@metamask-previews/kyc-controller 0.0.0-preview-8bfa290fb → 0.2.0-preview-0a30e47

package/dist/KycController.mjs

@@ -1,1877 +0,0 @@
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _KycController_instances, _KycController_sumsubLauncher, _KycController_moonpayFrameKeypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_dropTermsUnlessForVendor, _KycController_hasTermsForVendor, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
-import { BaseController } from "@metamask/base-controller";
-import { stringToBytes } from "@metamask/utils";
-import { x25519 } from "@noble/curves/ed25519";
-import { decryptCredentials, generateKeyPair } from "./crypto.mjs";
-import { toBase64Url } from "./encoding.mjs";
-import { controllerLog } from "./logger.mjs";
-import { deriveClientMaterial } from "./ukyc/deriveClientMaterial.mjs";
-import { verifyJwtChain } from "./ukyc/jwtChain.mjs";
-import { getOrCreateLocalUserSecret } from "./ukyc/localUserSecret.mjs";
-import { encodeStorageAccessTokenForHeader, signStorageAccessToken } from "./ukyc/storageAccessToken.mjs";
-import { wrapEncryptionKey } from "./ukyc/wrapEncryptionKey.mjs";
-// === GENERAL ===
-export const controllerName = 'KycController';
-const FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';
-const CHANNEL_CHECK = 'ch_1';
-const CHANNEL_AUTH = 'ch_2';
-const CHANNEL_RESET = 'ch_reset';
-// Placeholder credentials for the SumSub sub-flow. These are demo values that
-// must be replaced with real UKYC-issued material before production use.
-const MOCK_JWT_TOKEN = 'mock-jwt-token';
-// Lifetime of the read-only `ukyc_capability_token` minted when creating a
-// UKYC session. The storage-and-auth spec requires the token's `expires_at` to
-// cover the KYC session's expected lifetime — including the provider journey —
-// rather than a fixed short window, so this is a session-scoped window.
-const UKYC_CAPABILITY_TOKEN_TTL_MS = 4 * 60 * 60 * 1000;
-// The SumSub SDK status that signals the applicant finished the flow
-// successfully. Any other resolution (abandonment, failure, or a non-success
-// outcome) must not be recorded as `complete`.
-const SUMSUB_COMPLETED_STATUS = 'Completed';
-// Phases that represent an active vendor-session flow (tokens issued and/or
-// Check/Auth frames in progress). A repeat `initialize` while in one of these
-// must not restart the session and disrupt the in-flight flow.
-const IN_PROGRESS_PHASES = [
-    'session',
-    'check',
-    'auth',
-    'form',
-    'submit',
-];
-// How often to poll the UKYC session status after the SumSub SDK completes,
-// until a terminal status is reached. Overridable via the constructor.
-const DEFAULT_SESSION_STATUS_POLL_INTERVAL_MS = 15000;
-// UKYC status values. `kycStatus` (the relay-side decision) and `finalStatus`
-// (the vendor-side outcome) draw from the same vocabulary, so they are defined
-// once here and composed into the sets/checks below rather than repeated as
-// literals.
-const KYC_STATUSES = {
-    approved: 'approved',
-    completed: 'completed',
-    rejected: 'rejected',
-    failed: 'failed',
-    blocked: 'blocked',
-    pending: 'pending',
-};
-// `finalStatus` values that end the polling loop. Anything else (e.g.
-// `KYC_STATUSES.pending`) keeps polling.
-const TERMINAL_SESSION_STATUSES = new Set([
-    KYC_STATUSES.approved,
-    KYC_STATUSES.completed,
-    KYC_STATUSES.rejected,
-    KYC_STATUSES.failed,
-    KYC_STATUSES.blocked,
-]);
-// Terminal `finalStatus` values that represent a successful verification. Any
-// other terminal status resolves the sub-flow to `failed`.
-const SUCCESSFUL_SESSION_STATUSES = new Set([
-    KYC_STATUSES.approved,
-    KYC_STATUSES.completed,
-]);
-// Session creation can report that the applicant is already approved on the
-// relay (`kycStatus === KYC_STATUSES.approved`) while the vendor is still
-// finalizing its decision (`finalStatus === KYC_STATUSES.pending`, a
-// non-terminal status). In that case there is nothing left for the applicant
-// to do, so the sub-flow stops before launching the SDK and surfaces this
-// message.
-const VENDOR_PROCESSING_MESSAGE = 'Your KYC has been submitted and is being processed by the vendor.';
-// UKYC / relay error indicating the applicant already finished KYC. Mapped to
-// the simplified `completed` user status for the Money toast surface.
-const SESSION_NOT_IN_VALID_STATE = 'session_not_in_valid_state';
-// How often to refresh the user-keyed `GET /kyc/status` while the simplified
-// status is still `pending`. Overridable via the constructor.
-const DEFAULT_USER_STATUS_POLL_INTERVAL_MS = 15000;
-const kycControllerMetadata = {
-    phase: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: true,
-    },
-    statusMessage: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: true,
-    },
-    error: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: true,
-    },
-    email: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: false,
-        usedInUi: false,
-    },
-    termsAcceptedAt: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: false,
-    },
-    acceptedDisclaimerIds: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: false,
-    },
-    termsAcceptedVendor: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: false,
-    },
-    sumsubTncAccepted: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: false,
-    },
-    idosTncAccepted: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: false,
-    },
-    credentialReusabilityConsentGiven: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: false,
-    },
-    disclaimers: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: false,
-        usedInUi: true,
-    },
-    disclaimersError: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: true,
-    },
-    sessionDisclaimers: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: false,
-        usedInUi: true,
-    },
-    geoCountry: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: true,
-    },
-    sessionToken: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: false,
-        usedInUi: false,
-    },
-    accessToken: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: false,
-        usedInUi: false,
-    },
-    moonpayCustomerId: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: false,
-        usedInUi: false,
-    },
-    activeVendor: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: true,
-    },
-    activeProduct: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: true,
-    },
-    kycRequiredByProduct: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: true,
-    },
-    lastCheckedAt: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: false,
-    },
-    userStatus: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: true,
-    },
-    userStatusSumsubSessionId: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: true,
-        usedInUi: true,
-    },
-    userStatusErrorCode: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: true,
-    },
-    sumsub: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: false,
-        usedInUi: true,
-    },
-};
-/**
- * Constructs the default {@link KycController} state.
- *
- * @returns The default state.
- */
-export function getDefaultKycControllerState() {
-    return {
-        phase: 'idle',
-        statusMessage: '',
-        error: null,
-        email: null,
-        termsAcceptedAt: null,
-        acceptedDisclaimerIds: [],
-        termsAcceptedVendor: null,
-        sumsubTncAccepted: null,
-        idosTncAccepted: null,
-        credentialReusabilityConsentGiven: null,
-        disclaimers: [],
-        disclaimersError: null,
-        sessionDisclaimers: null,
-        geoCountry: null,
-        sessionToken: null,
-        accessToken: null,
-        moonpayCustomerId: null,
-        activeVendor: 'moonpay',
-        activeProduct: null,
-        kycRequiredByProduct: {},
-        lastCheckedAt: null,
-        userStatus: null,
-        userStatusSumsubSessionId: null,
-        userStatusErrorCode: null,
-        sumsub: {
-            status: 'idle',
-            result: null,
-            sessionId: null,
-            applicantAccessToken: null,
-            sessionStatus: null,
-        },
-    };
-}
-/**
- * Whether an error indicates the applicant already finished KYC — the UKYC /
- * relay `session_not_in_valid_state` signal — which the controller maps to the
- * simplified `completed` user status.
- *
- * @param error - The caught error.
- * @returns `true` when the error carries the `session_not_in_valid_state`
- * marker.
- */
-function isSessionAlreadyCompletedError(error) {
-    return String(error).includes(SESSION_NOT_IN_VALID_STATE);
-}
-/**
- * Whether recording session disclaimers failed because those document
- * versions were already consented for the session (`409 Conflict`).
- *
- * @param error - The caught error.
- * @returns `true` when the error is an HTTP 409.
- */
-function isConsentConflictError(error) {
-    return (typeof error === 'object' &&
-        error !== null &&
-        typeof error.httpStatus === 'number' &&
-        error.httpStatus === 409);
-}
-/**
- * Maps a session-disclaimer catalog into the `{ key, version }` records the
- * record-consents API expects, or an empty list when the user declined that
- * category.
- *
- * @param documents - Catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
- * @returns Consent records, or `[]` when not accepted.
