@metamask-previews/kyc-controller 0.0.0-preview-b63fbdb38 → 0.0.0-preview-e12b5ece6

package/dist/KycController.mjs

@@ -9,17 +9,19 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_dropTermsUnlessForVendor, _KycController_hasTermsForVendor, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
+var _KycController_instances, _KycController_sumsubLauncher, _KycController_moonpayFrameKeypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
 import { BaseController } from "@metamask/base-controller";
 import { stringToBytes } from "@metamask/utils";
 import { x25519 } from "@noble/curves/ed25519";
 import { decryptCredentials, generateKeyPair } from "./crypto.mjs";
 import { toBase64Url } from "./encoding.mjs";
+import { controllerLog } from "./logger.mjs";
 import { deriveClientMaterial } from "./ukyc/deriveClientMaterial.mjs";
 import { verifyJwtChain } from "./ukyc/jwtChain.mjs";
 import { getOrCreateLocalUserSecret } from "./ukyc/localUserSecret.mjs";
 import { encodeStorageAccessTokenForHeader, signStorageAccessToken } from "./ukyc/storageAccessToken.mjs";
 import { wrapEncryptionKey } from "./ukyc/wrapEncryptionKey.mjs";
+import { clearVendorDisclaimerAcceptance, hasVendorDisclaimerAcceptance, ironDisclaimerIds, recordVendorDisclaimerAcceptance } from "./vendorDisclaimerAcceptance.mjs";
 // === GENERAL ===
 export const controllerName = 'KycController';
 const FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';
@@ -116,31 +118,19 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
-    termsAcceptedAt: {
+    vendorDisclaimersAccepted: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
         usedInUi: false,
     },
-    acceptedDisclaimerIds: {
+    providerDisclaimersAccepted: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
         usedInUi: false,
     },
-    termsAcceptedVendor: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: false,
-    },
-    sumsubTncAccepted: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: true,
-        usedInUi: false,
-    },
-    idosTncAccepted: {
+    idosDisclaimersAccepted: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
@@ -152,13 +142,13 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
-    disclaimers: {
+    vendorDisclaimers: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
         usedInUi: true,
     },
-    disclaimersError: {
+    vendorError: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: false,
@@ -176,13 +166,13 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: true,
     },
-    sessionToken: {
+    moonpaySessionToken: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
         usedInUi: false,
     },
-    accessToken: {
+    moonpayAccessToken: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
@@ -243,6 +233,17 @@ const kycControllerMetadata = {
         usedInUi: true,
     },
 };
+/**
+ * Constructs the default {@link KycVendorDisclaimersAccepted} value.
+ *
+ * @returns The default vendor-disclaimer acceptance map.
+ */
+export function getDefaultKycVendorDisclaimersAccepted() {
+    return { moonpay: null, iron: null };
+}
+export function getDefaultKycProviderDisclaimersAccepted() {
+    return { sumsub: null };
+}
 /**
  * Constructs the default {@link KycController} state.
  *
@@ -254,18 +255,16 @@ export function getDefaultKycControllerState() {
         statusMessage: '',
         error: null,
         email: null,
-        termsAcceptedAt: null,
-        acceptedDisclaimerIds: [],
-        termsAcceptedVendor: null,
-        sumsubTncAccepted: null,
-        idosTncAccepted: null,
+        vendorDisclaimersAccepted: getDefaultKycVendorDisclaimersAccepted(),
+        providerDisclaimersAccepted: getDefaultKycProviderDisclaimersAccepted(),
+        idosDisclaimersAccepted: null,
         credentialReusabilityConsentGiven: null,
-        disclaimers: [],
-        disclaimersError: null,
+        vendorDisclaimers: [],
+        vendorError: null,
         sessionDisclaimers: null,
         geoCountry: null,
-        sessionToken: null,
-        accessToken: null,
+        moonpaySessionToken: null,
+        moonpayAccessToken: null,
         moonpayCustomerId: null,
         activeVendor: 'moonpay',
         activeProduct: null,
@@ -309,45 +308,62 @@ function isConsentConflictError(error) {
         error.httpStatus === 409);
 }
 /**
- * Maps a session-disclaimer catalog into the `{ key, version }` records the
- * record-consents API expects, or an empty list when the user declined that
- * category.
+ *
+ * @param value - The value to validate.
