus =\n  | 'not-started'\n  | 'pending'\n  | 'need-more-information'\n  | 'terminal-failure'\n  | 'completed';\n\n/**\n * Payload from `GET /kyc/status`, including optional fields that power the\n * 3-state error contract (retryable SumSub vs terminal vs EDD).\n */\nexport type KycUserStatusResponse = {\n  status: KycUserStatus;\n  /** Present when the user can reopen a SumSub session (retryable path). */\n  sumsubSessionId?: string;\n  /** Machine-readable error code for terminal / EDD UX. */\n  errorCode?: string;\n};\n\n/**\n * Phases of the end-to-end identity flow.\n *\n * - `idle` — nothing started.\n * - `terms` — waiting for the customer to accept the vendor terms.\n * - `session` — creating the vendor session (MoonPay) or creating the UKYC\n *   session and recording session-scoped disclaimers (non-MoonPay vendors).\n * - `check` — running the invisible connection-check frame (MoonPay only).\n * - `auth` — running the visible authentication (OTP) frame (MoonPay only).\n * - `form` — authenticated. When the flow is scoped to a product, the\n *   KYC-required check runs automatically from here; otherwise the consumer\n *   drives it manually via `checkKycRequired`. Consents-path vendors skip\n *   this phase.\n * - `submit` — submitting the KYC-required check / launching SumSub.\n * - `done` — flow complete; see `kycRequiredByProduct` / `sumsub` /\n *   `userStatus`. When KYC is required, the document-verification sub-flow is\n *   launched automatically.\n * - `error` — flow halted; see `error`.\n */\nexport type KycPhase =\n  | 'idle'\n  | 'terms'\n  | 'session'\n  | 'check'\n  | 'auth'\n  | 'form'\n  | 'submit'\n  | 'done'\n  | 'error';\n\n/**\n * Progress of the SumSub document-verification sub-flow.\n *\n * - `polling` — the SDK finished and the controller is polling the UKYC\n *   backend for the session's final decision (see `KycSessionStatus`). The\n *   sub-flow resolves to `complete` or `failed` once a terminal status arrives.\n * - `vendorProcessing` — session creation reported that the applicant is\n *   already approved on the relay (`kycStatus`) while the vendor is still\n *   finalizing its own decision (`finalStatus`). There is nothing left for the\n *   applicant to do, so the SDK is not launched; see `statusMessage`.\n */\nexport type KycSumSubStatus =\n  | 'idle'\n  | 'creatingSession'\n  | 'fetchingToken'\n  | 'launching'\n  | 'inProgress'\n  | 'polling'\n  | 'complete'\n  | 'failed'\n  | 'vendorProcessing';\n\n/**\n * The status of a UKYC session, returned by the `GET /sessions/{id}/status`\n * endpoint and polled after the SumSub SDK completes to determine the final\n * verification decision.\n */\nexport type KycSessionStatus = {\n  /**\n   * The overall status of the session. Terminal values (e.g. `approved`,\n   * `completed`, `rejected`, `failed`, `blocked`) end polling; any other value\n   * keeps polling.\n   */\n  finalStatus: string;\n  /** Optional human-readable message describing the status. */\n  statusMessage?: string;\n  /** The vendor-agnostic external user id associated with the session. */\n  externalUserId: string;\n  /** The KYC decision status. */\n  kycStatus: string;\n  /** The identity vendor that handled the session. */\n  vendor: string;\n  /** The vendor-specific status. */\n  vendorStatus: string;\n};\n\n/**\n * A single disclaimer/term the customer must accept before a vendor session is\n * created (`GET /vendors/{vendor}/disclaimers`).\n */\nexport type KycDisclaimer = {\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  display_name: string;\n  url: string;\n};\n\n/**\n * A vendor T&C signing returned by `POST /vendors/{vendor}/disclaimers`.\n */\nexport type KycVendorSigning = {\n  /** Iron signing id. */\n  id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  customer_id: string;\n  // Mirrors the vendor API response field, which is snake_case.\n  // eslint-disable-next-line @typescript-eslint/naming-convention\n  content_id?: string;\n};\n\n/**\n * A legal document in the session-scoped idOS / KYC-provider catalog\n * (`GET`/`POST /sessions/{sessionId}/disclaimers`).\n */\nexport type KycConsentDocument = {\n  /** Stable identifier of the legal document. */\n  key: string;\n  /** Version of the document currently in force. */\n  version: string;\n  /** Human-readable document title. */\n  title: string;\n  /** URL the document body is hosted at. */\n  url: string;\n  /** Whether this session already consented to this document version. */\n  consented: boolean;\n};\n\n/**\n * A consent record posted for a catalog document. `key` and `version` must\n * match the current session catalog.\n */\nexport type KycConsentRecord = {\n  key: string;\n  version: string;\n};\n\n/**\n * Session-scoped disclaimer catalog returned by\n * `GET`/`POST /sessions/{sessionId}/disclaimers`.\n */\nexport type KycSessionDisclaimers = {\n  /** idOS legal documents. */\n  idOS: KycConsentDocument[];\n  /** KYC provider (SumSub) legal documents. */\n  kycProvider: KycConsentDocument[];\n  /** Whether the user consented to reuse existing idOS credentials. */\n  credentialReusabilityConsentGiven: boolean;\n};\n\n/**\n * Parameters passed to a platform SumSub launcher.\n */\nexport type KycSumSubLaunchParams = {\n  /**\n   * The applicant access token used to initialize the SumSub SDK.\n   */\n  applicantAccessToken: string;\n\n  /**\n   * Called by the SDK when the access token expires; must resolve with a fresh\n   * applicant access token.\n   */\n  onTokenExpiration: () => Promise<string>;\n\n  /**\n   * Called when the SDK reports a status transition.\n   */\n  onStatusChange?: (prevStatus: string, newStatus: string) => void;\n\n  /**\n   * BCP-47 locale for the SDK UI.\n   */\n  locale?: string;\n\n  /**\n   * Enables SDK debug logging.\n   */\n  debug?: boolean;\n};\n\n/**\n * Platform adapter that launches the native/web SumSub SDK.\n *\n * The KYC controller is platform-agnostic and does not import any SDK; each\n * client (mobile / extension / web) injects an implementation of this\n * interface. The controller owns all orchestration (session creation, token\n * exchange, token refresh, state) and only delegates the actual SDK\n * presentation to `launch`.\n */\nexport type KycSumSubLauncher = {\n  /**\n   * Whether the underlying SDK is available in the current runtime (e.g. the\n   * native module is linked). When `false`, `startSumSub` fails fast.\n   */\n  isAvailable(): boolean;\n\n  /**\n   * Presents the SumSub verification flow and resolves with the SDK result.\n   */\n  launch(params: KycSumSubLaunchParams): Promise<Record<string, unknown>>;\n};\n"]}