- */
-function consentRecordsFromCatalog(documents, accepted) {
-    if (!accepted) {
-        return [];
-    }
-    return documents
-        .filter((document) => !document.consented)
-        .map(({ key, version }) => ({ key, version }));
-}
-/**
- * Whether an accepted T&C2 category has no catalog documents. An empty list
- * would otherwise skip the POST and count as success.
- *
- * @param documents - Catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
- * @returns `true` when the user accepted and the catalog is empty.
- */
-function isAcceptedCategoryEmpty(documents, accepted) {
-    return accepted && documents.length === 0;
-}
-/**
- * Whether an accepted category is still missing consent after a 409 re-GET:
- * empty catalog or any document still unconsented.
- *
- * @param documents - Latest catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
- * @returns `true` when accepted documents are not fully consented.
- */
-function acceptedCategoryStillMissing(documents, accepted) {
-    return (accepted &&
-        (documents.length === 0 ||
-            documents.some((document) => !document.consented)));
-}
-/**
- * Vendors other than MoonPay skip Check/Auth frames and use the empty-shell
- * customer + consents path instead.
- *
- * @param vendor - The identity vendor for the current flow.
- * @returns `true` when the vendor uses the consents session path.
- */
-function usesConsentsFlow(vendor) {
-    return vendor !== 'moonpay';
-}
-// === MESSENGER ===
-const MESSENGER_EXPOSED_METHODS = [
-    'initialize',
-    'loadDisclaimers',
-    'acceptTermsAndStartSession',
-    'createVendorCustomer',
-    'clearSavedTerms',
-    'handleFrameMessage',
-    'buildCheckFrameUrl',
-    'buildAuthFrameUrl',
-    'buildResetFrameUrl',
-    'checkKycRequired',
-    'getKycStatus',
-    'getCustomerIdentity',
-    'refreshKycStatus',
-    'startSumSub',
-    'getSessionStatus',
-    'reset',
-    'clearState',
-];
-// === CONTROLLER DEFINITION ===
-/**
- * `KycController` orchestrates the vendor-backed KYC / identity-verification
- * flow (MoonPay identity + SumSub documents) behind a vendor-neutral, per
- * product surface used by ramps and card. It owns all state, HTTP
- * orchestration (via `KycService`), crypto, and the frame message protocol;
- * platform-specific presentation (WebView/iframe, SumSub SDK) is injected.
- */
-export class KycController extends BaseController {
-    /**
-     * Constructs a new {@link KycController}.
-     *
-     * @param options - The constructor options.
-     * @param options.messenger - The messenger suited for this controller.
-     * @param options.state - Partial initial state; merged over defaults.
-     * @param options.sumsubLauncher - The platform SumSub launcher adapter.
-     * @param options.sessionStatusPollIntervalMs - How often to poll the UKYC
-     * session status after the SumSub SDK completes.
-     * @param options.userStatusPollIntervalMs - How often to refresh the
-     * user-keyed KYC status while it is still `pending`.
-     */
-    constructor({ messenger, state, sumsubLauncher, sessionStatusPollIntervalMs = DEFAULT_SESSION_STATUS_POLL_INTERVAL_MS, userStatusPollIntervalMs = DEFAULT_USER_STATUS_POLL_INTERVAL_MS, }) {
-        super({
-            messenger,
-            metadata: kycControllerMetadata,
-            name: controllerName,
-            state: { ...getDefaultKycControllerState(), ...state },
-        });
-        _KycController_instances.add(this);
-        _KycController_sumsubLauncher.set(this, void 0);
-        /** MoonPay Check/Auth frame X25519 keypair (never persisted). */
-        _KycController_moonpayFrameKeypair.set(this, null);
-        /** Auth-frame client token, kept out of state. */
-        _KycController_authClientToken.set(this, null);
-        /**
-         * Monotonic flow generation. Incremented by {@link reset} and
-         * {@link clearState} so in-flight async work (e.g. the KYC-required check)
-         * can detect that it was superseded and avoid writing stale results onto a
-         * reset controller.
-         */
-        _KycController_generation.set(this, 0);
-        /** Interval, in milliseconds, between session-status polls. */
-        _KycController_sessionStatusPollIntervalMs.set(this, void 0);
-        /** Handle for the scheduled next session-status poll, or `null`. */
-        _KycController_pollTimer.set(this, null);
-        /**
-         * Monotonic polling token. Bumped by {@link #stopPolling} (called on reset, a
-         * new sub-flow, and once a terminal status is reached) so an in-flight poll
-         * `tick` can detect it was superseded and neither write state nor schedule a
-         * follow-up. This closes the gap where clearing the timer alone would still
-         * let an already-awaiting request finish and reschedule.
-         */
-        _KycController_pollToken.set(this, 0);
-        /** Interval, in milliseconds, between user-keyed status polls. */
-        _KycController_userStatusPollIntervalMs.set(this, void 0);
-        /** Handle for the scheduled next user-status poll, or `null`. */
-        _KycController_userStatusPollTimer.set(this, null);
-        /**
-         * Whether a user-status poll loop is currently active. Tracked separately
-         * from {@link #userStatusPollTimer} because a scheduled tick clears the timer
-         * handle before awaiting `fetchKycStatus`; relying on the handle alone would
-         * let a concurrent {@link refreshKycStatus} start a second loop on the same
-         * token during that in-flight window.
-         */
-        _KycController_userStatusPolling.set(this, false);
-        /** Monotonic token for the user-status poll loop (see `#pollToken`). */
-        _KycController_userStatusPollToken.set(this, 0);
-        __classPrivateFieldSet(this, _KycController_sumsubLauncher, sumsubLauncher, "f");
-        __classPrivateFieldSet(this, _KycController_sessionStatusPollIntervalMs, sessionStatusPollIntervalMs, "f");
-        __classPrivateFieldSet(this, _KycController_userStatusPollIntervalMs, userStatusPollIntervalMs, "f");
-        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
-    }
-    /**
-     * Resolves persisted terms + geolocation, and auto-creates a session when
-     * terms are already accepted and an email is available.
-     *
-     * @param params - Optional parameters.
-     * @param params.email - The account email to associate with the session.
-     * @param params.product - The consuming feature the flow runs for. When
-     * provided, the controller automatically runs the KYC-required check once
-     * authentication completes (and chains into document verification when KYC
-     * is required). When omitted, the flow stops at `form` and the consumer must
-     * call `checkKycRequired` manually.
-     * @param params.vendor - Identity vendor for this flow. Non-MoonPay vendors
-     * skip Check/Auth frames and use the consents path. Defaults to `moonpay`.
-     */
-    async initialize(params) {
-        // A repeat `initialize` while a session flow is already in progress must
-        // not tear it down: creating a new vendor session clears the tokens and
-        // forces `phase` back through `session`/`check`, breaking an in-flight
-        // Check/Auth frame flow. Leave the active flow untouched and let the
-        // consumer drive it (or call `reset` first to start over).
-        const vendor = params?.vendor ?? 'moonpay';
-        if (IN_PROGRESS_PHASES.includes(this.state.phase)) {
-            if (vendor === 'moonpay' && !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
-                __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, generateKeyPair(), "f");
-            }
-            return;
-        }
-        if (vendor === 'moonpay') {
-            __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, generateKeyPair(), "f");
-        }
-        else {
-            __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, null, "f");
-        }
-        // `initialize` starts a fresh flow, so `activeProduct` is always reset to
-        // this call's product (or `null`). Otherwise a prior run's product could
-        // linger and cause `#continueAfterAuthentication` to auto-run the check /
-        // sub-flow when the caller intended the manual (product-less) flow.
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            if (params?.email) {
-                state.email = params.email;
-            }
-            state.activeVendor = vendor;
-            // MoonPay Check/Auth artifacts must not survive a switch to another
-            // vendor: leftover `sessionToken` would keep `buildCheckFrameUrl` alive,
-            // leftover `accessToken` / `#authClientToken` would keep Auth / KYC
-            // calls bound to MoonPay, and leftover `moonpayCustomerId` would make
-            // `getCustomerIdentity` report a MoonPay id under the wrong vendor.
-            if (vendor !== 'moonpay') {
-                __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
-            }
-            state.activeProduct = params?.product ?? null;
-        });
-        // Capture the flow generation so a `reset()` landing while the async
-        // geolocation / session steps below are in flight cannot write results
-        // onto an idle controller.
-        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-        // Resolve country for display; non-blocking.
-        try {
-            const country = await this.messenger.call('KycService:getGeoCountry');
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.geoCountry = country;
-            });
-        }
-        catch {
-            // Ignore; disclaimers loading will surface a country error if needed.
