@metamask-previews/kyc-controller 0.0.0-preview-e12b5ece6 → 0.0.0-preview-fe4b3be11

package/dist/KycController.mjs

@@ -9,7 +9,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KycController_instances, _KycController_sumsubLauncher, _KycController_moonpayFrameKeypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
+var _KycController_instances, _KycController_sumsubLauncher, _KycController_moonpayFrameKeypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_dropTermsUnlessForVendor, _KycController_hasTermsForVendor, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
 import { BaseController } from "@metamask/base-controller";
 import { stringToBytes } from "@metamask/utils";
 import { x25519 } from "@noble/curves/ed25519";
@@ -21,7 +21,6 @@ import { verifyJwtChain } from "./ukyc/jwtChain.mjs";
 import { getOrCreateLocalUserSecret } from "./ukyc/localUserSecret.mjs";
 import { encodeStorageAccessTokenForHeader, signStorageAccessToken } from "./ukyc/storageAccessToken.mjs";
 import { wrapEncryptionKey } from "./ukyc/wrapEncryptionKey.mjs";
-import { clearVendorDisclaimerAcceptance, hasVendorDisclaimerAcceptance, ironDisclaimerIds, recordVendorDisclaimerAcceptance } from "./vendorDisclaimerAcceptance.mjs";
 // === GENERAL ===
 export const controllerName = 'KycController';
 const FRAMES_BASE_URL = 'https://blocks.moonpay.com/platform/v1';
@@ -118,19 +117,31 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
-    vendorDisclaimersAccepted: {
+    termsAcceptedAt: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
         usedInUi: false,
     },
-    providerDisclaimersAccepted: {
+    acceptedDisclaimerIds: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
         usedInUi: false,
     },
-    idosDisclaimersAccepted: {
+    termsAcceptedVendor: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
+    sumsubTncAccepted: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: false,
+    },
+    idosTncAccepted: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: true,
@@ -142,13 +153,13 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
-    vendorDisclaimers: {
+    disclaimers: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
         usedInUi: true,
     },
-    vendorError: {
+    disclaimersError: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
         persist: false,
@@ -166,13 +177,13 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: true,
     },
-    moonpaySessionToken: {
+    sessionToken: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
         usedInUi: false,
     },
-    moonpayAccessToken: {
+    accessToken: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
         persist: false,
@@ -233,17 +244,6 @@ const kycControllerMetadata = {
         usedInUi: true,
     },
 };
-/**
- * Constructs the default {@link KycVendorDisclaimersAccepted} value.
- *
- * @returns The default vendor-disclaimer acceptance map.
- */
-export function getDefaultKycVendorDisclaimersAccepted() {
-    return { moonpay: null, iron: null };
-}
-export function getDefaultKycProviderDisclaimersAccepted() {
-    return { sumsub: null };
-}
 /**
  * Constructs the default {@link KycController} state.
  *
@@ -255,16 +255,18 @@ export function getDefaultKycControllerState() {
         statusMessage: '',
         error: null,
         email: null,
-        vendorDisclaimersAccepted: getDefaultKycVendorDisclaimersAccepted(),
-        providerDisclaimersAccepted: getDefaultKycProviderDisclaimersAccepted(),
-        idosDisclaimersAccepted: null,
+        termsAcceptedAt: null,
+        acceptedDisclaimerIds: [],
+        termsAcceptedVendor: null,
+        sumsubTncAccepted: null,
+        idosTncAccepted: null,
         credentialReusabilityConsentGiven: null,
-        vendorDisclaimers: [],
-        vendorError: null,
+        disclaimers: [],
+        disclaimersError: null,
         sessionDisclaimers: null,
         geoCountry: null,
-        moonpaySessionToken: null,
-        moonpayAccessToken: null,
+        sessionToken: null,
+        accessToken: null,
         moonpayCustomerId: null,
         activeVendor: 'moonpay',
         activeProduct: null,
@@ -308,62 +310,45 @@ function isConsentConflictError(error) {
         error.httpStatus === 409);
 }
 /**
- *
- * @param value - The value to validate.
- * @returns `true` when `value` is a valid consent record list.