package/dist/ukyc/wrapEncryptionKey.cjs

@@ -9,21 +9,26 @@ const encoding_js_1 = require("../encoding.cjs");
  * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
  * between our session client private key and the session server public key
  * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)
- * returned by `createUkycSession`. The client public key is not embedded in
- * `data`; it was already registered on `createUkycSession`.
+ * returned by `createUkycSession`. The 32-byte client public key is still
+ * prefixed onto `data` so the box is self-describing on the wire.
  *
  * @param sessionClientPrivateKey - Our session's X25519 private key.
  * @param sessionServerPublicKey - The server's X25519 public key (base64url).
  * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`
  * or the encoded `ukyc_capability_token`).
- * @returns The base64url `data` (ciphertext+tag) and `nonce`.
+ * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and
+ * `nonce`.
  */
 function wrapEncryptionKey(sessionClientPrivateKey, sessionServerPublicKey, plaintext) {
     const serverPublicKey = (0, encoding_js_1.base64UrlToBytes)(sessionServerPublicKey);
+    const { publicKey: clientPublicKey } = tweetnacl_1.box.keyPair.fromSecretKey(sessionClientPrivateKey);
     const nonce = (0, tweetnacl_1.randomBytes)(tweetnacl_1.box.nonceLength);
     const ciphertext = (0, tweetnacl_1.box)(plaintext, nonce, serverPublicKey, sessionClientPrivateKey);
+    const data = new Uint8Array(clientPublicKey.length + ciphertext.length);
+    data.set(clientPublicKey, 0);
+    data.set(ciphertext, clientPublicKey.length);
     return {
-        data: (0, encoding_js_1.toBase64Url)(ciphertext),
+        data: (0, encoding_js_1.toBase64Url)(data),
         nonce: (0, encoding_js_1.toBase64Url)(nonce),
     };
 }

