@metamask-previews/kyc-controller 0.0.0-preview-8bfa290fb → 0.2.0-preview-0a30e47

package/dist/KycService.cjs

@@ -1,637 +0,0 @@
-"use strict";
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _KycService_instances, _KycService_fetch, _KycService_baseUrl, _KycService_idosEnclaveBaseUrl, _KycService_idosRelayBaseUrl, _KycService_fetchWellKnownJwks, _KycService_validateResponse, _KycService_requestJson;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.KycService = exports.serviceName = void 0;
-const base_data_service_1 = require("@metamask/base-data-service");
-const controller_utils_1 = require("@metamask/controller-utils");
-const superstruct_1 = require("@metamask/superstruct");
-const utils_1 = require("@metamask/utils");
-const countryCodes_js_1 = require("./countryCodes.cjs");
-const constants_js_1 = require("./ukyc/constants.cjs");
-// === GENERAL ===
-/**
- * The name of the {@link KycService}, used to namespace the service's actions.
- */
-exports.serviceName = 'KycService';
-// === MESSENGER ===
-const MESSENGER_EXPOSED_METHODS = [
-    'getGeoCountry',
-    'fetchVendorDisclaimers',
-    'createSession',
-    'checkKycRequired',
-    'createVendorCustomer',
-    'submitVendorDisclaimers',
-    'fetchDisclaimersCatalog',
-    'fetchSessionDisclaimers',
-    'submitSessionDisclaimers',
-    'fetchKycStatus',
-    'fetchIdosEnclaveJwks',
-    'fetchIdosRelayJwks',
-    'createUkycSession',
-    'setAuthorizations',
-    'createJourney',
-    'getSessionStatus',
-];
-// === API RESPONSE SCHEMAS ===
-const DisclaimerStruct = (0, superstruct_1.type)({
-    id: (0, superstruct_1.string)(),
-    display_name: (0, superstruct_1.string)(),
-    url: (0, superstruct_1.string)(),
-});
-const DisclaimersResponseStruct = (0, superstruct_1.array)(DisclaimerStruct);
-const VendorSigningStruct = (0, superstruct_1.type)({
-    id: (0, superstruct_1.string)(),
-    customer_id: (0, superstruct_1.string)(),
-    content_id: (0, superstruct_1.optional)((0, superstruct_1.string)()),
-});
-const VendorSigningsResponseStruct = (0, superstruct_1.array)(VendorSigningStruct);
-const CreateSessionResponseStruct = (0, superstruct_1.type)({ sessionToken: (0, superstruct_1.string)() });
-// The live KYC API returns the flag under `required`; the service normalizes
-// this to `kycRequired` for consumers (see `checkKycRequired`).
-const KycRequiredResponseStruct = (0, superstruct_1.type)({ required: (0, superstruct_1.boolean)() });
-// The session server's public key, in JWK-like form, returned inside an
-// encryption schema from `POST /sessions`. `x` is the base64url public key
-// used to wrap a secret for that schema.
-const ServerPublicKeyStruct = (0, superstruct_1.type)({
-    kty: (0, superstruct_1.string)(),
-    crv: (0, superstruct_1.string)(),
-    x: (0, superstruct_1.string)(),
-    kid: (0, superstruct_1.optional)((0, superstruct_1.string)()),
-    alg: (0, superstruct_1.optional)((0, superstruct_1.string)()),
-    use: (0, superstruct_1.optional)((0, superstruct_1.string)()),
-});
-const EncryptionSchemaStruct = (0, superstruct_1.type)({
-    serverPublicKey: ServerPublicKeyStruct,
-    jwtChain: (0, superstruct_1.string)(),
-});
-// A single Ed25519 (OKP) JWK. `type` (not `object`) keeps optional/extra JWK
-// fields (`use`, `alg`) from failing validation.
