@metamask-previews/kyc-controller 0.0.0-preview-abca9bcea → 0.0.0-preview-ec24abb79

package/dist/KycController.mjs

@@ -9,21 +9,23 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KycController_instances, _KycController_sumsubLauncher, _KycController_moonPayFrames, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
+var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_dropTermsUnlessForVendor, _KycController_hasTermsForVendor, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
 import { BaseController } from "@metamask/base-controller";
 import { stringToBytes } from "@metamask/utils";
 import { x25519 } from "@noble/curves/ed25519";
+import { decryptCredentials, generateKeyPair } from "./crypto.mjs";
 import { toBase64Url } from "./encoding.mjs";
-import { controllerLog } from "./logger.mjs";
 import { deriveClientMaterial } from "./ukyc/deriveClientMaterial.mjs";
 import { verifyJwtChain } from "./ukyc/jwtChain.mjs";
 import { getOrCreateLocalUserSecret } from "./ukyc/localUserSecret.mjs";
 import { encodeStorageAccessTokenForHeader, signStorageAccessToken } from "./ukyc/storageAccessToken.mjs";
 import { wrapEncryptionKey } from "./ukyc/wrapEncryptionKey.mjs";
-import { clearVendorDisclaimerAcceptance, hasVendorDisclaimerAcceptance, ironDisclaimerIds, recordVendorDisclaimerAcceptance } from "./vendorDisclaimerAcceptance.mjs";
-import { clearMoonPaySession, MoonPayFrameHandler } from "./vendors/MoonPayFrameHandler.mjs";
 // === GENERAL ===
 export const controllerName = 'KycController';
+const FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';
+const CHANNEL_CHECK = 'ch_1';
+const CHANNEL_AUTH = 'ch_2';
+const CHANNEL_RESET = 'ch_reset';
 // Placeholder credentials for the SumSub sub-flow. These are demo values that
 // must be replaced with real UKYC-issued material before production use.
 const MOCK_JWT_TOKEN = 'mock-jwt-token';
@@ -114,19 +116,31 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
-    vendorDisclaimersAccepted: {
+    termsAcceptedAt: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
         usedInUi: false,
     },
-    providerDisclaimersAccepted: {
+    acceptedDisclaimerIds: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
         usedInUi: false,
     },
-    idosDisclaimersAccepted: {
+    termsAcceptedVendor: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
+    sumsubTncAccepted: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
+    idosTncAccepted: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
@@ -138,13 +152,13 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
-    vendorDisclaimers: {
+    disclaimers: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
         usedInUi: true,
     },
-    vendorError: {
+    disclaimersError: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: false,
@@ -162,13 +176,13 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: true,
     },
-    moonpaySessionToken: {
+    sessionToken: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
         usedInUi: false,
     },
-    moonpayAccessToken: {
+    accessToken: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
@@ -229,17 +243,6 @@ const kycControllerMetadata = {
         usedInUi: true,
     },
 };
-/**
- * Constructs the default {@link KycVendorDisclaimersAccepted} value.
- *
- * @returns The default vendor-disclaimer acceptance map.
- */
-export function getDefaultKycVendorDisclaimersAccepted() {
-    return { moonpay: null, iron: null };
-}
-export function getDefaultKycProviderDisclaimersAccepted() {
-    return { sumsub: null };
-}
 /**
  * Constructs the default {@link KycController} state.
  *
@@ -251,16 +254,18 @@ export function getDefaultKycControllerState() {
         statusMessage: '',
         error: null,
         email: null,
-        vendorDisclaimersAccepted: getDefaultKycVendorDisclaimersAccepted(),
-        providerDisclaimersAccepted: getDefaultKycProviderDisclaimersAccepted(),
-        idosDisclaimersAccepted: null,
+        termsAcceptedAt: null,
+        acceptedDisclaimerIds: [],
+        termsAcceptedVendor: null,
+        sumsubTncAccepted: null,
+        idosTncAccepted: null,
         credentialReusabilityConsentGiven: null,
-        vendorDisclaimers: [],
-        vendorError: null,
+        disclaimers: [],
+        disclaimersError: null,
         sessionDisclaimers: null,
         geoCountry: null,
-        moonpaySessionToken: null,
-        moonpayAccessToken: null,
+        sessionToken: null,
+        accessToken: null,
         moonpayCustomerId: null,
         activeVendor: 'moonpay',
         activeProduct: null,
@@ -304,62 +309,45 @@ function isConsentConflictError(error) {
         error.httpStatus === 409);
 }
 /**
- *
- * @param value - The value to validate.
- * @returns `true` when `value` is a valid consent record list.
