@metamask-previews/kyc-controller 0.0.0-preview-eb263b0ee → 0.0.0-preview-c61613ed2

package/CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Add `idosRelayBaseUrl` on `KycService` and `KycService.fetchIdosRelayJwks()` to fetch the idOS relay well-known JWKS used to verify the `ukycCapabilityToken` encryption schema. `encryptionDataKey` continues to verify against idOS enclave JWKS via `fetchIdosEnclaveJwks` / `idosEnclaveBaseUrl`. ([#10008](https://github.com/MetaMask/core/pull/10008))
 - Add session-scoped disclaimer APIs on `KycService` for the idOS / KYC-provider catalog ([#9979](https://github.com/MetaMask/core/pull/9979)):
   - `fetchSessionDisclaimers({ sessionId })` calls `GET /sessions/{sessionId}/disclaimers`
   - `submitSessionDisclaimers({ sessionId, idOS, kycProvider, credentialReusabilityConsentGiven })` calls `POST /sessions/{sessionId}/disclaimers`
@@ -29,6 +30,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **BREAKING:** Rename `fractalEncryptionBaseUrl` to `idosEnclaveBaseUrl`, `KycService.fetchJwks` / `KycService:fetchJwks` / `KycServiceFetchJwksAction` to `fetchIdosEnclaveJwks` / `KycService:fetchIdosEnclaveJwks` / `KycServiceFetchIdosEnclaveJwksAction`, and related Fractal encryption naming to idOS enclave. ([#10008](https://github.com/MetaMask/core/pull/10008))
+- **BREAKING:** Verify `encryptionDataKey` against idOS enclave JWKS (`KycService:fetchIdosEnclaveJwks` / `idosEnclaveBaseUrl`) and `ukycCapabilityToken` against idOS relay JWKS (`KycService:fetchIdosRelayJwks` / `idosRelayBaseUrl`) when wrapping UKYC authorizations, instead of validating both schemas against Fractal. Hosts must supply `idosRelayBaseUrl` on `KycService` construction (same class of requirement as `idosEnclaveBaseUrl`). ([#10008](https://github.com/MetaMask/core/pull/10008))
+- **BREAKING:** Require `sessionClientPublicKey` (unpadded base64url X25519 public key) and `residenceCountry` (ISO 3166-1 alpha-3) on `KycService.createUkycSession` (`POST /sessions`). The controller generates the per-session keypair before creating the session and uses the private half to wrap authorizations; residence country is taken from the resolved geo country. ([#9993](https://github.com/MetaMask/core/pull/9993))
 - **BREAKING:** Replace wrapping-key exchange (`KycService.getWrappingKey`) and sending wrapped keys at session creation with encryption schemas from `createUkycSession` plus `setAuthorizations` (`POST /sessions/{id}/authorizations`). `createUkycSession` no longer accepts `wrappedEncryptionKey` or `ukycCapabilityToken`; both secrets are wrapped on the client against per-secret schemas and posted separately. ([#9944](https://github.com/MetaMask/core/pull/9944))
 - **BREAKING:** Replace `KycService.submitConsents` (`POST /consents`) with session-scoped `fetchSessionDisclaimers` / `submitSessionDisclaimers` plus vendor T&C recording via `submitVendorDisclaimers`. Consents now use `{ key, version }` document records plus `credentialReusabilityConsentGiven` instead of Iron disclaimer ids and boolean T&C flags, and they require a UKYC session id. Iron content ids are posted separately to `POST /vendors/{vendor}/disclaimers`. The consents path records vendor T&Cs, then creates the UKYC session, then records session disclaimers. A 409 conflict is re-checked with a GET and only treated as success when every accepted document is consented. ([#9979](https://github.com/MetaMask/core/pull/9979))
 - Make the `fetch` option on the `KycService` constructor optional; it now defaults to the runtime's native `fetch` (browser, React Native, Node 18+), so consumers no longer need to inject one. ([#9908](https://github.com/MetaMask/core/pull/9908))

package/dist/KycController-method-action-types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"KycController-method-action-types.cjs","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycController } from './KycController.js';\n\n/**\n * Resolves persisted terms + geolocation, and auto-creates a session when\n * terms are already accepted and an email is available.\n *\n * @param params - Optional parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. When\n * provided, the controller automatically runs the KYC-required check once\n * authentication completes (and chains into document verification when KYC\n * is required). When omitted, the flow stops at `form` and the consumer must\n * call `checkKycRequired` manually.\n * @param params.vendor - Identity vendor for this flow. Non-MoonPay vendors\n * skip Check/Auth frames and use the consents path. Defaults to `moonpay`.\n */\nexport type KycControllerInitializeAction = {\n  type: `KycController:initialize`;\n  handler: KycController['initialize'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the given identity\n * vendor. Exposed so a consumer can ensure the customer exists before\n * showing T&C screens independently of {@link initialize}.\n *\n * A call while a session flow is already in progress is a no-op — matching\n * {@link initialize} — so a vendor switch cannot leave Check/Auth frames\n * attached to the wrong vendor. Call {@link reset} first to start over.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor for the customer.\n * @param params.email - Email for the vendor customer.\n */\nexport type KycControllerCreateVendorCustomerAction = {\n  type: `KycController:createVendorCustomer`;\n  handler: KycController['createVendorCustomer'];\n};\n\n/**\n * Loads the disclaimers for the resolved (or provided) country.\n *\n * @param params - Optional parameters.\n * @param params.country - ISO 3166-1 alpha-3 country code override.\n */\nexport type KycControllerLoadDisclaimersAction = {\n  type: `KycController:loadDisclaimers`;\n  handler: KycController['loadDisclaimers'];\n};\n\n/**\n * Captures terms acceptance for the currently loaded disclaimers and creates\n * a session.\n *\n * @param params - The parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. See\n * {@link initialize} for how the product drives the automatic post\n * authentication continuation.\n * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).\n * Required for every vendor so callers explicitly declare acceptance.\n * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).\n * Required for every vendor so callers explicitly declare acceptance.\n * @param params.credentialReusabilityConsentGiven - Whether the customer\n * consented to reuse existing idOS credentials. Used when recording\n * session-scoped disclaimers on the consents path. Defaults to `false`.