@metamask-previews/kyc-controller 0.0.0-preview-8bfa290fb → 0.2.0-preview-97d6b86c0

package/CHANGELOG.md

@@ -9,58 +9,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Add `idosRelayBaseUrl` on `KycService` and `KycService.fetchIdosRelayJwks()` to fetch the idOS relay well-known JWKS used to verify the `ukycCapabilityToken` encryption schema. `encryptionDataKey` continues to verify against idOS enclave JWKS via `fetchIdosEnclaveJwks` / `idosEnclaveBaseUrl`. ([#10008](https://github.com/MetaMask/core/pull/10008))
-- Add session-scoped disclaimer APIs on `KycService` for the idOS / KYC-provider catalog ([#9979](https://github.com/MetaMask/core/pull/9979)):
-  - `fetchSessionDisclaimers({ sessionId })` calls `GET /sessions/{sessionId}/disclaimers`
-  - `submitSessionDisclaimers({ sessionId, idOS, kycProvider, credentialReusabilityConsentGiven })` calls `POST /sessions/{sessionId}/disclaimers`
-- Add `KycService.submitVendorDisclaimers({ vendor, disclaimerIds })` (`POST /vendors/{vendor}/disclaimers`) to record Iron T&C signings, plus the `KycVendorSigning` response type. The consents path calls this alongside session-scoped disclaimers; vendor T&C ids are no longer sent on the session disclaimer POST. ([#9979](https://github.com/MetaMask/core/pull/9979))
-- Add `KycConsentDocument`, `KycConsentRecord`, and `KycSessionDisclaimers` types for that catalog, plus in-memory `credentialReusabilityConsentGiven` and `sessionDisclaimers` controller state. `acceptTermsAndStartSession` forwards optional `credentialReusabilityConsentGiven` (default `false`). ([#9979](https://github.com/MetaMask/core/pull/9979))
-- Parameterize Universal KYC vendor HTTP on `KycService` so identity vendors share one client surface instead of vendor-branded methods ([#9908](https://github.com/MetaMask/core/pull/9908)):
-  - `fetchDisclaimers({ vendor, country })` and `checkKycRequired({ vendor, ... })` call `/vendors/{vendor}/disclaimers` and `/vendors/{vendor}/kyc-required` (`vendor` defaults to `moonpay`)
-  - `createVendorCustomer({ vendor, email })` calls `POST /vendors/{vendor}/customers`
-  - `fetchKycStatus()` reads `GET /kyc/status`
-- Add a consents-path KYC flow on `KycController` for non-MoonPay vendors (currently `iron`): empty-shell customer → disclaimers → consents → SumSub, skipping MoonPay Check/Auth frames. `initialize({ vendor })` and `createVendorCustomer({ vendor, email })` drive the path; `acceptTermsAndStartSession` requires `sumsubTncSigned` / `idosTncSigned`. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Add `KycController.refreshKycStatus()` and the `KycController:statusChanged` event so consumers can poll user-keyed KYC status for toast / banner surfaces. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Add `KycController.getCustomerIdentity()` (and `KycCustomerIdentity`) returning the vendor-scoped `{ vendor, id }` for the current session, or `null` before authentication and after `reset()`. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Extend `KycProduct` with `'money'` and `KycVendor` with `'iron'`. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Add `KycUserStatus` / `KycUserStatusResponse` types for the simplified `GET /kyc/status` payload. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Add persisted `termsAcceptedVendor` state recording which vendor's disclaimers `acceptedDisclaimerIds` belong to, so stored acceptance is only reused for that vendor. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Add persisted `sumsubTncAccepted` and `idosTncAccepted` state so T&C2 flags can be validated when resuming a consents-path session. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Add `KycController.clearState()` (and the `KycController:clearState` action) restoring the default state, including the fields `reset()` preserves: the session email, terms acceptance, the per-product KYC-required cache and the user-keyed status. Intended for a full wallet reset. ([#9958](https://github.com/MetaMask/core/pull/9958))
+- Add `KycController.fetchSessionDisclaimers`, which fetches the idOS + KYC-provider disclaimers by `{ sessionId }` or `{ country }`. ([#10162](https://github.com/MetaMask/core/pull/10162))
 
