@metamask-previews/kyc-controller 0.0.0-preview-8bfa290fb → 0.2.0-preview-0a30e47

package/dist/{KycService.mjs → KycService.js}

@@ -1,21 +1,9 @@
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _KycService_instances, _KycService_fetch, _KycService_baseUrl, _KycService_idosEnclaveBaseUrl, _KycService_idosRelayBaseUrl, _KycService_fetchWellKnownJwks, _KycService_validateResponse, _KycService_requestJson;
-import { BaseDataService } from "@metamask/base-data-service";
-import { HttpError } from "@metamask/controller-utils";
-import { array, assert, boolean, enums, optional, string, StructError, type } from "@metamask/superstruct";
-import { Duration, inMilliseconds } from "@metamask/utils";
-import { alpha2ToAlpha3 } from "./countryCodes.mjs";
-import { UKYC_JWKS_PATH } from "./ukyc/constants.mjs";
+import { BaseDataService } from '@metamask/base-data-service';
+import { HttpError } from '@metamask/controller-utils';
+import { array, assert, boolean, enums, optional, string, StructError, type, } from '@metamask/superstruct';
+import { Duration, inMilliseconds } from '@metamask/utils';
+import { alpha2ToAlpha3 } from './countryCodes.js';
+import { UKYC_JWKS_PATH } from './ukyc/constants.js';
 // === GENERAL ===
 /**
  * The name of the {@link KycService}, used to namespace the service's actions.
@@ -29,8 +17,8 @@ const MESSENGER_EXPOSED_METHODS = [
     'checkKycRequired',
     'createVendorCustomer',
     'submitVendorDisclaimers',
-    'fetchDisclaimersCatalog',
-    'fetchSessionDisclaimers',
+    'fetchSessionDisclaimersByCountry',
+    'fetchSessionDisclaimersBySessionId',
     'submitSessionDisclaimers',
     'fetchKycStatus',
     'fetchIdosEnclaveJwks',
@@ -119,22 +107,30 @@ const KycUserStatusResponseStruct = type({
     sumsubSessionId: optional(string()),
     errorCode: optional(string()),
 });
-const ConsentDocumentStruct = type({
+const CatalogDocumentFields = {
     key: string(),
     version: string(),
     title: string(),
     url: string(),
+};
+const CatalogDocumentStruct = type(CatalogDocumentFields);
+// Session documents also report whether that version was already consented to.
+const ConsentDocumentStruct = type({
+    ...CatalogDocumentFields,
     consented: boolean(),
 });
-const DisclaimersCatalogFields = {
-    idOS: array(ConsentDocumentStruct),
-    kycProvider: array(ConsentDocumentStruct),
-};
-/** Global catalog from `GET /disclaimers` (no credential-reuse flag). */
-const GlobalDisclaimersResponseStruct = type(DisclaimersCatalogFields);
+/**
+ * Global catalog from `GET /disclaimers` (no per-document `consented` flag and
+ * no credential-reuse flag).
+ */
+const GlobalDisclaimersResponseStruct = type({
+    idOS: array(CatalogDocumentStruct),
+    kycProvider: array(CatalogDocumentStruct),
+});
 /** Session catalog from `GET`/`POST /sessions/{id}/disclaimers`. */
 const SessionDisclaimersResponseStruct = type({
-    ...DisclaimersCatalogFields,
+    idOS: array(ConsentDocumentStruct),
+    kycProvider: array(ConsentDocumentStruct),
     credentialReusabilityConsentGiven: boolean(),
 });
 // === SERVICE DEFINITION ===
@@ -162,6 +158,10 @@ const SessionDisclaimersResponseStruct = type({
  * which also means they are not retried by the service policy.
  */
 export class KycService extends BaseDataService {
+    #fetch;
+    #baseUrl;
+    #idosEnclaveBaseUrl;
+    #idosRelayBaseUrl;
     /**
      * Constructs a new KycService.