\n */\nexport type KycControllerAcceptTermsAndStartSessionAction = {\n  type: `KycController:acceptTermsAndStartSession`;\n  handler: KycController['acceptTermsAndStartSession'];\n};\n\n/**\n * Clears the persisted terms acceptance.\n */\nexport type KycControllerClearSavedTermsAction = {\n  type: `KycController:clearSavedTerms`;\n  handler: KycController['clearSavedTerms'];\n};\n\n/**\n * Handles a message posted by a Check/Auth frame and advances the flow.\n *\n * The transport-agnostic caller (WebView on mobile, iframe on web) forwards\n * the raw message and injects the returned `reply` back into the frame.\n *\n * @param params - The parameters.\n * @param params.message - The raw message posted by the frame.\n * @returns An object whose optional `reply` should be posted back.\n */\nexport type KycControllerHandleFrameMessageAction = {\n  type: `KycController:handleFrameMessage`;\n  handler: KycController['handleFrameMessage'];\n};\n\n/**\n * Builds the Check-frame URL, or `null` when no session exists yet.\n *\n * @returns The Check-frame URL or `null`.\n */\nexport type KycControllerBuildCheckFrameUrlAction = {\n  type: `KycController:buildCheckFrameUrl`;\n  handler: KycController['buildCheckFrameUrl'];\n};\n\n/**\n * Builds the Auth-frame URL, or `null` when no client token is available.\n *\n * @returns The Auth-frame URL or `null`.\n */\nexport type KycControllerBuildAuthFrameUrlAction = {\n  type: `KycController:buildAuthFrameUrl`;\n  handler: KycController['buildAuthFrameUrl'];\n};\n\n/**\n * Builds the Reset-frame URL.\n *\n * @returns The Reset-frame URL.\n */\nexport type KycControllerBuildResetFrameUrlAction = {\n  type: `KycController:buildResetFrameUrl`;\n  handler: KycController['buildResetFrameUrl'];\n};\n\n/**\n * Checks whether KYC is required for a product and caches the result.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @param params.country - Optional alpha-3 country override.\n * @returns Whether KYC is required.\n */\nexport type KycControllerCheckKycRequiredAction = {\n  type: `KycController:checkKycRequired`;\n  handler: KycController['checkKycRequired'];\n};\n\n/**\n * Reads the cached \"is KYC required\" result for a product.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @returns The cached value, or `undefined` if not yet checked.\n */\nexport type KycControllerGetKycStatusAction = {\n  type: `KycController:getKycStatus`;\n  handler: KycController['getKycStatus'];\n};\n\n/**\n * Returns the vendor-scoped identity for the currently authenticated\n * customer, or `null` when the flow has not yet captured a vendor customer\n * id (before authentication or after {@link reset}), or when a MoonPay id\n * is present under a different `activeVendor`.\n *\n * Exposed so consumers (e.g. ramps autoramp creation) can attach the vendor\n * customer id to downstream calls without reading the full KYC state, which\n * also holds session/access tokens. The id is session-scoped and never\n * persisted.\n *\n * @returns The current {@link KycCustomerIdentity}, or `null`.\n */\nexport type KycControllerGetCustomerIdentityAction = {\n  type: `KycController:getCustomerIdentity`;\n  handler: KycController['getCustomerIdentity'];\n};\n\n/**\n * Runs the SumSub document-verification sub-flow end to end:\n *\n * 1. creates a UKYC session, receiving per-secret encryption schemas;\n * 2. verifies each schema's `jwtChain` against the Fractal JWKS and confirms\n * the attested session server public key;\n * 3. derives the `data_encryption_key` from the wallet's UKYC\n * `local_user_secret` and wraps it for the session server;\n * 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the\n * same way as the encryption key, and submits both via authorizations;\n * 5. fetches the SumSub applicant access token; and\n * 6. presents the SDK via the injected launcher.\n *\n * If a UKYC session already exists (the consents path creates it before\n * recording session disclaimers), steps 1–4 are skipped.\n *\n * If authorizations report the applicant is already approved on the relay\n * while the vendor is still finalizing (`kycStatus: approved`,\n * `finalStatus: pending`), the sub-flow stops at step 4 with a\n * `vendorProcessing` status and a message rather than launching the SDK.\n *\n * @param params - Optional parameters.\n * @param params.locale - BCP-47 locale for the SDK UI.\n * @param params.debug - Enables SDK debug logging.\n * @returns The SDK result.\n */\nexport type KycControllerStartSumSubAction = {\n  type: `KycController:startSumSub`;\n  handler: KycController['startSumSub'];\n};\n\n/**\n * Refreshes the user-keyed simplified KYC status from `GET /kyc/status`,\n * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and\n * schedules short-interval polling while the status is `pending`.\n *\n * @returns The latest status payload.\n */\nexport type KycControllerRefreshKycStatusAction = {\n  type: `KycController:refreshKycStatus`;\n  handler: KycController['refreshKycStatus'];\n};\n\n/**\n * Fetches the current UKYC session status for the active sub-flow and records\n * it on state. Useful for a one-off refresh outside the automatic polling\n * loop that {@link startSumSub} runs.\n *\n * @returns The fetched session status.\n * @throws If there is no active SumSub session to query.\n */\nexport type KycControllerGetSessionStatusAction = {\n  type: `KycController:getSessionStatus`;\n  handler: KycController['getSessionStatus'];\n};\n\n/**\n * Resets the flow to idle, clearing session tokens and sub-flow state while\n * preserving persisted terms acceptance and the per-product cache.\n */\nexport type KycControllerResetAction = {\n  type: `KycController:reset`;\n  handler: KycController['reset'];\n};\n\n/**\n * Restores the controller to its default state, discarding everything\n * {@link reset} deliberately keeps: the session email, the persisted terms\n * acceptance, the per-product KYC-required cache and the user-keyed status.\n *\n * Intended for a full wallet reset, where no trace of the previous\n * customer may survive into the next wallet.\n */\nexport type KycControllerClearStateAction = {\n  type: `KycController:clearState`;\n  handler: KycController['clearState'];\n};\n\n/**\n * Union of all KycController action types.\n */\nexport type KycControllerMethodActions =\n  | KycControllerInitializeAction\n  | KycControllerCreateVendorCustomerAction\n  | KycControllerLoadDisclaimersAction\n  | KycControllerAcceptTermsAndStartSessionAction\n  | KycControllerClearSavedTermsAction\n  | KycControllerHandleFrameMessageAction\n  | KycControllerBuildCheckFrameUrlAction\n  | KycControllerBuildAuthFrameUrlAction\n  | KycControllerBuildResetFrameUrlAction\n  | KycControllerCheckKycRequiredAction\n  | KycControllerGetKycStatusAction\n  | KycControllerGetCustomerIdentityAction\n  | KycControllerStartSumSubAction\n  | KycControllerRefreshKycStatusAction\n  | KycControllerGetSessionStatusAction\n  | KycControllerResetAction\n  | KycControllerClearStateAction;\n"]}
