@metamask-previews/kyc-controller 0.0.0-preview-e12b5ece6 → 0.0.0-preview-e0510042f

package/dist/KycController.mjs

@@ -9,19 +9,17 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KycController_instances, _KycController_sumsubLauncher, _KycController_moonpayFrameKeypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
+var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_dropTermsUnlessForVendor, _KycController_hasTermsForVendor, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
 import { BaseController } from "@metamask/base-controller";
 import { stringToBytes } from "@metamask/utils";
 import { x25519 } from "@noble/curves/ed25519";
 import { decryptCredentials, generateKeyPair } from "./crypto.mjs";
 import { toBase64Url } from "./encoding.mjs";
-import { controllerLog } from "./logger.mjs";
 import { deriveClientMaterial } from "./ukyc/deriveClientMaterial.mjs";
 import { verifyJwtChain } from "./ukyc/jwtChain.mjs";
 import { getOrCreateLocalUserSecret } from "./ukyc/localUserSecret.mjs";
 import { encodeStorageAccessTokenForHeader, signStorageAccessToken } from "./ukyc/storageAccessToken.mjs";
 import { wrapEncryptionKey } from "./ukyc/wrapEncryptionKey.mjs";
-import { clearVendorDisclaimerAcceptance, hasVendorDisclaimerAcceptance, ironDisclaimerIds, recordVendorDisclaimerAcceptance } from "./vendorDisclaimerAcceptance.mjs";
 // === GENERAL ===
 export const controllerName = 'KycController';
 const FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';
@@ -118,19 +116,31 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
-    vendorDisclaimersAccepted: {
+    termsAcceptedAt: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
         usedInUi: false,
     },
-    providerDisclaimersAccepted: {
+    acceptedDisclaimerIds: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
         usedInUi: false,
     },
-    idosDisclaimersAccepted: {
+    termsAcceptedVendor: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
+    sumsubTncAccepted: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
+    idosTncAccepted: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
@@ -142,13 +152,13 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
-    vendorDisclaimers: {
+    disclaimers: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
         usedInUi: true,
     },
-    vendorError: {
+    disclaimersError: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: false,
@@ -166,13 +176,13 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: true,
     },
-    moonpaySessionToken: {
+    sessionToken: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
         usedInUi: false,
     },
-    moonpayAccessToken: {
+    accessToken: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
@@ -233,17 +243,6 @@ const kycControllerMetadata = {
         usedInUi: true,
     },
 };
-/**
- * Constructs the default {@link KycVendorDisclaimersAccepted} value.
- *
- * @returns The default vendor-disclaimer acceptance map.
- */
-export function getDefaultKycVendorDisclaimersAccepted() {
-    return { moonpay: null, iron: null };
-}
-export function getDefaultKycProviderDisclaimersAccepted() {
-    return { sumsub: null };
-}
 /**
  * Constructs the default {@link KycController} state.
  *
@@ -255,16 +254,18 @@ export function getDefaultKycControllerState() {
         statusMessage: '',
         error: null,
         email: null,
-        vendorDisclaimersAccepted: getDefaultKycVendorDisclaimersAccepted(),
-        providerDisclaimersAccepted: getDefaultKycProviderDisclaimersAccepted(),
-        idosDisclaimersAccepted: null,
+        termsAcceptedAt: null,
+        acceptedDisclaimerIds: [],
+        termsAcceptedVendor: null,
+        sumsubTncAccepted: null,
+        idosTncAccepted: null,
         credentialReusabilityConsentGiven: null,
-        vendorDisclaimers: [],
-        vendorError: null,
+        disclaimers: [],
+        disclaimersError: null,
         sessionDisclaimers: null,
         geoCountry: null,
-        moonpaySessionToken: null,
-        moonpayAccessToken: null,
+        sessionToken: null,
+        accessToken: null,
         moonpayCustomerId: null,
         activeVendor: 'moonpay',
         activeProduct: null,
@@ -308,62 +309,45 @@ function isConsentConflictError(error) {
         error.httpStatus === 409);
 }
 /**
- *
- * @param value - The value to validate.
- * @returns `true` when `value` is a valid consent record list.
- */
-function isValidConsentRecordList(value) {
-    return (Array.isArray(value) &&
-        value.every((item) => typeof item === 'object' &&
-            item !== null &&
-            typeof item.key === 'string' &&
-            typeof item.version === 'string'));
-}
-/**
- * Maps accepted disclaimer records onto unconsented catalog documents.
