@metamask-previews/kyc-controller 0.0.0-preview-e57e5c3dc → 0.0.0-preview-c34a16a37

package/dist/KycController.cjs

@@ -10,14 +10,14 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_localUserSecretStore, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_fail;
+var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startIronSession, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_fail;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KycController = exports.getDefaultKycControllerState = exports.controllerName = void 0;
 const base_controller_1 = require("@metamask/base-controller");
 const ed25519_1 = require("@noble/curves/ed25519");
 const crypto_js_1 = require("./crypto.cjs");
-const deriveClientMaterial_js_1 = require("./ukyc/deriveClientMaterial.cjs");
 const encoding_js_1 = require("./encoding.cjs");
+const deriveClientMaterial_js_1 = require("./ukyc/deriveClientMaterial.cjs");
 const jwtChain_js_1 = require("./ukyc/jwtChain.cjs");
 const localUserSecret_js_1 = require("./ukyc/localUserSecret.cjs");
 const storageAccessToken_js_1 = require("./ukyc/storageAccessToken.cjs");
@@ -87,6 +87,12 @@ const SUCCESSFUL_SESSION_STATUSES = new Set([
 // to do, so the sub-flow stops before launching the SDK and surfaces this
 // message.
 const VENDOR_PROCESSING_MESSAGE = 'Your KYC has been submitted and is being processed by the vendor.';
+// UKYC / relay error indicating the applicant already finished KYC. Mapped to
+// the simplified `completed` user status for the Money toast surface.
+const SESSION_NOT_IN_VALID_STATE = 'session_not_in_valid_state';
+// How often to refresh the user-keyed `GET /kyc/status` while the simplified
+// status is still `pending`. Overridable via the constructor.
+const DEFAULT_USER_STATUS_POLL_INTERVAL_MS = 15000;
 const kycControllerMetadata = {
     phase: {
         includeInDebugSnapshot: true,
@@ -160,6 +166,12 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: false,
     },
+    activeVendor: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: false,
+        usedInUi: true,
+    },
     activeProduct: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
@@ -178,6 +190,24 @@ const kycControllerMetadata = {
         persist: true,
         usedInUi: false,
     },
+    userStatus: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: true,
+    },
+    userStatusSumsubSessionId: {
+        includeInDebugSnapshot: false,
+        includeInStateLogs: false,
+        persist: true,
+        usedInUi: true,
+    },
+    userStatusErrorCode: {
+        includeInDebugSnapshot: true,
+        includeInStateLogs: true,
+        persist: true,
+        usedInUi: true,
+    },
     sumsub: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
@@ -204,9 +234,13 @@ function getDefaultKycControllerState() {
         sessionToken: null,
         accessToken: null,
         moonpayCustomerId: null,
+        activeVendor: 'moonpay',
         activeProduct: null,
         kycRequiredByProduct: {},
         lastCheckedAt: null,
+        userStatus: null,
+        userStatusSumsubSessionId: null,
+        userStatusErrorCode: null,
         sumsub: {
             status: 'idle',
             result: null,
@@ -222,6 +256,7 @@ const MESSENGER_EXPOSED_METHODS = [
     'initialize',
     'loadDisclaimers',
     'acceptTermsAndStartSession',
+    'createIronCustomer',
     'clearSavedTerms',
     'handleFrameMessage',
     'buildCheckFrameUrl',
@@ -229,6 +264,8 @@ const MESSENGER_EXPOSED_METHODS = [
     'buildResetFrameUrl',
     'checkKycRequired',
     'getKycStatus',
+    'getCustomerIdentity',
+    'refreshKycStatus',
     'startSumSub',
     'getSessionStatus',
     'reset',
@@ -251,8 +288,10 @@ class KycController extends base_controller_1.BaseController {
      * @param options.sumsubLauncher - The platform SumSub launcher adapter.
      * @param options.sessionStatusPollIntervalMs - How often to poll the UKYC
      * session status after the SumSub SDK completes.
+     * @param options.userStatusPollIntervalMs - How often to refresh the
+     * user-keyed KYC status while it is still `pending`.
      */
-    constructor({ messenger, state, sumsubLauncher, sessionStatusPollIntervalMs = DEFAULT_SESSION_STATUS_POLL_INTERVAL_MS, }) {
+    constructor({ messenger, state, sumsubLauncher, sessionStatusPollIntervalMs = DEFAULT_SESSION_STATUS_POLL_INTERVAL_MS, userStatusPollIntervalMs = DEFAULT_USER_STATUS_POLL_INTERVAL_MS, }) {
         super({
             messenger,
             metadata: kycControllerMetadata,
@@ -283,8 +322,15 @@ class KycController extends base_controller_1.BaseController {
          * let an already-awaiting request finish and reschedule.