+{"version":3,"file":"KycController-method-action-types.cjs","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycController } from './KycController.js';\n\n/**\n * Resolves persisted terms + geolocation, and auto-creates a session when\n * terms are already accepted and an email is available.\n *\n * @param params - Optional parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. When\n * provided, the controller automatically runs the KYC-required check once\n * authentication completes (and chains into document verification when KYC\n * is required). When omitted, the flow stops at `form` and the consumer must\n * call `checkKycRequired` manually.\n * @param params.vendor - Identity vendor for this flow. Non-MoonPay vendors\n * skip Check/Auth frames and use the consents path. Defaults to `moonpay`.\n */\nexport type KycControllerInitializeAction = {\n  type: `KycController:initialize`;\n  handler: KycController['initialize'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the given identity\n * vendor. Exposed so a consumer can ensure the customer exists before\n * showing T&C screens independently of {@link initialize}.\n *\n * A call while a session flow is already in progress is a no-op — matching\n * {@link initialize} — so a vendor switch cannot leave Check/Auth frames\n * attached to the wrong vendor. Call {@link reset} first to start over.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor for the customer.\n * @param params.email - Email for the vendor customer.\n */\nexport type KycControllerCreateVendorCustomerAction = {\n  type: `KycController:createVendorCustomer`;\n  handler: KycController['createVendorCustomer'];\n};\n\n/**\n * Loads the disclaimers for the resolved (or provided) country.\n *\n * @param params - Optional parameters.\n * @param params.country - ISO 3166-1 alpha-3 country code override.\n */\nexport type KycControllerLoadDisclaimersAction = {\n  type: `KycController:loadDisclaimers`;\n  handler: KycController['loadDisclaimers'];\n};\n\n/**\n * Captures terms acceptance for the currently loaded disclaimers and creates\n * a session.\n *\n * @param params - The parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. See\n * {@link initialize} for how the product drives the automatic post\n * authentication continuation.\n * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).\n * Required for every vendor so callers explicitly declare acceptance.\n * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).\n * Required for every vendor so callers explicitly declare acceptance.\n * @param params.credentialReusabilityConsentGiven - Whether the customer\n * consented to reuse existing idOS credentials. Used when recording\n * session-scoped disclaimers on the consents path. Defaults to `false`.\n */\nexport type KycControllerAcceptTermsAndStartSessionAction = {\n  type: `KycController:acceptTermsAndStartSession`;\n  handler: KycController['acceptTermsAndStartSession'];\n};\n\n/**\n * Clears the persisted terms acceptance.\n */\nexport type KycControllerClearSavedTermsAction = {\n  type: `KycController:clearSavedTerms`;\n  handler: KycController['clearSavedTerms'];\n};\n\n/**\n * Handles a message posted by a Check/Auth frame and advances the flow.\n *\n * The transport-agnostic caller (WebView on mobile, iframe on web) forwards\n * the raw message and injects the returned `reply` back into the frame.\n *\n * @param params - The parameters.\n * @param params.message - The raw message posted by the frame.\n * @returns An object whose optional `reply` should be posted back.\n */\nexport type KycControllerHandleFrameMessageAction = {\n  type: `KycController:handleFrameMessage`;\n  handler: KycController['handleFrameMessage'];\n};\n\n/**\n * Builds the Check-frame URL, or `null` when no session exists yet.\n *\n * @returns The Check-frame URL or `null`.\n */\nexport type KycControllerBuildCheckFrameUrlAction = {\n  type: `KycController:buildCheckFrameUrl`;\n  handler: KycController['buildCheckFrameUrl'];\n};\n\n/**\n * Builds the Auth-frame URL, or `null` when no client token is available.\n *\n * @returns The Auth-frame URL or `null`.\n */\nexport type KycControllerBuildAuthFrameUrlAction = {\n  type: `KycController:buildAuthFrameUrl`;\n  handler: KycController['buildAuthFrameUrl'];\n};\n\n/**\n * Builds the Reset-frame URL.\n *\n * @returns The Reset-frame URL.\n */\nexport type KycControllerBuildResetFrameUrlAction = {\n  type: `KycController:buildResetFrameUrl`;\n  handler: KycController['buildResetFrameUrl'];\n};\n\n/**\n * Checks whether KYC is required for a product and caches the result.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @param params.country - Optional alpha-3 country override.\n * @returns Whether KYC is required.\n */\nexport type KycControllerCheckKycRequiredAction = {\n  type: `KycController:checkKycRequired`;\n  handler: KycController['checkKycRequired'];\n};\n\n/**\n * Reads the cached \"is KYC required\" result for a product.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @returns The cached value, or `undefined` if not yet checked.\n */\nexport type KycControllerGetKycStatusAction = {\n  type: `KycController:getKycStatus`;\n  handler: KycController['getKycStatus'];\n};\n\n/**\n * Returns the vendor-scoped identity for the currently authenticated\n * customer, or `null` when the flow has not yet captured a vendor customer\n * id (before authentication or after {@link reset}), or when a MoonPay id\n * is present under a different `activeVendor`.\n *\n * Exposed so consumers (e.g. ramps autoramp creation) can attach the vendor\n * customer id to downstream calls without reading the full KYC state, which\n * also holds session/access tokens. The id is session-scoped and never\n * persisted.\n *\n * @returns The current {@link KycCustomerIdentity}, or `null`.