@metamask-previews/kyc-controller 0.0.0-preview-eb263b0ee → 0.0.0-preview-5b293ee50

package/dist/KycController.cjs

@@ -10,13 +10,13 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_recordSessionDisclaimers, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_dropTermsUnlessForVendor, _KycController_hasTermsForVendor, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_createUkycSession, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_assertAttestedServerPublicKey, _KycController_fail;
+var _KycController_instances, _KycController_sumsubLauncher, _KycController_keypair, _KycController_authClientToken, _KycController_generation, _KycController_sessionStatusPollIntervalMs, _KycController_pollTimer, _KycController_pollToken, _KycController_userStatusPollIntervalMs, _KycController_userStatusPollTimer, _KycController_userStatusPolling, _KycController_userStatusPollToken, _KycController_localUserSecretStore, _KycController_startConsentsSession, _KycController_createSession, _KycController_clearAcceptedTerms, _KycController_clearMoonPaySession, _KycController_dropTermsUnlessForVendor, _KycController_hasTermsForVendor, _KycController_handleCheckOutcome, _KycController_handleAuthOutcome, _KycController_continueAfterAuthentication, _KycController_requireTermsReacceptance, _KycController_buildUkycSessionVendorFields, _KycController_fetchAndApplyUserStatus, _KycController_applyUserStatus, _KycController_ensureUserStatusPolling, _KycController_stopUserStatusPolling, _KycController_startSessionStatusPolling, _KycController_pollSessionStatusOnce, _KycController_stopPolling, _KycController_cancelPendingSession, _KycController_updateIfCurrent, _KycController_applyUpdate, _KycController_fail;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KycController = exports.getDefaultKycControllerState = exports.controllerName = void 0;
 const base_controller_1 = require("@metamask/base-controller");
-const utils_1 = require("@metamask/utils");
 const ed25519_1 = require("@noble/curves/ed25519");
 const crypto_js_1 = require("./crypto.cjs");
+const encoding_js_1 = require("./encoding.cjs");
 const deriveClientMaterial_js_1 = require("./ukyc/deriveClientMaterial.cjs");
 const jwtChain_js_1 = require("./ukyc/jwtChain.cjs");
 const localUserSecret_js_1 = require("./ukyc/localUserSecret.cjs");
@@ -148,12 +148,6 @@ const kycControllerMetadata = {
         persist: true,
         usedInUi: false,
     },
-    credentialReusabilityConsentGiven: {
-        includeInDebugSnapshot: true,
-        includeInStateLogs: true,
-        persist: false,
-        usedInUi: false,
-    },
     disclaimers: {
         includeInDebugSnapshot: false,
         includeInStateLogs: false,
@@ -166,12 +160,6 @@ const kycControllerMetadata = {
         persist: false,
         usedInUi: true,
     },
-    sessionDisclaimers: {
-        includeInDebugSnapshot: false,
-        includeInStateLogs: false,
-        persist: false,
-        usedInUi: true,
-    },
     geoCountry: {
         includeInDebugSnapshot: true,
         includeInStateLogs: true,
@@ -261,10 +249,8 @@ function getDefaultKycControllerState() {
         termsAcceptedVendor: null,
         sumsubTncAccepted: null,
         idosTncAccepted: null,
-        credentialReusabilityConsentGiven: null,
         disclaimers: [],
         disclaimersError: null,
-        sessionDisclaimers: null,
         geoCountry: null,
         sessionToken: null,
         accessToken: null,
@@ -298,60 +284,6 @@ exports.getDefaultKycControllerState = getDefaultKycControllerState;
 function isSessionAlreadyCompletedError(error) {
     return String(error).includes(SESSION_NOT_IN_VALID_STATE);
 }
-/**
- * Whether recording session disclaimers failed because those document
- * versions were already consented for the session (`409 Conflict`).
- *
- * @param error - The caught error.
- * @returns `true` when the error is an HTTP 409.
- */
-function isConsentConflictError(error) {
-    return (typeof error === 'object' &&
-        error !== null &&
-        typeof error.httpStatus === 'number' &&
-        error.httpStatus === 409);
-}
-/**
- * Maps a session-disclaimer catalog into the `{ key, version }` records the
- * record-consents API expects, or an empty list when the user declined that
- * category.
- *
- * @param documents - Catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
- * @returns Consent records, or `[]` when not accepted.