+ * Maps a session-disclaimer catalog into the `{ key, version }` records the
+ * record-consents API expects, or an empty list when the user declined that
+ * category.
  *
  * @param documents - Catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
- * @returns Consent records to POST, omitting already-consented documents.
+ * @param accepted - Whether the user accepted that category.
+ * @returns Consent records, or `[]` when not accepted.
  */
-function consentRecordsFromAcceptedList(documents, accepted) {
-    if (accepted.length === 0) {
+function consentRecordsFromCatalog(documents, accepted) {
+    if (!accepted) {
         return [];
     }
-    const acceptedKeys = new Set(accepted.map((record) => `${record.key}:${record.version}`));
     return documents
-        .filter((document) => !document.consented &&
-        acceptedKeys.has(`${document.key}:${document.version}`))
+        .filter((document) => !document.consented)
         .map(({ key, version }) => ({ key, version }));
 }
 /**
- * Whether accepted disclaimers reference a missing catalog category.
+ * Whether an accepted T&C2 category has no catalog documents. An empty list
+ * would otherwise skip the POST and count as success.
  *
  * @param documents - Catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
- * @returns `true` when the caller accepted docs but the catalog is empty.
+ * @param accepted - Whether the user accepted that category.
+ * @returns `true` when the user accepted and the catalog is empty.
  */
 function isAcceptedCategoryEmpty(documents, accepted) {
-    return accepted.length > 0 && documents.length === 0;
+    return accepted && documents.length === 0;
 }
 /**
- * Whether accepted disclaimers are still missing consent after a 409 re-GET:
- * empty catalog or any accepted document still unconsented.
+ * Whether an accepted category is still missing consent after a 409 re-GET:
+ * empty catalog or any document still unconsented.
  *
  * @param documents - Latest catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
+ * @param accepted - Whether the user accepted that category.
  * @returns `true` when accepted documents are not fully consented.
  */
 function acceptedCategoryStillMissing(documents, accepted) {
-    if (accepted.length === 0) {
-        return false;
-    }
-    if (documents.length === 0) {
-        return true;
-    }
-    const acceptedKeys = new Set(accepted.map((record) => `${record.key}:${record.version}`));
-    const relevant = documents.filter((document) => acceptedKeys.has(`${document.key}:${document.version}`));
-    return (relevant.length === 0 || relevant.some((document) => !document.consented));
+    return (accepted &&
+        (documents.length === 0 ||
+            documents.some((document) => !document.consented)));
 }
 /**
  * Vendors other than MoonPay skip Check/Auth frames and use the empty-shell
@@ -425,8 +409,8 @@ export class KycController extends BaseController {
         });
         _KycController_instances.add(this);
         _KycController_sumsubLauncher.set(this, void 0);
-        /** MoonPay Check/Auth frame X25519 keypair (never persisted). */
-        _KycController_moonpayFrameKeypair.set(this, null);
+        /** Ephemeral X25519 keypair for the frame key exchange (never persisted). */
+        _KycController_keypair.set(this, void 0);
         /** Auth-frame client token, kept out of state. */
         _KycController_authClientToken.set(this, null);
         /**
@@ -465,6 +449,7 @@ export class KycController extends BaseController {
         __classPrivateFieldSet(this, _KycController_sumsubLauncher, sumsubLauncher, "f");
         __classPrivateFieldSet(this, _KycController_sessionStatusPollIntervalMs, sessionStatusPollIntervalMs, "f");
         __classPrivateFieldSet(this, _KycController_userStatusPollIntervalMs, userStatusPollIntervalMs, "f");
+        __classPrivateFieldSet(this, _KycController_keypair, generateKeyPair(), "f");
         this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
     /**
@@ -487,19 +472,10 @@ export class KycController extends BaseController {
         // forces `phase` back through `session`/`check`, breaking an in-flight
         // Check/Auth frame flow. Leave the active flow untouched and let the
         // consumer drive it (or call `reset` first to start over).