      *
@@ -187,19 +187,14 @@ export class KycService extends BaseDataService {
             queryClientConfig,
             policyOptions,
         });
-        _KycService_instances.add(this);
-        _KycService_fetch.set(this, void 0);
-        _KycService_baseUrl.set(this, void 0);
-        _KycService_idosEnclaveBaseUrl.set(this, void 0);
-        _KycService_idosRelayBaseUrl.set(this, void 0);
         // Fall back to the runtime's native `fetch`, bound to `globalThis` so it
         // can be invoked as a method of this instance without an illegal-invocation
         // error on platforms that check the receiver.
         if (fetchFunction) {
-            __classPrivateFieldSet(this, _KycService_fetch, fetchFunction, "f");
+            this.#fetch = fetchFunction;
         }
         else if (typeof globalThis.fetch === 'function') {
-            __classPrivateFieldSet(this, _KycService_fetch, globalThis.fetch.bind(globalThis), "f");
+            this.#fetch = globalThis.fetch.bind(globalThis);
         }
         else {
             throw new Error('KycService: fetch is not available globally and was not provided in options. Please inject a fetch implementation.');
@@ -207,9 +202,9 @@ export class KycService extends BaseDataService {
         if (!baseUrl) {
             throw new Error('KycService: baseUrl is required');
         }
-        __classPrivateFieldSet(this, _KycService_baseUrl, baseUrl, "f");
-        __classPrivateFieldSet(this, _KycService_idosEnclaveBaseUrl, idosEnclaveBaseUrl ?? '', "f");
-        __classPrivateFieldSet(this, _KycService_idosRelayBaseUrl, idosRelayBaseUrl ?? '', "f");
+        this.#baseUrl = baseUrl;
+        this.#idosEnclaveBaseUrl = idosEnclaveBaseUrl ?? '';
+        this.#idosRelayBaseUrl = idosRelayBaseUrl ?? '';
         this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
     /**
@@ -224,7 +219,7 @@ export class KycService extends BaseDataService {
         // Guard nullish/empty geolocation with the documented domain error rather
         // than letting `assert(location, string())` surface a superstruct
         // assertion error (which would change how the failure reads in
-        // `disclaimersError`).
+        // `vendorError`).
         const alpha2 = typeof location === 'string' ? location.split('-')[0].toUpperCase() : '';
         if (!alpha2 || alpha2 === 'UNKNOWN') {
             throw new Error(`Unable to determine country from geolocation (got "${String(location)}").`);
@@ -245,14 +240,14 @@ export class KycService extends BaseDataService {
      * @returns The disclaimers.
      */
     async fetchVendorDisclaimers({ vendor = 'moonpay', country, }) {
-        const url = new URL(`/vendors/${vendor}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const url = new URL(`/vendors/${vendor}/disclaimers`, this.#baseUrl);
         url.searchParams.set('country', country);
         const data = await this.fetchQuery({
             queryKey: [`${this.name}:fetchVendorDisclaimers`, vendor, country],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            queryFn: async () => this.#requestJson(url, { method: 'GET' }),
             staleTime: inMilliseconds(5, Duration.Minute),
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, DisclaimersResponseStruct, 'disclaimers');
+        return this.#validateResponse(data, DisclaimersResponseStruct, 'disclaimers');
     }
     /**
      * Creates a vendor session via the UKYC backend.
@@ -261,12 +256,12 @@ export class KycService extends BaseDataService {
      * @returns The created session token.
      */
     async createSession(params) {
-        const url = new URL('/vendors/moonpay/sessions', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+        const url = new URL('/vendors/moonpay/sessions', this.#baseUrl);
+        const data = await this.#requestJson(url, {
             method: 'POST',
             body: JSON.stringify(params),
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, CreateSessionResponseStruct, 'sessions');
+        return this.#validateResponse(data, CreateSessionResponseStruct, 'sessions');
     }
     /**
      * Checks whether KYC is required for the given vendor, country, and
@@ -277,7 +272,7 @@ export class KycService extends BaseDataService {
      */
     async checkKycRequired(params) {
         const vendor = params.vendor ?? 'moonpay';
-        const url = new URL(`/vendors/${vendor}/kyc-required`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const url = new URL(`/vendors/${vendor}/kyc-required`, this.#baseUrl);
         const capabilities = params.capabilities ?? [{ product: 'ramps' }];
         const body = vendor === 'moonpay'
             ? {
@@ -295,11 +290,11 @@ export class KycService extends BaseDataService {
                 throw new Error('checkKycRequired: country is required for vendor "moonpay".');
             }
         }
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+        const data = await this.#requestJson(url, {
             method: 'POST',
             body: JSON.stringify(body),
         });
-        const { required } = __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, KycRequiredResponseStruct, 'kyc-required');
+        const { required } = this.#validateResponse(data, KycRequiredResponseStruct, 'kyc-required');
         return { kycRequired: required };
     }
     /**
@@ -314,12 +309,12 @@ export class KycService extends BaseDataService {
      * @returns The vendor customer record (subset validated for controller use).