package/dist/ukyc/wrapEncryptionKey.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"wrapEncryptionKey.cjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;;AAAA,yCAA6C;AAE7C,iDAA+D;AAuB/D;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,IAAA,8BAAgB,EAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAA,uBAAW,EAAC,eAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAA,eAAG,EACpB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,IAAA,yBAAW,EAAC,UAAU,CAAC;QAC7B,KAAK,EAAE,IAAA,yBAAW,EAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAjBD,8CAiBC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps a secret for the UKYC session server using NaCl's `crypto_box`\n * (X25519 + XSalsa20-Poly1305) established with a per-secret wrapping key\n * returned inside an encryption schema from `createUkycSession`.\n *\n * Reuses a session client keypair whose public half is registered on\n * `createUkycSession`. `data` is the ciphertext+tag only; the server already\n * knows the client public key from session creation. Used for both the\n * `data_encryption_key` and the `ukyc_capability_token`.\n */\n\n/**\n * The transmitted portion of a wrapped secret: the `crypto_box` ciphertext\n * (which includes the 16-byte Poly1305 auth tag) and the nonce, both unpadded\n * base64url-encoded. Matches the KYC API `CapabilityAuthorization` wire shape.\n */\nexport type WrappedEncryptionKeyParts = {\n  data: string;\n  nonce: string;\n};\n\n/**\n * Wraps `plaintext` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)\n * returned by `createUkycSession`. The client public key is not embedded in\n * `data`; it was already registered on `createUkycSession`.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`\n * or the encoded `ukyc_capability_token`).\n * @returns The base64url `data` (ciphertext+tag) and `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  plaintext: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const nonce = randomBytes(box.nonceLength);\n  const ciphertext = box(\n    plaintext,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  return {\n    data: toBase64Url(ciphertext),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}
+{"version":3,"file":"wrapEncryptionKey.cjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;;AAAA,yCAA6C;AAE7C,iDAA+D;AAwB/D;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,IAAA,8BAAgB,EAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,eAAG,CAAC,OAAO,CAAC,aAAa,CAC9D,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,IAAA,uBAAW,EAAC,eAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAA,eAAG,EACpB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,IAAA,yBAAW,EAAC,IAAI,CAAC;QACvB,KAAK,EAAE,IAAA,yBAAW,EAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAvBD,8CAuBC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps a secret for the UKYC session server using NaCl's `crypto_box`\n * (X25519 + XSalsa20-Poly1305) established with a per-secret wrapping key\n * returned inside an encryption schema from `createUkycSession`.\n *\n * Reuses a session client keypair whose public half is registered on\n * `createUkycSession`. `data` is still `clientPublicKey (32) || ciphertext+tag`\n * so the box can be opened from `{ data, nonce }` alone. Used for both the\n * `data_encryption_key` and the `ukyc_capability_token`.\n */\n\n/**\n * The transmitted portion of a wrapped secret: the sender public key prefixed\n * to the `crypto_box` ciphertext (which includes the 16-byte Poly1305 auth\n * tag), and the nonce, both unpadded base64url-encoded. Matches the KYC API\n * `CapabilityAuthorization` wire shape.\n */\nexport type WrappedEncryptionKeyParts = {\n  data: string;\n  nonce: string;\n};\n\n/**\n * Wraps `plaintext` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)\n * returned by `createUkycSession`. The 32-byte client public key is still\n * prefixed onto `data` so the box is self-describing on the wire.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`\n * or the encoded `ukyc_capability_token`).\n * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and\n * `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  plaintext: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const { publicKey: clientPublicKey } = box.keyPair.fromSecretKey(\n    sessionClientPrivateKey,\n  );\n  const nonce = randomBytes(box.nonceLength);\n  const ciphertext = box(\n    plaintext,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  const data = new Uint8Array(clientPublicKey.length + ciphertext.length);\n  data.set(clientPublicKey, 0);\n  data.set(ciphertext, clientPublicKey.length);\n  return {\n    data: toBase64Url(data),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}