-        }
-        // A `reset()` / `clearState()` that landed while the geolocation request
-        // was in flight supersedes this flow. Stop here rather than driving the
-        // controller on into `terms` (or a new session): the steps below write
-        // unconditionally, and `loadDisclaimers` captures the post-reset
-        // generation, so its own guard would not catch this.
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        if (usesConsentsFlow(vendor) && this.state.email) {
-            try {
-                await this.messenger.call('KycService:createVendorCustomer', {
-                    vendor,
-                    email: this.state.email,
-                });
-            }
-            catch (error) {
-                if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                    return;
-                }
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Vendor customer creation failed: ${String(error)}`);
-                return;
-            }
-        }
-        // Drop another vendor's persisted acceptance only after this flow has
-        // committed (customer creation succeeded, or there was none to wait for).
-        // Clearing earlier would permanently lose ramps/card terms if Iron
-        // customer creation failed or a reset landed while it was in flight.
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, vendor);
-        const hasTerms = Boolean(this.state.termsAcceptedAt) &&
-            this.state.acceptedDisclaimerIds.length > 0;
-        if (hasTerms && this.state.email) {
-            if (usesConsentsFlow(vendor)) {
-                // Consents-path vendors require T&C2 flags; if they weren't persisted
-                // (i.e. null from pre-migration state), require reacceptance.
-                const sumsubTncSigned = this.state.sumsubTncAccepted;
-                const idosTncSigned = this.state.idosTncAccepted;
-                if (sumsubTncSigned === null || idosTncSigned === null) {
-                    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-                        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
-                        state.phase = 'terms';
-                    });
-                    await this.loadDisclaimers();
-                    return;
-                }
-                await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                    sumsubTncSigned,
-                    idosTncSigned,
-                    credentialReusabilityConsentGiven: this.state.credentialReusabilityConsentGiven ?? false,
-                });
-            }
-            else {
-                await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
-            }
-            return;
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.phase = 'terms';
-        });
-        await this.loadDisclaimers();
-    }
-    /**
-     * Creates (or resumes) an empty-shell customer for the given identity
-     * vendor. Exposed so a consumer can ensure the customer exists before
-     * showing T&C screens independently of {@link initialize}.
-     *
-     * A call while a session flow is already in progress is a no-op — matching
-     * {@link initialize} — so a vendor switch cannot leave Check/Auth frames
-     * attached to the wrong vendor. Call {@link reset} first to start over.
-     *
-     * @param params - The parameters.
-     * @param params.vendor - Identity vendor for the customer.
-     * @param params.email - Email for the vendor customer.
-     */
-    async createVendorCustomer(params) {
-        if (IN_PROGRESS_PHASES.includes(this.state.phase)) {
-            return;
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.email = params.email;
-            // MoonPay Check/Auth artifacts must not survive a switch to another
-            // vendor — see `initialize`. Terms for another vendor are dropped only
-            // after this request succeeds.
-            state.activeVendor = params.vendor;
-            if (params.vendor !== 'moonpay') {
-                __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
-                __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, null, "f");
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
-            }
-        });
-        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-        try {
-            await this.messenger.call('KycService:createVendorCustomer', {
-                vendor: params.vendor,
-                email: params.email,
-            });
-            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                return;
-            }
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, params.vendor);
-        }
-        catch (error) {
-            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                return;
-            }
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Vendor customer creation failed: ${String(error)}`);
-        }
-    }
-    /**
-     * Loads the disclaimers for the resolved (or provided) country.
-     *
-     * @param params - Optional parameters.
-     * @param params.country - ISO 3166-1 alpha-3 country code override.
-     */
-    async loadDisclaimers(params) {
-        // Capture the flow generation so a `reset()` landing while the geo /
-        // disclaimers requests are in flight cannot write results onto an idle
-        // controller.
-        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-        try {
-            const country = params?.country ??
-                this.state.geoCountry ??
-                (await this.messenger.call('KycService:getGeoCountry'));
-            if (country !== this.state.geoCountry) {
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                    state.geoCountry = country;
-                });
-            }
-            const disclaimers = await this.messenger.call('KycService:fetchVendorDisclaimers', {
-                vendor: this.state.activeVendor,
-                country,
-            });
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.disclaimers = disclaimers;
-                state.disclaimersError = null;
-            });
-        }
-        catch (error) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.disclaimersError = `Failed to load disclaimers: ${String(error)}`;
-            });
-        }
-    }
-    /**
-     * Captures terms acceptance for the currently loaded disclaimers and creates
-     * a session.
-     *
-     * @param params - The parameters.
-     * @param params.email - The account email to associate with the session.
-     * @param params.product - The consuming feature the flow runs for. See
-     * {@link initialize} for how the product drives the automatic post
-     * authentication continuation.
-     * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).
-     * Required for every vendor so callers explicitly declare acceptance.
-     * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
-     * Required for every vendor so callers explicitly declare acceptance.
-     * @param params.credentialReusabilityConsentGiven - Whether the customer
-     * consented to reuse existing idOS credentials. Used when recording
-     * session-scoped disclaimers on the consents path. Defaults to `false`.
-     */
-    async acceptTermsAndStartSession(params) {
-        const sumsubTncSigned = params?.sumsubTncSigned;
-        const idosTncSigned = params?.idosTncSigned;
-        if (typeof sumsubTncSigned !== 'boolean' ||
-            typeof idosTncSigned !== 'boolean') {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing T&C2 acceptance flags.');
-            return;
-        }
-        const credentialReusabilityConsentGiven = params.credentialReusabilityConsentGiven ?? false;
-        const termsAcceptedAt = new Date().toISOString();
-        const disclaimerIds = this.state.disclaimers.map((disclaimer) => disclaimer.id);
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            if (params.email) {
-                state.email = params.email;
-            }
-            if (params.product) {
-                state.activeProduct = params.product;
-            }
-            state.termsAcceptedAt = termsAcceptedAt;
-            state.acceptedDisclaimerIds = disclaimerIds;
-            state.termsAcceptedVendor = state.activeVendor;
-            state.sumsubTncAccepted = sumsubTncSigned;
-            state.idosTncAccepted = idosTncSigned;
-            state.credentialReusabilityConsentGiven =
-                credentialReusabilityConsentGiven;
-        });
-        if (usesConsentsFlow(this.state.activeVendor)) {
-            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                sumsubTncSigned,
-                idosTncSigned,
-                credentialReusabilityConsentGiven,
-            });
-            return;
-        }
-        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
-    }
-    /**
-     * Clears the persisted terms acceptance.
-     */
-    clearSavedTerms() {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
-        });
-    }
-    /**
-     * Handles a message posted by a Check/Auth frame and advances the flow.
-     *
-     * The transport-agnostic caller (WebView on mobile, iframe on web) forwards
-     * the raw message and injects the returned `reply` back into the frame.
-     *
-     * @param params - The parameters.
-     * @param params.message - The raw message posted by the frame.
-     * @returns An object whose optional `reply` should be posted back.
-     */
-    async handleFrameMessage(params) {
-        const payload = params.message;
-        if (!payload) {
-            return {};
-        }
-        if (payload.kind === 'handshake') {
-            const channelId = payload.meta?.channelId;
-            return { reply: { version: 2, meta: { channelId }, kind: 'ack' } };
-        }
-        if (payload.kind !== 'complete') {
-            return {};
-        }
-        const channelId = payload.meta?.channelId;
-        // Only honor a Check/Auth `complete` for the MoonPay frame the flow is
-        // currently waiting on. This drops stale or duplicate messages — e.g. a
-        // late post after `reset()` (phase `idle`), after the flow already
-        // advanced past this frame, or after a vendor switch — so they cannot
-        // resurrect tokens, rewind `phase`, or recapture `moonpayCustomerId` on a
-        // controller that has moved on. Frame messages are external input and,
-        // unlike the async steps, are not covered by the `#generation` guard.