- */
-function isValidConsentRecordList(value) {
-    return (Array.isArray(value) &&
-        value.every((item) => typeof item === 'object' &&
-            item !== null &&
-            typeof item.key === 'string' &&
-            typeof item.version === 'string'));
-}
-/**
- * Maps accepted disclaimer records onto unconsented catalog documents.
+ * Maps a session-disclaimer catalog into the `{ key, version }` records the
+ * record-consents API expects, or an empty list when the user declined that
+ * category.
  *
  * @param documents - Catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
- * @returns Consent records to POST, omitting already-consented documents.
+ * @param accepted - Whether the user accepted that category.
+ * @returns Consent records, or `[]` when not accepted.
  */
-function consentRecordsFromAcceptedList(documents, accepted) {
-    if (accepted.length === 0) {
+function consentRecordsFromCatalog(documents, accepted) {
+    if (!accepted) {
         return [];
     }
-    const acceptedKeys = new Set(accepted.map((record) => `${record.key}:${record.version}`));
     return documents
-        .filter((document) => !document.consented &&
-        acceptedKeys.has(`${document.key}:${document.version}`))
+        .filter((document) => !document.consented)
         .map(({ key, version }) => ({ key, version }));
 }
 /**
- * Whether accepted disclaimers reference a missing catalog category.
+ * Whether an accepted T&C2 category has no catalog documents. An empty list
+ * would otherwise skip the POST and count as success.
  *
  * @param documents - Catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
- * @returns `true` when the caller accepted docs but the catalog is empty.
+ * @param accepted - Whether the user accepted that category.
+ * @returns `true` when the user accepted and the catalog is empty.
  */
 function isAcceptedCategoryEmpty(documents, accepted) {
-    return accepted.length > 0 && documents.length === 0;
+    return accepted && documents.length === 0;
 }
 /**
- * Whether accepted disclaimers are still missing consent after a 409 re-GET:
- * empty catalog or any accepted document still unconsented.
+ * Whether an accepted category is still missing consent after a 409 re-GET:
+ * empty catalog or any document still unconsented.
  *
  * @param documents - Latest catalog documents for one consent category.
- * @param accepted - Accepted `{ key, version }` records from the caller.
+ * @param accepted - Whether the user accepted that category.
  * @returns `true` when accepted documents are not fully consented.
  */
 function acceptedCategoryStillMissing(documents, accepted) {
-    if (accepted.length === 0) {
-        return false;
-    }
-    if (documents.length === 0) {
-        return true;
-    }
-    const acceptedKeys = new Set(accepted.map((record) => `${record.key}:${record.version}`));
-    const relevant = documents.filter((document) => acceptedKeys.has(`${document.key}:${document.version}`));
-    return (relevant.length === 0 || relevant.some((document) => !document.consented));
+    return (accepted &&
+        (documents.length === 0 ||
+            documents.some((document) => !document.consented)));
 }
 /**
  * Vendors other than MoonPay skip Check/Auth frames and use the empty-shell
@@ -510,8 +495,8 @@ export class KycController extends BaseController {
             }
             state.activeVendor = vendor;
             // MoonPay Check/Auth artifacts must not survive a switch to another
-            // vendor: leftover `moonpaySessionToken` would keep `buildCheckFrameUrl` alive,
-            // leftover `moonpayAccessToken` / `#authClientToken` would keep Auth / KYC
+            // vendor: leftover `sessionToken` would keep `buildCheckFrameUrl` alive,
+            // leftover `accessToken` / `#authClientToken` would keep Auth / KYC
             // calls bound to MoonPay, and leftover `moonpayCustomerId` would make
             // `getCustomerIdentity` report a MoonPay id under the wrong vendor.
             if (vendor !== 'moonpay') {
@@ -564,14 +549,16 @@ export class KycController extends BaseController {
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
         }
-        const hasTerms = hasVendorDisclaimerAcceptance(this.state.vendorDisclaimersAccepted, vendor);
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, vendor);
+        const hasTerms = Boolean(this.state.termsAcceptedAt) &&
+            this.state.acceptedDisclaimerIds.length > 0;
         if (hasTerms && this.state.email) {
             if (usesConsentsFlow(vendor)) {
                 // Consents-path vendors require T&C2 flags; if they weren't persisted
                 // (i.e. null from pre-migration state), require reacceptance.