 ### Changed
 
-- Add `KycService.fetchDisclaimersCatalog` / `KycService:fetchDisclaimersCatalog` (`GET /disclaimers?country=`, ISO 3166-1 alpha-3) for the pre-session idOS + KYC-provider catalog, plus the `KycDisclaimersCatalog` type (no `credentialReusabilityConsentGiven`). `fetchSessionDisclaimers` remains session-scoped (`GET /sessions/{sessionId}/disclaimers` → `KycSessionDisclaimers`). ([#10011](https://github.com/MetaMask/core/pull/10011))
-- **BREAKING:** Rename `KycService.fetchDisclaimers` / `KycService:fetchDisclaimers` / `KycServiceFetchDisclaimersAction` to `fetchVendorDisclaimers` / `KycService:fetchVendorDisclaimers` / `KycServiceFetchVendorDisclaimersAction`. ([#10011](https://github.com/MetaMask/core/pull/10011))
-- **BREAKING:** Rename `fractalEncryptionBaseUrl` to `idosEnclaveBaseUrl`, `KycService.fetchJwks` / `KycService:fetchJwks` / `KycServiceFetchJwksAction` to `fetchIdosEnclaveJwks` / `KycService:fetchIdosEnclaveJwks` / `KycServiceFetchIdosEnclaveJwksAction`, and related Fractal encryption naming to idOS enclave. ([#10008](https://github.com/MetaMask/core/pull/10008))
-- **BREAKING:** Verify `encryptionDataKey` against idOS enclave JWKS (`KycService:fetchIdosEnclaveJwks` / `idosEnclaveBaseUrl`) and `ukycCapabilityToken` against idOS relay JWKS (`KycService:fetchIdosRelayJwks` / `idosRelayBaseUrl`) when wrapping UKYC authorizations, instead of validating both schemas against Fractal. Hosts must supply `idosRelayBaseUrl` on `KycService` construction (same class of requirement as `idosEnclaveBaseUrl`). ([#10008](https://github.com/MetaMask/core/pull/10008))
-- **BREAKING:** Require `sessionClientPublicKey` (unpadded base64url X25519 public key) and `residenceCountry` (ISO 3166-1 alpha-3) on `KycService.createUkycSession` (`POST /sessions`). The controller generates the per-session keypair before creating the session and uses the private half to wrap authorizations; residence country is taken from the resolved geo country. ([#9993](https://github.com/MetaMask/core/pull/9993))
-- **BREAKING:** Replace wrapping-key exchange (`KycService.getWrappingKey`) and sending wrapped keys at session creation with encryption schemas from `createUkycSession` plus `setAuthorizations` (`POST /sessions/{id}/authorizations`). `createUkycSession` no longer accepts `wrappedEncryptionKey` or `ukycCapabilityToken`; both secrets are wrapped on the client against per-secret schemas and posted separately. ([#9944](https://github.com/MetaMask/core/pull/9944))
-- **BREAKING:** Replace `KycService.submitConsents` (`POST /consents`) with session-scoped `fetchSessionDisclaimers` / `submitSessionDisclaimers` plus vendor T&C recording via `submitVendorDisclaimers`. Consents now use `{ key, version }` document records plus `credentialReusabilityConsentGiven` instead of Iron disclaimer ids and boolean T&C flags, and they require a UKYC session id. Iron content ids are posted separately to `POST /vendors/{vendor}/disclaimers`. The consents path records vendor T&Cs, then creates the UKYC session, then records session disclaimers. A 409 conflict is re-checked with a GET and only treated as success when every accepted document is consented. ([#9979](https://github.com/MetaMask/core/pull/9979))
-- Make the `fetch` option on the `KycService` constructor optional; it now defaults to the runtime's native `fetch` (browser, React Native, Node 18+), so consumers no longer need to inject one. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- **BREAKING:** Invalidate terms acceptance when `termsAcceptedVendor` is `null` (pre-migration state), forcing reacceptance after the multi-vendor upgrade to ensure users review current vendor terms. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- **BREAKING:** Require `sumsubTncSigned` and `idosTncSigned` on `acceptTermsAndStartSession` for every vendor, so callers explicitly declare T&C2 acceptance. Zero-argument calls and omitted flags fail instead of defaulting to `true`. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Rename `CreateUkycSessionParams.vendorId` to `vendor` for consistency with other service methods. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Bump `@metamask/base-data-service` from `^0.1.3` to `^1.0.0` ([#9972](https://github.com/MetaMask/core/pull/9972))
-- Replace `KycController` `console.error` tracing with the `@metamask/utils` debug logger (`createProjectLogger` / `createModuleLogger`), so flow diagnostics are opt-in via `DEBUG=kyc-controller*` instead of always printing to the console. ([#10054](https://github.com/MetaMask/core/pull/10054))
-- Bump `@metamask/utils` from `^11.11.0` to `^11.12.0` ([#10076](https://github.com/MetaMask/core/pull/10076))
+- **BREAKING:** Rename `KycService.fetchDisclaimersCatalog` to `fetchSessionDisclaimersByCountry`. ([#10162](https://github.com/MetaMask/core/pull/10162))
+  - Rename `FetchDisclaimersCatalogParams` to `FetchSessionDisclaimersByCountryParams`.
+  - Rename the messenger action `KycService:fetchDisclaimersCatalog` to `KycService:fetchSessionDisclaimersByCountry`.
+- **BREAKING:** Rename `KycService.fetchSessionDisclaimers` to `fetchSessionDisclaimersBySessionId` ([#10162](https://github.com/MetaMask/core/pull/10162))
+  - Rename `FetchSessionDisclaimersParams` to `FetchSessionDisclaimersBySessionIdParams`.
+  - Rename the messenger action `KycService:fetchSessionDisclaimers` to `KycService:fetchSessionDisclaimersBySessionId`.
 
-### Fixed
+## [0.2.0]
 