-        let expectedPhase = null;
-        if (channelId === CHANNEL_CHECK) {
-            expectedPhase = 'check';
-        }
-        else if (channelId === CHANNEL_AUTH) {
-            expectedPhase = 'auth';
-        }
-        if (!expectedPhase ||
-            this.state.phase !== expectedPhase ||
-            this.state.activeVendor !== 'moonpay') {
-            return {};
-        }
-        const status = payload.payload?.status;
-        const credsEnvelope = payload.payload?.credentials;
-        const customerId = payload.payload?.customer?.id ?? null;
-        if (customerId) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-                state.moonpayCustomerId = customerId;
-            });
-        }
-        if (!status) {
-            return {};
-        }
-        let accessToken;
-        let clientToken;
-        if (credsEnvelope && __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
-            try {
-                const { credentials } = decryptCredentials(credsEnvelope, __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").privateKey);
-                accessToken = credentials.accessToken;
-                clientToken = credentials.clientToken;
-            }
-            catch (error) {
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Failed to decrypt frame credentials: ${String(error)}`);
-                return {};
-            }
-        }
-        if (channelId === CHANNEL_CHECK) {
-            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_handleCheckOutcome).call(this, status, accessToken, clientToken);
-            return {};
-        }
-        // channelId === CHANNEL_AUTH, guaranteed by the expectedPhase guard above.
-        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_handleAuthOutcome).call(this, status, accessToken);
-        return {};
-    }
-    /**
-     * Builds the Check-frame URL, or `null` when no session exists yet.
-     *
-     * @returns The Check-frame URL or `null`.
-     */
-    buildCheckFrameUrl() {
-        if (this.state.activeVendor !== 'moonpay' ||
-            !this.state.sessionToken ||
-            !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
-            return null;
-        }
-        const url = new URL(`${FRAMES_BASE_URL}/check-connection`);
-        url.searchParams.set('sessionToken', this.state.sessionToken);
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").publicKeyHex);
-        url.searchParams.set('channelId', CHANNEL_CHECK);
-        url.searchParams.set('skipKyc', 'true');
-        return url.toString();
-    }
-    /**
-     * Builds the Auth-frame URL, or `null` when no client token is available.
-     *
-     * @returns The Auth-frame URL or `null`.
-     */
-    buildAuthFrameUrl() {
-        if (this.state.activeVendor !== 'moonpay' ||
-            !__classPrivateFieldGet(this, _KycController_authClientToken, "f") ||
-            !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
-            return null;
-        }
-        const url = new URL(`${FRAMES_BASE_URL}/auth`);
-        url.searchParams.set('clientToken', __classPrivateFieldGet(this, _KycController_authClientToken, "f"));
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").publicKeyHex);
-        url.searchParams.set('channelId', CHANNEL_AUTH);
-        return url.toString();
-    }
-    /**
-     * Builds the Reset-frame URL.
-     *
-     * @returns The Reset-frame URL.
-     */
-    buildResetFrameUrl() {
-        const url = new URL(`${FRAMES_BASE_URL}/reset`);
-        url.searchParams.set('channelId', CHANNEL_RESET);
-        return url.toString();
-    }
-    /**
-     * Checks whether KYC is required for a product and caches the result.
-     *
-     * @param params - The parameters.
-     * @param params.product - The consuming feature.
-     * @param params.country - Optional alpha-3 country override.
-     * @returns Whether KYC is required.
-     */
-    async checkKycRequired(params) {
-        const { accessToken } = this.state;
-        if (!accessToken) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing accessToken — repeat the authentication step.');
-            return false;
-        }
-        const country = params.country ?? this.state.geoCountry;
-        if (!country) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing country for KYC-required check.');
-            return false;
-        }
-        // Capture the flow generation so we can detect a `reset()` that happens
-        // while the HTTP call is in flight and avoid writing stale results.
-        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.phase = 'submit';
-            state.statusMessage = 'Checking KYC status...';
-        });
-        try {
-            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', { accessToken, country, capabilities: [{ product: params.product }] });
-            // The flow was reset while the check was in flight; discard the result
-            // rather than resurrecting a done/cached state on an idle controller.
-            const applied = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.kycRequiredByProduct[params.product] = kycRequired;
-                state.lastCheckedAt = new Date().toISOString();
-                state.phase = 'done';
-                state.statusMessage = 'KYC check complete.';
-            });
-            if (!applied) {
-                return false;
-            }
-            return kycRequired;
-        }
-        catch (error) {
-            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                return false;
-            }
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `KYC check failed: ${String(error)}`);
-            return false;
-        }
-    }
-    /**
-     * Reads the cached "is KYC required" result for a product.
-     *
-     * @param params - The parameters.
-     * @param params.product - The consuming feature.
-     * @returns The cached value, or `undefined` if not yet checked.
-     */
-    getKycStatus(params) {
-        return this.state.kycRequiredByProduct[params.product];
-    }
-    /**
-     * Returns the vendor-scoped identity for the currently authenticated
-     * customer, or `null` when the flow has not yet captured a vendor customer
-     * id (before authentication or after {@link reset}), or when a MoonPay id
-     * is present under a different `activeVendor`.
-     *
-     * Exposed so consumers (e.g. ramps autoramp creation) can attach the vendor
-     * customer id to downstream calls without reading the full KYC state, which
-     * also holds session/access tokens. The id is session-scoped and never
-     * persisted.
-     *
-     * @returns The current {@link KycCustomerIdentity}, or `null`.
-     */
-    getCustomerIdentity() {
-        const { moonpayCustomerId, activeVendor } = this.state;
-        // `moonpayCustomerId` is issued only by MoonPay Check/Auth frames. Never
-        // pair it with another vendor, even if a switch left the fields out of
-        // sync, so consumers cannot attach a MoonPay id to an Iron (or other)
-        // downstream call.
-        if (!moonpayCustomerId || activeVendor !== 'moonpay') {
-            return null;
-        }
-        return { vendor: 'moonpay', id: moonpayCustomerId };
-    }
-    /**
-     * Runs the SumSub document-verification sub-flow end to end:
-     *
-     *  1. creates a UKYC session, receiving per-secret encryption schemas;
-     *  2. verifies the `encryptionDataKey` schema's `jwtChain` against the
-     *     idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against
-     *     the idOS relay JWKS, then confirms each attested session server public
-     *     key;
-     *  3. derives the `data_encryption_key` from the wallet's UKYC
-     *     `local_user_secret` and wraps it for the session server;
-     *  4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the
-     *     same way as the encryption key, and submits both via authorizations;
-     *  5. fetches the SumSub applicant access token; and
-     *  6. presents the SDK via the injected launcher.
-     *
-     * If a UKYC session already exists (the consents path creates it before
-     * recording session disclaimers), steps 1–4 are skipped.
-     *
-     * If authorizations report the applicant is already approved on the relay
-     * while the vendor is still finalizing (`kycStatus: approved`,
-     * `finalStatus: pending`), the sub-flow stops at step 4 with a
-     * `vendorProcessing` status and a message rather than launching the SDK.
-     *
-     * @param params - Optional parameters.
-     * @param params.locale - BCP-47 locale for the SDK UI.
-     * @param params.debug - Enables SDK debug logging.
-     * @returns The SDK result.
-     */
-    async startSumSub(params) {
-        // A new sub-flow supersedes any polling still running from a prior run.
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopPolling).call(this);
-        if (!__classPrivateFieldGet(this, _KycController_sumsubLauncher, "f").isAvailable()) {
-            const error = 'SumSub SDK is not available in this runtime.';
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-                state.sumsub.status = 'failed';
-                state.sumsub.result = { error };
-            });
-            throw new Error(error);
-        }
-        // Capture the flow generation so each async step can detect a `reset()`
-        // that lands mid-flight and avoid writing stale sub-flow state (or, worse,
-        // presenting the SDK) on a controller that is now idle.
-        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-        try {
-            if (!this.state.sumsub.sessionId) {
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-                    state.sumsub.status = 'creatingSession';
-                    state.sumsub.result = null;
-                    state.sumsub.sessionStatus = null;
-                });
-                const created = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createUkycSession).call(this, generation);
-                if (!created) {
-                    return {};
-                }
-                // A user who already finished the journey can return to a session the
-                // relay has already approved (`kycStatus`) while the vendor is still
-                // finalizing its own decision (`finalStatus`). There is nothing left to
-                // verify, so stop here and surface a message rather than launching the
-                // SDK again.
-                if (created.vendorProcessing) {
-                    return {
-                        kycStatus: created.kycStatus,
-                        finalStatus: created.finalStatus,
-                    };
-                }
-            }
-            // Empty string is a valid "no id to poll" session id used by tests and
-            // must not be coalesced away as missing.
-            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
-            const sessionId = this.state.sumsub.sessionId || '';
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.sumsub.status = 'fetchingToken';
-                state.sumsub.sessionId = sessionId;
-            });
-            const { applicantAccessToken } = await this.messenger.call('KycService:createJourney', sessionId);
-            // A reset() may have landed while the session/token was being prepared.