-const JwkStruct = (0, superstruct_1.type)({
-    kty: (0, superstruct_1.string)(),
-    crv: (0, superstruct_1.string)(),
-    x: (0, superstruct_1.string)(),
-    kid: (0, superstruct_1.string)(),
-});
-const JwksResponseStruct = (0, superstruct_1.type)({ keys: (0, superstruct_1.array)(JwkStruct) });
-const UkycSessionResponseStruct = (0, superstruct_1.type)({
-    sessionId: (0, superstruct_1.string)(),
-    // Per-secret wrapping material so the client can seal the
-    // `data_encryption_key` and the `ukyc_capability_token` independently.
-    encryptionDataKey: EncryptionSchemaStruct,
-    ukycCapabilityToken: EncryptionSchemaStruct,
-});
-const ApplicantAccessTokenResponseStruct = (0, superstruct_1.type)({
-    status: (0, superstruct_1.string)(),
-    applicantAccessToken: (0, superstruct_1.string)(),
-});
-const SessionStatusResponseStruct = (0, superstruct_1.type)({
-    finalStatus: (0, superstruct_1.string)(),
-    statusMessage: (0, superstruct_1.optional)((0, superstruct_1.string)()),
-    externalUserId: (0, superstruct_1.string)(),
-    kycStatus: (0, superstruct_1.string)(),
-    vendor: (0, superstruct_1.string)(),
-    vendorStatus: (0, superstruct_1.string)(),
-});
-// Vendor customer subset — `type` (not `object`) keeps extra vendor fields from
-// failing validation while still requiring the fields the controller needs.
-const VendorCustomerResponseStruct = (0, superstruct_1.type)({
-    id: (0, superstruct_1.string)(),
-    email: (0, superstruct_1.string)(),
-    status: (0, superstruct_1.string)(),
-});
-const KYC_USER_STATUSES = [
-    'not-started',
-    'pending',
-    'need-more-information',
-    'terminal-failure',
-    'completed',
-];
-const KycUserStatusResponseStruct = (0, superstruct_1.type)({
-    status: (0, superstruct_1.enums)([...KYC_USER_STATUSES]),
-    sumsubSessionId: (0, superstruct_1.optional)((0, superstruct_1.string)()),
-    errorCode: (0, superstruct_1.optional)((0, superstruct_1.string)()),
-});
-const ConsentDocumentStruct = (0, superstruct_1.type)({
-    key: (0, superstruct_1.string)(),
-    version: (0, superstruct_1.string)(),
-    title: (0, superstruct_1.string)(),
-    url: (0, superstruct_1.string)(),
-    consented: (0, superstruct_1.boolean)(),
-});
-const DisclaimersCatalogFields = {
-    idOS: (0, superstruct_1.array)(ConsentDocumentStruct),
-    kycProvider: (0, superstruct_1.array)(ConsentDocumentStruct),
-};
-/** Global catalog from `GET /disclaimers` (no credential-reuse flag). */
-const GlobalDisclaimersResponseStruct = (0, superstruct_1.type)(DisclaimersCatalogFields);
-/** Session catalog from `GET`/`POST /sessions/{id}/disclaimers`. */
-const SessionDisclaimersResponseStruct = (0, superstruct_1.type)({
-    ...DisclaimersCatalogFields,
-    credentialReusabilityConsentGiven: (0, superstruct_1.boolean)(),
-});
-// === SERVICE DEFINITION ===
-/**
- * `KycService` communicates with the Universal KYC (UKYC) backend to drive the
- * identity + document-verification flow. It is stateless and platform-agnostic:
- * HTTP is performed through the runtime's native `fetch` (or an injected
- * `fetch` when provided), and the auth bearer token and geolocation come from
- * other controllers via the messenger.
- *
- * It extends {@link BaseDataService}, so read-only endpoints are routed through
- * `fetchQuery`: they are wrapped in the shared service policy (retries, circuit
- * breaker) and their results are exposed via the service's `QueryClient`.
- * `fetchDisclaimers` and `fetchJwks` are cached with a `staleTime`;
- * session-scoped disclaimer and status-polling reads opt out of caching
- * (`staleTime`/`gcTime` of `0`) so they never serve a stale result.