+ * @returns `true` when `value` is a valid consent record list.
+ */
+function isValidConsentRecordList(value) {
+    return (Array.isArray(value) &&
+        value.every((item) => typeof item === 'object' &&
+            item !== null &&
+            typeof item.key === 'string' &&
+            typeof item.version === 'string'));
+}
+/**
+ * Maps accepted disclaimer records onto unconsented catalog documents.
  *
  * @param documents - Catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
- * @returns Consent records, or `[]` when not accepted.
+ * @param accepted - Accepted `{ key, version }` records from the caller.
+ * @returns Consent records to POST, omitting already-consented documents.
  */
-function consentRecordsFromCatalog(documents, accepted) {
-    if (!accepted) {
+function consentRecordsFromAcceptedList(documents, accepted) {
+    if (accepted.length === 0) {
         return [];
     }
+    const acceptedKeys = new Set(accepted.map((record) => `${record.key}:${record.version}`));
     return documents
-        .filter((document) => !document.consented)
+        .filter((document) => !document.consented &&
+        acceptedKeys.has(`${document.key}:${document.version}`))
         .map(({ key, version }) => ({ key, version }));
 }
 /**
- * Whether an accepted T&C2 category has no catalog documents. An empty list
- * would otherwise skip the POST and count as success.
+ * Whether accepted disclaimers reference a missing catalog category.
  *
  * @param documents - Catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
- * @returns `true` when the user accepted and the catalog is empty.
+ * @param accepted - Accepted `{ key, version }` records from the caller.
+ * @returns `true` when the caller accepted docs but the catalog is empty.
  */
 function isAcceptedCategoryEmpty(documents, accepted) {
-    return accepted && documents.length === 0;
+    return accepted.length > 0 && documents.length === 0;
 }
 /**
- * Whether an accepted category is still missing consent after a 409 re-GET:
- * empty catalog or any document still unconsented.
+ * Whether accepted disclaimers are still missing consent after a 409 re-GET:
+ * empty catalog or any accepted document still unconsented.
  *
  * @param documents - Latest catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
+ * @param accepted - Accepted `{ key, version }` records from the caller.
  * @returns `true` when accepted documents are not fully consented.
  */
 function acceptedCategoryStillMissing(documents, accepted) {
-    return (accepted &&
-        (documents.length === 0 ||
-            documents.some((document) => !document.consented)));
+    if (accepted.length === 0) {
+        return false;
+    }
+    if (documents.length === 0) {
+        return true;
+    }
+    const acceptedKeys = new Set(accepted.map((record) => `${record.key}:${record.version}`));
+    const relevant = documents.filter((document) => acceptedKeys.has(`${document.key}:${document.version}`));
+    return (relevant.length === 0 || relevant.some((document) => !document.consented));
 }
 /**
  * Vendors other than MoonPay skip Check/Auth frames and use the empty-shell
@@ -409,8 +425,8 @@ export class KycController extends BaseController {
         });
         _KycController_instances.add(this);
         _KycController_sumsubLauncher.set(this, void 0);
-        /** Ephemeral X25519 keypair for the frame key exchange (never persisted). */
-        _KycController_keypair.set(this, void 0);
+        /** MoonPay Check/Auth frame X25519 keypair (never persisted). */
+        _KycController_moonpayFrameKeypair.set(this, null);
         /** Auth-frame client token, kept out of state. */
         _KycController_authClientToken.set(this, null);
         /**
@@ -449,7 +465,6 @@ export class KycController extends BaseController {
         __classPrivateFieldSet(this, _KycController_sumsubLauncher, sumsubLauncher, "f");
         __classPrivateFieldSet(this, _KycController_sessionStatusPollIntervalMs, sessionStatusPollIntervalMs, "f");
         __classPrivateFieldSet(this, _KycController_userStatusPollIntervalMs, userStatusPollIntervalMs, "f");
-        __classPrivateFieldSet(this, _KycController_keypair, generateKeyPair(), "f");
         this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
     /**
@@ -472,10 +487,19 @@ export class KycController extends BaseController {
         // forces `phase` back through `session`/`check`, breaking an in-flight
         // Check/Auth frame flow. Leave the active flow untouched and let the
         // consumer drive it (or call `reset` first to start over).