- */
-function consentRecordsFromCatalog(documents, accepted) {
-    if (!accepted) {
-        return [];
-    }
-    return documents
-        .filter((document) => !document.consented)
-        .map(({ key, version }) => ({ key, version }));
-}
-/**
- * Whether an accepted T&C2 category has no catalog documents. An empty list
- * would otherwise skip the POST and count as success.
- *
- * @param documents - Catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
- * @returns `true` when the user accepted and the catalog is empty.
- */
-function isAcceptedCategoryEmpty(documents, accepted) {
-    return accepted && documents.length === 0;
-}
-/**
- * Whether an accepted category is still missing consent after a 409 re-GET:
- * empty catalog or any document still unconsented.
- *
- * @param documents - Latest catalog documents for one consent category.
- * @param accepted - Whether the user accepted that category.
- * @returns `true` when accepted documents are not fully consented.
- */
-function acceptedCategoryStillMissing(documents, accepted) {
-    return (accepted &&
-        (documents.length === 0 ||
-            documents.some((document) => !document.consented)));
-}
 /**
  * Vendors other than MoonPay skip Check/Auth frames and use the empty-shell
  * customer + consents path instead.
@@ -563,7 +495,6 @@ class KycController extends base_controller_1.BaseController {
                 await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
                     sumsubTncSigned,
                     idosTncSigned,
-                    credentialReusabilityConsentGiven: this.state.credentialReusabilityConsentGiven ?? false,
                 });
             }
             else {
@@ -670,9 +601,6 @@ class KycController extends base_controller_1.BaseController {
      * Required for every vendor so callers explicitly declare acceptance.
      * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).
      * Required for every vendor so callers explicitly declare acceptance.
-     * @param params.credentialReusabilityConsentGiven - Whether the customer
-     * consented to reuse existing idOS credentials. Used when recording
-     * session-scoped disclaimers on the consents path. Defaults to `false`.
      */
     async acceptTermsAndStartSession(params) {
         const sumsubTncSigned = params?.sumsubTncSigned;
@@ -682,7 +610,6 @@ class KycController extends base_controller_1.BaseController {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_fail).call(this, 'Missing T&C2 acceptance flags.');
             return;
         }
-        const credentialReusabilityConsentGiven = params.credentialReusabilityConsentGiven ?? false;
         const termsAcceptedAt = new Date().toISOString();
         const disclaimerIds = this.state.disclaimers.map((disclaimer) => disclaimer.id);
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
@@ -697,15 +624,9 @@ class KycController extends base_controller_1.BaseController {
             state.termsAcceptedVendor = state.activeVendor;
             state.sumsubTncAccepted = sumsubTncSigned;
             state.idosTncAccepted = idosTncSigned;
-            state.credentialReusabilityConsentGiven =
-                credentialReusabilityConsentGiven;
         });
         if (usesConsentsFlow(this.state.activeVendor)) {
-            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, {
-                sumsubTncSigned,
-                idosTncSigned,
-                credentialReusabilityConsentGiven,
-            });
+            await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_startConsentsSession).call(this, { sumsubTncSigned, idosTncSigned });
             return;
         }
         await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createSession).call(this);
@@ -919,20 +840,17 @@ class KycController extends base_controller_1.BaseController {
     /**
      * Runs the SumSub document-verification sub-flow end to end:
      *
-     *  1. creates a UKYC session, receiving per-secret encryption schemas;
-     *  2. verifies each schema's `jwtChain` against the Fractal JWKS and confirms
-     *     the attested session server public key;
+     *  1. requests a per-session wrapping key from the UKYC backend;
+     *  2. verifies its `jwtChain` against the Fractal JWKS and confirms the
+     *     attested session server public key;
      *  3. derives the `data_encryption_key` from the wallet's UKYC
      *     `local_user_secret` and wraps it for the session server;
-     *  4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the
-     *     same way as the encryption key, and submits both via authorizations;
+     *  4. mints a client-signed, read-only `ukyc_capability_token` and creates
+     *     the UKYC session (handing over the wrapped key and the token);
      *  5. fetches the SumSub applicant access token; and
      *  6. presents the SDK via the injected launcher.
      *
-     * If a UKYC session already exists (the consents path creates it before
-     * recording session disclaimers), steps 1–4 are skipped.
-     *
-     * If authorizations report the applicant is already approved on the relay
+     * If session creation reports the applicant is already approved on the relay
      * while the vendor is still finalizing (`kycStatus: approved`,
      * `finalStatus: pending`), the sub-flow stops at step 4 with a
      * `vendorProcessing` status and a message rather than launching the SDK.