      */
     async createVendorCustomer(params) {
-        const url = new URL(`/vendors/${params.vendor}/customers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+        const url = new URL(`/vendors/${params.vendor}/customers`, this.#baseUrl);
+        const data = await this.#requestJson(url, {
             method: 'POST',
             body: JSON.stringify({ email: params.email }),
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, VendorCustomerResponseStruct, 'vendor customers');
+        return this.#validateResponse(data, VendorCustomerResponseStruct, 'vendor customers');
     }
     /**
      * Records vendor T&C acceptance (`POST /vendors/{vendor}/disclaimers`).
@@ -334,72 +329,72 @@ export class KycService extends BaseDataService {
      * @returns The vendor signing records.
      */
     async submitVendorDisclaimers(params) {
-        const url = new URL(`/vendors/${encodeURIComponent(params.vendor)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+        const url = new URL(`/vendors/${encodeURIComponent(params.vendor)}/disclaimers`, this.#baseUrl);
+        const data = await this.#requestJson(url, {
             method: 'POST',
             body: JSON.stringify({ disclaimerIds: params.disclaimerIds }),
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, VendorSigningsResponseStruct, 'vendor disclaimers');
+        return this.#validateResponse(data, VendorSigningsResponseStruct, 'vendor disclaimers');
     }
     /**
      * Fetches the global idOS + KYC-provider disclaimer catalog
-     * (`GET /disclaimers?country=`). Does not include
-     * `credentialReusabilityConsentGiven` — that is session-scoped via
-     * {@link fetchSessionDisclaimers}. Vendor T&Cs continue to come from
-     * {@link fetchVendorDisclaimers}.
+     * (`GET /disclaimers?country=`). Carries no consent state — per-document
+     * `consented` flags and `credentialReusabilityConsentGiven` are
+     * session-scoped via {@link fetchSessionDisclaimersBySessionId}. Vendor T&Cs continue to
+     * come from {@link fetchVendorDisclaimers}.
      *
      * @param params - The parameters.
      * @param params.country - ISO 3166-1 alpha-3 country code.
      * @returns The catalog documents.
      */
-    async fetchDisclaimersCatalog({ country, }) {
+    async fetchSessionDisclaimersByCountry({ country, }) {
         if (country.length !== 3) {
-            throw new Error(`KycService.fetchDisclaimersCatalog: country must be an ISO 3166-1 alpha-3 code (received "${country}").`);
+            throw new Error(`KycService.fetchSessionDisclaimersByCountry: country must be an ISO 3166-1 alpha-3 code (received "${country}").`);
         }
-        const url = new URL('/disclaimers', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const url = new URL('/disclaimers', this.#baseUrl);
         url.searchParams.set('country', country);
         const data = await this.fetchQuery({
-            queryKey: [`${this.name}:fetchDisclaimersCatalog`, country],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            queryKey: [`${this.name}:fetchSessionDisclaimersByCountry`, country],
+            queryFn: async () => this.#requestJson(url, { method: 'GET' }),
             staleTime: 0,
             gcTime: 0,
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, GlobalDisclaimersResponseStruct, 'disclaimers');
+        return this.#validateResponse(data, GlobalDisclaimersResponseStruct, 'disclaimers');
     }
     /**
      * Fetches the session-scoped idOS + KYC-provider disclaimer catalog
      * (`GET /sessions/{sessionId}/disclaimers`), including per-session
      * `consented` flags and `credentialReusabilityConsentGiven`. For the
-     * pre-session global catalog use {@link fetchDisclaimersCatalog}. Vendor
-     * T&Cs continue to come from {@link fetchVendorDisclaimers}.