-        const vendor = params?.vendor ?? 'moonpay';
         if (IN_PROGRESS_PHASES.includes(this.state.phase)) {
-            if (vendor === 'moonpay' && !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
-                __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, generateKeyPair(), "f");
-            }
             return;
         }
-        if (vendor === 'moonpay') {
-            __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, generateKeyPair(), "f");
-        }
-        else {
-            __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, null, "f");
-        }
+        const vendor = params?.vendor ?? 'moonpay';
         // `initialize` starts a fresh flow, so `activeProduct` is always reset to
         // this call's product (or `null`). Otherwise a prior run's product could
         // linger and cause `#continueAfterAuthentication` to auto-run the check /
@@ -510,8 +486,8 @@ export class KycController extends BaseController {
             }
             state.activeVendor = vendor;
             // MoonPay Check/Auth artifacts must not survive a switch to another
-            // vendor: leftover `moonpaySessionToken` would keep `buildCheckFrameUrl` alive,
-            // leftover `moonpayAccessToken` / `#authClientToken` would keep Auth / KYC
+            // vendor: leftover `sessionToken` would keep `buildCheckFrameUrl` alive,
+            // leftover `accessToken` / `#authClientToken` would keep Auth / KYC
             // calls bound to MoonPay, and leftover `moonpayCustomerId` would make
             // `getCustomerIdentity` report a MoonPay id under the wrong vendor.
             if (vendor !== 'moonpay') {
@@ -564,14 +540,16 @@ export class KycController extends BaseController {
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
         }
-        const hasTerms = hasVendorDisclaimerAcceptance(this.state.vendorDisclaimersAccepted, vendor);
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, vendor);
+        const hasTerms = Boolean(this.state.termsAcceptedAt) &&
+            this.state.acceptedDisclaimerIds.length > 0;
         if (hasTerms && this.state.email) {
             if (usesConsentsFlow(vendor)) {
                 // Consents-path vendors require T&C2 flags; if they weren't persisted
                 // (i.e. null from pre-migration state), require reacceptance.
-                const { providerDisclaimersAccepted, idosDisclaimersAccepted } = this.state;
-                if (providerDisclaimersAccepted.sumsub === null ||
-                    idosDisclaimersAccepted === null) {
+                const sumsubTncSigned = this.state.sumsubTncAccepted;
+                const idosTncSigned = this.state.idosTncAccepted;
+                if (sumsubTncSigned === null || idosTncSigned === null) {
                     __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
                         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
                         state.phase = 'terms';
@@ -580,19 +558,12 @@ export class KycController extends BaseController {
                     return;
                 }
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                    providerDisclaimersAccepted: providerDisclaimersAccepted.sumsub,
-                    idosDisclaimersAccepted,
+                    sumsubTncSigned,
+                    idosTncSigned,
                     credentialReusabilityConsentGiven: this.state.credentialReusabilityConsentGiven ?? false,
                 });
             }
             else {
-                // TODO: should this be here? or should it exist at all?
-                if (vendor === 'moonpay' && this.state.vendorDisclaimers.length === 0) {
-                    await this.loadDisclaimers();
-                    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                        return;
-                    }
-                }
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
             }
             return;
@@ -627,7 +598,6 @@ export class KycController extends BaseController {
             state.activeVendor = params.vendor;
             if (params.vendor !== 'moonpay') {
                 __classPrivateFieldSet(this, _KycController_authClientToken, null, "f");
-                __classPrivateFieldSet(this, _KycController_moonpayFrameKeypair, null, "f");
                 __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
             }
         });
@@ -637,6 +607,10 @@ export class KycController extends BaseController {
                 vendor: params.vendor,
                 email: params.email,
             });
+            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                return;
+            }
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, params.vendor);
         }
         catch (error) {
             if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
@@ -665,18 +639,18 @@ export class KycController extends BaseController {
                     state.geoCountry = country;
                 });
             }
-            const disclaimers = await this.messenger.call('KycService:fetchVendorDisclaimers', {
+            const disclaimers = await this.messenger.call('KycService:fetchDisclaimers', {
                 vendor: this.state.activeVendor,
                 country,
             });
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.vendorDisclaimers = disclaimers;
-                state.vendorError = null;
+                state.disclaimers = disclaimers;
+                state.disclaimersError = null;
             });
         }
         catch (error) {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.vendorError = `Failed to load disclaimers: ${String(error)}`;
+                state.disclaimersError = `Failed to load disclaimers: ${String(error)}`;
             });
         }
     }
@@ -689,47 +663,44 @@ export class KycController extends BaseController {
      * @param params.product - The consuming feature the flow runs for. See
      * {@link initialize} for how the product drives the automatic post
      * authentication continuation.