\n */\nexport type KycControllerGetCustomerIdentityAction = {\n  type: `KycController:getCustomerIdentity`;\n  handler: KycController['getCustomerIdentity'];\n};\n\n/**\n * Runs the SumSub document-verification sub-flow end to end:\n *\n * 1. creates a UKYC session, receiving per-secret encryption schemas;\n * 2. verifies the `encryptionDataKey` schema's `jwtChain` against the\n * idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against\n * the idOS relay JWKS, then confirms each attested session server public\n * key;\n * 3. derives the `data_encryption_key` from the wallet's UKYC\n * `local_user_secret` and wraps it for the session server;\n * 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the\n * same way as the encryption key, and submits both via authorizations;\n * 5. fetches the SumSub applicant access token; and\n * 6. presents the SDK via the injected launcher.\n *\n * If a UKYC session already exists (the consents path creates it before\n * recording session disclaimers), steps 1–4 are skipped.\n *\n * If authorizations report the applicant is already approved on the relay\n * while the vendor is still finalizing (`kycStatus: approved`,\n * `finalStatus: pending`), the sub-flow stops at step 4 with a\n * `vendorProcessing` status and a message rather than launching the SDK.\n *\n * @param params - Optional parameters.\n * @param params.locale - BCP-47 locale for the SDK UI.\n * @param params.debug - Enables SDK debug logging.\n * @returns The SDK result.\n */\nexport type KycControllerStartSumSubAction = {\n  type: `KycController:startSumSub`;\n  handler: KycController['startSumSub'];\n};\n\n/**\n * Refreshes the user-keyed simplified KYC status from `GET /kyc/status`,\n * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and\n * schedules short-interval polling while the status is `pending`.\n *\n * @returns The latest status payload.\n */\nexport type KycControllerRefreshKycStatusAction = {\n  type: `KycController:refreshKycStatus`;\n  handler: KycController['refreshKycStatus'];\n};\n\n/**\n * Fetches the current UKYC session status for the active sub-flow and records\n * it on state. Useful for a one-off refresh outside the automatic polling\n * loop that {@link startSumSub} runs.\n *\n * @returns The fetched session status.\n * @throws If there is no active SumSub session to query.\n */\nexport type KycControllerGetSessionStatusAction = {\n  type: `KycController:getSessionStatus`;\n  handler: KycController['getSessionStatus'];\n};\n\n/**\n * Resets the flow to idle, clearing session tokens and sub-flow state while\n * preserving persisted terms acceptance and the per-product cache.\n */\nexport type KycControllerResetAction = {\n  type: `KycController:reset`;\n  handler: KycController['reset'];\n};\n\n/**\n * Restores the controller to its default state, discarding everything\n * {@link reset} deliberately keeps: the session email, the persisted terms\n * acceptance, the per-product KYC-required cache and the user-keyed status.\n *\n * Intended for a full wallet reset, where no trace of the previous\n * customer may survive into the next wallet.\n */\nexport type KycControllerClearStateAction = {\n  type: `KycController:clearState`;\n  handler: KycController['clearState'];\n};\n\n/**\n * Union of all KycController action types.\n */\nexport type KycControllerMethodActions =\n  | KycControllerInitializeAction\n  | KycControllerCreateVendorCustomerAction\n  | KycControllerLoadDisclaimersAction\n  | KycControllerAcceptTermsAndStartSessionAction\n  | KycControllerClearSavedTermsAction\n  | KycControllerHandleFrameMessageAction\n  | KycControllerBuildCheckFrameUrlAction\n  | KycControllerBuildAuthFrameUrlAction\n  | KycControllerBuildResetFrameUrlAction\n  | KycControllerCheckKycRequiredAction\n  | KycControllerGetKycStatusAction\n  | KycControllerGetCustomerIdentityAction\n  | KycControllerStartSumSubAction\n  | KycControllerRefreshKycStatusAction\n  | KycControllerGetSessionStatusAction\n  | KycControllerResetAction\n  | KycControllerClearStateAction;\n"]}

package/dist/KycController-method-action-types.d.cts

@@ -161,8 +161,10 @@ export type KycControllerGetCustomerIdentityAction = {
  * Runs the SumSub document-verification sub-flow end to end:
  *
  * 1. creates a UKYC session, receiving per-secret encryption schemas;
- * 2. verifies each schema's `jwtChain` against the Fractal JWKS and confirms
- * the attested session server public key;
+ * 2. verifies the `encryptionDataKey` schema's `jwtChain` against the
+ * idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against
+ * the idOS relay JWKS, then confirms each attested session server public
+ * key;
  * 3. derives the `data_encryption_key` from the wallet's UKYC
  * `local_user_secret` and wraps it for the session server;
  * 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the

package/dist/KycController-method-action-types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"KycController-method-action-types.d.cts","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,4BAA2B;AAExD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,6CAA6C,GAAG;IAC1D,IAAI,EAAE,0CAA0C,CAAC;IACjD,OAAO,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;CACtD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,4BAA4B,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,6BAA6B,GAC7B,uCAAuC,GACvC,kCAAkC,GAClC,6CAA6C,GAC7C,kCAAkC,GAClC,qCAAqC,GACrC,qCAAqC,GACrC,oCAAoC,GACpC,qCAAqC,GACrC,mCAAmC,GACnC,+BAA+B,GAC/B,sCAAsC,GACtC,8BAA8B,GAC9B,mCAAmC,GACnC,mCAAmC,GACnC,wBAAwB,GACxB,6BAA6B,CAAC"}
+{"version":3,"file":"KycController-method-action-types.d.cts","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,4BAA2B;AAExD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,6CAA6C,GAAG;IAC1D,IAAI,EAAE,0CAA0C,CAAC;IACjD,OAAO,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;CACtD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,4BAA4B,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,6BAA6B,GAC7B,uCAAuC,GACvC,kCAAkC,GAClC,6CAA6C,GAC7C,kCAAkC,GAClC,qCAAqC,GACrC,qCAAqC,GACrC,oCAAoC,GACpC,qCAAqC,GACrC,mCAAmC,GACnC,+BAA+B,GAC/B,sCAAsC,GACtC,8BAA8B,GAC9B,mCAAmC,GACnC,mCAAmC,GACnC,wBAAwB,GACxB,6BAA6B,CAAC"}

package/dist/KycController-method-action-types.d.mts

@@ -161,8 +161,10 @@ export type KycControllerGetCustomerIdentityAction = {
  * Runs the SumSub document-verification sub-flow end to end:
  *
  * 1. creates a UKYC session, receiving per-secret encryption schemas;
- * 2. verifies each schema's `jwtChain` against the Fractal JWKS and confirms
- * the attested session server public key;
+ * 2. verifies the `encryptionDataKey` schema's `jwtChain` against the
+ * idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against