- *
- * Write endpoints (every `POST`) deliberately bypass `fetchQuery`. The query
- * cache is built for idempotent reads: it deduplicates concurrent requests
- * sharing a `queryKey`, retains responses for replay, and publishes them on the
- * messenger via `cacheUpdated`. None of that is safe for calls that create
- * sessions, customers, or consents — two overlapping `createVendorCustomer`
- * calls would collapse into a single `POST`, and session tokens would be
- * broadcast as cache payloads. Writes therefore call `#requestJson` directly,
- * which also means they are not retried by the service policy.
- */
-class KycService extends base_data_service_1.BaseDataService {
-    /**
-     * Constructs a new KycService.
-     *
-     * @param options - The constructor options.
-     * @param options.messenger - The messenger suited for this service.
-     * @param options.fetch - A function used to make HTTP requests. Defaults to
-     * the runtime's native `fetch`.
-     * @param options.baseUrl - Base URL of the KYC API
-     * @param options.idosEnclaveBaseUrl - Base URL of the idOS enclave, from
-     * which the JWKS used to verify the `encryptionDataKey` schema's `jwtChain`
-     * is fetched.
-     * @param options.idosRelayBaseUrl - Base URL of the idOS relay, from which
-     * the JWKS used to verify the `ukycCapabilityToken` schema's `jwtChain` is
-     * fetched.
-     * @param options.queryClientConfig - Shared configuration for all queries
-     * exposed by the service.
-     * @param options.policyOptions - Options for the request service policy.
-     */
-    constructor({ messenger, fetch: fetchFunction, baseUrl, idosEnclaveBaseUrl, idosRelayBaseUrl, queryClientConfig = {}, policyOptions = {}, }) {
-        super({
-            name: exports.serviceName,
-            messenger,
-            queryClientConfig,
-            policyOptions,
-        });
-        _KycService_instances.add(this);
-        _KycService_fetch.set(this, void 0);
-        _KycService_baseUrl.set(this, void 0);
-        _KycService_idosEnclaveBaseUrl.set(this, void 0);
-        _KycService_idosRelayBaseUrl.set(this, void 0);
-        // Fall back to the runtime's native `fetch`, bound to `globalThis` so it
-        // can be invoked as a method of this instance without an illegal-invocation
-        // error on platforms that check the receiver.
-        if (fetchFunction) {
-            __classPrivateFieldSet(this, _KycService_fetch, fetchFunction, "f");
-        }
-        else if (typeof globalThis.fetch === 'function') {
-            __classPrivateFieldSet(this, _KycService_fetch, globalThis.fetch.bind(globalThis), "f");
-        }
-        else {
-            throw new Error('KycService: fetch is not available globally and was not provided in options. Please inject a fetch implementation.');
-        }
-        if (!baseUrl) {
-            throw new Error('KycService: baseUrl is required');
-        }
-        __classPrivateFieldSet(this, _KycService_baseUrl, baseUrl, "f");
-        __classPrivateFieldSet(this, _KycService_idosEnclaveBaseUrl, idosEnclaveBaseUrl ?? '', "f");
-        __classPrivateFieldSet(this, _KycService_idosRelayBaseUrl, idosRelayBaseUrl ?? '', "f");
-        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
-    }
-    /**
-     * Resolves the customer's country from the geolocation source and converts it
-     * to an ISO 3166-1 alpha-3 code.
-     *
-     * @returns The alpha-3 country code.
-     * @throws If the country cannot be determined or mapped.
-     */
-    async getGeoCountry() {
-        const location = await this.messenger.call('GeolocationController:getGeolocation');
-        // Guard nullish/empty geolocation with the documented domain error rather
-        // than letting `assert(location, string())` surface a superstruct
-        // assertion error (which would change how the failure reads in
-        // `disclaimersError`).
-        const alpha2 = typeof location === 'string' ? location.split('-')[0].toUpperCase() : '';
-        if (!alpha2 || alpha2 === 'UNKNOWN') {
-            throw new Error(`Unable to determine country from geolocation (got "${String(location)}").`);
-        }
-        const alpha3 = (0, countryCodes_js_1.alpha2ToAlpha3)(alpha2);
-        if (!alpha3) {
-            throw new Error(`Unable to map country code "${alpha2}" to an ISO 3166-1 alpha-3 code.`);
-        }
-        return alpha3;
-    }
-    /**
-     * Fetches the disclaimers the customer must accept before a session is
-     * created.