-     * @param params.providerDisclaimersAccepted - Sumsub disclaimer documents the
-     * customer accepted (`{ key, version }` records). Required for every vendor
-     * so callers explicitly declare acceptance.
-     * @param params.idosDisclaimersAccepted - idOS disclaimer documents the
-     * customer accepted (`{ key, version }` records). Required for every vendor
-     * so callers explicitly declare acceptance.
+     * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).
+     * Required for every vendor so callers explicitly declare acceptance.
+     * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
+     * Required for every vendor so callers explicitly declare acceptance.
      * @param params.credentialReusabilityConsentGiven - Whether the customer
      * consented to reuse existing idOS credentials. Used when recording
      * session-scoped disclaimers on the consents path. Defaults to `false`.
      */
     async acceptTermsAndStartSession(params) {
-        const providerDisclaimersAccepted = params?.providerDisclaimersAccepted;
-        const idosDisclaimersAccepted = params?.idosDisclaimersAccepted;
-        if (!isValidConsentRecordList(providerDisclaimersAccepted) ||
-            !isValidConsentRecordList(idosDisclaimersAccepted)) {
+        const sumsubTncSigned = params?.sumsubTncSigned;
+        const idosTncSigned = params?.idosTncSigned;
+        if (typeof sumsubTncSigned !== 'boolean' ||
+            typeof idosTncSigned !== 'boolean') {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing T&C2 acceptance flags.');
             return;
         }
-        const credentialReusabilityConsentGiven = params?.credentialReusabilityConsentGiven ?? false;
+        const credentialReusabilityConsentGiven = params.credentialReusabilityConsentGiven ?? false;
         const termsAcceptedAt = new Date().toISOString();
-        const disclaimerIds = this.state.vendorDisclaimers.map((disclaimer) => disclaimer.id);
+        const disclaimerIds = this.state.disclaimers.map((disclaimer) => disclaimer.id);
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            if (params?.email) {
+            if (params.email) {
                 state.email = params.email;
             }
-            if (params?.product) {
+            if (params.product) {
                 state.activeProduct = params.product;
             }
-            state.vendorDisclaimersAccepted = recordVendorDisclaimerAcceptance(state.vendorDisclaimersAccepted, state.activeVendor, { termsAcceptedAt, disclaimerIds });
-            state.providerDisclaimersAccepted = {
-                ...state.providerDisclaimersAccepted,
-                sumsub: providerDisclaimersAccepted,
-            };
-            state.idosDisclaimersAccepted = idosDisclaimersAccepted;
+            state.termsAcceptedAt = termsAcceptedAt;
+            state.acceptedDisclaimerIds = disclaimerIds;
+            state.termsAcceptedVendor = state.activeVendor;
+            state.sumsubTncAccepted = sumsubTncSigned;
+            state.idosTncAccepted = idosTncSigned;
             state.credentialReusabilityConsentGiven =
                 credentialReusabilityConsentGiven;
         });
         if (usesConsentsFlow(this.state.activeVendor)) {
             await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                providerDisclaimersAccepted,
-                idosDisclaimersAccepted,
+                sumsubTncSigned,
+                idosTncSigned,
                 credentialReusabilityConsentGiven,
             });
             return;
@@ -741,12 +712,7 @@ export class KycController extends BaseController {
      */
     clearSavedTerms() {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.vendorDisclaimersAccepted =
-                getDefaultKycVendorDisclaimersAccepted();
-            state.providerDisclaimersAccepted =
-                getDefaultKycProviderDisclaimersAccepted();
-            state.idosDisclaimersAccepted = null;
-            state.credentialReusabilityConsentGiven = null;
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
         });
     }
     /**
@@ -804,9 +770,9 @@ export class KycController extends BaseController {
         }
         let accessToken;
         let clientToken;
-        if (credsEnvelope && __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
+        if (credsEnvelope) {
             try {
-                const { credentials } = decryptCredentials(credsEnvelope, __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").privateKey);
+                const { credentials } = decryptCredentials(credsEnvelope, __classPrivateFieldGet(this, _KycController_keypair, "f").privateKey);
                 accessToken = credentials.accessToken;
                 clientToken = credentials.clientToken;
             }
@@ -829,14 +795,12 @@ export class KycController extends BaseController {
      * @returns The Check-frame URL or `null`.