-- Stop routing `KycService` write endpoints through the query cache. Every `POST` (`createSession`, `checkKycRequired`, `createVendorCustomer`, `submitVendorDisclaimers`, `submitSessionDisclaimers`, `createUkycSession`, `setAuthorizations`, `createJourney`) now issues its request directly instead of via `fetchQuery`. Previously these were modelled as queries, so two overlapping calls sharing a `queryKey` were deduplicated into a single request — a second `createVendorCustomer` while the first was in flight never reached the API — and their responses were retained in the cache and published on the messenger as `cacheUpdated` payloads, which for these endpoints include session tokens and applicant access tokens. Writes are also no longer retried by the service policy, so a failed non-idempotent request cannot create duplicate records server-side. ([#10007](https://github.com/MetaMask/core/pull/10007))
-- Stop incorrectly prefixing the session client public key onto wrapped `encryptionDataKey` and `ukycCapabilityToken` values from `wrapEncryptionKey`. `data` is now ciphertext+tag only; the server already has the client public key from session creation. ([#10036](https://github.com/MetaMask/core/pull/10036))
-- Clear leftover MoonPay `sessionToken`, `accessToken`, and Check/Auth frame credentials when `initialize` or `createVendorCustomer` switches to another vendor, so `buildCheckFrameUrl` cannot return a MoonPay URL for a consents-path session. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Rewind the consents path when SumSub fails before completion (thrown step or SDK close without `Completed`), instead of refreshing user status and forcing `phase` to `done`. A terminal UKYC rejection after the SDK completed still finishes as `done` so the decision can be reflected in user status. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Make `createVendorCustomer` a no-op during in-progress phases (matching `initialize`), so a vendor switch cannot leave Check/Auth frames attached to the wrong vendor. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Ignore Check/Auth frame completion unless the active vendor is MoonPay, and do not return a MoonPay customer id from `getCustomerIdentity()` under another vendor. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Drop persisted terms acceptance on a vendor switch only after `createVendorCustomer` succeeds, so a failed or reset Money start cannot erase another vendor's stored acceptance. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Clear `moonpayCustomerId` when the active vendor is not MoonPay, so `getCustomerIdentity()` cannot report a MoonPay customer id under another vendor. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Call `unref()` on the user-status poll timer only when it exists. React Native and browser timers are numbers, so an unconditional `unref()` threw when status polling started outside Node. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Skip the `session_not_in_valid_state` completion write when a `reset()` superseded the SumSub flow, so a late vendor response can no longer force `userStatus` to `completed` (and publish `statusChanged`) on an idle controller. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Stop `initialize()` once a `reset()` or `clearState()` has superseded it, so a geolocation response arriving afterwards can no longer move the controller into the `terms` phase or reload disclaimers onto a controller that was just reset. ([#9958](https://github.com/MetaMask/core/pull/9958))
-- Validate that `accessToken` and `country` are provided when calling `checkKycRequired` with vendor `moonpay`, failing fast with a clear error instead of posting `undefined` values to the API. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Check for global `fetch` availability before binding in `KycService` constructor, throwing a descriptive error if `fetch` is neither provided nor globally available (e.g. older Node environments). ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Check for null bearer token before calling `assert()` in `#requestJson`, ensuring the custom "wallet signed in" error message is shown instead of a generic superstruct error. ([#9908](https://github.com/MetaMask/core/pull/9908))
-- Require reacceptance of consents-path terms when `sumsubTncAccepted` or `idosTncAccepted` are `null` (pre-migration state), preventing invalid T&C2 flag submission on session resume. ([#9908](https://github.com/MetaMask/core/pull/9908))
+### Changed
+
+- **BREAKING:** Drop CommonJS support ([#9536](https://github.com/MetaMask/core/pull/9536))
+  - This package is now ESM-only, but can still be used in CommonJS projects via `require(esm)` in modern Node.js versions (22+), or dynamic imports in older Node.js versions.
+- **BREAKING:** Bump minimum Node.js version to 22 ([#9976](https://github.com/MetaMask/core/pull/9976))
+- **BREAKING:** Bump TypeScript target to ES2022 ([#10019](https://github.com/MetaMask/core/pull/10019))
+  - This package now ships ES2022 code, requiring a compatible modern environment or bundler configuration to consume.
+- Bump `@metamask/base-controller` from `^9.1.0` to `^10.0.0` ([#10160](https://github.com/MetaMask/core/pull/10160))
+- Bump `@metamask/base-data-service` from `^1.0.0` to `^2.0.0` ([#10160](https://github.com/MetaMask/core/pull/10160))
+- Bump `@metamask/controller-utils` from `^12.3.0` to `^13.0.0` ([#10160](https://github.com/MetaMask/core/pull/10160))
+- Bump `@metamask/geolocation-controller` from `^1.0.0` to `^2.0.0` ([#10160](https://github.com/MetaMask/core/pull/10160))
+- Bump `@metamask/messenger` from `^2.0.0` to `^3.0.0` ([#10160](https://github.com/MetaMask/core/pull/10160))
+- Bump `@metamask/profile-sync-controller` from `^30.0.0` to `^31.0.0` ([#10160](https://github.com/MetaMask/core/pull/10160))
+
+## [0.1.0]
+
+### Added
+
+- Initial Release ([#10145](https://github.com/MetaMask/core/pull/10145))
 
-[Unreleased]: https://github.com/MetaMask/core/
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/kyc-controller@0.2.0...HEAD
+[0.2.0]: https://github.com/MetaMask/core/compare/@metamask/kyc-controller@0.1.0...@metamask/kyc-controller@0.2.0
+[0.1.0]: https://github.com/MetaMask/core/releases/tag/@metamask/kyc-controller@0.1.0

package/dist/{KycController-method-action-types.d.mts → KycController-method-action-types.d.ts}

@@ -2,7 +2,7 @@
  * This file is auto generated.
  * Do not edit manually.
  */
-import type { KycController } from "./KycController.mjs";
+import type { KycController } from './KycController.js';
 /**
  * Resolves persisted terms + geolocation, and auto-creates a session when
  * terms are already accepted and an email is available.
@@ -48,6 +48,28 @@ export type KycControllerLoadDisclaimersAction = {
     type: `KycController:loadDisclaimers`;
     handler: KycController['loadDisclaimers'];
 };
+/**
+ * Fetches the idOS + KYC-provider disclaimer catalog. Pass exactly one of
+ * `sessionId` or `country`:
+ *
+ * - `{ sessionId }` → {@link KycService.fetchSessionDisclaimersBySessionId}
+ * (`GET /sessions/{sessionId}/disclaimers`)
+ * - `{ country }` → {@link KycService.fetchSessionDisclaimersByCountry}
+ * (`GET /disclaimers?country=`)
+ *
+ * A session-id fetch also writes the catalog to `sessionDisclaimers`.
+ *
+ * @param params - The parameters. Provide exactly one of `sessionId` or
+ * `country`.
+ * @param params.sessionId - The UKYC session id.
+ * @param params.country - ISO 3166-1 alpha-3 country code.
+ * @returns The catalog. Session fetches include consent state; country
+ * fetches do not.
+ */
+export type KycControllerFetchSessionDisclaimersAction = {
+    type: `KycController:fetchSessionDisclaimers`;
+    handler: KycController['fetchSessionDisclaimers'];
+};
 /**
  * Captures terms acceptance for the currently loaded disclaimers and creates
  * a session.
@@ -57,10 +79,12 @@ export type KycControllerLoadDisclaimersAction = {
  * @param params.product - The consuming feature the flow runs for. See
  * {@link initialize} for how the product drives the automatic post
  * authentication continuation.
- * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).
- * Required for every vendor so callers explicitly declare acceptance.
- * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
- * Required for every vendor so callers explicitly declare acceptance.
+ * @param params.providerDisclaimersAccepted - Sumsub disclaimer documents the
+ * customer accepted (`{ key, version }` records). Required for every vendor
+ * so callers explicitly declare acceptance.
+ * @param params.idosDisclaimersAccepted - idOS disclaimer documents the
+ * customer accepted (`{ key, version }` records). Required for every vendor
+ * so callers explicitly declare acceptance.
  * @param params.credentialReusabilityConsentGiven - Whether the customer
  * consented to reuse existing idOS credentials. Used when recording
  * session-scoped disclaimers on the consents path. Defaults to `false`.
@@ -194,6 +218,10 @@ export type KycControllerStartSumSubAction = {
  * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and
  * schedules short-interval polling while the status is `pending`.
  *
+ * Skipped when `userStatus` is already `completed`: a follow-up
+ * `GET /kyc/status` can still read a stale `pending` (for example after
+ * `session_not_in_valid_state`) and must not undo that decision.
+ *
  * @returns The latest status payload.
  */
 export type KycControllerRefreshKycStatusAction = {
@@ -235,5 +263,5 @@ export type KycControllerClearStateAction = {
 /**
  * Union of all KycController action types.
  */
-export type KycControllerMethodActions = KycControllerInitializeAction | KycControllerCreateVendorCustomerAction | KycControllerLoadDisclaimersAction | KycControllerAcceptTermsAndStartSessionAction | KycControllerClearSavedTermsAction | KycControllerHandleFrameMessageAction | KycControllerBuildCheckFrameUrlAction | KycControllerBuildAuthFrameUrlAction | KycControllerBuildResetFrameUrlAction | KycControllerCheckKycRequiredAction | KycControllerGetKycStatusAction | KycControllerGetCustomerIdentityAction | KycControllerStartSumSubAction | KycControllerRefreshKycStatusAction | KycControllerGetSessionStatusAction | KycControllerResetAction | KycControllerClearStateAction;
-//# sourceMappingURL=KycController-method-action-types.d.mts.map
+export type KycControllerMethodActions = KycControllerInitializeAction | KycControllerCreateVendorCustomerAction | KycControllerLoadDisclaimersAction | KycControllerFetchSessionDisclaimersAction | KycControllerAcceptTermsAndStartSessionAction | KycControllerClearSavedTermsAction | KycControllerHandleFrameMessageAction | KycControllerBuildCheckFrameUrlAction | KycControllerBuildAuthFrameUrlAction | KycControllerBuildResetFrameUrlAction | KycControllerCheckKycRequiredAction | KycControllerGetKycStatusAction | KycControllerGetCustomerIdentityAction | KycControllerStartSumSubAction | KycControllerRefreshKycStatusAction | KycControllerGetSessionStatusAction | KycControllerResetAction | KycControllerClearStateAction;
+//# sourceMappingURL=KycController-method-action-types.d.ts.map