-     *
-     * @param params - The parameters.
-     * @param params.vendor - Identity vendor. Defaults to `moonpay`.
-     * @param params.country - ISO 3166-1 alpha-3 country code.
-     * @returns The disclaimers.
-     */
-    async fetchVendorDisclaimers({ vendor = 'moonpay', country, }) {
-        const url = new URL(`/vendors/${vendor}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        url.searchParams.set('country', country);
-        const data = await this.fetchQuery({
-            queryKey: [`${this.name}:fetchVendorDisclaimers`, vendor, country],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
-            staleTime: (0, utils_1.inMilliseconds)(5, utils_1.Duration.Minute),
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, DisclaimersResponseStruct, 'disclaimers');
-    }
-    /**
-     * Creates a vendor session via the UKYC backend.
-     *
-     * @param params - The session parameters.
-     * @returns The created session token.
-     */
-    async createSession(params) {
-        const url = new URL('/vendors/moonpay/sessions', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
-            method: 'POST',
-            body: JSON.stringify(params),
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, CreateSessionResponseStruct, 'sessions');
-    }
-    /**
-     * Checks whether KYC is required for the given vendor, country, and
-     * capabilities.
-     *
-     * @param params - The check parameters.
-     * @returns Whether KYC is required.
-     */
-    async checkKycRequired(params) {
-        const vendor = params.vendor ?? 'moonpay';
-        const url = new URL(`/vendors/${vendor}/kyc-required`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const capabilities = params.capabilities ?? [{ product: 'ramps' }];
-        const body = vendor === 'moonpay'
-            ? {
-                accessToken: params.accessToken,
-                country: params.country,
-                capabilities,
-            }
-            : {};
-        // MoonPay requires accessToken and country; validate before making the request.
-        if (vendor === 'moonpay') {
-            if (!params.accessToken) {
-                throw new Error('checkKycRequired: accessToken is required for vendor "moonpay".');
-            }
-            if (!params.country) {
-                throw new Error('checkKycRequired: country is required for vendor "moonpay".');
-            }
-        }
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
-            method: 'POST',
-            body: JSON.stringify(body),
-        });
-        const { required } = __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, KycRequiredResponseStruct, 'kyc-required');
-        return { kycRequired: required };
-    }
-    /**
-     * Creates (or resumes) an empty-shell customer for the authenticated
-     * canonical user on the given identity vendor. Must run before showing
-     * vendor T&C so the customer exists and resume logic can key off vendor
-     * status.
-     *
-     * @param params - The parameters.
-     * @param params.vendor - Identity vendor (e.g. `iron` for Money/VBA).
-     * @param params.email - Email associated with the customer.
-     * @returns The vendor customer record (subset validated for controller use).
-     */
-    async createVendorCustomer(params) {
-        const url = new URL(`/vendors/${params.vendor}/customers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
-            method: 'POST',
-            body: JSON.stringify({ email: params.email }),
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, VendorCustomerResponseStruct, 'vendor customers');
-    }
-    /**
-     * Records vendor T&C acceptance (`POST /vendors/{vendor}/disclaimers`).
-     * For Iron this creates content signings from the disclaimer ids the
-     * customer accepted. Session-scoped idOS / KYC-provider consents are
-     * recorded separately via {@link submitSessionDisclaimers}. Retries re-POST
-     * the same ids, matching the legacy `POST /consents` signing step.
-     *
-     * @param params - The parameters.
-     * @param params.vendor - Identity vendor (e.g. `iron`).
-     * @param params.disclaimerIds - Accepted vendor T&C ids.
-     * @returns The vendor signing records.
-     */
-    async submitVendorDisclaimers(params) {
-        const url = new URL(`/vendors/${encodeURIComponent(params.vendor)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
-            method: 'POST',
-            body: JSON.stringify({ disclaimerIds: params.disclaimerIds }),
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, VendorSigningsResponseStruct, 'vendor disclaimers');
-    }
-    /**
-     * Fetches the global idOS + KYC-provider disclaimer catalog
-     * (`GET /disclaimers?country=`). Does not include
-     * `credentialReusabilityConsentGiven` — that is session-scoped via
-     * {@link fetchSessionDisclaimers}. Vendor T&Cs continue to come from
-     * {@link fetchVendorDisclaimers}.