- */
-function isValidConsentRecordList(value) {
-    return (Array.isArray(value) &&
-        value.every((item) => typeof item === 'object' &&
-            item !== null &&
-            typeof item.key === 'string' &&
-            typeof item.version === 'string'));
-}
-/**
- * Maps accepted disclaimer records onto unconsented catalog documents.
+ * Maps a session-disclaimer catalog into the `{ key, version }` records the
+ * record-consents API expects, or an empty list when the user declined that
+ * category.
  *
  * @param documents - Catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
- * @returns Consent records to POST, omitting already-consented documents.
+ * @param accepted - Whether the user accepted that category.
+ * @returns Consent records, or `[]` when not accepted.
  */
-function consentRecordsFromAcceptedList(documents, accepted) {
-    if (accepted.length === 0) {
+function consentRecordsFromCatalog(documents, accepted) {
+    if (!accepted) {
         return [];
     }
-    const acceptedKeys = new Set(accepted.map((record) => `${record.key}:${record.version}`));
     return documents
-        .filter((document) => !document.consented &&
-        acceptedKeys.has(`${document.key}:${document.version}`))
+        .filter((document) => !document.consented)
         .map(({ key, version }) => ({ key, version }));
 }
 /**
- * Whether accepted disclaimers reference a missing catalog category.
+ * Whether an accepted T&C2 category has no catalog documents. An empty list
+ * would otherwise skip the POST and count as success.
  *
  * @param documents - Catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
- * @returns `true` when the caller accepted docs but the catalog is empty.
+ * @param accepted - Whether the user accepted that category.
+ * @returns `true` when the user accepted and the catalog is empty.
  */
 function isAcceptedCategoryEmpty(documents, accepted) {
-    return accepted.length > 0 && documents.length === 0;
+    return accepted && documents.length === 0;
 }
 /**
- * Whether accepted disclaimers are still missing consent after a 409 re-GET:
- * empty catalog or any accepted document still unconsented.
+ * Whether an accepted category is still missing consent after a 409 re-GET:
+ * empty catalog or any document still unconsented.
  *
  * @param documents - Latest catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
+ * @param accepted - Whether the user accepted that category.
  * @returns `true` when accepted documents are not fully consented.
  */
 function acceptedCategoryStillMissing(documents, accepted) {
-    if (accepted.length === 0) {
-        return false;
-    }
-    if (documents.length === 0) {
-        return true;
-    }
-    const acceptedKeys = new Set(accepted.map((record) => `${record.key}:${record.version}`));
-    const relevant = documents.filter((document) => acceptedKeys.has(`${document.key}:${document.version}`));
-    return (relevant.length === 0 || relevant.some((document) => !document.consented));
+    return (accepted &&
+        (documents.length === 0 ||
+            documents.some((document) => !document.consented)));
 }
 /**
  * Vendors other than MoonPay skip Check/Auth frames and use the empty-shell
@@ -395,9 +383,9 @@ const MESSENGER_EXPOSED_METHODS = [
 /**
  * `KycController` orchestrates the vendor-backed KYC / identity-verification
  * flow (MoonPay identity + SumSub documents) behind a vendor-neutral, per
- * product surface used by ramps and card. It owns all state and HTTP
- * orchestration (via `KycService`), while vendor protocol handling and
- * platform-specific presentation (WebView/iframe, SumSub SDK) are delegated.
+ * product surface used by ramps and card. It owns all state, HTTP
+ * orchestration (via `KycService`), crypto, and the frame message protocol;
+ * platform-specific presentation (WebView/iframe, SumSub SDK) is injected.
  */
 export class KycController extends BaseController {
     /**
@@ -421,8 +409,10 @@ export class KycController extends BaseController {
         });
         _KycController_instances.add(this);
         _KycController_sumsubLauncher.set(this, void 0);
-        /** MoonPay-specific frame protocol and non-persisted credentials. */
-        _KycController_moonPayFrames.set(this, void 0);
+        /** Ephemeral X25519 keypair for the frame key exchange (never persisted). */
+        _KycController_keypair.set(this, void 0);
+        /** Auth-frame client token, kept out of state. */
+        _KycController_authClientToken.set(this, null);
         /**
          * Monotonic flow generation. Incremented by {@link reset} and
          * {@link clearState} so in-flight async work (e.g. the KYC-required check)
@@ -459,13 +449,7 @@ export class KycController extends BaseController {
         __classPrivateFieldSet(this, _KycController_sumsubLauncher, sumsubLauncher, "f");
         __classPrivateFieldSet(this, _KycController_sessionStatusPollIntervalMs, sessionStatusPollIntervalMs, "f");
         __classPrivateFieldSet(this, _KycController_userStatusPollIntervalMs, userStatusPollIntervalMs, "f");
-        __classPrivateFieldSet(this, _KycController_moonPayFrames, new MoonPayFrameHandler({
-            getState: () => this.state,
-            update: (updater) => __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, updater),
-            fail: (message) => __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, message),
-            onAuthenticated: async () => __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_continueAfterAuthentication).call(this),
-            requireTermsReacceptance: () => __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_requireTermsReacceptance).call(this),
-        }), "f");
+        __classPrivateFieldSet(this, _KycController_keypair, generateKeyPair(), "f");
         this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
     /**
@@ -488,19 +472,10 @@ export class KycController extends BaseController {
         // forces `phase` back through `session`/`check`, breaking an in-flight
         // Check/Auth frame flow. Leave the active flow untouched and let the
         // consumer drive it (or call `reset` first to start over).