-                const { providerDisclaimersAccepted, idosDisclaimersAccepted } = this.state;
-                if (providerDisclaimersAccepted.sumsub === null ||
-                    idosDisclaimersAccepted === null) {
+                const sumsubTncSigned = this.state.sumsubTncAccepted;
+                const idosTncSigned = this.state.idosTncAccepted;
+                if (sumsubTncSigned === null || idosTncSigned === null) {
                     __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
                         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
                         state.phase = 'terms';
@@ -580,19 +567,12 @@ export class KycController extends BaseController {
                     return;
                 }
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                    providerDisclaimersAccepted: providerDisclaimersAccepted.sumsub,
-                    idosDisclaimersAccepted,
+                    sumsubTncSigned,
+                    idosTncSigned,
                     credentialReusabilityConsentGiven: this.state.credentialReusabilityConsentGiven ?? false,
                 });
             }
             else {
-                // TODO: should this be here? or should it exist at all?
-                if (vendor === 'moonpay' && this.state.vendorDisclaimers.length === 0) {
-                    await this.loadDisclaimers();
-                    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                        return;
-                    }
-                }
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
             }
             return;
@@ -637,6 +617,10 @@ export class KycController extends BaseController {
                 vendor: params.vendor,
                 email: params.email,
             });
+            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                return;
+            }
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_dropTermsUnlessForVendor).call(this, params.vendor);
         }
         catch (error) {
             if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
@@ -670,13 +654,13 @@ export class KycController extends BaseController {
                 country,
             });
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.vendorDisclaimers = disclaimers;
-                state.vendorError = null;
+                state.disclaimers = disclaimers;
+                state.disclaimersError = null;
             });
         }
         catch (error) {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.vendorError = `Failed to load disclaimers: ${String(error)}`;
+                state.disclaimersError = `Failed to load disclaimers: ${String(error)}`;
             });
         }
     }
@@ -689,47 +673,44 @@ export class KycController extends BaseController {
      * @param params.product - The consuming feature the flow runs for. See
      * {@link initialize} for how the product drives the automatic post
      * authentication continuation.
-     * @param params.providerDisclaimersAccepted - Sumsub disclaimer documents the
-     * customer accepted (`{ key, version }` records). Required for every vendor
-     * so callers explicitly declare acceptance.
-     * @param params.idosDisclaimersAccepted - idOS disclaimer documents the
-     * customer accepted (`{ key, version }` records). Required for every vendor
-     * so callers explicitly declare acceptance.
+     * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).
+     * Required for every vendor so callers explicitly declare acceptance.
+     * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
+     * Required for every vendor so callers explicitly declare acceptance.
      * @param params.credentialReusabilityConsentGiven - Whether the customer
      * consented to reuse existing idOS credentials. Used when recording
      * session-scoped disclaimers on the consents path. Defaults to `false`.