package/dist/ukyc/wrapEncryptionKey.d.cts

@@ -4,14 +4,15 @@
  * returned inside an encryption schema from `createUkycSession`.
  *
  * Reuses a session client keypair whose public half is registered on
- * `createUkycSession`. `data` is the ciphertext+tag only; the server already
- * knows the client public key from session creation. Used for both the
+ * `createUkycSession`. `data` is still `clientPublicKey (32) || ciphertext+tag`
+ * so the box can be opened from `{ data, nonce }` alone. Used for both the
  * `data_encryption_key` and the `ukyc_capability_token`.
  */
 /**
- * The transmitted portion of a wrapped secret: the `crypto_box` ciphertext
- * (which includes the 16-byte Poly1305 auth tag) and the nonce, both unpadded
- * base64url-encoded. Matches the KYC API `CapabilityAuthorization` wire shape.
+ * The transmitted portion of a wrapped secret: the sender public key prefixed
+ * to the `crypto_box` ciphertext (which includes the 16-byte Poly1305 auth
+ * tag), and the nonce, both unpadded base64url-encoded. Matches the KYC API
+ * `CapabilityAuthorization` wire shape.
  */
 export type WrappedEncryptionKeyParts = {
     data: string;
@@ -23,14 +24,15 @@ export type WrappedEncryptionKeyParts = {
  * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
  * between our session client private key and the session server public key
  * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)
- * returned by `createUkycSession`. The client public key is not embedded in
- * `data`; it was already registered on `createUkycSession`.
+ * returned by `createUkycSession`. The 32-byte client public key is still
+ * prefixed onto `data` so the box is self-describing on the wire.
  *
  * @param sessionClientPrivateKey - Our session's X25519 private key.
  * @param sessionServerPublicKey - The server's X25519 public key (base64url).
  * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`
  * or the encoded `ukyc_capability_token`).
- * @returns The base64url `data` (ciphertext+tag) and `nonce`.
+ * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and
+ * `nonce`.
  */
 export declare function wrapEncryptionKey(sessionClientPrivateKey: Uint8Array, sessionServerPublicKey: string, plaintext: Uint8Array): WrappedEncryptionKeyParts;
 //# sourceMappingURL=wrapEncryptionKey.d.cts.map

package/dist/ukyc/wrapEncryptionKey.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"wrapEncryptionKey.d.cts","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,uBAAuB,EAAE,UAAU,EACnC,sBAAsB,EAAE,MAAM,EAC9B,SAAS,EAAE,UAAU,GACpB,yBAAyB,CAa3B"}
+{"version":3,"file":"wrapEncryptionKey.d.cts","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,uBAAuB,EAAE,UAAU,EACnC,sBAAsB,EAAE,MAAM,EAC9B,SAAS,EAAE,UAAU,GACpB,yBAAyB,CAmB3B"}