+     * pre-session global catalog use {@link fetchSessionDisclaimersByCountry}.
+     * Vendor T&Cs continue to come from {@link fetchVendorDisclaimers}.
      *
      * @param params - The parameters.
      * @param params.sessionId - The UKYC session id.
      * @returns The catalog, including which documents are already consented.
      */
-    async fetchSessionDisclaimers({ sessionId, }) {
-        const url = new URL(`/sessions/${encodeURIComponent(sessionId)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+    async fetchSessionDisclaimersBySessionId({ sessionId, }) {
+        const url = new URL(`/sessions/${encodeURIComponent(sessionId)}/disclaimers`, this.#baseUrl);
         const data = await this.fetchQuery({
-            queryKey: [`${this.name}:fetchSessionDisclaimers`, sessionId],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            queryKey: [`${this.name}:fetchSessionDisclaimersBySessionId`, sessionId],
+            queryFn: async () => this.#requestJson(url, { method: 'GET' }),
             // Consent state can change after a POST, so always re-fetch.
             staleTime: 0,
             gcTime: 0,
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionDisclaimersResponseStruct, 'session disclaimers');
+        return this.#validateResponse(data, SessionDisclaimersResponseStruct, 'session disclaimers');
     }
     /**
      * Records idOS + KYC-provider consents for a UKYC session
      * (`POST /sessions/{sessionId}/disclaimers`). `key`/`version` pairs must
-     * match the current catalog from {@link fetchSessionDisclaimers}. A 409
+     * match the current catalog from {@link fetchSessionDisclaimersBySessionId}. A 409
      * means those document versions were already recorded for the session.
      *
      * @param params - The consent parameters.
      * @returns The updated catalog after recording.
      */
     async submitSessionDisclaimers(params) {
-        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/disclaimers`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/disclaimers`, this.#baseUrl);
+        const data = await this.#requestJson(url, {
             method: 'POST',
             body: JSON.stringify({
                 idOS: params.idOS,
@@ -407,7 +402,7 @@ export class KycService extends BaseDataService {
                 credentialReusabilityConsentGiven: params.credentialReusabilityConsentGiven,
             }),
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionDisclaimersResponseStruct, 'session disclaimers');
+        return this.#validateResponse(data, SessionDisclaimersResponseStruct, 'session disclaimers');
     }
     /**
      * Fetches the user-keyed simplified KYC status used by Money toast / banner
@@ -416,15 +411,36 @@ export class KycService extends BaseDataService {
      * @returns The simplified status payload.
      */
     async fetchKycStatus() {
-        const url = new URL('/kyc/status', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const url = new URL('/kyc/status', this.#baseUrl);
         const data = await this.fetchQuery({
             queryKey: [`${this.name}:fetchKycStatus`],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            queryFn: async () => this.#requestJson(url, { method: 'GET' }),
             // Status is polled for toast flips, so it must always be fresh.
             staleTime: 0,
             gcTime: 0,
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, KycUserStatusResponseStruct, 'kyc status');
+        return this.#validateResponse(data, KycUserStatusResponseStruct, 'kyc status');
+    }
+    /**
+     * Fetches a well-known JWKS from `baseUrl`, caching the result for an hour.
+     *
+     * @param baseUrl - Host base URL that serves `/.well-known/jwks.json`.
+     * @param queryName - Cache query-key segment.
+     * @param responseLabel - Label used in malformed-response errors.
+     * @param missingConfigMessage - Error thrown when `baseUrl` is empty.
+     * @returns The JWKS keys.
+     */
+    async #fetchWellKnownJwks(baseUrl, queryName, responseLabel, missingConfigMessage) {
+        if (!baseUrl) {
+            throw new Error(missingConfigMessage);
+        }
+        const url = new URL(UKYC_JWKS_PATH, baseUrl);
+        const data = await this.fetchQuery({
+            queryKey: [`${this.name}:${queryName}`, baseUrl],
+            queryFn: async () => this.#requestJson(url, { method: 'GET' }, { authenticated: false }),
+            staleTime: inMilliseconds(1, Duration.Hour),
+        });
+        return this.#validateResponse(data, JwksResponseStruct, responseLabel);
     }
     /**
      * Fetches the idOS enclave JWKS used to verify the
@@ -437,7 +453,7 @@ export class KycService extends BaseDataService {
      * @returns The JWKS keys.