          */
         _KycController_pollToken.set(this, 0);
+        /** Interval, in milliseconds, between user-keyed status polls. */
+        _KycController_userStatusPollIntervalMs.set(this, void 0);
+        /** Handle for the scheduled next user-status poll, or `null`. */
+        _KycController_userStatusPollTimer.set(this, null);
+        /** Monotonic token for the user-status poll loop (see `#pollToken`). */
+        _KycController_userStatusPollToken.set(this, 0);
         __classPrivateFieldSet(this, _KycController_sumsubLauncher, sumsubLauncher, "f");
         __classPrivateFieldSet(this, _KycController_sessionStatusPollIntervalMs, sessionStatusPollIntervalMs, "f");
+        __classPrivateFieldSet(this, _KycController_userStatusPollIntervalMs, userStatusPollIntervalMs, "f");
         __classPrivateFieldSet(this, _KycController_keypair, (0, crypto_js_1.generateKeyPair)(), "f");
         this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
@@ -299,6 +345,8 @@ class KycController extends base_controller_1.BaseController {
      * authentication completes (and chains into document verification when KYC
      * is required). When omitted, the flow stops at `form` and the consumer must
      * call `checkKycRequired` manually.
+     * @param params.vendor - Identity vendor for this flow. Pass `iron` for the
+     * Money/VBA path (no MoonPay Check/Auth frames). Defaults to `moonpay`.
      */
     async initialize(params) {
         // A repeat `initialize` while a session flow is already in progress must
@@ -309,6 +357,7 @@ class KycController extends base_controller_1.BaseController {
         if (IN_PROGRESS_PHASES.includes(this.state.phase)) {
             return;
         }
+        const vendor = params?.vendor ?? 'moonpay';
         // `initialize` starts a fresh flow, so `activeProduct` is always reset to
         // this call's product (or `null`). Otherwise a prior run's product could
         // linger and cause `#continueAfterAuthentication` to auto-run the check /
@@ -317,6 +366,13 @@ class KycController extends base_controller_1.BaseController {
             if (params?.email) {
                 state.email = params.email;
             }
+            state.activeVendor = vendor;
+            // `moonpayCustomerId` is only ever issued by the MoonPay Check / Auth
+            // frames. Leaving it set while the flow switches to another vendor would
+            // make `getCustomerIdentity` report a MoonPay id under the wrong vendor.
+            if (vendor !== 'moonpay') {
+                state.moonpayCustomerId = null;
+            }
             state.activeProduct = params?.product ?? null;
         });
         // Capture the flow generation so a `reset()` landing while the async
@@ -333,10 +389,36 @@ class KycController extends base_controller_1.BaseController {
         catch {
             // Ignore; disclaimers loading will surface a country error if needed.
         }
+        // Iron: create the empty-shell customer before T&C (offsite decision).
+        if (vendor === 'iron' && this.state.email) {
+            try {
+                await this.messenger.call('KycService:createIronCustomer', {
+                    email: this.state.email,
+                });
+                if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                    return;
+                }
+            }
+            catch (error) {
+                if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                    return;
+                }
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Iron customer creation failed: ${String(error)}`);
+                return;
+            }
+        }
         const hasTerms = Boolean(this.state.termsAcceptedAt) &&
             this.state.acceptedDisclaimerIds.length > 0;
         if (hasTerms && this.state.email) {
-            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
+            if (vendor === 'iron') {
+                await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startIronSession).call(this, {
+                    sumsubTncSigned: true,
+                    idosTncSigned: true,
+                });
+            }
+            else {
+                await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
+            }
             return;
         }
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
@@ -344,6 +426,35 @@ class KycController extends base_controller_1.BaseController {
         });
         await this.loadDisclaimers();
     }
+    /**
+     * Creates (or resumes) an Iron empty-shell customer. Exposed so Money can
+     * ensure the customer exists before showing T&C screens independently of
+     * {@link initialize}.
+     *
+     * @param params - The parameters.
+     * @param params.email - Email for the Iron customer.
+     */
+    async createIronCustomer(params) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            state.email = params.email;
+            state.activeVendor = 'iron';
+            // See `initialize`: a MoonPay-issued customer id must not survive a
+            // switch to Iron, or `getCustomerIdentity` reports the wrong vendor.