+ * the idOS relay JWKS, then confirms each attested session server public
+ * key;
  * 3. derives the `data_encryption_key` from the wallet's UKYC
  * `local_user_secret` and wraps it for the session server;
  * 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the

package/dist/KycController-method-action-types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"KycController-method-action-types.d.mts","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,4BAA2B;AAExD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,6CAA6C,GAAG;IAC1D,IAAI,EAAE,0CAA0C,CAAC;IACjD,OAAO,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;CACtD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,4BAA4B,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,6BAA6B,GAC7B,uCAAuC,GACvC,kCAAkC,GAClC,6CAA6C,GAC7C,kCAAkC,GAClC,qCAAqC,GACrC,qCAAqC,GACrC,oCAAoC,GACpC,qCAAqC,GACrC,mCAAmC,GACnC,+BAA+B,GAC/B,sCAAsC,GACtC,8BAA8B,GAC9B,mCAAmC,GACnC,mCAAmC,GACnC,wBAAwB,GACxB,6BAA6B,CAAC"}
+{"version":3,"file":"KycController-method-action-types.d.mts","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,4BAA2B;AAExD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,6CAA6C,GAAG;IAC1D,IAAI,EAAE,0CAA0C,CAAC;IACjD,OAAO,EAAE,aAAa,CAAC,4BAA4B,CAAC,CAAC;CACtD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,4BAA4B,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,6BAA6B,GAC7B,uCAAuC,GACvC,kCAAkC,GAClC,6CAA6C,GAC7C,kCAAkC,GAClC,qCAAqC,GACrC,qCAAqC,GACrC,oCAAoC,GACpC,qCAAqC,GACrC,mCAAmC,GACnC,+BAA+B,GAC/B,sCAAsC,GACtC,8BAA8B,GAC9B,mCAAmC,GACnC,mCAAmC,GACnC,wBAAwB,GACxB,6BAA6B,CAAC"}

package/dist/KycController-method-action-types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"KycController-method-action-types.mjs","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycController } from './KycController.js';\n\n/**\n * Resolves persisted terms + geolocation, and auto-creates a session when\n * terms are already accepted and an email is available.\n *\n * @param params - Optional parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. When\n * provided, the controller automatically runs the KYC-required check once\n * authentication completes (and chains into document verification when KYC\n * is required). When omitted, the flow stops at `form` and the consumer must\n * call `checkKycRequired` manually.\n * @param params.vendor - Identity vendor for this flow. Non-MoonPay vendors\n * skip Check/Auth frames and use the consents path. Defaults to `moonpay`.\n */\nexport type KycControllerInitializeAction = {\n  type: `KycController:initialize`;\n  handler: KycController['initialize'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the given identity\n * vendor. Exposed so a consumer can ensure the customer exists before\n * showing T&C screens independently of {@link initialize}.\n *\n * A call while a session flow is already in progress is a no-op — matching\n * {@link initialize} — so a vendor switch cannot leave Check/Auth frames\n * attached to the wrong vendor. Call {@link reset} first to start over.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor for the customer.\n * @param params.email - Email for the vendor customer.\n */\nexport type KycControllerCreateVendorCustomerAction = {\n  type: `KycController:createVendorCustomer`;\n  handler: KycController['createVendorCustomer'];\n};\n\n/**\n * Loads the disclaimers for the resolved (or provided) country.\n *\n * @param params - Optional parameters.\n * @param params.country - ISO 3166-1 alpha-3 country code override.\n */\nexport type KycControllerLoadDisclaimersAction = {\n  type: `KycController:loadDisclaimers`;\n  handler: KycController['loadDisclaimers'];\n};\n\n/**\n * Captures terms acceptance for the currently loaded disclaimers and creates\n * a session.\n *\n * @param params - The parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. See\n * {@link initialize} for how the product drives the automatic post\n * authentication continuation.\n * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).\n * Required for every vendor so callers explicitly declare acceptance.\n * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).\n * Required for every vendor so callers explicitly declare acceptance.\n * @param params.credentialReusabilityConsentGiven - Whether the customer\n * consented to reuse existing idOS credentials. Used when recording\n * session-scoped disclaimers on the consents path. Defaults to `false`.\n */\nexport type KycControllerAcceptTermsAndStartSessionAction = {\n  type: `KycController:acceptTermsAndStartSession`;\n  handler: KycController['acceptTermsAndStartSession'];\n};\n\n/**\n * Clears the persisted terms acceptance.\n */\nexport type KycControllerClearSavedTermsAction = {\n  type: `KycController:clearSavedTerms`;\n  handler: KycController['clearSavedTerms'];\n};\n\n/**\n * Handles a message posted by a Check/Auth frame and advances the flow.\n *\n * The transport-agnostic caller (WebView on mobile, iframe on web) forwards\n * the raw message and injects the returned `reply` back into the frame.\n *\n * @param params - The parameters.\n * @param params.message - The raw message posted by the frame.\n * @returns An object whose optional `reply` should be posted back.\n */\nexport type KycControllerHandleFrameMessageAction = {\n  type: `KycController:handleFrameMessage`;\n  handler: KycController['handleFrameMessage'];\n};\n\n/**\n * Builds the Check-frame URL, or `null` when no session exists yet.\n *\n * @returns The Check-frame URL or `null`.\n */\nexport type KycControllerBuildCheckFrameUrlAction = {\n  type: `KycController:buildCheckFrameUrl`;\n  handler: KycController['buildCheckFrameUrl'];\n};\n\n/**\n * Builds the Auth-frame URL, or `null` when no client token is available.\n *\n * @returns The Auth-frame URL or `null`.\n */\nexport type KycControllerBuildAuthFrameUrlAction = {\n  type: `KycController:buildAuthFrameUrl`;\n  handler: KycController['buildAuthFrameUrl'];\n};\n\n/**\n * Builds the Reset-frame URL.\n *\n * @returns The Reset-frame URL.\n */\nexport type KycControllerBuildResetFrameUrlAction = {\n  type: `KycController:buildResetFrameUrl`;\n  handler: KycController['buildResetFrameUrl'];\n};\n\n/**\n * Checks whether KYC is required for a product and caches the result.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @param params.country - Optional alpha-3 country override.\n * @returns Whether KYC is required.\n */\nexport type KycControllerCheckKycRequiredAction = {\n  type: `KycController:checkKycRequired`;\n  handler: KycController['checkKycRequired'];\n};\n\n/**\n * Reads the cached \"is KYC required\" result for a product.