      */
     async fetchIdosEnclaveJwks() {
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_fetchWellKnownJwks).call(this, __classPrivateFieldGet(this, _KycService_idosEnclaveBaseUrl, "f"), 'fetchIdosEnclaveJwks', 'idOS enclave JWKS', 'KycService: idosEnclaveBaseUrl is not configured; cannot fetch JWKS to verify the encryptionDataKey schema.');
+        return this.#fetchWellKnownJwks(this.#idosEnclaveBaseUrl, 'fetchIdosEnclaveJwks', 'idOS enclave JWKS', 'KycService: idosEnclaveBaseUrl is not configured; cannot fetch JWKS to verify the encryptionDataKey schema.');
     }
     /**
      * Fetches the idOS relay JWKS used to verify the `ukycCapabilityToken`
@@ -449,7 +465,7 @@ export class KycService extends BaseDataService {
      * @returns The JWKS keys.
      */
     async fetchIdosRelayJwks() {
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_fetchWellKnownJwks).call(this, __classPrivateFieldGet(this, _KycService_idosRelayBaseUrl, "f"), 'fetchIdosRelayJwks', 'idOS relay JWKS', 'KycService: idosRelayBaseUrl is not configured; cannot fetch JWKS to verify the ukycCapabilityToken schema.');
+        return this.#fetchWellKnownJwks(this.#idosRelayBaseUrl, 'fetchIdosRelayJwks', 'idOS relay JWKS', 'KycService: idosRelayBaseUrl is not configured; cannot fetch JWKS to verify the ukycCapabilityToken schema.');
     }
     /**
      * Creates a UKYC session for the SumSub document-verification sub-flow.
@@ -466,8 +482,8 @@ export class KycService extends BaseDataService {
      * @returns The UKYC session id and encryption schemas.
      */
     async createUkycSession(params) {
-        const url = new URL('/sessions', __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+        const url = new URL('/sessions', this.#baseUrl);
+        const data = await this.#requestJson(url, {
             method: 'POST',
             body: JSON.stringify({
                 vendorId: params.vendor ?? 'moonpay',
@@ -478,7 +494,7 @@ export class KycService extends BaseDataService {
                 vendorMetadata: params.vendorMetadata ?? {},
             }),
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, UkycSessionResponseStruct, 'UKYC sessions');
+        return this.#validateResponse(data, UkycSessionResponseStruct, 'UKYC sessions');
     }
     /**
      * Submits the wrapped `data_encryption_key` and wrapped
@@ -490,15 +506,15 @@ export class KycService extends BaseDataService {
      * @returns The session status after the authorizations are applied.
      */
     async setAuthorizations(params) {
-        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/authorizations`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, {
+        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/authorizations`, this.#baseUrl);
+        const data = await this.#requestJson(url, {
             method: 'POST',
             body: JSON.stringify({
                 wrappedEncryptionDataKey: params.wrappedEncryptionDataKey,
                 wrappedUkycCapabilityToken: params.wrappedUkycCapabilityToken,
             }),
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionStatusResponseStruct, 'authorizations');
+        return this.#validateResponse(data, SessionStatusResponseStruct, 'authorizations');
     }
     /**
      * Creates (or refreshes) the SumSub verification journey for a UKYC session,
@@ -508,9 +524,9 @@ export class KycService extends BaseDataService {
      * @returns The applicant access token and status.
      */
     async createJourney(sessionId) {
-        const url = new URL(`/sessions/${encodeURIComponent(sessionId)}/journey`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
-        const data = await __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'POST' });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, ApplicantAccessTokenResponseStruct, 'journey');
+        const url = new URL(`/sessions/${encodeURIComponent(sessionId)}/journey`, this.#baseUrl);
+        const data = await this.#requestJson(url, { method: 'POST' });
+        return this.#validateResponse(data, ApplicantAccessTokenResponseStruct, 'journey');
     }
     /**
      * Fetches the current status of a UKYC session. Polled after the SumSub SDK
@@ -521,113 +537,106 @@ export class KycService extends BaseDataService {
      * @returns The session status.