@@ -958,32 +876,65 @@ class KycController extends base_controller_1.BaseController {
         // presenting the SDK) on a controller that is now idle.
         const generation = __classPrivateFieldGet(this, _KycController_generation, "f");
         try {
-            if (!this.state.sumsub.sessionId) {
-                __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-                    state.sumsub.status = 'creatingSession';
-                    state.sumsub.result = null;
-                    state.sumsub.sessionStatus = null;
+            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
+                state.sumsub.status = 'creatingSession';
+                state.sumsub.result = null;
+                state.sumsub.sessionStatus = null;
+            });
+            const jwtToken = MOCK_JWT_TOKEN;
+            // Establish a per-session X25519 keypair and exchange our public half for
+            // the server's wrapping key. The private half stays on the device and is
+            // used to derive the shared secret that seals the data_encryption_key.
+            const sessionClientPrivateKey = ed25519_1.x25519.utils.randomSecretKey();
+            const sessionClientPublicKey = ed25519_1.x25519.getPublicKey(sessionClientPrivateKey);
+            const wrappingKey = await this.messenger.call('KycService:getWrappingKey', { sessionClientPublicKey: (0, encoding_js_1.toBase64Url)(sessionClientPublicKey) });
+            // Verify the jwtChain against Fractal's JWKS, then confirm the returned
+            // sessionServerPublicKey matches the value attested inside the verified
+            // JWT payload before trusting it for key wrapping.
+            const { keys } = await this.messenger.call('KycService:fetchJwks');
+            const jwtChainPayload = (0, jwtChain_js_1.verifyJwtChain)(keys, wrappingKey.jwtChain);
+            if (jwtChainPayload.sessionServerPublicKeyX !==
+                wrappingKey.sessionServerPublicKey.x) {
+                throw new Error('sessionServerPublicKey does not match the verified jwtChain payload (sessionServerPublicKeyX).');
+            }
+            // Derive the data_encryption_key from the local_user_secret and wrap it
+            // for the session server. Only the wrapped (encrypted) key ever leaves
+            // the device.
+            const localUserSecret = await (0, localUserSecret_js_1.getOrCreateLocalUserSecret)(__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_localUserSecretStore).call(this));
+            const clientMaterial = (0, deriveClientMaterial_js_1.deriveClientMaterial)(localUserSecret);
+            const wrappedEncryptionKey = {
+                sessionId: wrappingKey.id,
+                ...(0, wrapEncryptionKey_js_1.wrapEncryptionKey)(sessionClientPrivateKey, wrappingKey.sessionServerPublicKey.x, clientMaterial.dataEncryptionKey),
+            };
+            // Mint a read-only `ukyc_capability_token` for the session. Only the
+            // client holds the signing key derived from `local_user_secret`, so only
+            // the client can mint it; scoping it to `read` means it authorizes later
+            // storage reads without granting write or delete access.
+            const ukycCapabilityToken = (0, storageAccessToken_js_1.signStorageAccessToken)({
+                material: clientMaterial,
+                operations: ['read'],
+                expiresAt: new Date(Date.now() + UKYC_CAPABILITY_TOKEN_TTL_MS),
+            });
+            const { sessionId, kycStatus, finalStatus } = await this.messenger.call('KycService:createUkycSession', {
+                jwtToken,
+                ...__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_buildUkycSessionVendorFields).call(this),
+                wrappedEncryptionKey,
+                ukycCapabilityToken,
+            });
+            // A user who already finished the journey can return to a session the
+            // relay has already approved (`kycStatus`) while the vendor is still
+            // finalizing its own decision (`finalStatus`). There is nothing left to
+            // verify, so stop here and surface a message rather than launching the
+            // SDK again.
+            if (kycStatus === KYC_STATUSES.approved &&
+                finalStatus === KYC_STATUSES.pending) {
+                const stillCurrent = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
+                    state.sumsub.status = 'vendorProcessing';
+                    state.sumsub.sessionId = sessionId;
+                    state.statusMessage = VENDOR_PROCESSING_MESSAGE;
                 });
-                const created = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createUkycSession).call(this, generation);
-                if (!created) {
-                    return {};
-                }
-                // A user who already finished the journey can return to a session the
-                // relay has already approved (`kycStatus`) while the vendor is still
-                // finalizing its own decision (`finalStatus`). There is nothing left to
-                // verify, so stop here and surface a message rather than launching the
-                // SDK again.