-     *
-     * @param params - The parameters.
-     * @param params.country - ISO 3166-1 alpha-3 country code.
-     * @returns The catalog documents.
-     */
-    async fetchDisclaimersCatalog({ country, }) {
-        if (country.length !== 3) {
-            throw new Error(`KycService.fetchDisclaimersCatalog: country must be an ISO 3166-1 alpha-3 code (received "${country}").`);
-        }
-        const url = new URL('/disclaimers', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        url.searchParams.set('country', country);
-        const data = await this.fetchQuery({
-            queryKey: [`${this.name}:fetchDisclaimersCatalog`, country],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
-            staleTime: 0,
-            gcTime: 0,
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, GlobalDisclaimersResponseStruct, 'disclaimers');
-    }
-    /**
-     * Fetches the session-scoped idOS + KYC-provider disclaimer catalog
-     * (`GET /sessions/{sessionId}/disclaimers`), including per-session
-     * `consented` flags and `credentialReusabilityConsentGiven`. For the
-     * pre-session global catalog use {@link fetchDisclaimersCatalog}. Vendor
-     * T&Cs continue to come from {@link fetchVendorDisclaimers}.
-     *
-     * @param params - The parameters.
-     * @param params.sessionId - The UKYC session id.
-     * @returns The catalog, including which documents are already consented.
-     */
-    async fetchSessionDisclaimers({ sessionId, }) {
-        const url = new URL(`/sessions/${encodeURIComponent(sessionId)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await this.fetchQuery({
-            queryKey: [`${this.name}:fetchSessionDisclaimers`, sessionId],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
-            // Consent state can change after a POST, so always re-fetch.
-            staleTime: 0,
-            gcTime: 0,
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionDisclaimersResponseStruct, 'session disclaimers');
-    }
-    /**
-     * Records idOS + KYC-provider consents for a UKYC session
-     * (`POST /sessions/{sessionId}/disclaimers`). `key`/`version` pairs must
-     * match the current catalog from {@link fetchSessionDisclaimers}. A 409
-     * means those document versions were already recorded for the session.
-     *
-     * @param params - The consent parameters.
-     * @returns The updated catalog after recording.
-     */
-    async submitSessionDisclaimers(params) {
-        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
-            method: 'POST',
-            body: JSON.stringify({
-                idOS: params.idOS,
-                kycProvider: params.kycProvider,
-                credentialReusabilityConsentGiven: params.credentialReusabilityConsentGiven,
-            }),
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionDisclaimersResponseStruct, 'session disclaimers');
-    }
-    /**
-     * Fetches the user-keyed simplified KYC status used by Money toast / banner
-     * surfaces (`GET /kyc/status`).
-     *
-     * @returns The simplified status payload.
-     */
-    async fetchKycStatus() {
-        const url = new URL('/kyc/status', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await this.fetchQuery({
-            queryKey: [`${this.name}:fetchKycStatus`],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
-            // Status is polled for toast flips, so it must always be fresh.
-            staleTime: 0,
-            gcTime: 0,
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, KycUserStatusResponseStruct, 'kyc status');
-    }
-    /**
-     * Fetches the idOS enclave JWKS used to verify the
-     * `encryptionDataKey` schema's `jwtChain` from
-     * {@link KycService.createUkycSession}.
-     *
-     * This is an unauthenticated request to a well-known path on the idOS enclave
-     * host, distinct from the UKYC base URL.
-     *
-     * @returns The JWKS keys.
-     */
-    async fetchIdosEnclaveJwks() {
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_fetchWellKnownJwks).call(this, __classPrivateFieldGet(this, _KycService_idosEnclaveBaseUrl, "f"), 'fetchIdosEnclaveJwks', 'idOS enclave JWKS', 'KycService: idosEnclaveBaseUrl is not configured; cannot fetch JWKS to verify the encryptionDataKey schema.');
-    }
-    /**
-     * Fetches the idOS relay JWKS used to verify the `ukycCapabilityToken`
-     * schema's `jwtChain` from {@link KycService.createUkycSession}.