+            state.moonpayCustomerId = null;
+        });
+        const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
+        try {
+            await this.messenger.call('KycService:createIronCustomer', {
+                email: params.email,
+            });
+        }
+        catch (error) {
+            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                return;
+            }
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, `Iron customer creation failed: ${String(error)}`);
+        }
+    }
     /**
      * Loads the disclaimers for the resolved (or provided) country.
      *
@@ -364,7 +475,13 @@ class KycController extends base_controller_1.BaseController {
                     state.geoCountry = country;
                 });
             }
-            const disclaimers = await this.messenger.call('KycService:fetchDisclaimers', { country });
+            const disclaimers = this.state.activeVendor === 'iron'
+                ? await this.messenger.call('KycService:fetchIronDisclaimers', {
+                    country,
+                })
+                : await this.messenger.call('KycService:fetchDisclaimers', {
+                    country,
+                });
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
                 state.disclaimers = disclaimers;
                 state.disclaimersError = null;
@@ -385,6 +502,10 @@ class KycController extends base_controller_1.BaseController {
      * @param params.product - The consuming feature the flow runs for. See
      * {@link initialize} for how the product drives the automatic post
      * authentication continuation.
+     * @param params.sumsubTncSigned - Iron path: whether Sumsub T&C were
+     * accepted (T&C2). Defaults to `true` when omitted.
+     * @param params.idosTncSigned - Iron path: whether idOS T&C were accepted
+     * (T&C2). Defaults to `true` when omitted.
      */
     async acceptTermsAndStartSession(params) {
         const termsAcceptedAt = new Date().toISOString();
@@ -399,6 +520,13 @@ class KycController extends base_controller_1.BaseController {
             state.termsAcceptedAt = termsAcceptedAt;
             state.acceptedDisclaimerIds = disclaimerIds;
         });
+        if (this.state.activeVendor === 'iron') {
+            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startIronSession).call(this, {
+                sumsubTncSigned: params?.sumsubTncSigned ?? true,
+                idosTncSigned: params?.idosTncSigned ?? true,
+            });
+            return;
+        }
         await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
     }
     /**
@@ -580,6 +708,25 @@ class KycController extends base_controller_1.BaseController {
     getKycStatus(params) {
         return this.state.kycRequiredByProduct[params.product];
     }
+    /**
+     * Returns the vendor-scoped identity for the currently authenticated
+     * customer, or `null` when the flow has not yet captured a vendor customer
+     * id (before authentication or after {@link reset}).
+     *
+     * Exposed so consumers (e.g. ramps autoramp creation) can attach the vendor
+     * customer id to downstream calls without reading the full KYC state, which
+     * also holds session/access tokens. The id is session-scoped and never
+     * persisted.
+     *
+     * @returns The current {@link KycCustomerIdentity}, or `null`.
+     */
+    getCustomerIdentity() {
+        const { moonpayCustomerId, activeVendor } = this.state;
+        if (!moonpayCustomerId) {
+            return null;
+        }
+        return { vendor: activeVendor, id: moonpayCustomerId };
+    }
     /**
      * Runs the SumSub document-verification sub-flow end to end:
      *
@@ -658,12 +805,18 @@ class KycController extends base_controller_1.BaseController {
                 operations: ['read'],
                 expiresAt: new Date(Date.now() + UKYC_CAPABILITY_TOKEN_TTL_MS),
             });
+            const isIron = this.state.activeVendor === 'iron';
             const { sessionId, kycStatus, finalStatus } = await this.messenger.call('KycService:createUkycSession', {
                 jwtToken,
-                vendorMetadata: {
-                    moonPayAccessToken: this.state.accessToken,
-                    moonPayUserId: this.state.moonpayCustomerId,
-                },
+                vendorId: isIron ? 'iron' : 'moonpay',
+                ...(isIron
+                    ? {}
+                    : {
+                        vendorMetadata: {
+                            moonPayAccessToken: this.state.accessToken,
+                            moonPayUserId: this.state.moonpayCustomerId,
+                        },
+                    }),
                 wrappedEncryptionKey,
                 ukycCapabilityToken,
             });
@@ -753,6 +906,28 @@ class KycController extends base_controller_1.BaseController {
             return result;
         }
         catch (error) {
+            // Applicant already finished KYC — treat as completed for Money toast.
+            if (String(error).includes(SESSION_NOT_IN_VALID_STATE)) {
+                // A reset() may have landed while `launch` was in flight; forcing
+                // `completed` (and publishing `statusChanged`) on an idle controller
+                // would resurrect a flow the consumer already tore down.