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @returns The cached value, or `undefined` if not yet checked.\n */\nexport type KycControllerGetKycStatusAction = {\n  type: `KycController:getKycStatus`;\n  handler: KycController['getKycStatus'];\n};\n\n/**\n * Returns the vendor-scoped identity for the currently authenticated\n * customer, or `null` when the flow has not yet captured a vendor customer\n * id (before authentication or after {@link reset}), or when a MoonPay id\n * is present under a different `activeVendor`.\n *\n * Exposed so consumers (e.g. ramps autoramp creation) can attach the vendor\n * customer id to downstream calls without reading the full KYC state, which\n * also holds session/access tokens. The id is session-scoped and never\n * persisted.\n *\n * @returns The current {@link KycCustomerIdentity}, or `null`.\n */\nexport type KycControllerGetCustomerIdentityAction = {\n  type: `KycController:getCustomerIdentity`;\n  handler: KycController['getCustomerIdentity'];\n};\n\n/**\n * Runs the SumSub document-verification sub-flow end to end:\n *\n * 1. creates a UKYC session, receiving per-secret encryption schemas;\n * 2. verifies each schema's `jwtChain` against the Fractal JWKS and confirms\n * the attested session server public key;\n * 3. derives the `data_encryption_key` from the wallet's UKYC\n * `local_user_secret` and wraps it for the session server;\n * 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the\n * same way as the encryption key, and submits both via authorizations;\n * 5. fetches the SumSub applicant access token; and\n * 6. presents the SDK via the injected launcher.\n *\n * If a UKYC session already exists (the consents path creates it before\n * recording session disclaimers), steps 1–4 are skipped.\n *\n * If authorizations report the applicant is already approved on the relay\n * while the vendor is still finalizing (`kycStatus: approved`,\n * `finalStatus: pending`), the sub-flow stops at step 4 with a\n * `vendorProcessing` status and a message rather than launching the SDK.\n *\n * @param params - Optional parameters.\n * @param params.locale - BCP-47 locale for the SDK UI.\n * @param params.debug - Enables SDK debug logging.\n * @returns The SDK result.\n */\nexport type KycControllerStartSumSubAction = {\n  type: `KycController:startSumSub`;\n  handler: KycController['startSumSub'];\n};\n\n/**\n * Refreshes the user-keyed simplified KYC status from `GET /kyc/status`,\n * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and\n * schedules short-interval polling while the status is `pending`.\n *\n * @returns The latest status payload.\n */\nexport type KycControllerRefreshKycStatusAction = {\n  type: `KycController:refreshKycStatus`;\n  handler: KycController['refreshKycStatus'];\n};\n\n/**\n * Fetches the current UKYC session status for the active sub-flow and records\n * it on state. Useful for a one-off refresh outside the automatic polling\n * loop that {@link startSumSub} runs.\n *\n * @returns The fetched session status.\n * @throws If there is no active SumSub session to query.\n */\nexport type KycControllerGetSessionStatusAction = {\n  type: `KycController:getSessionStatus`;\n  handler: KycController['getSessionStatus'];\n};\n\n/**\n * Resets the flow to idle, clearing session tokens and sub-flow state while\n * preserving persisted terms acceptance and the per-product cache.\n */\nexport type KycControllerResetAction = {\n  type: `KycController:reset`;\n  handler: KycController['reset'];\n};\n\n/**\n * Restores the controller to its default state, discarding everything\n * {@link reset} deliberately keeps: the session email, the persisted terms\n * acceptance, the per-product KYC-required cache and the user-keyed status.\n *\n * Intended for a full wallet reset, where no trace of the previous\n * customer may survive into the next wallet.\n */\nexport type KycControllerClearStateAction = {\n  type: `KycController:clearState`;\n  handler: KycController['clearState'];\n};\n\n/**\n * Union of all KycController action types.\n */\nexport type KycControllerMethodActions =\n  | KycControllerInitializeAction\n  | KycControllerCreateVendorCustomerAction\n  | KycControllerLoadDisclaimersAction\n  | KycControllerAcceptTermsAndStartSessionAction\n  | KycControllerClearSavedTermsAction\n  | KycControllerHandleFrameMessageAction\n  | KycControllerBuildCheckFrameUrlAction\n  | KycControllerBuildAuthFrameUrlAction\n  | KycControllerBuildResetFrameUrlAction\n  | KycControllerCheckKycRequiredAction\n  | KycControllerGetKycStatusAction\n  | KycControllerGetCustomerIdentityAction\n  | KycControllerStartSumSubAction\n  | KycControllerRefreshKycStatusAction\n  | KycControllerGetSessionStatusAction\n  | KycControllerResetAction\n  | KycControllerClearStateAction;\n"]}
+{"version":3,"file":"KycController-method-action-types.mjs","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycController } from './KycController.js';\n\n/**\n * Resolves persisted terms + geolocation, and auto-creates a session when\n * terms are already accepted and an email is available.\n *\n * @param params - Optional parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. When\n * provided, the controller automatically runs the KYC-required check once\n * authentication completes (and chains into document verification when KYC\n * is required). When omitted, the flow stops at `form` and the consumer must\n * call `checkKycRequired` manually.\n * @param params.vendor - Identity vendor for this flow. Non-MoonPay vendors\n * skip Check/Auth frames and use the consents path. Defaults to `moonpay`.\n */\nexport type KycControllerInitializeAction = {\n  type: `KycController:initialize`;\n  handler: KycController['initialize'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the given identity\n * vendor. Exposed so a consumer can ensure the customer exists before\n * showing T&C screens independently of {@link initialize}.\n *\n * A call while a session flow is already in progress is a no-op — matching\n * {@link initialize} — so a vendor switch cannot leave Check/Auth frames\n * attached to the wrong vendor. Call {@link reset} first to start over.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor for the customer.\n * @param params.email - Email for the vendor customer.\n */\nexport type KycControllerCreateVendorCustomerAction = {\n  type: `KycController:createVendorCustomer`;\n  handler: KycController['createVendorCustomer'];\n};\n\n/**\n * Loads the disclaimers for the resolved (or provided) country.