-                if (created.vendorProcessing) {
-                    return {
-                        kycStatus: created.kycStatus,
-                        finalStatus: created.finalStatus,
-                    };
-                }
+                return stillCurrent ? { kycStatus, finalStatus } : {};
             }
-            // Empty string is a valid "no id to poll" session id used by tests and
-            // must not be coalesced away as missing.
-            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
-            const sessionId = this.state.sumsub.sessionId || '';
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
                 state.sumsub.status = 'fetchingToken';
                 state.sumsub.sessionId = sessionId;
@@ -1145,8 +1096,6 @@ class KycController extends base_controller_1.BaseController {
             state.error = null;
             state.disclaimers = [];
             state.disclaimersError = null;
-            state.sessionDisclaimers = null;
-            state.credentialReusabilityConsentGiven = null;
             state.sessionToken = null;
             state.accessToken = null;
             state.moonpayCustomerId = null;
@@ -1184,15 +1133,12 @@ _KycController_sumsubLauncher = new WeakMap(), _KycController_keypair = new Weak
     };
 }, _KycController_startConsentsSession = 
 /**
- * Consents-path vendors: record vendor T&Cs, create a UKYC session,
- * record session-scoped idOS / KYC-provider disclaimers, then launch
- * SumSub — skipping MoonPay Check/Auth frames.
+ * Consents-path vendors: post vendor signings + Sumsub/idOS ack, then
+ * launch SumSub — skipping MoonPay Check/Auth frames.
  *
- * @param consents - T&C2 flags mapped onto the session disclaimer catalog.
+ * @param consents - T&C2 boolean flags.
  * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
  * @param consents.idosTncSigned - Whether idOS T&C were accepted.
- * @param consents.credentialReusabilityConsentGiven - Whether credential
- * reuse was accepted.
  */
 async function _KycController_startConsentsSession(consents) {
     const { email, acceptedDisclaimerIds } = this.state;
@@ -1209,44 +1155,18 @@ async function _KycController_startConsentsSession(consents) {
         state.error = null;
         state.phase = 'session';
         state.statusMessage = 'Submitting consents...';
-        state.sumsub.status = 'creatingSession';
-        state.sumsub.result = null;
-        state.sumsub.sessionStatus = null;
         // Consents-path vendors have no MoonPay session/access tokens.
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearMoonPaySession).call(this, state);
     });
     try {
-        await this.messenger.call('KycService:submitVendorDisclaimers', {
-            vendor: this.state.activeVendor,
+        await this.messenger.call('KycService:submitConsents', {
             disclaimerIds: acceptedDisclaimerIds,
+            sumsubTncSigned: consents.sumsubTncSigned,
+            idosTncSigned: consents.idosTncSigned,
         });
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
         }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.statusMessage = 'Creating session...';
-        });
-        const created = await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_createUkycSession).call(this, generation);
-        if (!created || __classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        await __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_recordSessionDisclaimers).call(this, created.sessionId, consents, generation);
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        if (created.vendorProcessing) {
-            try {
-                await this.refreshKycStatus();
-            }
-            catch (statusError) {
-                console.error('KYC status refresh failed:', statusError);
-            }
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.phase = 'done';
-                state.statusMessage = VENDOR_PROCESSING_MESSAGE;
-            });
-            return;
-        }
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
             state.phase = 'submit';
             state.statusMessage = 'Starting document verification...';
@@ -1285,24 +1205,6 @@ async function _KycController_startConsentsSession(consents) {
         });
     }
     catch (error) {
-        if (isSessionAlreadyCompletedError(error)) {
-            if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-                return;
-            }
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUserStatus).call(this, {
-                status: 'completed',
-                sumsubSessionId: null,
-                errorCode: null,
-            });
-            __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-                state.sumsub.status = 'complete';
-                state.sumsub.result = { alreadyCompleted: true };
-                state.statusMessage = 'KYC already completed.';
-                state.phase = 'done';
-                state.error = null;
-            });
-            return;
-        }
         console.error('Consents session failed:', error);
         if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
             return;
@@ -1310,10 +1212,6 @@ async function _KycController_startConsentsSession(consents) {
         __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
             __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_clearAcceptedTerms).call(this, state);
             state.activeProduct = null;
-            state.sessionDisclaimers = null;
-            // Session create ran before recording disclaimers. Drop the leftover
-            // UKYC session so a later `startSumSub` cannot skip consent recording.