package/dist/KycController-method-action-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KycController-method-action-types.d.ts","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,uCAAuC,CAAC;IAC9C,OAAO,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,6CAA6C,GAAG;IAC1D,IAAI,EAAE,0CAA0C,CAAC;IACjD,OAAO,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;CACtD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,4BAA4B,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,6BAA6B,GAC7B,uCAAuC,GACvC,kCAAkC,GAClC,0CAA0C,GAC1C,6CAA6C,GAC7C,kCAAkC,GAClC,qCAAqC,GACrC,qCAAqC,GACrC,oCAAoC,GACpC,qCAAqC,GACrC,mCAAmC,GACnC,+BAA+B,GAC/B,sCAAsC,GACtC,8BAA8B,GAC9B,mCAAmC,GACnC,mCAAmC,GACnC,wBAAwB,GACxB,6BAA6B,CAAC"}

package/dist/{KycController-method-action-types.mjs → KycController-method-action-types.js}

@@ -3,4 +3,4 @@
  * Do not edit manually.
  */
 export {};
-//# sourceMappingURL=KycController-method-action-types.mjs.map
+//# sourceMappingURL=KycController-method-action-types.js.map

package/dist/KycController-method-action-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KycController-method-action-types.js","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycController } from './KycController.js';\n\n/**\n * Resolves persisted terms + geolocation, and auto-creates a session when\n * terms are already accepted and an email is available.\n *\n * @param params - Optional parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. When\n * provided, the controller automatically runs the KYC-required check once\n * authentication completes (and chains into document verification when KYC\n * is required). When omitted, the flow stops at `form` and the consumer must\n * call `checkKycRequired` manually.\n * @param params.vendor - Identity vendor for this flow. Non-MoonPay vendors\n * skip Check/Auth frames and use the consents path. Defaults to `moonpay`.\n */\nexport type KycControllerInitializeAction = {\n  type: `KycController:initialize`;\n  handler: KycController['initialize'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the given identity\n * vendor. Exposed so a consumer can ensure the customer exists before\n * showing T&C screens independently of {@link initialize}.\n *\n * A call while a session flow is already in progress is a no-op — matching\n * {@link initialize} — so a vendor switch cannot leave Check/Auth frames\n * attached to the wrong vendor. Call {@link reset} first to start over.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor for the customer.\n * @param params.email - Email for the vendor customer.\n */\nexport type KycControllerCreateVendorCustomerAction = {\n  type: `KycController:createVendorCustomer`;\n  handler: KycController['createVendorCustomer'];\n};\n\n/**\n * Loads the disclaimers for the resolved (or provided) country.\n *\n * @param params - Optional parameters.\n * @param params.country - ISO 3166-1 alpha-3 country code override.\n */\nexport type KycControllerLoadDisclaimersAction = {\n  type: `KycController:loadDisclaimers`;\n  handler: KycController['loadDisclaimers'];\n};\n\n/**\n * Fetches the idOS + KYC-provider disclaimer catalog. Pass exactly one of\n * `sessionId` or `country`:\n *\n * - `{ sessionId }` → {@link KycService.fetchSessionDisclaimersBySessionId}\n * (`GET /sessions/{sessionId}/disclaimers`)\n * - `{ country }` → {@link KycService.fetchSessionDisclaimersByCountry}\n * (`GET /disclaimers?country=`)\n *\n * A session-id fetch also writes the catalog to `sessionDisclaimers`.\n *\n * @param params - The parameters. Provide exactly one of `sessionId` or\n * `country`.\n * @param params.sessionId - The UKYC session id.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The catalog. Session fetches include consent state; country\n * fetches do not.\n */\nexport type KycControllerFetchSessionDisclaimersAction = {\n  type: `KycController:fetchSessionDisclaimers`;\n  handler: KycController['fetchSessionDisclaimers'];\n};\n\n/**\n * Captures terms acceptance for the currently loaded disclaimers and creates\n * a session.\n *\n * @param params - The parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. See\n * {@link initialize} for how the product drives the automatic post\n * authentication continuation.\n * @param params.providerDisclaimersAccepted - Sumsub disclaimer documents the\n * customer accepted (`{ key, version }` records). Required for every vendor\n * so callers explicitly declare acceptance.\n * @param params.idosDisclaimersAccepted - idOS disclaimer documents the\n * customer accepted (`{ key, version }` records). Required for every vendor\n * so callers explicitly declare acceptance.\n * @param params.credentialReusabilityConsentGiven - Whether the customer\n * consented to reuse existing idOS credentials. Used when recording\n * session-scoped disclaimers on the consents path. Defaults to `false`.\n */\nexport type KycControllerAcceptTermsAndStartSessionAction = {\n  type: `KycController:acceptTermsAndStartSession`;\n  handler: KycController['acceptTermsAndStartSession'];\n};\n\n/**\n * Clears the persisted terms acceptance.\n */\nexport type KycControllerClearSavedTermsAction = {\n  type: `KycController:clearSavedTerms`;\n  handler: KycController['clearSavedTerms'];\n};\n\n/**\n * Handles a message posted by a Check/Auth frame and advances the flow.\n *\n * The transport-agnostic caller (WebView on mobile, iframe on web) forwards\n * the raw message and injects the returned `reply` back into the frame.\n *\n * @param params - The parameters.\n * @param params.message - The raw message posted by the frame.\n * @returns An object whose optional `reply` should be posted back.\n */\nexport type KycControllerHandleFrameMessageAction = {\n  type: `KycController:handleFrameMessage`;\n  handler: KycController['handleFrameMessage'];\n};\n\n/**\n * Builds the Check-frame URL, or `null` when no session exists yet.\n *\n * @returns The Check-frame URL or `null`.\n */\nexport type KycControllerBuildCheckFrameUrlAction = {\n  type: `KycController:buildCheckFrameUrl`;\n  handler: KycController['buildCheckFrameUrl'];\n};\n\n/**\n * Builds the Auth-frame URL, or `null` when no client token is available.