+        const vendor = params?.vendor ?? 'moonpay';
         if (IN_PROGRESS_PHASES.includes(this.state.phase)) {
+            if (vendor === 'moonpay' && !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
+                __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, generateKeyPair(), "f");
+            }
             return;
         }
-        const vendor = params?.vendor ?? 'moonpay';
+        if (vendor === 'moonpay') {
+            __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, generateKeyPair(), "f");
+        }
+        else {
+            __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, null, "f");
+        }
         // `initialize` starts a fresh flow, so `activeProduct` is always reset to
         // this call's product (or `null`). Otherwise a prior run's product could
         // linger and cause `#continueAfterAuthentication` to auto-run the check /
@@ -486,8 +510,8 @@ export class KycController extends BaseController {
             }
             state.activeVendor = vendor;
             // MoonPay Check/Auth artifacts must not survive a switch to another
-            // vendor: leftover `sessionToken` would keep `buildCheckFrameUrl` alive,
-            // leftover `accessToken` / `#authClientToken` would keep Auth / KYC
+            // vendor: leftover `moonpaySessionToken` would keep `buildCheckFrameUrl` alive,
+            // leftover `moonpayAccessToken` / `#authClientToken` would keep Auth / KYC
             // calls bound to MoonPay, and leftover `moonpayCustomerId` would make
             // `getCustomerIdentity` report a MoonPay id under the wrong vendor.
             if (vendor !== 'moonpay') {
@@ -540,16 +564,14 @@ export class KycController extends BaseController {
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
         }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, vendor);
-        const hasTerms = Boolean(this.state.termsAcceptedAt) &&
-            this.state.acceptedDisclaimerIds.length > 0;
+        const hasTerms = hasVendorDisclaimerAcceptance(this.state.vendorDisclaimersAccepted, vendor);
         if (hasTerms && this.state.email) {
             if (usesConsentsFlow(vendor)) {
                 // Consents-path vendors require T&C2 flags; if they weren't persisted
                 // (i.e. null from pre-migration state), require reacceptance.
-                const sumsubTncSigned = this.state.sumsubTncAccepted;
-                const idosTncSigned = this.state.idosTncAccepted;
-                if (sumsubTncSigned === null || idosTncSigned === null) {
+                const { providerDisclaimersAccepted, idosDisclaimersAccepted } = this.state;
+                if (providerDisclaimersAccepted.sumsub === null ||
+                    idosDisclaimersAccepted === null) {
                     __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
                         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
                         state.phase = 'terms';
@@ -558,12 +580,19 @@ export class KycController extends BaseController {
                     return;
                 }
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                    sumsubTncSigned,
-                    idosTncSigned,
+                    providerDisclaimersAccepted: providerDisclaimersAccepted.sumsub,
+                    idosDisclaimersAccepted,
                     credentialReusabilityConsentGiven: this.state.credentialReusabilityConsentGiven ?? false,
                 });
             }
             else {
+                // TODO: should this be here? or should it exist at all?
+                if (vendor === 'moonpay' && this.state.vendorDisclaimers.length === 0) {
+                    await this.loadDisclaimers();
+                    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                        return;
+                    }
+                }
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
             }
             return;
@@ -598,6 +627,7 @@ export class KycController extends BaseController {
             state.activeVendor = params.vendor;
             if (params.vendor !== 'moonpay') {
                 __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
+                __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, null, "f");
                 __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
             }
         });
@@ -607,10 +637,6 @@ export class KycController extends BaseController {
                 vendor: params.vendor,
                 email: params.email,
             });
-            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                return;
-            }
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, params.vendor);
         }
         catch (error) {
             if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
@@ -639,18 +665,18 @@ export class KycController extends BaseController {
                     state.geoCountry = country;
                 });
             }
-            const disclaimers = await this.messenger.call('KycService:fetchDisclaimers', {
+            const disclaimers = await this.messenger.call('KycService:fetchVendorDisclaimers', {
                 vendor: this.state.activeVendor,
                 country,
             });
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.disclaimers = disclaimers;
-                state.disclaimersError = null;
+                state.vendorDisclaimers = disclaimers;
+                state.vendorError = null;
             });
         }
         catch (error) {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.disclaimersError = `Failed to load disclaimers: ${String(error)}`;
+                state.vendorError = `Failed to load disclaimers: ${String(error)}`;
             });
         }
     }
@@ -663,44 +689,47 @@ export class KycController extends BaseController {
      * @param params.product - The consuming feature the flow runs for. See
      * {@link initialize} for how the product drives the automatic post
      * authentication continuation.