-     *
-     * This is an unauthenticated request to a well-known path on the idOS relay
-     * host, distinct from both the UKYC base URL and the idOS enclave.
-     *
-     * @returns The JWKS keys.
-     */
-    async fetchIdosRelayJwks() {
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_fetchWellKnownJwks).call(this, __classPrivateFieldGet(this, _KycService_idosRelayBaseUrl, "f"), 'fetchIdosRelayJwks', 'idOS relay JWKS', 'KycService: idosRelayBaseUrl is not configured; cannot fetch JWKS to verify the ukycCapabilityToken schema.');
-    }
-    /**
-     * Creates a UKYC session for the SumSub document-verification sub-flow.
-     *
-     * The client registers its per-session X25519 public key so the server can
-     * later open boxes sealed with the matching private key, and supplies the
-     * customer's ISO 3166-1 alpha-3 country of residence. The response
-     * carries per-secret encryption schemas (`encryptionDataKey` and
-     * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and
-     * the read-only `ukyc_capability_token` and submit them via
-     * {@link KycService.setAuthorizations}.
-     *
-     * @param params - The session parameters.
-     * @returns The UKYC session id and encryption schemas.
-     */
-    async createUkycSession(params) {
-        const url = new URL('/sessions', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
-            method: 'POST',
-            body: JSON.stringify({
-                vendorId: params.vendor ?? 'moonpay',
-                vendorUserId: 'mockedId',
-                jwtToken: params.jwtToken,
-                sessionClientPublicKey: params.sessionClientPublicKey,
-                residenceCountry: params.residenceCountry,
-                vendorMetadata: params.vendorMetadata ?? {},
-            }),
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, UkycSessionResponseStruct, 'UKYC sessions');
-    }
-    /**
-     * Submits the wrapped `data_encryption_key` and wrapped
-     * `ukyc_capability_token` for a UKYC session. Both secrets are sealed with
-     * `wrapEncryptionKey` against the encryption schemas returned by
-     * {@link KycService.createUkycSession}.
-     *
-     * @param params - The wrapped authorizations.
-     * @returns The session status after the authorizations are applied.
-     */
-    async setAuthorizations(params) {
-        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/authorizations`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
-            method: 'POST',
-            body: JSON.stringify({
-                wrappedEncryptionDataKey: params.wrappedEncryptionDataKey,
-                wrappedUkycCapabilityToken: params.wrappedUkycCapabilityToken,
-            }),
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionStatusResponseStruct, 'authorizations');
-    }
-    /**
-     * Creates (or refreshes) the SumSub verification journey for a UKYC session,
-     * returning the applicant access token used to launch the SDK.
-     *
-     * @param sessionId - The UKYC session id from `createUkycSession`.
-     * @returns The applicant access token and status.
-     */
-    async createJourney(sessionId) {
-        const url = new URL(`/sessions/${encodeURIComponent(sessionId)}/journey`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'POST' });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, ApplicantAccessTokenResponseStruct, 'journey');
-    }
-    /**
-     * Fetches the current status of a UKYC session. Polled after the SumSub SDK
-     * completes to determine the final verification decision.
-     *
-     * @param params - The parameters.
-     * @param params.sessionId - The UKYC session id.
-     * @returns The session status.
-     */
-    async getSessionStatus(params) {
-        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/status`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await this.fetchQuery({
-            queryKey: [`${this.name}:getSessionStatus`, params.sessionId],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
-            // Status is polled for a terminal decision, so it must always be fresh.
-            staleTime: 0,
-            gcTime: 0,
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionStatusResponseStruct, 'session status');
-    }
-}
-exports.KycService = KycService;
-_KycService_fetch = new WeakMap(), _KycService_baseUrl = new WeakMap(), _KycService_idosEnclaveBaseUrl = new WeakMap(), _KycService_idosRelayBaseUrl = new WeakMap(), _KycService_instances = new WeakSet(), _KycService_fetchWellKnownJwks = 
-/**
- * Fetches a well-known JWKS from `baseUrl`, caching the result for an hour.