\n *\n * @returns The Auth-frame URL or `null`.\n */\nexport type KycControllerBuildAuthFrameUrlAction = {\n  type: `KycController:buildAuthFrameUrl`;\n  handler: KycController['buildAuthFrameUrl'];\n};\n\n/**\n * Builds the Reset-frame URL.\n *\n * @returns The Reset-frame URL.\n */\nexport type KycControllerBuildResetFrameUrlAction = {\n  type: `KycController:buildResetFrameUrl`;\n  handler: KycController['buildResetFrameUrl'];\n};\n\n/**\n * Checks whether KYC is required for a product and caches the result.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @param params.country - Optional alpha-3 country override.\n * @returns Whether KYC is required.\n */\nexport type KycControllerCheckKycRequiredAction = {\n  type: `KycController:checkKycRequired`;\n  handler: KycController['checkKycRequired'];\n};\n\n/**\n * Reads the cached \"is KYC required\" result for a product.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @returns The cached value, or `undefined` if not yet checked.\n */\nexport type KycControllerGetKycStatusAction = {\n  type: `KycController:getKycStatus`;\n  handler: KycController['getKycStatus'];\n};\n\n/**\n * Returns the vendor-scoped identity for the currently authenticated\n * customer, or `null` when the flow has not yet captured a vendor customer\n * id (before authentication or after {@link reset}), or when a MoonPay id\n * is present under a different `activeVendor`.\n *\n * Exposed so consumers (e.g. ramps autoramp creation) can attach the vendor\n * customer id to downstream calls without reading the full KYC state, which\n * also holds session/access tokens. The id is session-scoped and never\n * persisted.\n *\n * @returns The current {@link KycCustomerIdentity}, or `null`.\n */\nexport type KycControllerGetCustomerIdentityAction = {\n  type: `KycController:getCustomerIdentity`;\n  handler: KycController['getCustomerIdentity'];\n};\n\n/**\n * Runs the SumSub document-verification sub-flow end to end:\n *\n * 1. creates a UKYC session, receiving per-secret encryption schemas;\n * 2. verifies the `encryptionDataKey` schema's `jwtChain` against the\n * idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against\n * the idOS relay JWKS, then confirms each attested session server public\n * key;\n * 3. derives the `data_encryption_key` from the wallet's UKYC\n * `local_user_secret` and wraps it for the session server;\n * 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the\n * same way as the encryption key, and submits both via authorizations;\n * 5. fetches the SumSub applicant access token; and\n * 6. presents the SDK via the injected launcher.\n *\n * If a UKYC session already exists (the consents path creates it before\n * recording session disclaimers), steps 1–4 are skipped.\n *\n * If authorizations report the applicant is already approved on the relay\n * while the vendor is still finalizing (`kycStatus: approved`,\n * `finalStatus: pending`), the sub-flow stops at step 4 with a\n * `vendorProcessing` status and a message rather than launching the SDK.\n *\n * @param params - Optional parameters.\n * @param params.locale - BCP-47 locale for the SDK UI.\n * @param params.debug - Enables SDK debug logging.\n * @returns The SDK result.\n */\nexport type KycControllerStartSumSubAction = {\n  type: `KycController:startSumSub`;\n  handler: KycController['startSumSub'];\n};\n\n/**\n * Refreshes the user-keyed simplified KYC status from `GET /kyc/status`,\n * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and\n * schedules short-interval polling while the status is `pending`.\n *\n * Skipped when `userStatus` is already `completed`: a follow-up\n * `GET /kyc/status` can still read a stale `pending` (for example after\n * `session_not_in_valid_state`) and must not undo that decision.\n *\n * @returns The latest status payload.\n */\nexport type KycControllerRefreshKycStatusAction = {\n  type: `KycController:refreshKycStatus`;\n  handler: KycController['refreshKycStatus'];\n};\n\n/**\n * Fetches the current UKYC session status for the active sub-flow and records\n * it on state. Useful for a one-off refresh outside the automatic polling\n * loop that {@link startSumSub} runs.\n *\n * @returns The fetched session status.\n * @throws If there is no active SumSub session to query.\n */\nexport type KycControllerGetSessionStatusAction = {\n  type: `KycController:getSessionStatus`;\n  handler: KycController['getSessionStatus'];\n};\n\n/**\n * Resets the flow to idle, clearing session tokens and sub-flow state while\n * preserving persisted terms acceptance and the per-product cache.\n */\nexport type KycControllerResetAction = {\n  type: `KycController:reset`;\n  handler: KycController['reset'];\n};\n\n/**\n * Restores the controller to its default state, discarding everything\n * {@link reset} deliberately keeps: the session email, the persisted terms\n * acceptance, the per-product KYC-required cache and the user-keyed status.\n *\n * Intended for a full wallet reset, where no trace of the previous\n * customer may survive into the next wallet.\n */\nexport type KycControllerClearStateAction = {\n  type: `KycController:clearState`;\n  handler: KycController['clearState'];\n};\n\n/**\n * Union of all KycController action types.\n */\nexport type KycControllerMethodActions =\n  | KycControllerInitializeAction\n  | KycControllerCreateVendorCustomerAction\n  | KycControllerLoadDisclaimersAction\n  | KycControllerFetchSessionDisclaimersAction\n  | KycControllerAcceptTermsAndStartSessionAction\n  | KycControllerClearSavedTermsAction\n  | KycControllerHandleFrameMessageAction\n  | KycControllerBuildCheckFrameUrlAction\n  | KycControllerBuildAuthFrameUrlAction\n  | KycControllerBuildResetFrameUrlAction\n  | KycControllerCheckKycRequiredAction\n  | KycControllerGetKycStatusAction\n  | KycControllerGetCustomerIdentityAction\n  | KycControllerStartSumSubAction\n  | KycControllerRefreshKycStatusAction\n  | KycControllerGetSessionStatusAction\n  | KycControllerResetAction\n  | KycControllerClearStateAction;\n"]}