      */
     async acceptTermsAndStartSession(params) {
-        const providerDisclaimersAccepted = params?.providerDisclaimersAccepted;
-        const idosDisclaimersAccepted = params?.idosDisclaimersAccepted;
-        if (!isValidConsentRecordList(providerDisclaimersAccepted) ||
-            !isValidConsentRecordList(idosDisclaimersAccepted)) {
+        const sumsubTncSigned = params?.sumsubTncSigned;
+        const idosTncSigned = params?.idosTncSigned;
+        if (typeof sumsubTncSigned !== 'boolean' ||
+            typeof idosTncSigned !== 'boolean') {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing T&C2 acceptance flags.');
             return;
         }
-        const credentialReusabilityConsentGiven = params?.credentialReusabilityConsentGiven ?? false;
+        const credentialReusabilityConsentGiven = params.credentialReusabilityConsentGiven ?? false;
         const termsAcceptedAt = new Date().toISOString();
-        const disclaimerIds = this.state.vendorDisclaimers.map((disclaimer) => disclaimer.id);
+        const disclaimerIds = this.state.disclaimers.map((disclaimer) => disclaimer.id);
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            if (params?.email) {
+            if (params.email) {
                 state.email = params.email;
             }
-            if (params?.product) {
+            if (params.product) {
                 state.activeProduct = params.product;
             }
-            state.vendorDisclaimersAccepted = recordVendorDisclaimerAcceptance(state.vendorDisclaimersAccepted, state.activeVendor, { termsAcceptedAt, disclaimerIds });
-            state.providerDisclaimersAccepted = {
-                ...state.providerDisclaimersAccepted,
-                sumsub: providerDisclaimersAccepted,
-            };
-            state.idosDisclaimersAccepted = idosDisclaimersAccepted;
+            state.termsAcceptedAt = termsAcceptedAt;
+            state.acceptedDisclaimerIds = disclaimerIds;
+            state.termsAcceptedVendor = state.activeVendor;
+            state.sumsubTncAccepted = sumsubTncSigned;
+            state.idosTncAccepted = idosTncSigned;
             state.credentialReusabilityConsentGiven =
                 credentialReusabilityConsentGiven;
         });
         if (usesConsentsFlow(this.state.activeVendor)) {
             await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                providerDisclaimersAccepted,
-                idosDisclaimersAccepted,
+                sumsubTncSigned,
+                idosTncSigned,
                 credentialReusabilityConsentGiven,
             });
             return;
@@ -741,12 +722,7 @@ export class KycController extends BaseController {
      */
     clearSavedTerms() {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.vendorDisclaimersAccepted =
-                getDefaultKycVendorDisclaimersAccepted();
-            state.providerDisclaimersAccepted =
-                getDefaultKycProviderDisclaimersAccepted();
-            state.idosDisclaimersAccepted = null;
-            state.credentialReusabilityConsentGiven = null;
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
         });
     }
     /**
@@ -830,12 +806,12 @@ export class KycController extends BaseController {
      */
     buildCheckFrameUrl() {
         if (this.state.activeVendor !== 'moonpay' ||
-            !this.state.moonpaySessionToken ||
+            !this.state.sessionToken ||
             !__classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f")) {
             return null;
         }
         const url = new URL(`${FRAMES_BASE_URL}/check-connection`);
-        url.searchParams.set('sessionToken', this.state.moonpaySessionToken);
+        url.searchParams.set('sessionToken', this.state.sessionToken);
         url.searchParams.set('publicKey', __classPrivateFieldGet(this, _KycController_moonpayFrameKeypair, "f").publicKeyHex);
         url.searchParams.set('channelId', CHANNEL_CHECK);
         url.searchParams.set('skipKyc', 'true');
@@ -877,9 +853,9 @@ export class KycController extends BaseController {
      * @returns Whether KYC is required.
      */
     async checkKycRequired(params) {
-        const { moonpayAccessToken } = this.state;
-        if (!moonpayAccessToken) {
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing moonpayAccessToken — repeat the authentication step.');
+        const { accessToken } = this.state;
+        if (!accessToken) {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing accessToken — repeat the authentication step.');
             return false;
         }
         const country = params.country ?? this.state.geoCountry;
@@ -895,11 +871,7 @@ export class KycController extends BaseController {
             state.statusMessage = 'Checking KYC status...';
         });
         try {
-            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', {
-                accessToken: moonpayAccessToken,
-                country,
-                capabilities: [{ product: params.product }],
-            });
+            const { kycRequired } = await this.messenger.call('KycService:checkKycRequired', { accessToken, country, capabilities: [{ product: params.product }] });
             // The flow was reset while the check was in flight; discard the result
             // rather than resurrecting a done/cached state on an idle controller.
             const applied = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
@@ -1184,12 +1156,12 @@ export class KycController extends BaseController {
             state.phase = 'idle';
             state.statusMessage = '';
             state.error = null;
-            state.vendorDisclaimers = [];
-            state.vendorError = null;
+            state.disclaimers = [];
+            state.disclaimersError = null;
             state.sessionDisclaimers = null;
             state.credentialReusabilityConsentGiven = null;
-            state.moonpaySessionToken = null;
-            state.moonpayAccessToken = null;
+            state.sessionToken = null;
+            state.accessToken = null;
             state.moonpayCustomerId = null;
             state.activeVendor = 'moonpay';
             state.activeProduct = null;
@@ -1229,14 +1201,13 @@ _KycController_sumsubLauncher = new WeakMap(), _KycController_moonpayFrameKeypai
  * SumSub — skipping MoonPay Check/Auth frames.