-     * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).
-     * Required for every vendor so callers explicitly declare acceptance.
-     * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
-     * Required for every vendor so callers explicitly declare acceptance.
+     * @param params.providerDisclaimersAccepted - Sumsub disclaimer documents the
+     * customer accepted (`{ key, version }` records). Required for every vendor
+     * so callers explicitly declare acceptance.
+     * @param params.idosDisclaimersAccepted - idOS disclaimer documents the
+     * customer accepted (`{ key, version }` records). Required for every vendor
+     * so callers explicitly declare acceptance.
      * @param params.credentialReusabilityConsentGiven - Whether the customer
      * consented to reuse existing idOS credentials. Used when recording
      * session-scoped disclaimers on the consents path. Defaults to `false`.
      */
     async acceptTermsAndStartSession(params) {
-        const sumsubTncSigned = params?.sumsubTncSigned;
-        const idosTncSigned = params?.idosTncSigned;
-        if (typeof sumsubTncSigned !== 'boolean' ||
-            typeof idosTncSigned !== 'boolean') {
+        const providerDisclaimersAccepted = params?.providerDisclaimersAccepted;
+        const idosDisclaimersAccepted = params?.idosDisclaimersAccepted;
+        if (!isValidConsentRecordList(providerDisclaimersAccepted) ||
+            !isValidConsentRecordList(idosDisclaimersAccepted)) {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing T&C2 acceptance flags.');
             return;
         }
-        const credentialReusabilityConsentGiven = params.credentialReusabilityConsentGiven ?? false;
+        const credentialReusabilityConsentGiven = params?.credentialReusabilityConsentGiven ?? false;
         const termsAcceptedAt = new Date().toISOString();
-        const disclaimerIds = this.state.disclaimers.map((disclaimer) => disclaimer.id);
+        const disclaimerIds = this.state.vendorDisclaimers.map((disclaimer) => disclaimer.id);
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            if (params.email) {
+            if (params?.email) {
                 state.email = params.email;
             }
-            if (params.product) {
+            if (params?.product) {
                 state.activeProduct = params.product;
             }
-            state.termsAcceptedAt = termsAcceptedAt;
-            state.acceptedDisclaimerIds = disclaimerIds;
-            state.termsAcceptedVendor = state.activeVendor;
-            state.sumsubTncAccepted = sumsubTncSigned;
-            state.idosTncAccepted = idosTncSigned;
+            state.vendorDisclaimersAccepted = recordVendorDisclaimerAcceptance(state.vendorDisclaimersAccepted, state.activeVendor, { termsAcceptedAt, disclaimerIds });
+            state.providerDisclaimersAccepted = {
+                ...state.providerDisclaimersAccepted,
+                sumsub: providerDisclaimersAccepted,
+            };
+            state.idosDisclaimersAccepted = idosDisclaimersAccepted;
             state.credentialReusabilityConsentGiven =
                 credentialReusabilityConsentGiven;
         });
         if (usesConsentsFlow(this.state.activeVendor)) {
             await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                sumsubTncSigned,
-                idosTncSigned,
+                providerDisclaimersAccepted,
+                idosDisclaimersAccepted,
                 credentialReusabilityConsentGiven,
             });
             return;
@@ -712,7 +741,12 @@ export class KycController extends BaseController {
      */
     clearSavedTerms() {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+            state.vendorDisclaimersAccepted =
+                getDefaultKycVendorDisclaimersAccepted();
+            state.providerDisclaimersAccepted =
+                getDefaultKycProviderDisclaimersAccepted();
+            state.idosDisclaimersAccepted = null;
+            state.credentialReusabilityConsentGiven = null;
         });
     }
     /**
@@ -770,9 +804,9 @@ export class KycController extends BaseController {
         }
         let accessToken;
         let clientToken;
-        if (credsEnvelope) {
+        if (credsEnvelope && __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
             try {
-                const { credentials } = decryptCredentials(credsEnvelope, __classPrivateFieldGet(this, _KycController_keypair, "f").privateKey);
+                const { credentials } = decryptCredentials(credsEnvelope, __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").privateKey);
                 accessToken = credentials.accessToken;
                 clientToken = credentials.clientToken;
             }
@@ -795,12 +829,14 @@ export class KycController extends BaseController {
      * @returns The Check-frame URL or `null`.