+                if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+                    return { alreadyCompleted: true };
+                }
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUserStatus).call(this, {
+                    status: 'completed',
+                    sumsubSessionId: null,
+                    errorCode: null,
+                });
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
+                    state.sumsub.status = 'complete';
+                    state.sumsub.result = { alreadyCompleted: true };
+                    state.statusMessage = 'KYC already completed.';
+                    state.phase = 'done';
+                    state.error = null;
+                });
+                return { alreadyCompleted: true };
+            }
             const result = { error: String(error) };
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
                 state.sumsub.status = 'failed';
@@ -761,6 +936,23 @@ class KycController extends base_controller_1.BaseController {
             return result;
         }
     }
+    /**
+     * Refreshes the user-keyed simplified KYC status from `GET /kyc/status`,
+     * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and
+     * schedules short-interval polling while the status is `pending`.
+     *
+     * @returns The latest status payload.
+     */
+    async refreshKycStatus() {
+        const payload = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fetchAndApplyUserStatus).call(this);
+        if (payload.status === 'pending') {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_ensureUserStatusPolling).call(this);
+        }
+        else {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
+        }
+        return payload;
+    }
     /**
      * Fetches the current UKYC session status for the active sub-flow and records
      * it on state. Useful for a one-off refresh outside the automatic polling
@@ -792,6 +984,7 @@ class KycController extends base_controller_1.BaseController {
         // Stop any session-status polling so a late poll cannot write onto the
         // now-idle controller.
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopPolling).call(this);
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
         // Invalidate any in-flight async work started before this reset so its
         // results are discarded rather than written onto the now-idle controller.
         __classPrivateFieldSet(this, _KycController_generation, __classPrivateFieldGet(this, _KycController_generation, "f") + 1, "f");
@@ -804,6 +997,7 @@ class KycController extends base_controller_1.BaseController {
             state.sessionToken = null;
             state.accessToken = null;
             state.moonpayCustomerId = null;
+            state.activeVendor = 'moonpay';
             state.activeProduct = null;
             state.sumsub = {
                 status: 'idle',
@@ -816,11 +1010,91 @@ class KycController extends base_controller_1.BaseController {
     }
 }
 exports.KycController = KycController;
-_KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
+_KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new WeakMap(), _KycController_authClientToken = new WeakMap(), _KycController_generation = new WeakMap(), _KycController_sessionStatusPollIntervalMs = new WeakMap(), _KycController_pollTimer = new WeakMap(), _KycController_pollToken = new WeakMap(), _KycController_userStatusPollIntervalMs = new WeakMap(), _KycController_userStatusPollTimer = new WeakMap(), _KycController_userStatusPollToken = new WeakMap(), _KycController_instances = new WeakSet(), _KycController_localUserSecretStore = function _KycController_localUserSecretStore() {
     return {
         get: async (path, entropySourceId) => this.messenger.call('UserStorageController:performGetStorage', path, entropySourceId),
         set: async (path, value, entropySourceId) => this.messenger.call('UserStorageController:performSetStorage', path, value, entropySourceId),
     };
+}, _KycController_startIronSession = 
+/**
+ * Iron-only path: post consents (Iron signings + Sumsub/idOS ack), then
+ * launch SumSub — skipping MoonPay Check/Auth frames.
+ *
+ * @param consents - T&C2 boolean flags.
+ * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
+ * @param consents.idosTncSigned - Whether idOS T&C were accepted.
+ */
+async function _KycController_startIronSession(consents) {
+    const { email, acceptedDisclaimerIds } = this.state;
+    if (!email) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing email for Iron session.');
+        return;
+    }
+    if (acceptedDisclaimerIds.length === 0) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing Iron disclaimer acceptance.');
+        return;
+    }
+    const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+        state.error = null;
+        state.phase = 'session';
+        state.statusMessage = 'Submitting consents...';
+        // Iron has no MoonPay session/access tokens.
+        state.sessionToken = null;
+        state.accessToken = null;
+    });
+    try {
+        await this.messenger.call('KycService:submitConsents', {
+            ironDisclaimerIds: acceptedDisclaimerIds,
+            sumsubTncSigned: consents.sumsubTncSigned,
+            idosTncSigned: consents.idosTncSigned,
+        });
+        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+            return;
+        }
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            state.phase = 'submit';
+            state.statusMessage = 'Starting document verification...';
+        });
+        const sumsubResult = await this.startSumSub();
+        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+            return;
+        }
+        const sumsubError = sumsubResult?.error;
+        if (typeof sumsubError === 'string') {
+            throw new Error(sumsubError);
+        }
+        // After SumSub, refresh user-keyed status for the Money toast and start
+        // polling while still pending. Soft-fail: toast refresh must not rewind
+        // the consent / SumSub outcome.