package/dist/{KycController.d.mts → KycController.d.ts}

@@ -1,11 +1,11 @@
-import type { ControllerGetStateAction, ControllerStateChangeEvent } from "@metamask/base-controller";
-import { BaseController } from "@metamask/base-controller";
-import type { Messenger } from "@metamask/messenger";
-import type { UserStorageControllerPerformGetStorageAction, UserStorageControllerPerformSetStorageAction } from "@metamask/profile-sync-controller/user-storage";
-import type { Json } from "@metamask/utils";
-import type { KycControllerMethodActions } from "./KycController-method-action-types.mjs";
-import type { KycServiceMethodActions } from "./KycService-method-action-types.mjs";
-import type { KycCustomerIdentity, KycDisclaimer, KycPhase, KycProduct, KycSessionDisclaimers, KycSessionStatus, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycVendor } from "./types.mjs";
+import type { ControllerGetStateAction, ControllerStateChangeEvent } from '@metamask/base-controller';
+import { BaseController } from '@metamask/base-controller';
+import type { Messenger } from '@metamask/messenger';
+import type { UserStorageControllerPerformGetStorageAction, UserStorageControllerPerformSetStorageAction } from '@metamask/profile-sync-controller/user-storage';
+import type { Json } from '@metamask/utils';
+import type { KycControllerMethodActions } from './KycController-method-action-types.js';
+import type { KycServiceMethodActions } from './KycService-method-action-types.js';
+import type { KycConsentRecord, KycCustomerIdentity, KycDisclaimer, KycDisclaimersCatalog, KycPhase, KycProduct, KycProviderDisclaimersAccepted, KycSessionDisclaimers, KycSessionStatus, KycSumSubLauncher, KycSumSubStatus, KycUserStatus, KycVendor, KycVendorDisclaimersAccepted } from './types.js';
 export declare const controllerName = "KycController";
 /**
  * Describes the shape of the state object for {@link KycController}.
@@ -19,30 +19,27 @@ export type KycControllerState = {
     error: string | null;
     /** Email associated with the session (sourced from the account). */
     email: string | null;
-    /** ISO-8601 timestamp of the customer's terms acceptance (persisted). */
-    termsAcceptedAt: string | null;
-    /** IDs of the disclaimers the customer accepted (persisted). */
-    acceptedDisclaimerIds: string[];
     /**
-     * The vendor whose disclaimers `acceptedDisclaimerIds` belong to (persisted).
-     * Each vendor serves its own disclaimer set, so acceptance recorded for one
-     * vendor must not be reused for another. `null` when nothing is accepted.
+     * Persisted vendor-disclaimer acceptance (T&C1) with fixed `moonpay` and
+     * `iron` keys. MoonPay stores only `termsAcceptedAt`; Iron stores
+     * `disclaimerIds`.
      */
-    termsAcceptedVendor: KycVendor | null;
+    vendorDisclaimersAccepted: KycVendorDisclaimersAccepted;
     /**
-     * Whether the customer accepted the SumSub T&C (T&C2) during the last
-     * terms acceptance (persisted). Consents-path vendors require this flag
-     * when resuming a session. `null` for acceptance recorded before this
-     * field existed (treated as requiring reacceptance).
+     * KYC-provider disclaimer documents the customer accepted during the last
+     * terms acceptance (persisted `{ key, version }` records under `sumsub`).
+     * Consents-path vendors require this when resuming a session. `null` for
+     * acceptance recorded before this field existed (treated as requiring
+     * reacceptance).
      */
-    sumsubTncAccepted: boolean | null;
+    providerDisclaimersAccepted: KycProviderDisclaimersAccepted;
     /**
-     * Whether the customer accepted the idOS T&C (T&C2) during the last
-     * terms acceptance (persisted). Consents-path vendors require this flag
-     * when resuming a session. `null` for acceptance recorded before this
-     * field existed (treated as requiring reacceptance).
+     * idOS disclaimer documents the customer accepted during the last terms
+     * acceptance (persisted `{ key, version }` records). Consents-path vendors
+     * require this when resuming a session. `null` for acceptance recorded
+     * before this field existed (treated as requiring reacceptance).
      */
-    idosTncAccepted: boolean | null;
+    idosDisclaimersAccepted: KycConsentRecord[] | null;
     /**
      * Whether the customer consented to reuse existing idOS credentials
      * during this session. Applied when recording session-scoped disclaimers.
@@ -50,10 +47,10 @@ export type KycControllerState = {
      * `null` when never set (treated as `false`).
      */
     credentialReusabilityConsentGiven: boolean | null;
-    /** Disclaimers fetched for the current country. */
-    disclaimers: KycDisclaimer[];
-    /** Error encountered while loading disclaimers, or `null`. */
-    disclaimersError: string | null;
+    /** Vendor disclaimers fetched for the current country. */
+    vendorDisclaimers: KycDisclaimer[];
+    /** Error encountered while loading vendor disclaimers, or `null`. */
+    vendorError: string | null;
     /**
      * idOS / KYC-provider disclaimer catalog from `GET /disclaimers` or
      * `GET /sessions/{sessionId}/disclaimers`. `null` until the catalog has
@@ -62,10 +59,10 @@ export type KycControllerState = {
     sessionDisclaimers: KycSessionDisclaimers | null;
     /** Resolved ISO 3166-1 alpha-3 country code. */
     geoCountry: string | null;
-    /** Vendor session token (not persisted, not logged). */
-    sessionToken: string | null;
-    /** Vendor access token (not persisted, not logged). */
-    accessToken: string | null;
+    /** MoonPay session token (not persisted, not logged). */
+    moonpaySessionToken: string | null;
+    /** MoonPay access token (not persisted, not logged). */
+    moonpayAccessToken: string | null;
     /** Vendor customer id, used for the SumSub hand-off. */