-            // Gate the `launching` write and the decision to open the SDK behind a
-            // single generation check: `#updateIfCurrent` only writes when still
-            // current and reports whether it did. Since there is no `await` between
-            // this check and `launch` below, a successful result guarantees the SDK
-            // is never presented on a flow that a concurrent reset() returned to idle.
-            const stillCurrent = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.sumsub.status = 'launching';
-                state.sumsub.applicantAccessToken = applicantAccessToken;
-            });
-            if (!stillCurrent) {
-                return {};
-            }
-            // Track whether the SDK ever reported a successful completion. A resolved
-            // `launch` alone does not imply success — the applicant may have
-            // abandoned the flow or the SDK may have reported a non-success outcome.
-            let reachedCompletion = false;
-            const result = await __classPrivateFieldGet(this, _KycController_sumsubLauncher, "f").launch({
-                applicantAccessToken,
-                onTokenExpiration: async () => {
-                    // A reset() may have superseded this flow while the SDK stayed open.
-                    // Refuse to refresh against the now-stale UKYC session rather than
-                    // silently keeping an orphaned SDK alive.
-                    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                        throw new Error('KYC flow was reset; SumSub session is no longer active.');
-                    }
-                    const refreshed = await this.messenger.call('KycService:createJourney', sessionId);
-                    return refreshed.applicantAccessToken;
-                },
-                onStatusChange: (_prev, next) => {
-                    if (next === SUMSUB_COMPLETED_STATUS) {
-                        reachedCompletion = true;
-                    }
-                    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                        state.sumsub.status =
-                            next === SUMSUB_COMPLETED_STATUS ? 'complete' : 'inProgress';
-                    });
-                },
-                locale: params?.locale ?? 'en',
-                debug: params?.debug ?? false,
-            });
-            // A resolved `launch` alone is not the final outcome: only a SDK-reported
-            // completion is worth polling for a verification decision. Anything else
-            // (abandonment, non-success) is `failed` and must not be polled.
-            const applied = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.sumsub.status = reachedCompletion ? 'polling' : 'failed';
-                state.sumsub.result = result;
-            });
-            // Once the SDK completes, the authoritative verification decision comes
-            // from the UKYC backend, not the SDK result. Poll the session status
-            // until it reaches a terminal decision. Guard on `applied` so a `reset()`
-            // that landed during `launch` cannot start polling on an idle flow.
-            if (applied && reachedCompletion) {
-                if (sessionId) {
-                    await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startSessionStatusPolling).call(this, sessionId);
-                }
-                else {
-                    // No session id to poll against; fall back to treating the SDK
-                    // completion as the final outcome.
-                    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                        state.sumsub.status = 'complete';
-                    });
-                }
-            }
-            return result;
-        }
-        catch (error) {
-            // Applicant already finished KYC — treat as completed for Money toast.
-            if (isSessionAlreadyCompletedError(error)) {
-                // A reset() may have landed while `launch` was in flight; forcing
-                // `completed` (and publishing `statusChanged`) on an idle controller
-                // would resurrect a flow the consumer already tore down.
-                if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                    return { alreadyCompleted: true };
-                }
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUserStatus).call(this, {
-                    status: 'completed',
-                    sumsubSessionId: null,
-                    errorCode: null,
-                });
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                    state.sumsub.status = 'complete';
-                    state.sumsub.result = { alreadyCompleted: true };
-                    state.statusMessage = 'KYC already completed.';
-                    state.phase = 'done';
-                    state.error = null;
-                });
-                return { alreadyCompleted: true };
-            }
-            const result = { error: String(error) };
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.sumsub.status = 'failed';
-                state.sumsub.result = result;
-            });
-            return result;
-        }
-    }
-    /**
-     * Refreshes the user-keyed simplified KYC status from `GET /kyc/status`,
-     * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and
-     * schedules short-interval polling while the status is `pending`.
-     *
-     * @returns The latest status payload.
-     */
-    async refreshKycStatus() {
-        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-        const payload = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fetchAndApplyUserStatus).call(this);
-        // A `reset()` landing while the request was in flight already stopped
-        // polling and left the flow idle, and the payload above is the pre-reset
-        // cached status. Starting a loop from it would poll — and publish
-        // `statusChanged` — on a torn-down flow.
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return payload;
-        }
-        if (payload.status === 'pending') {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_ensureUserStatusPolling).call(this);
-        }
-        else {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
-        }
-        return payload;
-    }
-    /**
-     * Fetches the current UKYC session status for the active sub-flow and records
-     * it on state. Useful for a one-off refresh outside the automatic polling
-     * loop that {@link startSumSub} runs.
-     *
-     * @returns The fetched session status.
-     * @throws If there is no active SumSub session to query.
-     */
-    async getSessionStatus() {
-        const { sessionId } = this.state.sumsub;
-        if (!sessionId) {
-            throw new Error('Cannot fetch session status: no active SumSub session.');
-        }
-        // Capture the flow generation so a `reset()` landing while the request is
-        // in flight cannot write the result onto an idle controller.
-        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-        const sessionStatus = await this.messenger.call('KycService:getSessionStatus', { sessionId });
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.sumsub.sessionStatus = sessionStatus;
-        });
-        return sessionStatus;
-    }
-    /**
-     * Resets the flow to idle, clearing session tokens and sub-flow state while
-     * preserving persisted terms acceptance and the per-product cache.
-     */
-    reset() {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_cancelPendingSession).call(this);
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.phase = 'idle';
-            state.statusMessage = '';
-            state.error = null;
-            state.disclaimers = [];
-            state.disclaimersError = null;
-            state.sessionDisclaimers = null;
-            state.credentialReusabilityConsentGiven = null;
-            state.sessionToken = null;
-            state.accessToken = null;
-            state.moonpayCustomerId = null;
-            state.activeVendor = 'moonpay';
-            state.activeProduct = null;
-            state.sumsub = {
-                status: 'idle',
-                result: null,
-                sessionId: null,
-                applicantAccessToken: null,
-                sessionStatus: null,
-            };
-        });
-    }
-    /**
-     * Restores the controller to its default state, discarding everything
-     * {@link reset} deliberately keeps: the session email, the persisted terms
-     * acceptance, the per-product KYC-required cache and the user-keyed status.
-     *
-     * Intended for a full wallet reset, where no trace of the previous
-     * customer may survive into the next wallet.
-     */
-    clearState() {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_cancelPendingSession).call(this);
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            Object.assign(state, getDefaultKycControllerState());
-        });
-    }
-}
-_KycController_sumsubLauncher = new WeakMap(), _KycController_moonpayFrameKeypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPolling = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
-    return {
-        get: async (path, entropySourceId) => this.messenger.call('UserStorageController:performGetStorage', path, entropySourceId),
-        set: async (path, value, entropySourceId) => this.messenger.call('UserStorageController:performSetStorage', path, value, entropySourceId),
-    };
-}, _KycController_startConsentsSession = 
-/**
- * Consents-path vendors: record vendor T&Cs, create a UKYC session,
- * record session-scoped idOS / KYC-provider disclaimers, then launch
- * SumSub — skipping MoonPay Check/Auth frames.
- *
- * @param consents - T&C2 flags mapped onto the session disclaimer catalog.
- * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
- * @param consents.idosTncSigned - Whether idOS T&C were accepted.
- * @param consents.credentialReusabilityConsentGiven - Whether credential
- * reuse was accepted.
- */
-async function _KycController_startConsentsSession(consents) {
-    const { email, acceptedDisclaimerIds } = this.state;
-    if (!email) {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for consents session.');
-        return;
-    }
-    if (acceptedDisclaimerIds.length === 0) {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing disclaimer acceptance.');
-        return;
-    }
-    const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        state.error = null;
-        state.phase = 'session';
-        state.statusMessage = 'Submitting consents...';
-        state.sumsub.status = 'creatingSession';
-        state.sumsub.result = null;
-        state.sumsub.sessionStatus = null;
-        // Consents-path vendors have no MoonPay session/access tokens.