-        const vendor = params?.vendor ?? 'moonpay';
         if (IN_PROGRESS_PHASES.includes(this.state.phase)) {
-            if (vendor === 'moonpay') {
-                __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").ensureKeypair();
-            }
             return;
         }
-        if (vendor === 'moonpay') {
-            __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").startFlow();
-        }
-        else {
-            __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").clear();
-        }
+        const vendor = params?.vendor ?? 'moonpay';
         // `initialize` starts a fresh flow, so `activeProduct` is always reset to
         // this call's product (or `null`). Otherwise a prior run's product could
         // linger and cause `#continueAfterAuthentication` to auto-run the check /
@@ -510,9 +485,14 @@ export class KycController extends BaseController {
                 state.email = params.email;
             }
             state.activeVendor = vendor;
-            // MoonPay Check/Auth artifacts must not survive a switch to another vendor
+            // MoonPay Check/Auth artifacts must not survive a switch to another
+            // vendor: leftover `sessionToken` would keep `buildCheckFrameUrl` alive,
+            // leftover `accessToken` / `#authClientToken` would keep Auth / KYC
+            // calls bound to MoonPay, and leftover `moonpayCustomerId` would make
+            // `getCustomerIdentity` report a MoonPay id under the wrong vendor.
             if (vendor !== 'moonpay') {
-                clearMoonPaySession(state);
+                __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
             }
             state.activeProduct = params?.product ?? null;
         });
@@ -560,14 +540,16 @@ export class KycController extends BaseController {
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
         }
-        const hasTerms = hasVendorDisclaimerAcceptance(this.state.vendorDisclaimersAccepted, vendor);
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, vendor);
+        const hasTerms = Boolean(this.state.termsAcceptedAt) &&
+            this.state.acceptedDisclaimerIds.length > 0;
         if (hasTerms && this.state.email) {
             if (usesConsentsFlow(vendor)) {
                 // Consents-path vendors require T&C2 flags; if they weren't persisted
                 // (i.e. null from pre-migration state), require reacceptance.
-                const { providerDisclaimersAccepted, idosDisclaimersAccepted } = this.state;
-                if (providerDisclaimersAccepted.sumsub === null ||
-                    idosDisclaimersAccepted === null) {
+                const sumsubTncSigned = this.state.sumsubTncAccepted;
+                const idosTncSigned = this.state.idosTncAccepted;
+                if (sumsubTncSigned === null || idosTncSigned === null) {
                     __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
                         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
                         state.phase = 'terms';
@@ -576,19 +558,12 @@ export class KycController extends BaseController {
                     return;
                 }
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                    providerDisclaimersAccepted: providerDisclaimersAccepted.sumsub,
-                    idosDisclaimersAccepted,
+                    sumsubTncSigned,
+                    idosTncSigned,
                     credentialReusabilityConsentGiven: this.state.credentialReusabilityConsentGiven ?? false,
                 });
             }
             else {
-                // TODO: should this be here? or should it exist at all?
-                if (vendor === 'moonpay' && this.state.vendorDisclaimers.length === 0) {
-                    await this.loadDisclaimers();
-                    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                        return;
-                    }
-                }
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
             }
             return;
@@ -622,8 +597,8 @@ export class KycController extends BaseController {
             // after this request succeeds.