     moonpayCustomerId: string | null;
     /**
@@ -109,12 +106,32 @@ export type KycControllerState = {
         sessionStatus: KycSessionStatus | null;
     };
 };
+/**
+ * Constructs the default {@link KycVendorDisclaimersAccepted} value.
+ *
+ * @returns The default vendor-disclaimer acceptance map.
+ */
+export declare function getDefaultKycVendorDisclaimersAccepted(): KycVendorDisclaimersAccepted;
+export declare function getDefaultKycProviderDisclaimersAccepted(): KycProviderDisclaimersAccepted;
 /**
  * Constructs the default {@link KycController} state.
  *
  * @returns The default state.
  */
 export declare function getDefaultKycControllerState(): KycControllerState;
+/**
+ * Parameters for {@link KycController.fetchSessionDisclaimers}. Provide
+ * exactly one of `sessionId` or `country`.
+ */
+export type FetchSessionDisclaimersParams = {
+    /** UKYC session id from `KycService.createUkycSession`. */
+    sessionId: string;
+    country?: never;
+} | {
+    /** ISO 3166-1 alpha-3 country code for `GET /disclaimers?country=`. */
+    country: string;
+    sessionId?: never;
+};
 export type KycControllerGetStateAction = ControllerGetStateAction<typeof controllerName, KycControllerState>;
 export type KycControllerActions = KycControllerGetStateAction | KycControllerMethodActions;
 type AllowedActions = KycServiceMethodActions | UserStorageControllerPerformGetStorageAction | UserStorageControllerPerformSetStorageAction;
@@ -162,9 +179,9 @@ export type KycControllerOptions = {
 /**
  * `KycController` orchestrates the vendor-backed KYC / identity-verification
  * flow (MoonPay identity + SumSub documents) behind a vendor-neutral, per
- * product surface used by ramps and card. It owns all state, HTTP
- * orchestration (via `KycService`), crypto, and the frame message protocol;
- * platform-specific presentation (WebView/iframe, SumSub SDK) is injected.
+ * product surface used by ramps and card. It owns all state and HTTP
+ * orchestration (via `KycService`), while vendor protocol handling and
+ * platform-specific presentation (WebView/iframe, SumSub SDK) are delegated.
  */
 export declare class KycController extends BaseController<typeof controllerName, KycControllerState, KycControllerMessenger> {
     #private;
@@ -226,6 +243,25 @@ export declare class KycController extends BaseController<typeof controllerName,
     loadDisclaimers(params?: {
         country?: string;
     }): Promise<void>;
+    /**
+     * Fetches the idOS + KYC-provider disclaimer catalog. Pass exactly one of
+     * `sessionId` or `country`:
+     *
+     * - `{ sessionId }` → {@link KycService.fetchSessionDisclaimersBySessionId}
+     *   (`GET /sessions/{sessionId}/disclaimers`)
+     * - `{ country }` → {@link KycService.fetchSessionDisclaimersByCountry}
+     *   (`GET /disclaimers?country=`)
+     *
+     * A session-id fetch also writes the catalog to `sessionDisclaimers`.
+     *
+     * @param params - The parameters. Provide exactly one of `sessionId` or
+     * `country`.
+     * @param params.sessionId - The UKYC session id.
+     * @param params.country - ISO 3166-1 alpha-3 country code.
+     * @returns The catalog. Session fetches include consent state; country
+     * fetches do not.
+     */
+    fetchSessionDisclaimers(params: FetchSessionDisclaimersParams): Promise<KycSessionDisclaimers | KycDisclaimersCatalog>;
     /**
      * Captures terms acceptance for the currently loaded disclaimers and creates
      * a session.
@@ -235,19 +271,21 @@ export declare class KycController extends BaseController<typeof controllerName,
      * @param params.product - The consuming feature the flow runs for. See
      * {@link initialize} for how the product drives the automatic post
      * authentication continuation.
-     * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).
-     * Required for every vendor so callers explicitly declare acceptance.
-     * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
-     * Required for every vendor so callers explicitly declare acceptance.
+     * @param params.providerDisclaimersAccepted - Sumsub disclaimer documents the
+     * customer accepted (`{ key, version }` records). Required for every vendor
+     * so callers explicitly declare acceptance.
+     * @param params.idosDisclaimersAccepted - idOS disclaimer documents the
+     * customer accepted (`{ key, version }` records). Required for every vendor
+     * so callers explicitly declare acceptance.
      * @param params.credentialReusabilityConsentGiven - Whether the customer
      * consented to reuse existing idOS credentials. Used when recording
      * session-scoped disclaimers on the consents path. Defaults to `false`.
      */
-    acceptTermsAndStartSession(params: {
+    acceptTermsAndStartSession(params?: {
         email?: string;
         product?: KycProduct;
-        sumsubTncSigned: boolean;
-        idosTncSigned: boolean;
+        providerDisclaimersAccepted: KycConsentRecord[];
+        idosDisclaimersAccepted: KycConsentRecord[];
         credentialReusabilityConsentGiven?: boolean;
     }): Promise<void>;
     /**
@@ -360,6 +398,10 @@ export declare class KycController extends BaseController<typeof controllerName,
      * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and
      * schedules short-interval polling while the status is `pending`.
      *
+     * Skipped when `userStatus` is already `completed`: a follow-up
+     * `GET /kyc/status` can still read a stale `pending` (for example after
+     * `session_not_in_valid_state`) and must not undo that decision.
+     *
      * @returns The latest status payload.
      */
     refreshKycStatus(): Promise<{
@@ -392,4 +434,4 @@ export declare class KycController extends BaseController<typeof controllerName,
     clearState(): void;
 }
 export {};
-//# sourceMappingURL=KycController.d.mts.map
+//# sourceMappingURL=KycController.d.ts.map