      */
     buildCheckFrameUrl() {
-        if (this.state.activeVendor !== 'moonpay' ||
-            !this.state.moonpaySessionToken ||
-            !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
+        if (this.state.activeVendor !== 'moonpay' || !this.state.sessionToken) {
             return null;
         }
         const url = new URL(`${FRAMES_BASE_URL}/check-connection`);
-        url.searchParams.set('sessionToken', this.state.moonpaySessionToken);
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").publicKeyHex);
+        url.searchParams.set('sessionToken', this.state.sessionToken);
+        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_keypair, "f").publicKeyHex);
         url.searchParams.set('channelId', CHANNEL_CHECK);
         url.searchParams.set('skipKyc', 'true');
         return url.toString();
@@ -847,14 +811,12 @@ export class KycController extends BaseController {
      * @returns The Auth-frame URL or `null`.
      */
     buildAuthFrameUrl() {
-        if (this.state.activeVendor !== 'moonpay' ||
-            !__classPrivateFieldGet(this, _KycController_authClientToken, "f") ||
-            !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
+        if (this.state.activeVendor !== 'moonpay' || !__classPrivateFieldGet(this, _KycController_authClientToken, "f")) {
             return null;
         }
         const url = new URL(`${FRAMES_BASE_URL}/auth`);
         url.searchParams.set('clientToken', __classPrivateFieldGet(this, _KycController_authClientToken, "f"));
-        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").publicKeyHex);
+        url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_keypair, "f").publicKeyHex);
         url.searchParams.set('channelId', CHANNEL_AUTH);
         return url.toString();
     }
@@ -877,9 +839,9 @@ export class KycController extends BaseController {
      * @returns Whether KYC is required.
      */
     async checkKycRequired(params) {
-        const { moonpayAccessToken } = this.state;
-        if (!moonpayAccessToken) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing moonpayAccessToken — repeat the authentication step.');
+        const { accessToken } = this.state;
+        if (!accessToken) {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing accessToken — repeat the authentication step.');
             return false;
         }
         const country = params.country ?? this.state.geoCountry;
@@ -895,11 +857,7 @@ export class KycController extends BaseController {
             state.statusMessage = 'Checking KYC status...';
         });
         try {
-            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', {
-                accessToken: moonpayAccessToken,
-                country,
-                capabilities: [{ product: params.product }],
-            });
+            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', { accessToken, country, capabilities: [{ product: params.product }] });
             // The flow was reset while the check was in flight; discard the result
             // rather than resurrecting a done/cached state on an idle controller.
             const applied = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
@@ -1184,12 +1142,12 @@ export class KycController extends BaseController {
             state.phase = 'idle';
             state.statusMessage = '';
             state.error = null;
-            state.vendorDisclaimers = [];
-            state.vendorError = null;
+            state.disclaimers = [];
+            state.disclaimersError = null;
             state.sessionDisclaimers = null;
             state.credentialReusabilityConsentGiven = null;
-            state.moonpaySessionToken = null;
-            state.moonpayAccessToken = null;
+            state.sessionToken = null;
+            state.accessToken = null;
             state.moonpayCustomerId = null;
             state.activeVendor = 'moonpay';
             state.activeProduct = null;
@@ -1217,7 +1175,7 @@ export class KycController extends BaseController {
         });
     }
 }
-_KycController_sumsubLauncher = new WeakMap(), _KycController_moonpayFrameKeypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPolling = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
+_KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPolling = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
     return {
         get: async (path, entropySourceId) => this.messenger.call('UserStorageController:performGetStorage', path, entropySourceId),
         set: async (path, value, entropySourceId) => this.messenger.call('UserStorageController:performSetStorage', path, value, entropySourceId),
@@ -1229,14 +1187,13 @@ _KycController_sumsubLauncher = new WeakMap(), _KycController_moonpayFrameKeypai
  * SumSub — skipping MoonPay Check/Auth frames.
  *
  * @param consents - T&C2 flags mapped onto the session disclaimer catalog.
- * @param consents.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.
- * @param consents.idosDisclaimersAccepted - Accepted idOS disclaimer records.
+ * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
+ * @param consents.idosTncSigned - Whether idOS T&C were accepted.
  * @param consents.credentialReusabilityConsentGiven - Whether credential
  * reuse was accepted.
  */
 async function _KycController_startConsentsSession(consents) {
-    const { email } = this.state;
-    const acceptedDisclaimerIds = ironDisclaimerIds(this.state.vendorDisclaimersAccepted);
+    const { email, acceptedDisclaimerIds } = this.state;
     if (!email) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for consents session.');
         return;
@@ -1280,7 +1237,7 @@ async function _KycController_startConsentsSession(consents) {
                 await this.refreshKycStatus();
             }
             catch (statusError) {
-                controllerLog('KYC status refresh failed:', statusError);
+                console.error('KYC status refresh failed:', statusError);
             }
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
                 state.phase = 'done';
@@ -1316,7 +1273,7 @@ async function _KycController_startConsentsSession(consents) {
             await this.refreshKycStatus();
         }
         catch (statusError) {
-            controllerLog('KYC status refresh failed:', statusError);
+            console.error('KYC status refresh failed:', statusError);
         }
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
             if (state.phase !== 'error' && state.phase !== 'done') {
@@ -1344,7 +1301,7 @@ async function _KycController_startConsentsSession(consents) {
             });
             return;
         }
-        controllerLog('Consents session failed:', error);
+        console.error('Consents session failed:', error);
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
         }
@@ -1371,8 +1328,8 @@ async function _KycController_startConsentsSession(consents) {
  *
  * @param sessionId - The UKYC session id.
  * @param consents - T&C2 flags mapped onto catalog documents.
- * @param consents.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.
- * @param consents.idosDisclaimersAccepted - Accepted idOS disclaimer records.
+ * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
+ * @param consents.idosTncSigned - Whether idOS T&C were accepted.
  * @param consents.credentialReusabilityConsentGiven - Whether credential
  * reuse was accepted.
  * @param generation - Flow generation captured by the caller.
@@ -1386,12 +1343,12 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
         state.sessionDisclaimers = catalog;
         state.statusMessage = 'Submitting consents...';
     });
-    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosDisclaimersAccepted) ||
-        isAcceptedCategoryEmpty(catalog.kycProvider, consents.providerDisclaimersAccepted)) {
+    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosTncSigned) ||
+        isAcceptedCategoryEmpty(catalog.kycProvider, consents.sumsubTncSigned)) {
         throw new Error('Session disclaimer catalog is missing documents for an accepted category.');
     }
-    const idOS = consentRecordsFromAcceptedList(catalog.idOS, consents.idosDisclaimersAccepted);
-    const kycProvider = consentRecordsFromAcceptedList(catalog.kycProvider, consents.providerDisclaimersAccepted);
+    const idOS = consentRecordsFromCatalog(catalog.idOS, consents.idosTncSigned);
+    const kycProvider = consentRecordsFromCatalog(catalog.kycProvider, consents.sumsubTncSigned);
     const reuseUnchanged = catalog.credentialReusabilityConsentGiven ===
         consents.credentialReusabilityConsentGiven;
     if (idOS.length === 0 && kycProvider.length === 0 && reuseUnchanged) {
@@ -1422,9 +1379,8 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
             state.sessionDisclaimers = latest;
         });
-        // TODO: Should we really be doing client side validation of these?
-        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosDisclaimersAccepted);
-        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.providerDisclaimersAccepted);
+        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosTncSigned);
+        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.sumsubTncSigned);
         const stillMissingReuse = consents.credentialReusabilityConsentGiven &&
             !latest.credentialReusabilityConsentGiven;
         if (stillMissingIdos || stillMissingProvider || stillMissingReuse) {
@@ -1436,9 +1392,7 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
  * Creates a vendor session from the currently stored terms + email.