      */
     buildCheckFrameUrl() {
-        if (this.state.activeVendor !== 'moonpay' || !this.state.sessionToken) {
+        if (this.state.activeVendor !== 'moonpay' ||
+            !this.state.moonpaySessionToken ||
+            !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
             return null;
         }
         const url = new URL(`${FRAMES_BASE_URL}/check-connection`);
-        url.searchParams.set('sessionToken', this.state.sessionToken);
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_keypair, "f").publicKeyHex);
+        url.searchParams.set('sessionToken', this.state.moonpaySessionToken);
+        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").publicKeyHex);
         url.searchParams.set('channelId', CHANNEL_CHECK);
         url.searchParams.set('skipKyc', 'true');
         return url.toString();
@@ -811,12 +847,14 @@ export class KycController extends BaseController {
      * @returns The Auth-frame URL or `null`.
      */
     buildAuthFrameUrl() {
-        if (this.state.activeVendor !== 'moonpay' || !__classPrivateFieldGet(this, _KycController_authClientToken, "f")) {
+        if (this.state.activeVendor !== 'moonpay' ||
+            !__classPrivateFieldGet(this, _KycController_authClientToken, "f") ||
+            !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
             return null;
         }
         const url = new URL(`${FRAMES_BASE_URL}/auth`);
         url.searchParams.set('clientToken', __classPrivateFieldGet(this, _KycController_authClientToken, "f"));
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_keypair, "f").publicKeyHex);
+        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").publicKeyHex);
         url.searchParams.set('channelId', CHANNEL_AUTH);
         return url.toString();
     }
@@ -839,9 +877,9 @@ export class KycController extends BaseController {
      * @returns Whether KYC is required.
      */
     async checkKycRequired(params) {
-        const { accessToken } = this.state;
-        if (!accessToken) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing accessToken — repeat the authentication step.');
+        const { moonpayAccessToken } = this.state;
+        if (!moonpayAccessToken) {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing moonpayAccessToken — repeat the authentication step.');
             return false;
         }
         const country = params.country ?? this.state.geoCountry;
@@ -857,7 +895,11 @@ export class KycController extends BaseController {
             state.statusMessage = 'Checking KYC status...';
         });
         try {
-            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', { accessToken, country, capabilities: [{ product: params.product }] });
+            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', {
+                accessToken: moonpayAccessToken,
+                country,
+                capabilities: [{ product: params.product }],
+            });
             // The flow was reset while the check was in flight; discard the result
             // rather than resurrecting a done/cached state on an idle controller.
             const applied = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
@@ -1142,12 +1184,12 @@ export class KycController extends BaseController {
             state.phase = 'idle';
             state.statusMessage = '';
             state.error = null;
-            state.disclaimers = [];
-            state.disclaimersError = null;
+            state.vendorDisclaimers = [];
+            state.vendorError = null;
             state.sessionDisclaimers = null;
             state.credentialReusabilityConsentGiven = null;
-            state.sessionToken = null;
-            state.accessToken = null;
+            state.moonpaySessionToken = null;
+            state.moonpayAccessToken = null;
             state.moonpayCustomerId = null;
             state.activeVendor = 'moonpay';
             state.activeProduct = null;
@@ -1175,7 +1217,7 @@ export class KycController extends BaseController {
         });
     }
 }
-_KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPolling = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
+_KycController_sumsubLauncher = new WeakMap(), _KycController_moonpayFrameKeypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPolling = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
     return {
         get: async (path, entropySourceId) => this.messenger.call('UserStorageController:performGetStorage', path, entropySourceId),
         set: async (path, value, entropySourceId) => this.messenger.call('UserStorageController:performSetStorage', path, value, entropySourceId),
@@ -1187,13 +1229,14 @@ _KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new Weak
  * SumSub — skipping MoonPay Check/Auth frames.
  *
  * @param consents - T&C2 flags mapped onto the session disclaimer catalog.
- * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
- * @param consents.idosTncSigned - Whether idOS T&C were accepted.
+ * @param consents.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.