-            state.sumsub = { ...getDefaultKycControllerState().sumsub };
             state.error = `Consents session failed: ${String(error)}`;
             state.statusMessage =
                 'Consent / verification failed — accept the terms to try again.';
@@ -1321,74 +1219,6 @@ async function _KycController_startConsentsSession(consents) {
         });
         await this.loadDisclaimers();
     }
-}, _KycController_recordSessionDisclaimers = 
-/**
- * Fetches the session-scoped disclaimer catalog and records consents
- * derived from the T&C2 flags. Already-consented catalog rows are omitted
- * from the POST. A 409 is re-checked with a GET: continue only when every
- * accepted document is now consented, otherwise fail closed.
- *
- * @param sessionId - The UKYC session id.
- * @param consents - T&C2 flags mapped onto catalog documents.
- * @param consents.sumsubTncSigned - Whether Sumsub T&C were accepted.
- * @param consents.idosTncSigned - Whether idOS T&C were accepted.
- * @param consents.credentialReusabilityConsentGiven - Whether credential
- * reuse was accepted.
- * @param generation - Flow generation captured by the caller.
- */
-async function _KycController_recordSessionDisclaimers(sessionId, consents, generation) {
-    const catalog = await this.messenger.call('KycService:fetchSessionDisclaimers', { sessionId });
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return;
-    }
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-        state.sessionDisclaimers = catalog;
-        state.statusMessage = 'Submitting consents...';
-    });
-    if (isAcceptedCategoryEmpty(catalog.idOS, consents.idosTncSigned) ||
-        isAcceptedCategoryEmpty(catalog.kycProvider, consents.sumsubTncSigned)) {
-        throw new Error('Session disclaimer catalog is missing documents for an accepted category.');
-    }
-    const idOS = consentRecordsFromCatalog(catalog.idOS, consents.idosTncSigned);
-    const kycProvider = consentRecordsFromCatalog(catalog.kycProvider, consents.sumsubTncSigned);
-    const reuseUnchanged = catalog.credentialReusabilityConsentGiven ===
-        consents.credentialReusabilityConsentGiven;
-    if (idOS.length === 0 && kycProvider.length === 0 && reuseUnchanged) {
-        return;
-    }
-    try {
-        const recorded = await this.messenger.call('KycService:submitSessionDisclaimers', {
-            sessionId,
-            idOS,
-            kycProvider,
-            credentialReusabilityConsentGiven: consents.credentialReusabilityConsentGiven,
-        });
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-            state.sessionDisclaimers = recorded;
-        });
-    }
-    catch (error) {
-        if (!isConsentConflictError(error)) {
-            throw error;
-        }
-        // 409 means some document version was already recorded. Re-fetch and
-        // continue only when every document the user accepted is now consented;
-        // otherwise fail closed so a version bump cannot skip new docs.
-        const latest = await this.messenger.call('KycService:fetchSessionDisclaimers', { sessionId });
-        if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-            return;
-        }
-        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
-            state.sessionDisclaimers = latest;
-        });
-        const stillMissingIdos = acceptedCategoryStillMissing(latest.idOS, consents.idosTncSigned);
-        const stillMissingProvider = acceptedCategoryStillMissing(latest.kycProvider, consents.sumsubTncSigned);
-        const stillMissingReuse = consents.credentialReusabilityConsentGiven &&
-            !latest.credentialReusabilityConsentGiven;
-        if (stillMissingIdos || stillMissingProvider || stillMissingReuse) {
-            throw error;
-        }
-    }
 }, _KycController_createSession = 
 /**
  * Creates a vendor session from the currently stored terms + email.
@@ -1460,7 +1290,6 @@ async function _KycController_createSession() {
     state.termsAcceptedVendor = null;
     state.sumsubTncAccepted = null;
     state.idosTncAccepted = null;
-    state.credentialReusabilityConsentGiven = null;
 }, _KycController_clearMoonPaySession = function _KycController_clearMoonPaySession(state) {
     state.moonpayCustomerId = null;
     state.sessionToken = null;
@@ -1587,71 +1416,6 @@ async function _KycController_continueAfterAuthentication() {
         };
     }
     return { vendor: this.state.activeVendor };
-}, _KycController_createUkycSession = 
-/**
- * Creates a UKYC session, wraps the `data_encryption_key` and
- * `ukyc_capability_token` against the returned encryption schemas, and
- * submits both via authorizations. Stores `sumsub.sessionId`. Returns `null`
- * when a `reset()` superseded the flow.