             state.activeVendor = params.vendor;
             if (params.vendor !== 'moonpay') {
-                __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").clear();
-                clearMoonPaySession(state);
+                __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
             }
         });
         const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
@@ -632,6 +607,10 @@ export class KycController extends BaseController {
                 vendor: params.vendor,
                 email: params.email,
             });
+            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                return;
+            }
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, params.vendor);
         }
         catch (error) {
             if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
@@ -660,18 +639,18 @@ export class KycController extends BaseController {
                     state.geoCountry = country;
                 });
             }
-            const disclaimers = await this.messenger.call('KycService:fetchVendorDisclaimers', {
+            const disclaimers = await this.messenger.call('KycService:fetchDisclaimers', {
                 vendor: this.state.activeVendor,
                 country,
             });
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.vendorDisclaimers = disclaimers;
-                state.vendorError = null;
+                state.disclaimers = disclaimers;
+                state.disclaimersError = null;
             });
         }
         catch (error) {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.vendorError = `Failed to load disclaimers: ${String(error)}`;
+                state.disclaimersError = `Failed to load disclaimers: ${String(error)}`;
             });
         }
     }
@@ -684,47 +663,44 @@ export class KycController extends BaseController {
      * @param params.product - The consuming feature the flow runs for. See
      * {@link initialize} for how the product drives the automatic post
      * authentication continuation.
-     * @param params.providerDisclaimersAccepted - Sumsub disclaimer documents the
-     * customer accepted (`{ key, version }` records). Required for every vendor
-     * so callers explicitly declare acceptance.
-     * @param params.idosDisclaimersAccepted - idOS disclaimer documents the
-     * customer accepted (`{ key, version }` records). Required for every vendor
-     * so callers explicitly declare acceptance.
+     * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).
+     * Required for every vendor so callers explicitly declare acceptance.
+     * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
+     * Required for every vendor so callers explicitly declare acceptance.
      * @param params.credentialReusabilityConsentGiven - Whether the customer
      * consented to reuse existing idOS credentials. Used when recording
      * session-scoped disclaimers on the consents path. Defaults to `false`.
      */
     async acceptTermsAndStartSession(params) {
-        const providerDisclaimersAccepted = params?.providerDisclaimersAccepted;
-        const idosDisclaimersAccepted = params?.idosDisclaimersAccepted;
-        if (!isValidConsentRecordList(providerDisclaimersAccepted) ||
-            !isValidConsentRecordList(idosDisclaimersAccepted)) {
+        const sumsubTncSigned = params?.sumsubTncSigned;
+        const idosTncSigned = params?.idosTncSigned;
+        if (typeof sumsubTncSigned !== 'boolean' ||
+            typeof idosTncSigned !== 'boolean') {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing T&C2 acceptance flags.');
             return;
         }
-        const credentialReusabilityConsentGiven = params?.credentialReusabilityConsentGiven ?? false;
+        const credentialReusabilityConsentGiven = params.credentialReusabilityConsentGiven ?? false;
         const termsAcceptedAt = new Date().toISOString();
-        const disclaimerIds = this.state.vendorDisclaimers.map((disclaimer) => disclaimer.id);
+        const disclaimerIds = this.state.disclaimers.map((disclaimer) => disclaimer.id);
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            if (params?.email) {
+            if (params.email) {
                 state.email = params.email;
             }
-            if (params?.product) {
+            if (params.product) {
                 state.activeProduct = params.product;
             }
-            state.vendorDisclaimersAccepted = recordVendorDisclaimerAcceptance(state.vendorDisclaimersAccepted, state.activeVendor, { termsAcceptedAt, disclaimerIds });
-            state.providerDisclaimersAccepted = {
-                ...state.providerDisclaimersAccepted,
-                sumsub: providerDisclaimersAccepted,
-            };
-            state.idosDisclaimersAccepted = idosDisclaimersAccepted;
+            state.termsAcceptedAt = termsAcceptedAt;
+            state.acceptedDisclaimerIds = disclaimerIds;
+            state.termsAcceptedVendor = state.activeVendor;
+            state.sumsubTncAccepted = sumsubTncSigned;
+            state.idosTncAccepted = idosTncSigned;
             state.credentialReusabilityConsentGiven =
                 credentialReusabilityConsentGiven;
         });
         if (usesConsentsFlow(this.state.activeVendor)) {
             await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                providerDisclaimersAccepted,
-                idosDisclaimersAccepted,
+                sumsubTncSigned,
+                idosTncSigned,
                 credentialReusabilityConsentGiven,
             });
             return;
@@ -736,12 +712,7 @@ export class KycController extends BaseController {
      */
     clearSavedTerms() {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.vendorDisclaimersAccepted =
-                getDefaultKycVendorDisclaimersAccepted();
-            state.providerDisclaimersAccepted =
-                getDefaultKycProviderDisclaimersAccepted();
-            state.idosDisclaimersAccepted = null;
-            state.credentialReusabilityConsentGiven = null;
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
         });
     }
     /**
@@ -755,7 +726,68 @@ export class KycController extends BaseController {
      * @returns An object whose optional `reply` should be posted back.