  *
  * @param consents - T&C2 flags mapped onto the session disclaimer catalog.
- * @param consents.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.
- * @param consents.idosDisclaimersAccepted - Accepted idOS disclaimer records.
+ * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
+ * @param consents.idosTncSigned - Whether idOS T&C were accepted.
  * @param consents.credentialReusabilityConsentGiven - Whether credential
  * reuse was accepted.
  */
 async function _KycController_startConsentsSession(consents) {
-    const { email } = this.state;
-    const acceptedDisclaimerIds = ironDisclaimerIds(this.state.vendorDisclaimersAccepted);
+    const { email, acceptedDisclaimerIds } = this.state;
     if (!email) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for consents session.');
         return;
@@ -1371,8 +1342,8 @@ async function _KycController_startConsentsSession(consents) {
  *
  * @param sessionId - The UKYC session id.
  * @param consents - T&C2 flags mapped onto catalog documents.
- * @param consents.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.
- * @param consents.idosDisclaimersAccepted - Accepted idOS disclaimer records.
+ * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
+ * @param consents.idosTncSigned - Whether idOS T&C were accepted.
  * @param consents.credentialReusabilityConsentGiven - Whether credential
  * reuse was accepted.
  * @param generation - Flow generation captured by the caller.
@@ -1386,12 +1357,12 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
         state.sessionDisclaimers = catalog;
         state.statusMessage = 'Submitting consents...';
     });
-    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosDisclaimersAccepted) ||
-        isAcceptedCategoryEmpty(catalog.kycProvider, consents.providerDisclaimersAccepted)) {
+    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosTncSigned) ||
+        isAcceptedCategoryEmpty(catalog.kycProvider, consents.sumsubTncSigned)) {
         throw new Error('Session disclaimer catalog is missing documents for an accepted category.');
     }
-    const idOS = consentRecordsFromAcceptedList(catalog.idOS, consents.idosDisclaimersAccepted);
-    const kycProvider = consentRecordsFromAcceptedList(catalog.kycProvider, consents.providerDisclaimersAccepted);
+    const idOS = consentRecordsFromCatalog(catalog.idOS, consents.idosTncSigned);
+    const kycProvider = consentRecordsFromCatalog(catalog.kycProvider, consents.sumsubTncSigned);
     const reuseUnchanged = catalog.credentialReusabilityConsentGiven ===
         consents.credentialReusabilityConsentGiven;
     if (idOS.length === 0 && kycProvider.length === 0 && reuseUnchanged) {
@@ -1422,9 +1393,8 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
             state.sessionDisclaimers = latest;
         });
-        // TODO: Should we really be doing client side validation of these?
-        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosDisclaimersAccepted);
-        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.providerDisclaimersAccepted);
+        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosTncSigned);
+        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.sumsubTncSigned);
         const stillMissingReuse = consents.credentialReusabilityConsentGiven &&
             !latest.credentialReusabilityConsentGiven;
         if (stillMissingIdos || stillMissingProvider || stillMissingReuse) {
@@ -1436,9 +1406,7 @@ async function _KycController_recordSessionDisclaimers(sessionId, consents, gene
  * Creates a vendor session from the currently stored terms + email.
  */
 async function _KycController_createSession() {
-    const { email } = this.state;
-    const termsAcceptedAt = this.state.vendorDisclaimersAccepted.moonpay?.termsAcceptedAt;
-    const acceptedDisclaimerIds = this.state.vendorDisclaimers.map((disclaimer) => disclaimer.id);
+    const { email, termsAcceptedAt, acceptedDisclaimerIds } = this.state;
     if (!email) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for session creation.');
         return;
@@ -1453,7 +1421,7 @@ async function _KycController_createSession() {
     // (or, on failure, invalid) session token, `buildAuthFrameUrl` cannot
     // return a URL tied to an old client token, and `checkKycRequired` cannot
     // run with an access token from an earlier authentication. The Check/Auth
-    // frames re-populate these for the new session. Because `moonpaySessionToken` is
+    // frames re-populate these for the new session. Because `sessionToken` is
     // cleared here and only re-set on success, a failed creation leaves it
     // `null` rather than resurrecting the previous session.