package/dist/KycController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KycController.d.ts","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,4CAA4C,EAC5C,4CAA4C,EAC7C,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAK5C,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAMnF,OAAO,KAAK,EAEV,gBAAgB,EAChB,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,EACV,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EAEjB,eAAe,EACf,aAAa,EACb,SAAS,EACT,4BAA4B,EAC7B,MAAM,YAAY,CAAC;AAwBpB,eAAO,MAAM,cAAc,kBAAkB,CAAC;AA2H9C;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,0CAA0C;IAC1C,KAAK,EAAE,QAAQ,CAAC;IAChB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB;;;;OAIG;IACH,yBAAyB,EAAE,4BAA4B,CAAC;IACxD;;;;;;OAMG;IACH,2BAA2B,EAAE,8BAA8B,CAAC;IAC5D;;;;;OAKG;IACH,uBAAuB,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IACnD;;;;;OAKG;IACH,iCAAiC,EAAE,OAAO,GAAG,IAAI,CAAC;IAElD,0DAA0D;IAC1D,iBAAiB,EAAE,aAAa,EAAE,CAAC;IACnC,qEAAqE;IACrE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,kBAAkB,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEjD,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,yDAAyD;IACzD,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,wDAAwD;IACxD,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC;;;;OAIG;IACH,YAAY,EAAE,SAAS,CAAC;IAExB;;;;;;OAMG;IACH,aAAa,EAAE,UAAU,GAAG,IAAI,CAAC;IAEjC,+DAA+D;IAC/D,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,qEAAqE;IACrE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;OAIG;IACH,UAAU,EAAE,aAAa,GAAG,IAAI,CAAC;IACjC,+DAA+D;IAC/D,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,mDAAmD;IACnD,MAAM,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC;;;WAGG;QACH,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACxC,CAAC;CACH,CAAC;AA+IF;;;;GAIG;AACH,wBAAgB,sCAAsC,IAAI,4BAA4B,CAErF;AAED,wBAAgB,wCAAwC,IAAI,8BAA8B,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,kBAAkB,CAgCjE;AAiID;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GACrC;IACE,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,GACD;IACE,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB,CAAC;AAyBN,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAChE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,KAAK,cAAc,GACf,uBAAuB,GACvB,4CAA4C,GAC5C,4CAA4C,CAAC;AAEjD,MAAM,MAAM,6BAA6B,GAAG,0BAA0B,CACpE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE;QACP;YACE,MAAM,EAAE,aAAa,CAAC;YACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;YAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;SAC1B;KACF,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,6BAA6B,GAC7B,+BAA+B,CAAC;AAEpC,KAAK,aAAa,GAAG,KAAK,CAAC;AAE3B,MAAM,MAAM,sBAAsB,GAAG,SAAS,CAC5C,OAAO,cAAc,EACrB,oBAAoB,GAAG,cAAc,EACrC,mBAAmB,GAAG,aAAa,CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpC;;;OAGG;IACH,cAAc,EAAE,iBAAiB,CAAC;IAClC;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,CAAC;AAIF;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,cAAc,CAC/C,OAAO,cAAc,EACrB,kBAAkB,EAClB,sBAAsB,CACvB;;IA+CC;;;;;;;;;;;OAWG;IACH,YAAY,EACV,SAAS,EACT,KAAK,EACL,cAAc,EACd,2BAAqE,EACrE,wBAA+D,GAChE,EAAE,oBAAoB,EAwBtB;IAkCD;;;;;;;;;;;;;OAaG;IACG,UAAU,CAAC,MAAM,CAAC,EAAE;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,MAAM,CAAC,EAAE,SAAS,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgIhB;IAED;;;;;;;;;;;;OAYG;IACG,oBAAoB,CAAC,MAAM,EAAE;QACjC,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhB;IAED;;;;;OAKG;IACG,eAAe,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BlE;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,uBAAuB,CAC3B,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,CAkCxD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,0BAA0B,CAAC,MAAM,CAAC,EAAE;QACxC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,2BAA2B,EAAE,gBAAgB,EAAE,CAAC;QAChD,uBAAuB,EAAE,gBAAgB,EAAE,CAAC;QAC5C,iCAAiC,CAAC,EAAE,OAAO,CAAC;KAC7C,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChB;IAiYD;;OAEG;IACH,eAAe,IAAI,IAAI,CAStB;IAyBD;;;;;;;;;OASG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAC/B,OAAO,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAE/B;IAuDD;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAElC;IAED;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjC;IAED;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,CAE3B;IAED;;;;;;;OAOG;IACG,gBAAgB,CAAC,MAAM,EAAE;QAC7B,OAAO,EAAE,UAAU,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmDnB;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,GAAG,SAAS,CAEjE;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,IAAI,mBAAmB,GAAG,IAAI,CAUhD;IAyJD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA+LnC;IAED;;;;;;;;;;OAUG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,MAAM,EAAE,aAAa,CAAC;QACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAwBD;IAoHD;;;;;;;OAOG;IACG,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAiBlD;IAkGD;;;OAGG;IACH,KAAK,IAAI,IAAI,CAqBZ;IAED;;;;;;;OAOG;IACH,UAAU,IAAI,IAAI,CAKjB;CAwFF"}