      */
     async handleFrameMessage(params) {
-        return await __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").handleMessage(params.message);
+        const payload = params.message;
+        if (!payload) {
+            return {};
+        }
+        if (payload.kind === 'handshake') {
+            const channelId = payload.meta?.channelId;
+            return { reply: { version: 2, meta: { channelId }, kind: 'ack' } };
+        }
+        if (payload.kind !== 'complete') {
+            return {};
+        }
+        const channelId = payload.meta?.channelId;
+        // Only honor a Check/Auth `complete` for the MoonPay frame the flow is
+        // currently waiting on. This drops stale or duplicate messages — e.g. a
+        // late post after `reset()` (phase `idle`), after the flow already
+        // advanced past this frame, or after a vendor switch — so they cannot
+        // resurrect tokens, rewind `phase`, or recapture `moonpayCustomerId` on a
+        // controller that has moved on. Frame messages are external input and,
+        // unlike the async steps, are not covered by the `#generation` guard.
+        let expectedPhase = null;
+        if (channelId === CHANNEL_CHECK) {
+            expectedPhase = 'check';
+        }
+        else if (channelId === CHANNEL_AUTH) {
+            expectedPhase = 'auth';
+        }
+        if (!expectedPhase ||
+            this.state.phase !== expectedPhase ||
+            this.state.activeVendor !== 'moonpay') {
+            return {};
+        }
+        const status = payload.payload?.status;
+        const credsEnvelope = payload.payload?.credentials;
+        const customerId = payload.payload?.customer?.id ?? null;
+        if (customerId) {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+                state.moonpayCustomerId = customerId;
+            });
+        }
+        if (!status) {
+            return {};
+        }
+        let accessToken;
+        let clientToken;
+        if (credsEnvelope) {
+            try {
+                const { credentials } = decryptCredentials(credsEnvelope, __classPrivateFieldGet(this, _KycController_keypair, "f").privateKey);
+                accessToken = credentials.accessToken;
+                clientToken = credentials.clientToken;
+            }
+            catch (error) {
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Failed to decrypt frame credentials: ${String(error)}`);
+                return {};
+            }
+        }
+        if (channelId === CHANNEL_CHECK) {
+            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_handleCheckOutcome).call(this, status, accessToken, clientToken);
+            return {};
+        }
+        // channelId === CHANNEL_AUTH, guaranteed by the expectedPhase guard above.
+        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_handleAuthOutcome).call(this, status, accessToken);
+        return {};
     }
     /**
      * Builds the Check-frame URL, or `null` when no session exists yet.
@@ -763,7 +795,15 @@ export class KycController extends BaseController {
      * @returns The Check-frame URL or `null`.
      */
     buildCheckFrameUrl() {
-        return __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").buildCheckFrameUrl();
+        if (this.state.activeVendor !== 'moonpay' || !this.state.sessionToken) {
+            return null;
+        }
+        const url = new URL(`${FRAMES_BASE_URL}/check-connection`);
+        url.searchParams.set('sessionToken', this.state.sessionToken);
+        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_keypair, "f").publicKeyHex);
+        url.searchParams.set('channelId', CHANNEL_CHECK);
+        url.searchParams.set('skipKyc', 'true');
+        return url.toString();
     }
     /**
      * Builds the Auth-frame URL, or `null` when no client token is available.
@@ -771,7 +811,14 @@ export class KycController extends BaseController {
      * @returns The Auth-frame URL or `null`.
      */
     buildAuthFrameUrl() {
-        return __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").buildAuthFrameUrl();
+        if (this.state.activeVendor !== 'moonpay' || !__classPrivateFieldGet(this, _KycController_authClientToken, "f")) {
+            return null;
+        }
+        const url = new URL(`${FRAMES_BASE_URL}/auth`);
+        url.searchParams.set('clientToken', __classPrivateFieldGet(this, _KycController_authClientToken, "f"));
+        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_keypair, "f").publicKeyHex);
+        url.searchParams.set('channelId', CHANNEL_AUTH);
+        return url.toString();
     }
     /**
      * Builds the Reset-frame URL.
@@ -779,7 +826,9 @@ export class KycController extends BaseController {
      * @returns The Reset-frame URL.
      */
     buildResetFrameUrl() {
-        return __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").buildResetFrameUrl();
+        const url = new URL(`${FRAMES_BASE_URL}/reset`);
+        url.searchParams.set('channelId', CHANNEL_RESET);
+        return url.toString();
     }
     /**
      * Checks whether KYC is required for a product and caches the result.