\n *\n * @param params - Optional parameters.\n * @param params.country - ISO 3166-1 alpha-3 country code override.\n */\nexport type KycControllerLoadDisclaimersAction = {\n  type: `KycController:loadDisclaimers`;\n  handler: KycController['loadDisclaimers'];\n};\n\n/**\n * Captures terms acceptance for the currently loaded disclaimers and creates\n * a session.\n *\n * @param params - The parameters.\n * @param params.email - The account email to associate with the session.\n * @param params.product - The consuming feature the flow runs for. See\n * {@link initialize} for how the product drives the automatic post\n * authentication continuation.\n * @param params.sumsubTncSigned - Whether Sumsub T&C were accepted (T&C2).\n * Required for every vendor so callers explicitly declare acceptance.\n * @param params.idosTncSigned - Whether idOS T&C were accepted (T&C2).\n * Required for every vendor so callers explicitly declare acceptance.\n * @param params.credentialReusabilityConsentGiven - Whether the customer\n * consented to reuse existing idOS credentials. Used when recording\n * session-scoped disclaimers on the consents path. Defaults to `false`.\n */\nexport type KycControllerAcceptTermsAndStartSessionAction = {\n  type: `KycController:acceptTermsAndStartSession`;\n  handler: KycController['acceptTermsAndStartSession'];\n};\n\n/**\n * Clears the persisted terms acceptance.\n */\nexport type KycControllerClearSavedTermsAction = {\n  type: `KycController:clearSavedTerms`;\n  handler: KycController['clearSavedTerms'];\n};\n\n/**\n * Handles a message posted by a Check/Auth frame and advances the flow.\n *\n * The transport-agnostic caller (WebView on mobile, iframe on web) forwards\n * the raw message and injects the returned `reply` back into the frame.\n *\n * @param params - The parameters.\n * @param params.message - The raw message posted by the frame.\n * @returns An object whose optional `reply` should be posted back.\n */\nexport type KycControllerHandleFrameMessageAction = {\n  type: `KycController:handleFrameMessage`;\n  handler: KycController['handleFrameMessage'];\n};\n\n/**\n * Builds the Check-frame URL, or `null` when no session exists yet.\n *\n * @returns The Check-frame URL or `null`.\n */\nexport type KycControllerBuildCheckFrameUrlAction = {\n  type: `KycController:buildCheckFrameUrl`;\n  handler: KycController['buildCheckFrameUrl'];\n};\n\n/**\n * Builds the Auth-frame URL, or `null` when no client token is available.\n *\n * @returns The Auth-frame URL or `null`.\n */\nexport type KycControllerBuildAuthFrameUrlAction = {\n  type: `KycController:buildAuthFrameUrl`;\n  handler: KycController['buildAuthFrameUrl'];\n};\n\n/**\n * Builds the Reset-frame URL.\n *\n * @returns The Reset-frame URL.\n */\nexport type KycControllerBuildResetFrameUrlAction = {\n  type: `KycController:buildResetFrameUrl`;\n  handler: KycController['buildResetFrameUrl'];\n};\n\n/**\n * Checks whether KYC is required for a product and caches the result.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @param params.country - Optional alpha-3 country override.\n * @returns Whether KYC is required.\n */\nexport type KycControllerCheckKycRequiredAction = {\n  type: `KycController:checkKycRequired`;\n  handler: KycController['checkKycRequired'];\n};\n\n/**\n * Reads the cached \"is KYC required\" result for a product.\n *\n * @param params - The parameters.\n * @param params.product - The consuming feature.\n * @returns The cached value, or `undefined` if not yet checked.\n */\nexport type KycControllerGetKycStatusAction = {\n  type: `KycController:getKycStatus`;\n  handler: KycController['getKycStatus'];\n};\n\n/**\n * Returns the vendor-scoped identity for the currently authenticated\n * customer, or `null` when the flow has not yet captured a vendor customer\n * id (before authentication or after {@link reset}), or when a MoonPay id\n * is present under a different `activeVendor`.\n *\n * Exposed so consumers (e.g. ramps autoramp creation) can attach the vendor\n * customer id to downstream calls without reading the full KYC state, which\n * also holds session/access tokens. The id is session-scoped and never\n * persisted.\n *\n * @returns The current {@link KycCustomerIdentity}, or `null`.\n */\nexport type KycControllerGetCustomerIdentityAction = {\n  type: `KycController:getCustomerIdentity`;\n  handler: KycController['getCustomerIdentity'];\n};\n\n/**\n * Runs the SumSub document-verification sub-flow end to end:\n *\n * 1. creates a UKYC session, receiving per-secret encryption schemas;\n * 2. verifies the `encryptionDataKey` schema's `jwtChain` against the\n * idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against\n * the idOS relay JWKS, then confirms each attested session server public\n * key;\n * 3. derives the `data_encryption_key` from the wallet's UKYC\n * `local_user_secret` and wraps it for the session server;\n * 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the\n * same way as the encryption key, and submits both via authorizations;\n * 5. fetches the SumSub applicant access token; and\n * 6. presents the SDK via the injected launcher.\n *\n * If a UKYC session already exists (the consents path creates it before\n * recording session disclaimers), steps 1–4 are skipped.\n *\n * If authorizations report the applicant is already approved on the relay\n * while the vendor is still finalizing (`kycStatus: approved`,\n * `finalStatus: pending`), the sub-flow stops at step 4 with a\n * `vendorProcessing` status and a message rather than launching the SDK.\n *\n * @param params - Optional parameters.\n * @param params.locale - BCP-47 locale for the SDK UI.\n * @param params.debug - Enables SDK debug logging.\n * @returns The SDK result.\n */\nexport type KycControllerStartSumSubAction = {\n  type: `KycController:startSumSub`;\n  handler: KycController['startSumSub'];\n};\n\n/**\n * Refreshes the user-keyed simplified KYC status from `GET /kyc/status`,\n * stores it on state, publishes {@link KycControllerStatusChangedEvent}, and\n * schedules short-interval polling while the status is `pending`.\n *\n * @returns The latest status payload.\n */\nexport type KycControllerRefreshKycStatusAction = {\n  type: `KycController:refreshKycStatus`;\n  handler: KycController['refreshKycStatus'];\n};\n\n/**\n * Fetches the current UKYC session status for the active sub-flow and records\n * it on state. Useful for a one-off refresh outside the automatic polling\n * loop that {@link startSumSub} runs.