package/dist/ukyc/wrapEncryptionKey.d.mts

@@ -4,14 +4,15 @@
  * returned inside an encryption schema from `createUkycSession`.
  *
  * Reuses a session client keypair whose public half is registered on
- * `createUkycSession`. `data` is the ciphertext+tag only; the server already
- * knows the client public key from session creation. Used for both the
+ * `createUkycSession`. `data` is still `clientPublicKey (32) || ciphertext+tag`
+ * so the box can be opened from `{ data, nonce }` alone. Used for both the
  * `data_encryption_key` and the `ukyc_capability_token`.
  */
 /**
- * The transmitted portion of a wrapped secret: the `crypto_box` ciphertext
- * (which includes the 16-byte Poly1305 auth tag) and the nonce, both unpadded
- * base64url-encoded. Matches the KYC API `CapabilityAuthorization` wire shape.
+ * The transmitted portion of a wrapped secret: the sender public key prefixed
+ * to the `crypto_box` ciphertext (which includes the 16-byte Poly1305 auth
+ * tag), and the nonce, both unpadded base64url-encoded. Matches the KYC API
+ * `CapabilityAuthorization` wire shape.
  */
 export type WrappedEncryptionKeyParts = {
     data: string;
@@ -23,14 +24,15 @@ export type WrappedEncryptionKeyParts = {
  * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
  * between our session client private key and the session server public key
  * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)
- * returned by `createUkycSession`. The client public key is not embedded in
- * `data`; it was already registered on `createUkycSession`.
+ * returned by `createUkycSession`. The 32-byte client public key is still
+ * prefixed onto `data` so the box is self-describing on the wire.
  *
  * @param sessionClientPrivateKey - Our session's X25519 private key.
  * @param sessionServerPublicKey - The server's X25519 public key (base64url).
  * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`
  * or the encoded `ukyc_capability_token`).
- * @returns The base64url `data` (ciphertext+tag) and `nonce`.
+ * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and
+ * `nonce`.
  */
 export declare function wrapEncryptionKey(sessionClientPrivateKey: Uint8Array, sessionServerPublicKey: string, plaintext: Uint8Array): WrappedEncryptionKeyParts;
 //# sourceMappingURL=wrapEncryptionKey.d.mts.map

package/dist/ukyc/wrapEncryptionKey.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"wrapEncryptionKey.d.mts","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,uBAAuB,EAAE,UAAU,EACnC,sBAAsB,EAAE,MAAM,EAC9B,SAAS,EAAE,UAAU,GACpB,yBAAyB,CAa3B"}
+{"version":3,"file":"wrapEncryptionKey.d.mts","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,uBAAuB,EAAE,UAAU,EACnC,sBAAsB,EAAE,MAAM,EAC9B,SAAS,EAAE,UAAU,GACpB,yBAAyB,CAmB3B"}

package/dist/ukyc/wrapEncryptionKey.mjs

@@ -7,21 +7,26 @@ import { base64UrlToBytes, toBase64Url } from "../encoding.mjs";
  * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret
  * between our session client private key and the session server public key
  * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)
- * returned by `createUkycSession`. The client public key is not embedded in
- * `data`; it was already registered on `createUkycSession`.
+ * returned by `createUkycSession`. The 32-byte client public key is still
+ * prefixed onto `data` so the box is self-describing on the wire.
  *
  * @param sessionClientPrivateKey - Our session's X25519 private key.
  * @param sessionServerPublicKey - The server's X25519 public key (base64url).
  * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`
  * or the encoded `ukyc_capability_token`).
- * @returns The base64url `data` (ciphertext+tag) and `nonce`.
+ * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and
+ * `nonce`.
  */
 export function wrapEncryptionKey(sessionClientPrivateKey, sessionServerPublicKey, plaintext) {
     const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);
+    const { publicKey: clientPublicKey } = box.keyPair.fromSecretKey(sessionClientPrivateKey);
     const nonce = randomBytes(box.nonceLength);
     const ciphertext = box(plaintext, nonce, serverPublicKey, sessionClientPrivateKey);
+    const data = new Uint8Array(clientPublicKey.length + ciphertext.length);
+    data.set(clientPublicKey, 0);
+    data.set(ciphertext, clientPublicKey.length);
     return {
-        data: toBase64Url(ciphertext),
+        data: toBase64Url(data),
         nonce: toBase64Url(nonce),
     };
 }