      */
     async getSessionStatus(params) {
-        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/status`, __classPrivateFieldGet(this, _KycService_baseUrl, "f"));
+        const url = new URL(`/sessions/${encodeURIComponent(params.sessionId)}/status`, this.#baseUrl);
         const data = await this.fetchQuery({
             queryKey: [`${this.name}:getSessionStatus`, params.sessionId],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }),
+            queryFn: async () => this.#requestJson(url, { method: 'GET' }),
             // Status is polled for a terminal decision, so it must always be fresh.
             staleTime: 0,
             gcTime: 0,
         });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, SessionStatusResponseStruct, 'session status');
-    }
-}
-_KycService_fetch = new WeakMap(), _KycService_baseUrl = new WeakMap(), _KycService_idosEnclaveBaseUrl = new WeakMap(), _KycService_idosRelayBaseUrl = new WeakMap(), _KycService_instances = new WeakSet(), _KycService_fetchWellKnownJwks = 
-/**
- * Fetches a well-known JWKS from `baseUrl`, caching the result for an hour.
- *
- * @param baseUrl - Host base URL that serves `/.well-known/jwks.json`.
- * @param queryName - Cache query-key segment.
- * @param responseLabel - Label used in malformed-response errors.
- * @param missingConfigMessage - Error thrown when `baseUrl` is empty.
- * @returns The JWKS keys.
- */
-async function _KycService_fetchWellKnownJwks(baseUrl, queryName, responseLabel, missingConfigMessage) {
-    if (!baseUrl) {
-        throw new Error(missingConfigMessage);
+        return this.#validateResponse(data, SessionStatusResponseStruct, 'session status');
     }
-    const url = new URL(UKYC_JWKS_PATH, baseUrl);
-    const data = await this.fetchQuery({
-        queryKey: [`${this.name}:${queryName}`, baseUrl],
-        queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }, { authenticated: false }),
-        staleTime: inMilliseconds(1, Duration.Hour),
-    });
-    return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, JwksResponseStruct, responseLabel);
-}, _KycService_validateResponse = function _KycService_validateResponse(data, struct, apiName) {
-    try {
-        assert(data, struct);
-        return data;
-    }
-    catch (error) {
-        const detail = error instanceof StructError
-            ? `${error.message} (received: ${JSON.stringify(data)})`
-            : // `assert` only ever throws `StructError` for the plain structs used
-                // here, so this is a defensive fallback that is not exercised.
-                /* istanbul ignore next */
-                String(error);
-        throw new Error(`Malformed response received from ${apiName} API: ${detail}`);
-    }
-}, _KycService_requestJson = 
-/**
- * Performs a single JSON request.
- *
- * Read endpoints pass this as the `queryFn` to {@link fetchQuery}, which
- * wraps it in the shared service policy (retries, circuit breaker). Write
- * endpoints call it directly, so they are executed exactly once. Requests
- * are authenticated with the wallet bearer token by default; pass
- * `{ authenticated: false }` for calls to services that do not expect it
- * (e.g. the idOS enclave or idOS relay JWKS endpoints).
- *
- * @param url - The request URL.
- * @param init - The request init (method, body).
- * @param options - Request options.
- * @param options.authenticated - Whether to attach the bearer token. Defaults
- * to `true`.
- * @returns The parsed JSON response.
- */
-async function _KycService_requestJson(url, init, options = {}) {
-    const { authenticated = true } = options;
-    const headers = {};
-    // Only advertise a JSON body when one is actually sent; bodyless requests
-    // (e.g. `createJourney`) must not carry a `Content-Type`.
-    if (init.body !== undefined && init.body !== null) {
-        headers['Content-Type'] = 'application/json';
-    }
-    if (authenticated) {
-        const bearerToken = await this.messenger.call('AuthenticationController:getBearerToken');
-        if (!bearerToken) {
-            throw new Error('Unable to obtain an authentication bearer token — is the wallet signed in?');
+    /**
+     * Validates a parsed API response against a superstruct schema, throwing a
+     * descriptive error when the response does not match.
+     *
+     * Unlike a bare `Struct.is` check, this surfaces exactly which field was
+     * missing or had the wrong type, which is essential for diagnosing shape
+     * mismatches between the client and the live API.