@@ -790,9 +839,9 @@ export class KycController extends BaseController {
      * @returns Whether KYC is required.
      */
     async checkKycRequired(params) {
-        const { moonpayAccessToken } = this.state;
-        if (!moonpayAccessToken) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing moonpayAccessToken — repeat the authentication step.');
+        const { accessToken } = this.state;
+        if (!accessToken) {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing accessToken — repeat the authentication step.');
             return false;
         }
         const country = params.country ?? this.state.geoCountry;
@@ -808,11 +857,7 @@ export class KycController extends BaseController {
             state.statusMessage = 'Checking KYC status...';
         });
         try {
-            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', {
-                accessToken: moonpayAccessToken,
-                country,
-                capabilities: [{ product: params.product }],
-            });
+            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', { accessToken, country, capabilities: [{ product: params.product }] });
             // The flow was reset while the check was in flight; discard the result
             // rather than resurrecting a done/cached state on an idle controller.
             const applied = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
@@ -1097,11 +1142,13 @@ export class KycController extends BaseController {
             state.phase = 'idle';
             state.statusMessage = '';
             state.error = null;
-            state.vendorDisclaimers = [];
-            state.vendorError = null;
+            state.disclaimers = [];
+            state.disclaimersError = null;
             state.sessionDisclaimers = null;
             state.credentialReusabilityConsentGiven = null;
-            clearMoonPaySession(state);
+            state.sessionToken = null;
+            state.accessToken = null;
+            state.moonpayCustomerId = null;
             state.activeVendor = 'moonpay';
             state.activeProduct = null;
             state.sumsub = {
@@ -1128,7 +1175,7 @@ export class KycController extends BaseController {
         });
     }
 }
-_KycController_sumsubLauncher = new WeakMap(), _KycController_moonPayFrames = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPolling = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
+_KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPolling = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
     return {
         get: async (path, entropySourceId) => this.messenger.call('UserStorageController:performGetStorage', path, entropySourceId),
         set: async (path, value, entropySourceId) => this.messenger.call('UserStorageController:performSetStorage', path, value, entropySourceId),
@@ -1140,14 +1187,13 @@ _KycController_sumsubLauncher = new WeakMap(), _KycController_moonPayFrames = ne
  * SumSub — skipping MoonPay Check/Auth frames.
  *
  * @param consents - T&C2 flags mapped onto the session disclaimer catalog.
- * @param consents.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.
- * @param consents.idosDisclaimersAccepted - Accepted idOS disclaimer records.
+ * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
+ * @param consents.idosTncSigned - Whether idOS T&C were accepted.
  * @param consents.credentialReusabilityConsentGiven - Whether credential
  * reuse was accepted.
  */
 async function _KycController_startConsentsSession(consents) {
-    const { email } = this.state;
-    const acceptedDisclaimerIds = ironDisclaimerIds(this.state.vendorDisclaimersAccepted);
+    const { email, acceptedDisclaimerIds } = this.state;
     if (!email) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for consents session.');
         return;
@@ -1165,7 +1211,7 @@ async function _KycController_startConsentsSession(consents) {
         state.sumsub.result = null;
         state.sumsub.sessionStatus = null;
         // Consents-path vendors have no MoonPay session/access tokens.
-        clearMoonPaySession(state);
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
     });
     try {
         await this.messenger.call('KycService:submitVendorDisclaimers', {
@@ -1191,7 +1237,7 @@ async function _KycController_startConsentsSession(consents) {
                 await this.refreshKycStatus();
             }
             catch (statusError) {
-                controllerLog('KYC status refresh failed:', statusError);
+                console.error('KYC status refresh failed:', statusError);
             }
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
                 state.phase = 'done';
@@ -1227,7 +1273,7 @@ async function _KycController_startConsentsSession(consents) {
             await this.refreshKycStatus();
         }
         catch (statusError) {
-            controllerLog('KYC status refresh failed:', statusError);
+            console.error('KYC status refresh failed:', statusError);
         }
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
             if (state.phase !== 'error' && state.phase !== 'done') {
@@ -1255,7 +1301,7 @@ async function _KycController_startConsentsSession(consents) {
             });
             return;
         }
-        controllerLog('Consents session failed:', error);
+        console.error('Consents session failed:', error);
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
         }
@@ -1282,8 +1328,8 @@ async function _KycController_startConsentsSession(consents) {
  *
  * @param sessionId - The UKYC session id.
  * @param consents - T&C2 flags mapped onto catalog documents.
- * @param consents.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.
- * @param consents.idosDisclaimersAccepted - Accepted idOS disclaimer records.
+ * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
+ * @param consents.idosTncSigned - Whether idOS T&C were accepted.
  * @param consents.credentialReusabilityConsentGiven - Whether credential
  * reuse was accepted.
  * @param generation - Flow generation captured by the caller.
@@ -1297,12 +1343,12 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
         state.sessionDisclaimers = catalog;
         state.statusMessage = 'Submitting consents...';
     });
-    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosDisclaimersAccepted) ||
-        isAcceptedCategoryEmpty(catalog.kycProvider, consents.providerDisclaimersAccepted)) {
+    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosTncSigned) ||
+        isAcceptedCategoryEmpty(catalog.kycProvider, consents.sumsubTncSigned)) {
         throw new Error('Session disclaimer catalog is missing documents for an accepted category.');
     }
-    const idOS = consentRecordsFromAcceptedList(catalog.idOS, consents.idosDisclaimersAccepted);
-    const kycProvider = consentRecordsFromAcceptedList(catalog.kycProvider, consents.providerDisclaimersAccepted);
+    const idOS = consentRecordsFromCatalog(catalog.idOS, consents.idosTncSigned);
+    const kycProvider = consentRecordsFromCatalog(catalog.kycProvider, consents.sumsubTncSigned);
     const reuseUnchanged = catalog.credentialReusabilityConsentGiven ===
         consents.credentialReusabilityConsentGiven;
     if (idOS.length === 0 && kycProvider.length === 0 && reuseUnchanged) {
@@ -1333,9 +1379,8 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
             state.sessionDisclaimers = latest;
         });
-        // TODO: Should we really be doing client side validation of these?
-        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosDisclaimersAccepted);
-        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.providerDisclaimersAccepted);
+        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosTncSigned);
+        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.sumsubTncSigned);
         const stillMissingReuse = consents.credentialReusabilityConsentGiven &&
             !latest.credentialReusabilityConsentGiven;
         if (stillMissingIdos || stillMissingProvider || stillMissingReuse) {
@@ -1347,9 +1392,7 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
  * Creates a vendor session from the currently stored terms + email.
  */
 async function _KycController_createSession() {
-    const { email } = this.state;
-    const termsAcceptedAt = this.state.vendorDisclaimersAccepted.moonpay?.termsAcceptedAt;
-    const acceptedDisclaimerIds = this.state.vendorDisclaimers.map((disclaimer) => disclaimer.id);
+    const { email, termsAcceptedAt, acceptedDisclaimerIds } = this.state;
     if (!email) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for session creation.');
         return;
@@ -1364,7 +1407,7 @@ async function _KycController_createSession() {
     // (or, on failure, invalid) session token, `buildAuthFrameUrl` cannot
     // return a URL tied to an old client token, and `checkKycRequired` cannot
     // run with an access token from an earlier authentication. The Check/Auth
-    // frames re-populate these for the new session. Because `moonpaySessionToken` is
+    // frames re-populate these for the new session. Because `sessionToken` is
     // cleared here and only re-set on success, a failed creation leaves it
     // `null` rather than resurrecting the previous session.
     // Capture the flow generation so a `reset()` landing while the create
@@ -1372,24 +1415,24 @@ async function _KycController_createSession() {
     // the now-idle controller (failure). The synchronous update below runs
     // before any `await`, so it needs no guard.
     const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
-    __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").clearAuthentication();
+    __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
     __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
         state.error = null;
         state.phase = 'session';
         state.statusMessage = 'Creating session...';
-        state.moonpaySessionToken = null;
-        state.moonpayAccessToken = null;
+        state.sessionToken = null;
+        state.accessToken = null;
     });
     try {
         const { sessionToken } = await this.messenger.call('KycService:createSession', { email, termsAcceptedAt, disclaimerIds: acceptedDisclaimerIds });
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.moonpaySessionToken = sessionToken;
+            state.sessionToken = sessionToken;
             state.phase = 'check';
             state.statusMessage = 'Authenticating via Check frame...';
         });
     }
     catch (error) {
-        controllerLog('Session creation failed:', error);
+        console.error('Session creation failed:', error);
         // A reset() superseded this flow while the request was in flight; leave
         // the idle controller alone rather than forcing it back to `terms`.