package/dist/ukyc/wrapEncryptionKey.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"wrapEncryptionKey.mjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAuB;AAuB/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,GAAG,CACpB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC;QAC7B,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps a secret for the UKYC session server using NaCl's `crypto_box`\n * (X25519 + XSalsa20-Poly1305) established with a per-secret wrapping key\n * returned inside an encryption schema from `createUkycSession`.\n *\n * Reuses a session client keypair whose public half is registered on\n * `createUkycSession`. `data` is the ciphertext+tag only; the server already\n * knows the client public key from session creation. Used for both the\n * `data_encryption_key` and the `ukyc_capability_token`.\n */\n\n/**\n * The transmitted portion of a wrapped secret: the `crypto_box` ciphertext\n * (which includes the 16-byte Poly1305 auth tag) and the nonce, both unpadded\n * base64url-encoded. Matches the KYC API `CapabilityAuthorization` wire shape.\n */\nexport type WrappedEncryptionKeyParts = {\n  data: string;\n  nonce: string;\n};\n\n/**\n * Wraps `plaintext` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)\n * returned by `createUkycSession`. The client public key is not embedded in\n * `data`; it was already registered on `createUkycSession`.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`\n * or the encoded `ukyc_capability_token`).\n * @returns The base64url `data` (ciphertext+tag) and `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  plaintext: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const nonce = randomBytes(box.nonceLength);\n  const ciphertext = box(\n    plaintext,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  return {\n    data: toBase64Url(ciphertext),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}
+{"version":3,"file":"wrapEncryptionKey.mjs","sourceRoot":"","sources":["../../src/ukyc/wrapEncryptionKey.ts"],"names":[],"mappings":";;AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAuB;AAwB/D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,uBAAmC,EACnC,sBAA8B,EAC9B,SAAqB;IAErB,MAAM,eAAe,GAAG,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAC9D,uBAAuB,CACxB,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,GAAG,CACpB,SAAS,EACT,KAAK,EACL,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;QACvB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC","sourcesContent":["import { randomBytes, box } from 'tweetnacl';\n\nimport { base64UrlToBytes, toBase64Url } from '../encoding.js';\n\n/**\n * Wraps a secret for the UKYC session server using NaCl's `crypto_box`\n * (X25519 + XSalsa20-Poly1305) established with a per-secret wrapping key\n * returned inside an encryption schema from `createUkycSession`.\n *\n * Reuses a session client keypair whose public half is registered on\n * `createUkycSession`. `data` is still `clientPublicKey (32) || ciphertext+tag`\n * so the box can be opened from `{ data, nonce }` alone. Used for both the\n * `data_encryption_key` and the `ukyc_capability_token`.\n */\n\n/**\n * The transmitted portion of a wrapped secret: the sender public key prefixed\n * to the `crypto_box` ciphertext (which includes the 16-byte Poly1305 auth\n * tag), and the nonce, both unpadded base64url-encoded. Matches the KYC API\n * `CapabilityAuthorization` wire shape.\n */\nexport type WrappedEncryptionKeyParts = {\n  data: string;\n  nonce: string;\n};\n\n/**\n * Wraps `plaintext` for the UKYC session server.\n *\n * The box is sealed with NaCl's `crypto_box`, keyed by the X25519 shared secret\n * between our session client private key and the session server public key\n * from an encryption schema (`encryptionDataKey` or `ukycCapabilityToken`)\n * returned by `createUkycSession`. The 32-byte client public key is still\n * prefixed onto `data` so the box is self-describing on the wire.\n *\n * @param sessionClientPrivateKey - Our session's X25519 private key.\n * @param sessionServerPublicKey - The server's X25519 public key (base64url).\n * @param plaintext - The raw bytes to encrypt (e.g. the `data_encryption_key`\n * or the encoded `ukyc_capability_token`).\n * @returns The base64url `data` (`clientPublicKey || ciphertext+tag`) and\n * `nonce`.\n */\nexport function wrapEncryptionKey(\n  sessionClientPrivateKey: Uint8Array,\n  sessionServerPublicKey: string,\n  plaintext: Uint8Array,\n): WrappedEncryptionKeyParts {\n  const serverPublicKey = base64UrlToBytes(sessionServerPublicKey);\n  const { publicKey: clientPublicKey } = box.keyPair.fromSecretKey(\n    sessionClientPrivateKey,\n  );\n  const nonce = randomBytes(box.nonceLength);\n  const ciphertext = box(\n    plaintext,\n    nonce,\n    serverPublicKey,\n    sessionClientPrivateKey,\n  );\n  const data = new Uint8Array(clientPublicKey.length + ciphertext.length);\n  data.set(clientPublicKey, 0);\n  data.set(ciphertext, clientPublicKey.length);\n  return {\n    data: toBase64Url(data),\n    nonce: toBase64Url(nonce),\n  };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask-previews/kyc-controller",
-  "version": "0.0.0-preview-8bfa290fb",
+  "version": "0.0.0-preview-ec24abb79",
   "description": "Shared KYC / identity verification controller used across MetaMask clients",
   "keywords": [
     "Ethereum",
@@ -64,7 +64,7 @@
     "@metamask/messenger": "^2.0.0",
     "@metamask/profile-sync-controller": "^29.0.0",
     "@metamask/superstruct": "^3.4.1",
-    "@metamask/utils": "^11.12.0",
+    "@metamask/utils": "^11.11.0",
     "@noble/ciphers": "^1.3.0",
     "@noble/curves": "^1.9.2",
     "@noble/hashes": "^1.8.0",