- *
- * @param baseUrl - Host base URL that serves `/.well-known/jwks.json`.
- * @param queryName - Cache query-key segment.
- * @param responseLabel - Label used in malformed-response errors.
- * @param missingConfigMessage - Error thrown when `baseUrl` is empty.
- * @returns The JWKS keys.
- */
-async function _KycService_fetchWellKnownJwks(baseUrl, queryName, responseLabel, missingConfigMessage) {
-    if (!baseUrl) {
-        throw new Error(missingConfigMessage);
-    }
-    const url = new URL(constants_js_1.UKYC_JWKS_PATH, baseUrl);
-    const data = await this.fetchQuery({
-        queryKey: [`${this.name}:${queryName}`, baseUrl],
-        queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }, { authenticated: false }),
-        staleTime: (0, utils_1.inMilliseconds)(1, utils_1.Duration.Hour),
-    });
-    return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, JwksResponseStruct, responseLabel);
-}, _KycService_validateResponse = function _KycService_validateResponse(data, struct, apiName) {
-    try {
-        (0, superstruct_1.assert)(data, struct);
-        return data;
-    }
-    catch (error) {
-        const detail = error instanceof superstruct_1.StructError
-            ? `${error.message} (received: ${JSON.stringify(data)})`
-            : // `assert` only ever throws `StructError` for the plain structs used
-                // here, so this is a defensive fallback that is not exercised.
-                /* istanbul ignore next */
-                String(error);
-        throw new Error(`Malformed response received from ${apiName} API: ${detail}`);
-    }
-}, _KycService_requestJson = 
-/**
- * Performs a single JSON request.
- *
- * Read endpoints pass this as the `queryFn` to {@link fetchQuery}, which
- * wraps it in the shared service policy (retries, circuit breaker). Write
- * endpoints call it directly, so they are executed exactly once. Requests
- * are authenticated with the wallet bearer token by default; pass
- * `{ authenticated: false }` for calls to services that do not expect it
- * (e.g. the idOS enclave or idOS relay JWKS endpoints).
- *
- * @param url - The request URL.
- * @param init - The request init (method, body).
- * @param options - Request options.
- * @param options.authenticated - Whether to attach the bearer token. Defaults
- * to `true`.
- * @returns The parsed JSON response.
- */
-async function _KycService_requestJson(url, init, options = {}) {
-    const { authenticated = true } = options;
-    const headers = {};
-    // Only advertise a JSON body when one is actually sent; bodyless requests
-    // (e.g. `createJourney`) must not carry a `Content-Type`.
-    if (init.body !== undefined && init.body !== null) {
-        headers['Content-Type'] = 'application/json';
-    }
-    if (authenticated) {
-        const bearerToken = await this.messenger.call('AuthenticationController:getBearerToken');
-        if (!bearerToken) {
-            throw new Error('Unable to obtain an authentication bearer token — is the wallet signed in?');
-        }
-        (0, superstruct_1.assert)(bearerToken, (0, superstruct_1.string)());
-        headers.Authorization = `Bearer ${bearerToken}`;
-    }
-    const response = await __classPrivateFieldGet(this, _KycService_fetch, "f").call(this, url.toString(), {
-        ...init,
-        headers,
-    });
-    if (!response.ok) {
-        let detail = '';
-        try {
-            const errorBody = await response.json();
-            if (errorBody && typeof errorBody === 'object') {
-                const record = errorBody;
-                if (typeof record.message === 'string') {
-                    detail = record.message;
-                }
-                else if (typeof record.error === 'string') {
-                    detail = record.error;
-                }
-            }
-        }
-        catch {
-            // Ignore body parse failures; status alone is still useful.
-        }
-        throw new controller_utils_1.HttpError(response.status, `Fetching '${url.toString()}' failed with status '${response.status}'${detail ? `: ${detail}` : ''}`);
-    }
-    // DELETE (and similar) endpoints return 204 No Content.
-    if (response.status === 204) {
-        return null;
-    }
-    return (await response.json());
-};
-//# sourceMappingURL=KycService.cjs.map