\n *\n * @returns The fetched session status.\n * @throws If there is no active SumSub session to query.\n */\nexport type KycControllerGetSessionStatusAction = {\n  type: `KycController:getSessionStatus`;\n  handler: KycController['getSessionStatus'];\n};\n\n/**\n * Resets the flow to idle, clearing session tokens and sub-flow state while\n * preserving persisted terms acceptance and the per-product cache.\n */\nexport type KycControllerResetAction = {\n  type: `KycController:reset`;\n  handler: KycController['reset'];\n};\n\n/**\n * Restores the controller to its default state, discarding everything\n * {@link reset} deliberately keeps: the session email, the persisted terms\n * acceptance, the per-product KYC-required cache and the user-keyed status.\n *\n * Intended for a full wallet reset, where no trace of the previous\n * customer may survive into the next wallet.\n */\nexport type KycControllerClearStateAction = {\n  type: `KycController:clearState`;\n  handler: KycController['clearState'];\n};\n\n/**\n * Union of all KycController action types.\n */\nexport type KycControllerMethodActions =\n  | KycControllerInitializeAction\n  | KycControllerCreateVendorCustomerAction\n  | KycControllerLoadDisclaimersAction\n  | KycControllerAcceptTermsAndStartSessionAction\n  | KycControllerClearSavedTermsAction\n  | KycControllerHandleFrameMessageAction\n  | KycControllerBuildCheckFrameUrlAction\n  | KycControllerBuildAuthFrameUrlAction\n  | KycControllerBuildResetFrameUrlAction\n  | KycControllerCheckKycRequiredAction\n  | KycControllerGetKycStatusAction\n  | KycControllerGetCustomerIdentityAction\n  | KycControllerStartSumSubAction\n  | KycControllerRefreshKycStatusAction\n  | KycControllerGetSessionStatusAction\n  | KycControllerResetAction\n  | KycControllerClearStateAction;\n"]}

package/dist/KycController.cjs

@@ -17,6 +17,7 @@ const base_controller_1 = require("@metamask/base-controller");
 const utils_1 = require("@metamask/utils");
 const ed25519_1 = require("@noble/curves/ed25519");
 const crypto_js_1 = require("./crypto.cjs");
+const encoding_js_1 = require("./encoding.cjs");
 const deriveClientMaterial_js_1 = require("./ukyc/deriveClientMaterial.cjs");
 const jwtChain_js_1 = require("./ukyc/jwtChain.cjs");
 const localUserSecret_js_1 = require("./ukyc/localUserSecret.cjs");
@@ -920,8 +921,10 @@ class KycController extends base_controller_1.BaseController {
      * Runs the SumSub document-verification sub-flow end to end:
      *
      *  1. creates a UKYC session, receiving per-secret encryption schemas;
-     *  2. verifies each schema's `jwtChain` against the Fractal JWKS and confirms
-     *     the attested session server public key;
+     *  2. verifies the `encryptionDataKey` schema's `jwtChain` against the
+     *     idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against
+     *     the idOS relay JWKS, then confirms each attested session server public
+     *     key;
      *  3. derives the `data_encryption_key` from the wallet's UKYC
      *     `local_user_secret` and wraps it for the session server;
      *  4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the
@@ -1600,22 +1603,44 @@ async function _KycController_continueAfterAuthentication() {
 async function _KycController_createUkycSession(generation) {
     const jwtToken = MOCK_JWT_TOKEN;
     // Establish a per-session X25519 keypair used to seal both secrets. The
-    // private half stays on the device; each encryption schema from session
-    // creation supplies the matching server public key.
+    // private half stays on the device; the public half is registered on the
+    // session so the server can open later authorizations. Each encryption
+    // schema from session creation supplies the matching server public key.
     const sessionClientPrivateKey = ed25519_1.x25519.utils.randomSecretKey();
+    const sessionClientPublicKey = (0, encoding_js_1.toBase64Url)(ed25519_1.x25519.getPublicKey(sessionClientPrivateKey));
+    // Residence is the ISO 3166-1 alpha-3 country already resolved for
+    // disclaimers / KYC-required; fetch it if this sub-flow started without
+    // that earlier step.
+    const residenceCountry = this.state.geoCountry ??
+        (await this.messenger.call('KycService:getGeoCountry'));
+    if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
+        return null;
+    }
+    if (residenceCountry !== this.state.geoCountry) {
+        __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
+            state.geoCountry = residenceCountry;
+        });
+    }
     const { sessionId, encryptionDataKey, ukycCapabilityToken: capabilityTokenSchema, } = await this.messenger.call('KycService:createUkycSession', {
         jwtToken,
+        sessionClientPublicKey,
+        residenceCountry,
         ...__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_buildUkycSessionVendorFields).call(this),
     });
     if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
         return null;
     }
-    // Verify each jwtChain against Fractal's JWKS, then confirm the returned
-    // server public key matches the value attested inside the verified JWT
-    // payload before trusting it for wrapping.
-    const { keys } = await this.messenger.call('KycService:fetchJwks');
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, keys, encryptionDataKey);
-    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, keys, capabilityTokenSchema);
+    // Verify each schema's jwtChain against the matching issuer JWKS, then
+    // confirm the returned server public key matches the value attested inside
+    // the verified JWT payload before trusting it for wrapping.
+    // `encryptionDataKey` is attested by the idOS enclave; `ukycCapabilityToken` by the
+    // idOS relay.
+    const [{ keys: idosEnclaveKeys }, { keys: idosRelayKeys }] = await Promise.all([
+        this.messenger.call('KycService:fetchIdosEnclaveJwks'),
+        this.messenger.call('KycService:fetchIdosRelayJwks'),
+    ]);
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, idosEnclaveKeys, encryptionDataKey);
+    __classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, idosRelayKeys, capabilityTokenSchema);
     // Derive the data_encryption_key from the local_user_secret, mint a
     // read-only capability token, and wrap both for the session server. Only
     // the wrapped (encrypted) material ever leaves the device.