- *
- * @param generation - Flow generation captured by the caller.
- * @returns The created session, or `null` if superseded.
- */
-async function _KycController_createUkycSession(generation) {
-    const jwtToken = MOCK_JWT_TOKEN;
-    // Establish a per-session X25519 keypair used to seal both secrets. The
-    // private half stays on the device; each encryption schema from session
-    // creation supplies the matching server public key.
-    const sessionClientPrivateKey = ed25519_1.x25519.utils.randomSecretKey();
-    const { sessionId, encryptionDataKey, ukycCapabilityToken: capabilityTokenSchema, } = await this.messenger.call('KycService:createUkycSession', {
-        jwtToken,
-        ...__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_buildUkycSessionVendorFields).call(this),
-    });
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return null;
-    }
-    // Verify each jwtChain against Fractal's JWKS, then confirm the returned
-    // server public key matches the value attested inside the verified JWT
-    // payload before trusting it for wrapping.
-    const { keys } = await this.messenger.call('KycService:fetchJwks');
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, keys, encryptionDataKey);
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, keys, capabilityTokenSchema);
-    // Derive the data_encryption_key from the local_user_secret, mint a
-    // read-only capability token, and wrap both for the session server. Only
-    // the wrapped (encrypted) material ever leaves the device.
-    const localUserSecret = await (0, localUserSecret_js_1.getOrCreateLocalUserSecret)(__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_localUserSecretStore).call(this));
-    const clientMaterial = (0, deriveClientMaterial_js_1.deriveClientMaterial)(localUserSecret);
-    const wrappedEncryptionDataKey = (0, wrapEncryptionKey_js_1.wrapEncryptionKey)(sessionClientPrivateKey, encryptionDataKey.serverPublicKey.x, clientMaterial.dataEncryptionKey);
-    // Only the client holds the signing key derived from `local_user_secret`,
-    // so only the client can mint the token; scoping it to `read` means it
-    // authorizes later storage reads without granting write or delete access.
-    const ukycCapabilityToken = (0, storageAccessToken_js_1.signStorageAccessToken)({
-        material: clientMaterial,
-        operations: ['read'],
-        expiresAt: new Date(Date.now() + UKYC_CAPABILITY_TOKEN_TTL_MS),
-    });
-    const wrappedUkycCapabilityToken = (0, wrapEncryptionKey_js_1.wrapEncryptionKey)(sessionClientPrivateKey, capabilityTokenSchema.serverPublicKey.x, (0, utils_1.stringToBytes)((0, storageAccessToken_js_1.encodeStorageAccessTokenForHeader)(ukycCapabilityToken)));
-    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
-        return null;
-    }
-    const { kycStatus, finalStatus } = await this.messenger.call('KycService:setAuthorizations', {
-        sessionId,
-        wrappedEncryptionDataKey,
-        wrappedUkycCapabilityToken,
-    });
-    const vendorProcessing = kycStatus === KYC_STATUSES.approved &&
-        finalStatus === KYC_STATUSES.pending;
-    const stillCurrent = __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
-        state.sumsub.sessionId = sessionId;
-        if (vendorProcessing) {
-            state.sumsub.status = 'vendorProcessing';
-            state.statusMessage = VENDOR_PROCESSING_MESSAGE;
-        }
-    });
-    if (!stillCurrent) {
-        return null;
-    }
-    return { sessionId, kycStatus, finalStatus, vendorProcessing };
 }, _KycController_fetchAndApplyUserStatus = 
 /**
  * Fetches `GET /kyc/status` and applies it to state without managing the
@@ -1829,11 +1593,6 @@ async function _KycController_pollSessionStatusOnce(sessionId, token) {
         // @ts-expect-error Avoid "type instantiation is excessively deep".
         updater(state);
     });
-}, _KycController_assertAttestedServerPublicKey = function _KycController_assertAttestedServerPublicKey(keys, schema) {
-    const jwtChainPayload = (0, jwtChain_js_1.verifyJwtChain)(keys, schema.jwtChain);
-    if (jwtChainPayload.sessionServerPublicKeyX !== schema.serverPublicKey.x) {
-        throw new Error('sessionServerPublicKey does not match the verified jwtChain payload (sessionServerPublicKeyX).');
-    }
 }, _KycController_fail = function _KycController_fail(message) {
     __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_applyUpdate).call(this, (state) => {
         state.error = message;