+ * @param consents.idosDisclaimersAccepted - Accepted idOS disclaimer records.
  * @param consents.credentialReusabilityConsentGiven - Whether credential
  * reuse was accepted.
  */
 async function _KycController_startConsentsSession(consents) {
-    const { email, acceptedDisclaimerIds } = this.state;
+    const { email } = this.state;
+    const acceptedDisclaimerIds = ironDisclaimerIds(this.state.vendorDisclaimersAccepted);
     if (!email) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for consents session.');
         return;
@@ -1237,7 +1280,7 @@ async function _KycController_startConsentsSession(consents) {
                 await this.refreshKycStatus();
             }
             catch (statusError) {
-                console.error('KYC status refresh failed:', statusError);
+                controllerLog('KYC status refresh failed:', statusError);
             }
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
                 state.phase = 'done';
@@ -1273,7 +1316,7 @@ async function _KycController_startConsentsSession(consents) {
             await this.refreshKycStatus();
         }
         catch (statusError) {
-            console.error('KYC status refresh failed:', statusError);
+            controllerLog('KYC status refresh failed:', statusError);
         }
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
             if (state.phase !== 'error' && state.phase !== 'done') {
@@ -1301,7 +1344,7 @@ async function _KycController_startConsentsSession(consents) {
             });
             return;
         }
-        console.error('Consents session failed:', error);
+        controllerLog('Consents session failed:', error);
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
         }
@@ -1328,8 +1371,8 @@ async function _KycController_startConsentsSession(consents) {
  *
  * @param sessionId - The UKYC session id.
  * @param consents - T&C2 flags mapped onto catalog documents.
- * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
- * @param consents.idosTncSigned - Whether idOS T&C were accepted.
+ * @param consents.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.
+ * @param consents.idosDisclaimersAccepted - Accepted idOS disclaimer records.
  * @param consents.credentialReusabilityConsentGiven - Whether credential
  * reuse was accepted.
  * @param generation - Flow generation captured by the caller.
@@ -1343,12 +1386,12 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
         state.sessionDisclaimers = catalog;
         state.statusMessage = 'Submitting consents...';
     });
-    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosTncSigned) ||
-        isAcceptedCategoryEmpty(catalog.kycProvider, consents.sumsubTncSigned)) {
+    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosDisclaimersAccepted) ||
+        isAcceptedCategoryEmpty(catalog.kycProvider, consents.providerDisclaimersAccepted)) {
         throw new Error('Session disclaimer catalog is missing documents for an accepted category.');
     }
-    const idOS = consentRecordsFromCatalog(catalog.idOS, consents.idosTncSigned);
-    const kycProvider = consentRecordsFromCatalog(catalog.kycProvider, consents.sumsubTncSigned);
+    const idOS = consentRecordsFromAcceptedList(catalog.idOS, consents.idosDisclaimersAccepted);
+    const kycProvider = consentRecordsFromAcceptedList(catalog.kycProvider, consents.providerDisclaimersAccepted);
     const reuseUnchanged = catalog.credentialReusabilityConsentGiven ===
         consents.credentialReusabilityConsentGiven;
     if (idOS.length === 0 && kycProvider.length === 0 && reuseUnchanged) {
@@ -1379,8 +1422,9 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
             state.sessionDisclaimers = latest;
         });
-        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosTncSigned);
-        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.sumsubTncSigned);
+        // TODO: Should we really be doing client side validation of these?
+        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosDisclaimersAccepted);
+        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.providerDisclaimersAccepted);
         const stillMissingReuse = consents.credentialReusabilityConsentGiven &&
             !latest.credentialReusabilityConsentGiven;
         if (stillMissingIdos || stillMissingProvider || stillMissingReuse) {
@@ -1392,7 +1436,9 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
  * Creates a vendor session from the currently stored terms + email.
  */
 async function _KycController_createSession() {
-    const { email, termsAcceptedAt, acceptedDisclaimerIds } = this.state;
+    const { email } = this.state;
+    const termsAcceptedAt = this.state.vendorDisclaimersAccepted.moonpay?.termsAcceptedAt;
+    const acceptedDisclaimerIds = this.state.vendorDisclaimers.map((disclaimer) => disclaimer.id);
     if (!email) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for session creation.');
         return;
@@ -1407,7 +1453,7 @@ async function _KycController_createSession() {
     // (or, on failure, invalid) session token, `buildAuthFrameUrl` cannot
     // return a URL tied to an old client token, and `checkKycRequired` cannot
     // run with an access token from an earlier authentication. The Check/Auth
-    // frames re-populate these for the new session. Because `sessionToken` is
+    // frames re-populate these for the new session. Because `moonpaySessionToken` is
     // cleared here and only re-set on success, a failed creation leaves it
     // `null` rather than resurrecting the previous session.