+     *
+     * @param data - The parsed response body.
+     * @param struct - The superstruct schema the body is expected to satisfy.
+     * @param apiName - A human-readable name of the API, used in the error message.
+     * @returns The validated, typed response.
+     * @throws If `data` does not match `struct`.
+     */
+    #validateResponse(data, struct, apiName) {
+        try {
+            assert(data, struct);
+            return data;
+        }
+        catch (error) {
+            const detail = error instanceof StructError
+                ? `${error.message} (received: ${JSON.stringify(data)})`
+                : // `assert` only ever throws `StructError` for the plain structs used
+                    // here, so this is a defensive fallback that is not exercised.
+                    /* istanbul ignore next */
+                    String(error);
+            throw new Error(`Malformed response received from ${apiName} API: ${detail}`);
         }
-        assert(bearerToken, string());
-        headers.Authorization = `Bearer ${bearerToken}`;
     }
-    const response = await __classPrivateFieldGet(this, _KycService_fetch, "f").call(this, url.toString(), {
-        ...init,
-        headers,
-    });
-    if (!response.ok) {
-        let detail = '';
-        try {
-            const errorBody = await response.json();
-            if (errorBody && typeof errorBody === 'object') {
-                const record = errorBody;
-                if (typeof record.message === 'string') {
-                    detail = record.message;
-                }
-                else if (typeof record.error === 'string') {
-                    detail = record.error;
+    /**
+     * Performs a single JSON request.
+     *
+     * Read endpoints pass this as the `queryFn` to {@link fetchQuery}, which
+     * wraps it in the shared service policy (retries, circuit breaker). Write
+     * endpoints call it directly, so they are executed exactly once. Requests
+     * are authenticated with the wallet bearer token by default; pass
+     * `{ authenticated: false }` for calls to services that do not expect it
+     * (e.g. the idOS enclave or idOS relay JWKS endpoints).
+     *
+     * @param url - The request URL.
+     * @param init - The request init (method, body).
+     * @param options - Request options.
+     * @param options.authenticated - Whether to attach the bearer token. Defaults
+     * to `true`.
+     * @returns The parsed JSON response.
+     */
+    async #requestJson(url, init, options = {}) {
+        const { authenticated = true } = options;
+        const headers = {};
+        // Only advertise a JSON body when one is actually sent; bodyless requests
+        // (e.g. `createJourney`) must not carry a `Content-Type`.
+        if (init.body !== undefined && init.body !== null) {
+            headers['Content-Type'] = 'application/json';
+        }
+        if (authenticated) {
+            const bearerToken = await this.messenger.call('AuthenticationController:getBearerToken');
+            if (!bearerToken) {
+                throw new Error('Unable to obtain an authentication bearer token — is the wallet signed in?');
+            }
+            assert(bearerToken, string());
+            headers.Authorization = `Bearer ${bearerToken}`;
+        }
+        const response = await this.#fetch(url.toString(), {
+            ...init,
+            headers,
+        });
+        if (!response.ok) {
+            let detail = '';
+            try {
+                const errorBody = await response.json();
+                if (errorBody && typeof errorBody === 'object') {
+                    const record = errorBody;
+                    if (typeof record.message === 'string') {
+                        detail = record.message;
+                    }
+                    else if (typeof record.error === 'string') {
+                        detail = record.error;
+                    }
                 }
             }
+            catch {
+                // Ignore body parse failures; status alone is still useful.
+            }
+            throw new HttpError(response.status, `Fetching '${url.toString()}' failed with status '${response.status}'${detail ? `: ${detail}` : ''}`);
         }
-        catch {
-            // Ignore body parse failures; status alone is still useful.
+        // DELETE (and similar) endpoints return 204 No Content.
+        if (response.status === 204) {
+            return null;
         }
-        throw new HttpError(response.status, `Fetching '${url.toString()}' failed with status '${response.status}'${detail ? `: ${detail}` : ''}`);
+        return (await response.json());
     }
-    // DELETE (and similar) endpoints return 204 No Content.
-    if (response.status === 204) {
-        return null;
-    }
-    return (await response.json());
-};
-//# sourceMappingURL=KycService.mjs.map
+}
+//# sourceMappingURL=KycService.js.map