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
@@ -1409,13 +1452,82 @@ async function _KycController_createSession() {
         });
         await this.loadDisclaimers();
     }
-}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state, vendor) {
-    const targetVendor = vendor ?? state.activeVendor;
-    state.vendorDisclaimersAccepted = clearVendorDisclaimerAcceptance(state.vendorDisclaimersAccepted, targetVendor);
-    state.providerDisclaimersAccepted =
-        getDefaultKycProviderDisclaimersAccepted();
-    state.idosDisclaimersAccepted = null;
+}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state) {
+    state.termsAcceptedAt = null;
+    state.acceptedDisclaimerIds = [];
+    state.termsAcceptedVendor = null;
+    state.sumsubTncAccepted = null;
+    state.idosTncAccepted = null;
     state.credentialReusabilityConsentGiven = null;
+}, _KycController_clearMoonPaySession = function _KycController_clearMoonPaySession(state) {
+    state.moonpayCustomerId = null;
+    state.sessionToken = null;
+    state.accessToken = null;
+}, _KycController_dropTermsUnlessForVendor = function _KycController_dropTermsUnlessForVendor(vendor) {
+    if (__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_hasTermsForVendor).call(this, vendor)) {
+        return;
+    }
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+    });
+}, _KycController_hasTermsForVendor = function _KycController_hasTermsForVendor(vendor) {
+    if (this.state.termsAcceptedVendor === null) {
+        return false;
+    }
+    return this.state.termsAcceptedVendor === vendor;
+}, _KycController_handleCheckOutcome = 
+/**
+ * Applies a Check-frame outcome.
+ *
+ * @param status - The frame status.
+ * @param accessToken - The decrypted access token, if any.
+ * @param clientToken - The decrypted client token, if any.
+ */
+async function _KycController_handleCheckOutcome(status, accessToken, clientToken) {
+    if (status === 'active' && accessToken) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            state.accessToken = accessToken;
+            state.phase = 'form';
+            state.statusMessage = 'Already authenticated. Review to submit.';
+        });
+        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_continueAfterAuthentication).call(this);
+        return;
+    }
+    if (status === 'connectionRequired' && clientToken) {
+        __classPrivateFieldSet(this, _KycController_authClientToken, clientToken, "f");
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            state.phase = 'auth';
+            state.statusMessage = 'Verify your email via OTP in the Auth frame.';
+        });
+        return;
+    }
+    if (status === 'termsAcceptanceRequired') {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_requireTermsReacceptance).call(this);
+        return;
+    }
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Check frame returned status: ${status}`);
+}, _KycController_handleAuthOutcome = 
+/**
+ * Applies an Auth-frame outcome.
+ *
+ * @param status - The frame status.
+ * @param accessToken - The decrypted access token, if any.
+ */
+async function _KycController_handleAuthOutcome(status, accessToken) {
+    if (status === 'active' && accessToken) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            state.accessToken = accessToken;
+            state.phase = 'form';
+            state.statusMessage = 'Authenticated. Review to submit.';
+        });
+        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_continueAfterAuthentication).call(this);
+        return;
+    }
+    if (status === 'termsAcceptanceRequired') {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_requireTermsReacceptance).call(this);
+        return;
+    }
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Auth frame returned status: ${status}`);
 }, _KycController_continueAfterAuthentication = 
 /**
  * Continues the flow once authentication has completed (phase `form`).
@@ -1467,7 +1579,7 @@ async function _KycController_continueAfterAuthentication() {
         return {
             vendor: 'moonpay',
             vendorMetadata: {
-                moonPayAccessToken: this.state.moonpayAccessToken,
+                moonPayAccessToken: this.state.accessToken,
                 moonPayUserId: this.state.moonpayCustomerId,
             },
         };
@@ -1535,8 +1647,7 @@ async function _KycController_createUkycSession(generation) {
     // authorizes later storage reads without granting write or delete access.
     const ukycCapabilityToken = signStorageAccessToken({
         material: clientMaterial,
-        // TODO: Confirm with idOS when this can be switched back to read and a separate token is sent for write
-        operations: ['read', 'write'],
+        operations: ['read'],
         expiresAt: new Date(Date.now() + UKYC_CAPABILITY_TOKEN_TTL_MS),
     });
     const wrappedUkycCapabilityToken = wrapEncryptionKey(sessionClientPrivateKey, capabilityTokenSchema.serverPublicKey.x, stringToBytes(encodeStorageAccessTokenForHeader(ukycCapabilityToken)));
@@ -1723,7 +1834,7 @@ async function _KycController_pollSessionStatusOnce(sessionId, token) {
         __classPrivateFieldSet(this, _KycController_pollTimer, null, "f");
     }
 }, _KycController_cancelPendingSession = function _KycController_cancelPendingSession() {
-    __classPrivateFieldGet(this, _KycController_moonPayFrames, "f").clear();
+    __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
     __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopPolling).call(this);
     __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
     __classPrivateFieldSet(this, _KycController_generation, __classPrivateFieldGet(this, _KycController_generation, "f") + 1, "f");