package/dist/logger.cjs

@@ -1,9 +0,0 @@
-"use strict";
-/* istanbul ignore file */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createModuleLogger = exports.controllerLog = exports.projectLogger = void 0;
-const utils_1 = require("@metamask/utils");
-Object.defineProperty(exports, "createModuleLogger", { enumerable: true, get: function () { return utils_1.createModuleLogger; } });
-exports.projectLogger = (0, utils_1.createProjectLogger)('kyc-controller');
-exports.controllerLog = (0, utils_1.createModuleLogger)(exports.projectLogger, 'KycController');
-//# sourceMappingURL=logger.cjs.map

package/dist/logger.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.cjs","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAAA,0BAA0B;;;AAE1B,2CAA0E;AAMjE,mGANqB,0BAAkB,OAMrB;AAJd,QAAA,aAAa,GAAG,IAAA,2BAAmB,EAAC,gBAAgB,CAAC,CAAC;AAEtD,QAAA,aAAa,GAAG,IAAA,0BAAkB,EAAC,qBAAa,EAAE,eAAe,CAAC,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nexport const projectLogger = createProjectLogger('kyc-controller');\n\nexport const controllerLog = createModuleLogger(projectLogger, 'KycController');\n\nexport { createModuleLogger };\n"]}

package/dist/logger.d.cts

@@ -1,6 +0,0 @@
-/// <reference types="debug" />
-import { createModuleLogger } from "@metamask/utils";
-export declare const projectLogger: import("debug").Debugger;
-export declare const controllerLog: import("debug").Debugger;
-export { createModuleLogger };
-//# sourceMappingURL=logger.d.cts.map

package/dist/logger.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.d.cts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAEA,OAAO,EAAuB,kBAAkB,EAAE,wBAAwB;AAE1E,eAAO,MAAM,aAAa,0BAAwC,CAAC;AAEnE,eAAO,MAAM,aAAa,0BAAqD,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/logger.d.mts

@@ -1,6 +0,0 @@
-/// <reference types="debug" />
-import { createModuleLogger } from "@metamask/utils";
-export declare const projectLogger: import("debug").Debugger;
-export declare const controllerLog: import("debug").Debugger;
-export { createModuleLogger };
-//# sourceMappingURL=logger.d.mts.map

package/dist/logger.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.d.mts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";AAEA,OAAO,EAAuB,kBAAkB,EAAE,wBAAwB;AAE1E,eAAO,MAAM,aAAa,0BAAwC,CAAC;AAEnE,eAAO,MAAM,aAAa,0BAAqD,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/logger.mjs

@@ -1,6 +0,0 @@
-/* istanbul ignore file */
-import { createProjectLogger, createModuleLogger } from "@metamask/utils";
-export const projectLogger = createProjectLogger('kyc-controller');
-export const controllerLog = createModuleLogger(projectLogger, 'KycController');
-export { createModuleLogger };
-//# sourceMappingURL=logger.mjs.map

package/dist/logger.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.mjs","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,wBAAwB;AAE1E,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,CAAC","sourcesContent":["/* istanbul ignore file */\n\nimport { createProjectLogger, createModuleLogger } from '@metamask/utils';\n\nexport const projectLogger = createProjectLogger('kyc-controller');\n\nexport const controllerLog = createModuleLogger(projectLogger, 'KycController');\n\nexport { createModuleLogger };\n"]}