+        try {
+            await this.refreshKycStatus();
+        }
+        catch (statusError) {
+            console.error('KYC status refresh failed:', statusError);
+        }
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
+            if (state.phase !== 'error' && state.phase !== 'done') {
+                state.phase = 'done';
+                state.statusMessage = 'KYC submitted.';
+            }
+        });
+    }
+    catch (error) {
+        console.error('Iron session failed:', error);
+        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+            return;
+        }
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
+            state.activeProduct = null;
+            state.error = `Iron session failed: ${String(error)}`;
+            state.statusMessage =
+                'Consent / verification failed — accept the terms to try again.';
+            state.phase = 'terms';
+        });
+        await this.loadDisclaimers();
+    }
 }, _KycController_createSession = 
 /**
  * Creates a vendor session from the currently stored terms + email.
@@ -986,6 +1260,88 @@ async function _KycController_continueAfterAuthentication() {
         state.statusMessage =
             'The vendor updated its Terms of Use — please re-accept.';
     });
+}, _KycController_fetchAndApplyUserStatus = 
+/**
+ * Fetches `GET /kyc/status` and applies it to state without managing the
+ * poll loop (used by both {@link refreshKycStatus} and the poll tick).
+ *
+ * @returns The latest status payload.
+ */
+async function _KycController_fetchAndApplyUserStatus() {
+    const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
+    const response = await this.messenger.call('KycService:fetchKycStatus');
+    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+        return {
+            status: this.state.userStatus ?? 'not-started',
+            sumsubSessionId: this.state.userStatusSumsubSessionId,
+            errorCode: this.state.userStatusErrorCode,
+        };
+    }
+    const payload = {
+        status: response.status,
+        sumsubSessionId: response.sumsubSessionId ?? null,
+        errorCode: response.errorCode ?? null,
+    };
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUserStatus).call(this, payload);
+    return payload;
+}, _KycController_applyUserStatus = function _KycController_applyUserStatus(payload) {
+    const previous = this.state.userStatus;
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+        state.userStatus = payload.status;
+        state.userStatusSumsubSessionId = payload.sumsubSessionId;
+        state.userStatusErrorCode = payload.errorCode;
+    });
+    if (previous !== payload.status) {
+        this.messenger.publish(`${exports.controllerName}:statusChanged`, payload);
+    }
+}, _KycController_ensureUserStatusPolling = function _KycController_ensureUserStatusPolling() {
+    if (__classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f") !== null) {
+        return;
+    }
+    const token = __classPrivateFieldGet(this, _KycController_userStatusPollToken, "f");
+    const tick = async () => {
+        try {
+            const payload = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fetchAndApplyUserStatus).call(this);
+            // Race with `reset()` / `#stopUserStatusPolling` while the request was
+            // in flight — do not reschedule onto an idle controller.
+            /* istanbul ignore next */
+            if (__classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") !== token) {
+                return;
+            }
+            if (payload.status !== 'pending') {
+                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_stopUserStatusPolling).call(this);
+                return;
+            }
+        }
+        catch {
+            // Keep polling on transient errors, unless the loop was superseded.
+            /* istanbul ignore next */
+            if (__classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") !== token) {
+                return;
+            }
+        }
+        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, setTimeout(() => {
+            __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
+            // eslint-disable-next-line @typescript-eslint/no-floating-promises
+            tick();
+        }, __classPrivateFieldGet(this, _KycController_userStatusPollIntervalMs, "f")), "f");
+        // Allow the process to exit while a pending-status poll is scheduled.
+        // React Native / browser timers are numbers with no `unref`, hence the
+        // optional call.
+        __classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f").unref?.();
+    };
+    __classPrivateFieldSet(this, _KycController_userStatusPollTimer, setTimeout(() => {
+        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
+        // eslint-disable-next-line @typescript-eslint/no-floating-promises
+        tick();
+    }, __classPrivateFieldGet(this, _KycController_userStatusPollIntervalMs, "f")), "f");
+    __classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f").unref?.();
+}, _KycController_stopUserStatusPolling = function _KycController_stopUserStatusPolling() {
+    __classPrivateFieldSet(this, _KycController_userStatusPollToken, __classPrivateFieldGet(this, _KycController_userStatusPollToken, "f") + 1, "f");
+    if (__classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f") !== null) {
+        clearTimeout(__classPrivateFieldGet(this, _KycController_userStatusPollTimer, "f"));
+        __classPrivateFieldSet(this, _KycController_userStatusPollTimer, null, "f");
+    }
 }, _KycController_startSessionStatusPolling = 
 /**
  * Begins polling the UKYC session status until a terminal decision is