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
-    });
-    try {
-        await this.messenger.call('KycService:submitVendorDisclaimers', {
-            vendor: this.state.activeVendor,
-            disclaimerIds: acceptedDisclaimerIds,
-        });
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.statusMessage = 'Creating session...';
-        });
-        const created = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createUkycSession).call(this, generation);
-        if (!created || __classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_recordSessionDisclaimers).call(this, created.sessionId, consents, generation);
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        if (created.vendorProcessing) {
-            try {
-                await this.refreshKycStatus();
-            }
-            catch (statusError) {
-                controllerLog('KYC status refresh failed:', statusError);
-            }
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.phase = 'done';
-                state.statusMessage = VENDOR_PROCESSING_MESSAGE;
-            });
-            return;
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.phase = 'submit';
-            state.statusMessage = 'Starting document verification...';
-        });
-        const sumsubResult = await this.startSumSub();
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        // `startSumSub` records `sumsub.status = 'failed'` for thrown steps,
-        // an SDK close without Completed, *and* a terminal UKYC rejection
-        // after the SDK reported Completed. Only rewind when there is no
-        // session-status decision yet (abandonment / thrown step). A
-        // Completed-then-rejected poll writes `sessionStatus` and is a
-        // finished flow: refresh user status and land on `done`.
-        if (this.state.sumsub.status === 'failed' &&
-            this.state.sumsub.sessionStatus === null) {
-            const sumsubError = sumsubResult?.error;
-            throw new Error(typeof sumsubError === 'string'
-                ? sumsubError
-                : 'SumSub verification did not complete.');
-        }
-        // After SumSub, refresh user-keyed status for the Money toast and start
-        // polling while still pending. Soft-fail: toast refresh must not rewind
-        // the consent / SumSub outcome.
-        try {
-            await this.refreshKycStatus();
-        }
-        catch (statusError) {
-            controllerLog('KYC status refresh failed:', statusError);
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            if (state.phase !== 'error' && state.phase !== 'done') {
-                state.phase = 'done';
-                state.statusMessage = 'KYC submitted.';
-            }
-        });
-    }
-    catch (error) {
-        if (isSessionAlreadyCompletedError(error)) {
-            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                return;
-            }
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUserStatus).call(this, {
-                status: 'completed',
-                sumsubSessionId: null,
-                errorCode: null,
-            });
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.sumsub.status = 'complete';
-                state.sumsub.result = { alreadyCompleted: true };
-                state.statusMessage = 'KYC already completed.';
-                state.phase = 'done';
-                state.error = null;
-            });
-            return;
-        }
-        controllerLog('Consents session failed:', error);
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
-            state.activeProduct = null;
-            state.sessionDisclaimers = null;
-            // Session create ran before recording disclaimers. Drop the leftover
-            // UKYC session so a later `startSumSub` cannot skip consent recording.
-            state.sumsub = { ...getDefaultKycControllerState().sumsub };
-            state.error = `Consents session failed: ${String(error)}`;
-            state.statusMessage =
-                'Consent / verification failed — accept the terms to try again.';
-            state.phase = 'terms';
-        });
-        await this.loadDisclaimers();
-    }
-}, _KycController_recordSessionDisclaimers = 
-/**
- * Fetches the session-scoped disclaimer catalog and records consents
- * derived from the T&C2 flags. Already-consented catalog rows are omitted
- * from the POST. A 409 is re-checked with a GET: continue only when every
- * accepted document is now consented, otherwise fail closed.
- *
- * @param sessionId - The UKYC session id.
- * @param consents - T&C2 flags mapped onto catalog documents.
- * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
- * @param consents.idosTncSigned - Whether idOS T&C were accepted.
- * @param consents.credentialReusabilityConsentGiven - Whether credential
- * reuse was accepted.
- * @param generation - Flow generation captured by the caller.
- */
-async function _KycController_recordSessionDisclaimers(sessionId, consents, generation) {
-    const catalog = await this.messenger.call('KycService:fetchSessionDisclaimers', { sessionId });
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return;
-    }
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        state.sessionDisclaimers = catalog;
-        state.statusMessage = 'Submitting consents...';
-    });
-    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosTncSigned) ||
-        isAcceptedCategoryEmpty(catalog.kycProvider, consents.sumsubTncSigned)) {
-        throw new Error('Session disclaimer catalog is missing documents for an accepted category.');
-    }
-    const idOS = consentRecordsFromCatalog(catalog.idOS, consents.idosTncSigned);
-    const kycProvider = consentRecordsFromCatalog(catalog.kycProvider, consents.sumsubTncSigned);
-    const reuseUnchanged = catalog.credentialReusabilityConsentGiven ===
-        consents.credentialReusabilityConsentGiven;
-    if (idOS.length === 0 && kycProvider.length === 0 && reuseUnchanged) {
-        return;
-    }
-    try {
-        const recorded = await this.messenger.call('KycService:submitSessionDisclaimers', {
-            sessionId,
-            idOS,
-            kycProvider,
-            credentialReusabilityConsentGiven: consents.credentialReusabilityConsentGiven,
-        });
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.sessionDisclaimers = recorded;
-        });
-    }
-    catch (error) {
-        if (!isConsentConflictError(error)) {
-            throw error;
-        }
-        // 409 means some document version was already recorded. Re-fetch and
-        // continue only when every document the user accepted is now consented;
-        // otherwise fail closed so a version bump cannot skip new docs.
-        const latest = await this.messenger.call('KycService:fetchSessionDisclaimers', { sessionId });
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.sessionDisclaimers = latest;
-        });
-        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosTncSigned);
-        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.sumsubTncSigned);
-        const stillMissingReuse = consents.credentialReusabilityConsentGiven &&
-            !latest.credentialReusabilityConsentGiven;
-        if (stillMissingIdos || stillMissingProvider || stillMissingReuse) {
-            throw error;
-        }
-    }
-}, _KycController_createSession = 
-/**
- * Creates a vendor session from the currently stored terms + email.
- */
-async function _KycController_createSession() {
-    const { email, termsAcceptedAt, acceptedDisclaimerIds } = this.state;
-    if (!email) {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for session creation.');
-        return;
-    }
-    if (!termsAcceptedAt || acceptedDisclaimerIds.length === 0) {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing terms acceptance for session creation.');
-        return;
-    }
-    // A new session invalidates any authentication carried over from a prior
-    // session. Clear the stale session token, access token, and auth-frame
-    // client token so `buildCheckFrameUrl` cannot return a URL bound to an old
-    // (or, on failure, invalid) session token, `buildAuthFrameUrl` cannot
-    // return a URL tied to an old client token, and `checkKycRequired` cannot
-    // run with an access token from an earlier authentication. The Check/Auth
-    // frames re-populate these for the new session. Because `sessionToken` is
-    // cleared here and only re-set on success, a failed creation leaves it
-    // `null` rather than resurrecting the previous session.
-    // Capture the flow generation so a `reset()` landing while the create
-    // request is in flight cannot resurrect a session (success) or overwrite
-    // the now-idle controller (failure). The synchronous update below runs
-    // before any `await`, so it needs no guard.
-    const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-    __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        state.error = null;
-        state.phase = 'session';
-        state.statusMessage = 'Creating session...';
-        state.sessionToken = null;
-        state.accessToken = null;
-    });
-    try {
-        const { sessionToken } = await this.messenger.call('KycService:createSession', { email, termsAcceptedAt, disclaimerIds: acceptedDisclaimerIds });
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.sessionToken = sessionToken;
-            state.phase = 'check';
-            state.statusMessage = 'Authenticating via Check frame...';
-        });
-    }
-    catch (error) {
-        controllerLog('Session creation failed:', error);
-        // A reset() superseded this flow while the request was in flight; leave
-        // the idle controller alone rather than forcing it back to `terms`.
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        // Invalidate the stored acceptance so the customer can retry. Also clear
-        // `activeProduct` so a later `acceptTermsAndStartSession` that omits a
-        // product cannot auto-run the KYC check / SumSub chain for this failed
-        // flow's product — matching how `initialize` starts from a clean product.
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
-            state.activeProduct = null;
-            state.error = `Session creation failed: ${String(error)}`;
-            state.statusMessage =
-                'Session creation failed — accept the terms to try again.';
-            state.phase = 'terms';
-        });
-        await this.loadDisclaimers();
-    }
-}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state) {
-    state.termsAcceptedAt = null;
-    state.acceptedDisclaimerIds = [];
-    state.termsAcceptedVendor = null;
-    state.sumsubTncAccepted = null;
-    state.idosTncAccepted = null;
-    state.credentialReusabilityConsentGiven = null;
-}, _KycController_clearMoonPaySession = function _KycController_clearMoonPaySession(state) {
-    state.moonpayCustomerId = null;
-    state.sessionToken = null;
-    state.accessToken = null;
-}, _KycController_dropTermsUnlessForVendor = function _KycController_dropTermsUnlessForVendor(vendor) {
-    if (__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_hasTermsForVendor).call(this, vendor)) {
-        return;
-    }
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
-    });
-}, _KycController_hasTermsForVendor = function _KycController_hasTermsForVendor(vendor) {
-    if (this.state.termsAcceptedVendor === null) {
-        return false;
-    }
-    return this.state.termsAcceptedVendor === vendor;
-}, _KycController_handleCheckOutcome = 
-/**
- * Applies a Check-frame outcome.