     // Capture the flow generation so a `reset()` landing while the create
@@ -1420,19 +1466,19 @@ async function _KycController_createSession() {
         state.error = null;
         state.phase = 'session';
         state.statusMessage = 'Creating session...';
-        state.sessionToken = null;
-        state.accessToken = null;
+        state.moonpaySessionToken = null;
+        state.moonpayAccessToken = null;
     });
     try {
         const { sessionToken } = await this.messenger.call('KycService:createSession', { email, termsAcceptedAt, disclaimerIds: acceptedDisclaimerIds });
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.sessionToken = sessionToken;
+            state.moonpaySessionToken = sessionToken;
             state.phase = 'check';
             state.statusMessage = 'Authenticating via Check frame...';
         });
     }
     catch (error) {
-        console.error('Session creation failed:', error);
+        controllerLog('Session creation failed:', error);
         // A reset() superseded this flow while the request was in flight; leave
         // the idle controller alone rather than forcing it back to `terms`.
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
@@ -1452,29 +1498,17 @@ async function _KycController_createSession() {
         });
         await this.loadDisclaimers();
     }
-}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state) {
-    state.termsAcceptedAt = null;
-    state.acceptedDisclaimerIds = [];
-    state.termsAcceptedVendor = null;
-    state.sumsubTncAccepted = null;
-    state.idosTncAccepted = null;
+}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state, vendor) {
+    const targetVendor = vendor ?? state.activeVendor;
+    state.vendorDisclaimersAccepted = clearVendorDisclaimerAcceptance(state.vendorDisclaimersAccepted, targetVendor);
+    state.providerDisclaimersAccepted =
+        getDefaultKycProviderDisclaimersAccepted();
+    state.idosDisclaimersAccepted = null;
     state.credentialReusabilityConsentGiven = null;
 }, _KycController_clearMoonPaySession = function _KycController_clearMoonPaySession(state) {
     state.moonpayCustomerId = null;
-    state.sessionToken = null;
-    state.accessToken = null;
-}, _KycController_dropTermsUnlessForVendor = function _KycController_dropTermsUnlessForVendor(vendor) {
-    if (__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_hasTermsForVendor).call(this, vendor)) {
-        return;
-    }
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
-    });
-}, _KycController_hasTermsForVendor = function _KycController_hasTermsForVendor(vendor) {
-    if (this.state.termsAcceptedVendor === null) {
-        return false;
-    }
-    return this.state.termsAcceptedVendor === vendor;
+    state.moonpaySessionToken = null;
+    state.moonpayAccessToken = null;
 }, _KycController_handleCheckOutcome = 
 /**
  * Applies a Check-frame outcome.
@@ -1486,7 +1520,7 @@ async function _KycController_createSession() {
 async function _KycController_handleCheckOutcome(status, accessToken, clientToken) {
     if (status === 'active' && accessToken) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.accessToken = accessToken;
+            state.moonpayAccessToken = accessToken;
             state.phase = 'form';
             state.statusMessage = 'Already authenticated. Review to submit.';
         });
@@ -1516,7 +1550,7 @@ async function _KycController_handleCheckOutcome(status, accessToken, clientToke
 async function _KycController_handleAuthOutcome(status, accessToken) {
     if (status === 'active' && accessToken) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.accessToken = accessToken;
+            state.moonpayAccessToken = accessToken;
             state.phase = 'form';
             state.statusMessage = 'Authenticated. Review to submit.';
         });
@@ -1579,7 +1613,7 @@ async function _KycController_continueAfterAuthentication() {
         return {
             vendor: 'moonpay',
             vendorMetadata: {
-                moonPayAccessToken: this.state.accessToken,
+                moonPayAccessToken: this.state.moonpayAccessToken,
                 moonPayUserId: this.state.moonpayCustomerId,
             },
         };