     // Capture the flow generation so a `reset()` landing while the create
@@ -1466,13 +1434,13 @@ async function _KycController_createSession() {
         state.error = null;
         state.phase = 'session';
         state.statusMessage = 'Creating session...';
-        state.moonpaySessionToken = null;
-        state.moonpayAccessToken = null;
+        state.sessionToken = null;
+        state.accessToken = null;
     });
     try {
         const { sessionToken } = await this.messenger.call('KycService:createSession', { email, termsAcceptedAt, disclaimerIds: acceptedDisclaimerIds });
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.moonpaySessionToken = sessionToken;
+            state.sessionToken = sessionToken;
             state.phase = 'check';
             state.statusMessage = 'Authenticating via Check frame...';
         });
@@ -1498,17 +1466,29 @@ async function _KycController_createSession() {
         });
         await this.loadDisclaimers();
     }
-}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state, vendor) {
-    const targetVendor = vendor ?? state.activeVendor;
-    state.vendorDisclaimersAccepted = clearVendorDisclaimerAcceptance(state.vendorDisclaimersAccepted, targetVendor);
-    state.providerDisclaimersAccepted =
-        getDefaultKycProviderDisclaimersAccepted();
-    state.idosDisclaimersAccepted = null;
+}, _KycController_clearAcceptedTerms = function _KycController_clearAcceptedTerms(state) {
+    state.termsAcceptedAt = null;
+    state.acceptedDisclaimerIds = [];
+    state.termsAcceptedVendor = null;
+    state.sumsubTncAccepted = null;
+    state.idosTncAccepted = null;
     state.credentialReusabilityConsentGiven = null;
 }, _KycController_clearMoonPaySession = function _KycController_clearMoonPaySession(state) {
     state.moonpayCustomerId = null;
-    state.moonpaySessionToken = null;
-    state.moonpayAccessToken = null;
+    state.sessionToken = null;
+    state.accessToken = null;
+}, _KycController_dropTermsUnlessForVendor = function _KycController_dropTermsUnlessForVendor(vendor) {
+    if (__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_hasTermsForVendor).call(this, vendor)) {
+        return;
+    }
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+    });
+}, _KycController_hasTermsForVendor = function _KycController_hasTermsForVendor(vendor) {
+    if (this.state.termsAcceptedVendor === null) {
+        return false;
+    }
+    return this.state.termsAcceptedVendor === vendor;
 }, _KycController_handleCheckOutcome = 
 /**
  * Applies a Check-frame outcome.
@@ -1520,7 +1500,7 @@ async function _KycController_createSession() {
 async function _KycController_handleCheckOutcome(status, accessToken, clientToken) {
     if (status === 'active' && accessToken) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.moonpayAccessToken = accessToken;
+            state.accessToken = accessToken;
             state.phase = 'form';
             state.statusMessage = 'Already authenticated. Review to submit.';
         });
@@ -1550,7 +1530,7 @@ async function _KycController_handleCheckOutcome(status, accessToken, clientToke
 async function _KycController_handleAuthOutcome(status, accessToken) {
     if (status === 'active' && accessToken) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.moonpayAccessToken = accessToken;
+            state.accessToken = accessToken;
             state.phase = 'form';
             state.statusMessage = 'Authenticated. Review to submit.';
         });
@@ -1613,7 +1593,7 @@ async function _KycController_continueAfterAuthentication() {
         return {
             vendor: 'moonpay',
             vendorMetadata: {
-                moonPayAccessToken: this.state.moonpayAccessToken,
+                moonPayAccessToken: this.state.accessToken,
                 moonPayUserId: this.state.moonpayCustomerId,
             },
         };