  */
 async function _KycController_createSession() {
-    const { email } = this.state;
-    const termsAcceptedAt = this.state.vendorDisclaimersAccepted.moonpay?.termsAcceptedAt;
-    const acceptedDisclaimerIds = this.state.vendorDisclaimers.map((disclaimer) => disclaimer.id);
+    const { email, termsAcceptedAt, acceptedDisclaimerIds } = this.state;
     if (!email) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for session creation.');
         return;
@@ -1453,7 +1407,7 @@ async function _KycController_createSession() {
     // (or, on failure, invalid) session token, `buildAuthFrameUrl` cannot
     // return a URL tied to an old client token, and `checkKycRequired` cannot
     // run with an access token from an earlier authentication. The Check/Auth
-    // frames re-populate these for the new session. Because `moonpaySessionToken` is
+    // frames re-populate these for the new session. Because `sessionToken` is
     // cleared here and only re-set on success, a failed creation leaves it
     // `null` rather than resurrecting the previous session.
     // Capture the flow generation so a `reset()` landing while the create
@@ -1466,19 +1420,19 @@ async function _KycController_createSession() {
         state.error = null;
         state.phase = 'session';
         state.statusMessage = 'Creating session...';
-        state.moonpaySessionToken = null;
-        state.moonpayAccessToken = null;
+        state.sessionToken = null;
+        state.accessToken = null;
     });
     try {
         const { sessionToken } = await this.messenger.call('KycService:createSession', { email, termsAcceptedAt, disclaimerIds: acceptedDisclaimerIds });
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.moonpaySessionToken = sessionToken;
+            state.sessionToken = sessionToken;
             state.phase = 'check';
             state.statusMessage = 'Authenticating via Check frame...';
         });
     }
     catch (error) {
-        controllerLog('Session creation failed:', error);
+        console.error('Session creation failed:', error);
         // A reset() superseded this flow while the request was in flight; leave
         // the idle controller alone rather than forcing it back to `terms`.
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
@@ -1498,17 +1452,29 @@ async function _KycController_createSession() {
         });
         await this.loadDisclaimers();
     }
-}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state, vendor) {
-    const targetVendor = vendor ?? state.activeVendor;
-    state.vendorDisclaimersAccepted = clearVendorDisclaimerAcceptance(state.vendorDisclaimersAccepted, targetVendor);
-    state.providerDisclaimersAccepted =
-        getDefaultKycProviderDisclaimersAccepted();
-    state.idosDisclaimersAccepted = null;
+}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state) {
+    state.termsAcceptedAt = null;
+    state.acceptedDisclaimerIds = [];
+    state.termsAcceptedVendor = null;
+    state.sumsubTncAccepted = null;
+    state.idosTncAccepted = null;
     state.credentialReusabilityConsentGiven = null;
 }, _KycController_clearMoonPaySession = function _KycController_clearMoonPaySession(state) {
     state.moonpayCustomerId = null;
-    state.moonpaySessionToken = null;
-    state.moonpayAccessToken = null;
+    state.sessionToken = null;
+    state.accessToken = null;
+}, _KycController_dropTermsUnlessForVendor = function _KycController_dropTermsUnlessForVendor(vendor) {
+    if (__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_hasTermsForVendor).call(this, vendor)) {
+        return;
+    }
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+    });
+}, _KycController_hasTermsForVendor = function _KycController_hasTermsForVendor(vendor) {
+    if (this.state.termsAcceptedVendor === null) {
+        return false;
+    }
+    return this.state.termsAcceptedVendor === vendor;
 }, _KycController_handleCheckOutcome = 
 /**
  * Applies a Check-frame outcome.
@@ -1520,7 +1486,7 @@ async function _KycController_createSession() {
 async function _KycController_handleCheckOutcome(status, accessToken, clientToken) {
     if (status === 'active' && accessToken) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.moonpayAccessToken = accessToken;
+            state.accessToken = accessToken;
             state.phase = 'form';
             state.statusMessage = 'Already authenticated. Review to submit.';
         });
@@ -1550,7 +1516,7 @@ async function _KycController_handleCheckOutcome(status, accessToken, clientToke
 async function _KycController_handleAuthOutcome(status, accessToken) {
     if (status === 'active' && accessToken) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.moonpayAccessToken = accessToken;
+            state.accessToken = accessToken;
             state.phase = 'form';
             state.statusMessage = 'Authenticated. Review to submit.';
         });
@@ -1613,7 +1579,7 @@ async function _KycController_continueAfterAuthentication() {
         return {
             vendor: 'moonpay',
             vendorMetadata: {
-                moonPayAccessToken: this.state.moonpayAccessToken,
+                moonPayAccessToken: this.state.accessToken,
                 moonPayUserId: this.state.moonpayCustomerId,
             },
         };