- *
- * @param status - The frame status.
- * @param accessToken - The decrypted access token, if any.
- * @param clientToken - The decrypted client token, if any.
- */
-async function _KycController_handleCheckOutcome(status, accessToken, clientToken) {
-    if (status === 'active' && accessToken) {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.accessToken = accessToken;
-            state.phase = 'form';
-            state.statusMessage = 'Already authenticated. Review to submit.';
-        });
-        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_continueAfterAuthentication).call(this);
-        return;
-    }
-    if (status === 'connectionRequired' && clientToken) {
-        __classPrivateFieldSet(this, _KycController_authClientToken, clientToken, "f");
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.phase = 'auth';
-            state.statusMessage = 'Verify your email via OTP in the Auth frame.';
-        });
-        return;
-    }
-    if (status === 'termsAcceptanceRequired') {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_requireTermsReacceptance).call(this);
-        return;
-    }
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Check frame returned status: ${status}`);
-}, _KycController_handleAuthOutcome = 
-/**
- * Applies an Auth-frame outcome.
- *
- * @param status - The frame status.
- * @param accessToken - The decrypted access token, if any.
- */
-async function _KycController_handleAuthOutcome(status, accessToken) {
-    if (status === 'active' && accessToken) {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.accessToken = accessToken;
-            state.phase = 'form';
-            state.statusMessage = 'Authenticated. Review to submit.';
-        });
-        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_continueAfterAuthentication).call(this);
-        return;
-    }
-    if (status === 'termsAcceptanceRequired') {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_requireTermsReacceptance).call(this);
-        return;
-    }
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Auth frame returned status: ${status}`);
-}, _KycController_continueAfterAuthentication = 
-/**
- * Continues the flow once authentication has completed (phase `form`).
- *
- * When the flow is scoped to a product (see {@link initialize}), the
- * KYC-required check runs automatically, and — when KYC is required — the
- * document-verification sub-flow is launched. When no product is set, this is
- * a no-op and the flow stays at `form` for the consumer to drive manually.
- *
- * Errors are already recorded on state by `checkKycRequired` (`error`
- * phase) and `startSumSub` (`sumsub.status = 'failed'`); this method swallows
- * them so it can be awaited safely from the frame-message handler.
- */
-async function _KycController_continueAfterAuthentication() {
-    const product = this.state.activeProduct;
-    if (!product) {
-        return;
-    }
-    // Re-entry protection lives at the frame boundary: `handleFrameMessage`
-    // only honors a Check/Auth `complete` while `phase` matches and
-    // `activeVendor` is MoonPay, and both outcome handlers move `phase` to
-    // `form` before awaiting this method. A duplicate, late, or cross-vendor
-    // `complete` therefore lands after the phase moved on (or on the wrong
-    // vendor) and is dropped before it can start a second continuation. Any
-    // writes here are additionally guarded by `#generation` (see
-    // `checkKycRequired` / `startSumSub`) so a `reset()` mid-continuation
-    // cannot corrupt state.
-    const kycRequired = await this.checkKycRequired({ product });
-    if (!kycRequired) {
-        return;
-    }
-    try {
-        await this.startSumSub();
-    }
-    catch {
-        // `startSumSub` already records `sumsub.status = 'failed'`; swallow the
-        // rethrown error (e.g. SDK unavailable) so the awaited continuation
-        // resolves cleanly rather than surfacing as an unhandled rejection.
-    }
-}, _KycController_requireTermsReacceptance = function _KycController_requireTermsReacceptance() {
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
-        state.phase = 'terms';
-        state.statusMessage =
-            'The vendor updated its Terms of Use — please re-accept.';
-    });
-}, _KycController_buildUkycSessionVendorFields = function _KycController_buildUkycSessionVendorFields() {
-    if (this.state.activeVendor === 'moonpay') {
-        return {
-            vendor: 'moonpay',
-            vendorMetadata: {
-                moonPayAccessToken: this.state.accessToken,
-                moonPayUserId: this.state.moonpayCustomerId,
-            },
-        };
-    }
-    return { vendor: this.state.activeVendor };
-}, _KycController_createUkycSession = 
-/**
- * Creates a UKYC session, wraps the `data_encryption_key` and
- * `ukyc_capability_token` against the returned encryption schemas, and
- * submits both via authorizations. Stores `sumsub.sessionId`. Returns `null`
- * when a `reset()` superseded the flow.
- *
- * @param generation - Flow generation captured by the caller.
- * @returns The created session, or `null` if superseded.
- */
-async function _KycController_createUkycSession(generation) {
-    const jwtToken = MOCK_JWT_TOKEN;
-    // Establish a per-session X25519 keypair used to seal both secrets. The
-    // private half stays on the device; the public half is registered on the
-    // session so the server can open later authorizations. Each encryption
-    // schema from session creation supplies the matching server public key.
-    const sessionClientPrivateKey = x25519.utils.randomSecretKey();
-    const sessionClientPublicKey = toBase64Url(x25519.getPublicKey(sessionClientPrivateKey));
-    // Residence is the ISO 3166-1 alpha-3 country already resolved for
-    // disclaimers / KYC-required; fetch it if this sub-flow started without
-    // that earlier step.
-    const residenceCountry = this.state.geoCountry ??
-        (await this.messenger.call('KycService:getGeoCountry'));
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return null;
-    }
-    if (residenceCountry !== this.state.geoCountry) {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.geoCountry = residenceCountry;
-        });
-    }
-    const { sessionId, encryptionDataKey, ukycCapabilityToken: capabilityTokenSchema, } = await this.messenger.call('KycService:createUkycSession', {
-        jwtToken,
-        sessionClientPublicKey,
-        residenceCountry,
-        ...__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_buildUkycSessionVendorFields).call(this),
-    });
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return null;
-    }
-    // Verify each schema's jwtChain against the matching issuer JWKS, then
-    // confirm the returned server public key matches the value attested inside
-    // the verified JWT payload before trusting it for wrapping.
-    // `encryptionDataKey` is attested by the idOS enclave; `ukycCapabilityToken` by the
-    // idOS relay.
-    const [{ keys: idosEnclaveKeys }, { keys: idosRelayKeys }] = await Promise.all([
-        this.messenger.call('KycService:fetchIdosEnclaveJwks'),
-        this.messenger.call('KycService:fetchIdosRelayJwks'),
-    ]);
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, idosEnclaveKeys, encryptionDataKey);
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, idosRelayKeys, capabilityTokenSchema);
-    // Derive the data_encryption_key from the local_user_secret, mint a
-    // read-only capability token, and wrap both for the session server. Only
-    // the wrapped (encrypted) material ever leaves the device.
-    const localUserSecret = await getOrCreateLocalUserSecret(__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_localUserSecretStore).call(this));
-    const clientMaterial = deriveClientMaterial(localUserSecret);
-    const wrappedEncryptionDataKey = wrapEncryptionKey(sessionClientPrivateKey, encryptionDataKey.serverPublicKey.x, clientMaterial.dataEncryptionKey);
-    // Only the client holds the signing key derived from `local_user_secret`,
-    // so only the client can mint the token; scoping it to `read` means it
-    // authorizes later storage reads without granting write or delete access.
-    const ukycCapabilityToken = signStorageAccessToken({
-        material: clientMaterial,
-        operations: ['read'],
-        expiresAt: new Date(Date.now() + UKYC_CAPABILITY_TOKEN_TTL_MS),
-    });
-    const wrappedUkycCapabilityToken = wrapEncryptionKey(sessionClientPrivateKey, capabilityTokenSchema.serverPublicKey.x, stringToBytes(encodeStorageAccessTokenForHeader(ukycCapabilityToken)));
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return null;
-    }
-    const { kycStatus, finalStatus } = await this.messenger.call('KycService:setAuthorizations', {
-        sessionId,
-        wrappedEncryptionDataKey,
-        wrappedUkycCapabilityToken,
-    });
-    const vendorProcessing = kycStatus === KYC_STATUSES.approved &&
-        finalStatus === KYC_STATUSES.pending;
-    const stillCurrent = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-        state.sumsub.sessionId = sessionId;
-        if (vendorProcessing) {
-            state.sumsub.status = 'vendorProcessing';
-            state.statusMessage = VENDOR_PROCESSING_MESSAGE;
-        }
-    });
-    if (!stillCurrent) {
-        return null;
-    }
-    return { sessionId, kycStatus, finalStatus, vendorProcessing };
-}, _KycController_fetchAndApplyUserStatus = 
-/**
- * Fetches `GET /kyc/status` and applies it to state without managing the
- * poll loop (used by both {@link refreshKycStatus} and the poll tick).
- *
- * @returns The latest status payload.
- */
-async function _KycController_fetchAndApplyUserStatus() {
-    const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-    const response = await this.messenger.call('KycService:fetchKycStatus');
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return {
-            status: this.state.userStatus ?? 'not-started',
-            sumsubSessionId: this.state.userStatusSumsubSessionId,
-            errorCode: this.state.userStatusErrorCode,
-        };
-    }
-    const payload = {
-        status: response.status,
-        sumsubSessionId: response.sumsubSessionId ?? null,
-        errorCode: response.errorCode ?? null,
-    };
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUserStatus).call(this, payload);
-    return payload;
-}, _KycController_applyUserStatus = function _KycController_applyUserStatus(payload) {
-    const previous = this.state.userStatus;
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        state.userStatus = payload.status;
-        state.userStatusSumsubSessionId = payload.sumsubSessionId;
-        state.userStatusErrorCode = payload.errorCode;
-    });
-    if (previous !== payload.status) {
-        this.messenger.publish(`${controllerName}:statusChanged`, payload);
-    }
-}, _KycController_ensureUserStatusPolling = function _KycController_ensureUserStatusPolling() {
-    if (__classPrivateFieldGet(this, _KycController_userStatusPolling, "f")) {
-        return;
-    }
-    __classPrivateFieldSet(this, _KycController_userStatusPolling, true, "f");
-    const token = __classPrivateFieldGet(this, _KycController_userStatusPollToken, "f");
-    const tick = async () => {
-        try {
-            const payload = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fetchAndApplyUserStatus).call(this);
-            // Race with `reset()` / `#stopUserStatusPolling` while the request was
-            // in flight — do not reschedule onto an idle controller.
-            /* istanbul ignore next */
-            if (__classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") !== token) {
-                return;
-            }
-            if (payload.status !== 'pending') {
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
-                return;
-            }
-        }
-        catch {
-            // Keep polling on transient errors, unless the loop was superseded.
-            /* istanbul ignore next */
-            if (__classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") !== token) {
-                return;
-            }
-        }
-        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, setTimeout(() => {
-            __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
-            // eslint-disable-next-line @typescript-eslint/no-floating-promises
-            tick();
-        }, __classPrivateFieldGet(this, _KycController_userStatusPollIntervalMs, "f")), "f");
-        // Allow the process to exit while a pending-status poll is scheduled.
-        // React Native / browser timers are numbers with no `unref`, hence the
-        // optional call.
-        __classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f").unref?.();
-    };
-    __classPrivateFieldSet(this, _KycController_userStatusPollTimer, setTimeout(() => {
-        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
-        // eslint-disable-next-line @typescript-eslint/no-floating-promises
-        tick();
-    }, __classPrivateFieldGet(this, _KycController_userStatusPollIntervalMs, "f")), "f");
-    __classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f").unref?.();
-}, _KycController_stopUserStatusPolling = function _KycController_stopUserStatusPolling() {
-    __classPrivateFieldSet(this, _KycController_userStatusPollToken, __classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") + 1, "f");
-    __classPrivateFieldSet(this, _KycController_userStatusPolling, false, "f");
-    if (__classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f") !== null) {
-        clearTimeout(__classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f"));
-        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
-    }
-}, _KycController_startSessionStatusPolling = 
-/**
- * Begins polling the UKYC session status until a terminal decision is
- * reached. The first poll runs immediately (and is awaited by
- * {@link startSumSub}); subsequent polls are scheduled every
- * `#sessionStatusPollIntervalMs`.
- *
- * @param sessionId - The UKYC session id to poll.
- * @returns A promise that resolves once the first poll settles.
- */
-async function _KycController_startSessionStatusPolling(sessionId) {
-    // Supersede any prior loop and claim a fresh token for this one. Because
-    // `#stopPolling` bumps the token, any in-flight poll from a previous loop
-    // sees a mismatch and neither writes state nor reschedules.
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopPolling).call(this);
-    const token = __classPrivateFieldGet(this, _KycController_pollToken, "f");
-    const tick = async () => {
-        const shouldStop = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_pollSessionStatusOnce).call(this, sessionId, token);
-        if (shouldStop) {
-            return;
-        }
-        __classPrivateFieldSet(this, _KycController_pollTimer, setTimeout(() => {
-            __classPrivateFieldSet(this, _KycController_pollTimer, null, "f");
-            // `tick` swallows its own errors (see `#pollSessionStatusOnce`) and
-            // therefore never rejects, so this fire-and-forget scheduled poll
-            // cannot surface as an unhandled rejection.
-            // eslint-disable-next-line @typescript-eslint/no-floating-promises
-            tick();
-        }, __classPrivateFieldGet(this, _KycController_sessionStatusPollIntervalMs, "f")), "f");
-    };
-    await tick();
-}, _KycController_pollSessionStatusOnce = 
-/**
- * Performs a single session-status poll: fetches the status, records it, and
- * resolves the sub-flow when the status is terminal.
- *
- * Transient errors are swallowed so the loop keeps polling; the last good
- * `sessionStatus` is deliberately preserved rather than being overwritten
- * with the error.
- *
- * @param sessionId - The UKYC session id to poll.
- * @param token - The polling token captured when the loop started.
- * @returns `true` when the loop should stop (terminal status or superseded
- * by a reset / new sub-flow), `false` when it should keep polling.
- */
-async function _KycController_pollSessionStatusOnce(sessionId, token) {
-    try {
-        const sessionStatus = await this.messenger.call('KycService:getSessionStatus', { sessionId });
-        // Superseded while the request was in flight — drop the result.
-        if (__classPrivateFieldGet(this, _KycController_pollToken, "f") !== token) {
-            return true;
-        }
-        const isTerminal = TERMINAL_SESSION_STATUSES.has(sessionStatus.finalStatus);
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.sumsub.sessionStatus = sessionStatus;
-            if (isTerminal) {
-                state.sumsub.status = SUCCESSFUL_SESSION_STATUSES.has(sessionStatus.finalStatus)
-                    ? 'complete'
-                    : 'failed';
-            }
-        });
-        if (isTerminal) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopPolling).call(this);
-        }
-        return isTerminal;
-    }
-    catch {
-        // Keep polling on transient errors, preserving the last good status.
-        // Stop only when a reset / new sub-flow superseded this loop.
-        return __classPrivateFieldGet(this, _KycController_pollToken, "f") !== token;
-    }
-}, _KycController_stopPolling = function _KycController_stopPolling() {
-    __classPrivateFieldSet(this, _KycController_pollToken, __classPrivateFieldGet(this, _KycController_pollToken, "f") + 1, "f");
-    if (__classPrivateFieldGet(this, _KycController_pollTimer, "f") !== null) {
-        clearTimeout(__classPrivateFieldGet(this, _KycController_pollTimer, "f"));
-        __classPrivateFieldSet(this, _KycController_pollTimer, null, "f");
-    }
-}, _KycController_cancelPendingSession = function _KycController_cancelPendingSession() {
-    __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopPolling).call(this);
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
-    __classPrivateFieldSet(this, _KycController_generation, __classPrivateFieldGet(this, _KycController_generation, "f") + 1, "f");
-}, _KycController_updateIfCurrent = function _KycController_updateIfCurrent(generation, updater) {
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return false;
-    }
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, updater);
-    return true;
-}, _KycController_applyUpdate = function _KycController_applyUpdate(updater) {
-    this.update((state) => {
-        // @ts-expect-error Avoid "type instantiation is excessively deep".
-        updater(state);
-    });
-}, _KycController_assertAttestedServerPublicKey = function _KycController_assertAttestedServerPublicKey(keys, schema) {
-    const jwtChainPayload = verifyJwtChain(keys, schema.jwtChain);
-    if (jwtChainPayload.sessionServerPublicKeyX !== schema.serverPublicKey.x) {
-        throw new Error('sessionServerPublicKey does not match the verified jwtChain payload (sessionServerPublicKeyX).');
-    }
-}, _KycController_fail = function _KycController_fail(message) {
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        state.error = message;
-        state.phase = 'error';
-    });
-};
-//# sourceMappingURL=KycController.mjs.map