@metamask-previews/kyc-controller 0.0.0-preview-eb263b0ee → 0.0.0-preview-c61613ed2

package/dist/KycService-method-action-types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"KycService-method-action-types.cjs","sourceRoot":"","sources":["../src/KycService-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycService } from './KycService.js';\n\n/**\n * Resolves the customer's country from the geolocation source and converts it\n * to an ISO 3166-1 alpha-3 code.\n *\n * @returns The alpha-3 country code.\n * @throws If the country cannot be determined or mapped.\n */\nexport type KycServiceGetGeoCountryAction = {\n  type: `KycService:getGeoCountry`;\n  handler: KycService['getGeoCountry'];\n};\n\n/**\n * Fetches the disclaimers the customer must accept before a session is\n * created.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor. Defaults to `moonpay`.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The disclaimers.\n */\nexport type KycServiceFetchDisclaimersAction = {\n  type: `KycService:fetchDisclaimers`;\n  handler: KycService['fetchDisclaimers'];\n};\n\n/**\n * Creates a vendor session via the UKYC backend.\n *\n * @param params - The session parameters.\n * @returns The created session token.\n */\nexport type KycServiceCreateSessionAction = {\n  type: `KycService:createSession`;\n  handler: KycService['createSession'];\n};\n\n/**\n * Checks whether KYC is required for the given vendor, country, and\n * capabilities.\n *\n * @param params - The check parameters.\n * @returns Whether KYC is required.\n */\nexport type KycServiceCheckKycRequiredAction = {\n  type: `KycService:checkKycRequired`;\n  handler: KycService['checkKycRequired'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the authenticated\n * canonical user on the given identity vendor. Must run before showing\n * vendor T&C so the customer exists and resume logic can key off vendor\n * status.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor (e.g. `iron` for Money/VBA).\n * @param params.email - Email associated with the customer.\n * @returns The vendor customer record (subset validated for controller use).\n */\nexport type KycServiceCreateVendorCustomerAction = {\n  type: `KycService:createVendorCustomer`;\n  handler: KycService['createVendorCustomer'];\n};\n\n/**\n * Records vendor T&C acceptance (`POST /vendors/{vendor}/disclaimers`).\n * For Iron this creates content signings from the disclaimer ids the\n * customer accepted. Session-scoped idOS / KYC-provider consents are\n * recorded separately via {@link submitSessionDisclaimers}. Retries re-POST\n * the same ids, matching the legacy `POST /consents` signing step.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor (e.g. `iron`).\n * @param params.disclaimerIds - Accepted vendor T&C ids.\n * @returns The vendor signing records.\n */\nexport type KycServiceSubmitVendorDisclaimersAction = {\n  type: `KycService:submitVendorDisclaimers`;\n  handler: KycService['submitVendorDisclaimers'];\n};\n\n/**\n * Fetches the session-scoped idOS + KYC-provider disclaimer catalog\n * (`GET /sessions/{sessionId}/disclaimers`). Requires an existing UKYC\n * session; vendor T&Cs continue to come from {@link fetchDisclaimers}.\n *\n * @param params - The parameters.\n * @param params.sessionId - The UKYC session id.\n * @returns The catalog, including which documents are already consented.\n */\nexport type KycServiceFetchSessionDisclaimersAction = {\n  type: `KycService:fetchSessionDisclaimers`;\n  handler: KycService['fetchSessionDisclaimers'];\n};\n\n/**\n * Records idOS + KYC-provider consents for a UKYC session\n * (`POST /sessions/{sessionId}/disclaimers`). `key`/`version` pairs must\n * match the current catalog from {@link fetchSessionDisclaimers}. A 409\n * means those document versions were already recorded for the session.\n *\n * @param params - The consent parameters.\n * @returns The updated catalog after recording.\n */\nexport type KycServiceSubmitSessionDisclaimersAction = {\n  type: `KycService:submitSessionDisclaimers`;\n  handler: KycService['submitSessionDisclaimers'];\n};\n\n/**\n * Fetches the user-keyed simplified KYC status used by Money toast / banner\n * surfaces (`GET /kyc/status`).\n *\n * @returns The simplified status payload.\n */\nexport type KycServiceFetchKycStatusAction = {\n  type: `KycService:fetchKycStatus`;\n  handler: KycService['fetchKycStatus'];\n};\n\n/**\n * Fetches the Fractal encryption service JWKS used to verify the `jwtChain`s\n * returned inside encryption schemas from {@link KycService.createUkycSession}.\n *\n * This is an unauthenticated request to a well-known path on the Fractal\n * host, distinct from the UKYC base URL.\n *\n * @returns The JWKS keys.\n */\nexport type KycServiceFetchJwksAction = {\n  type: `KycService:fetchJwks`;\n  handler: KycService['fetchJwks'];\n};\n\n/**\n * Creates a UKYC session for the SumSub document-verification sub-flow.\n *\n * The response carries per-secret encryption schemas (`encryptionDataKey` and\n * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and\n * the read-only `ukyc_capability_token` and submit them via\n * {@link KycService.setAuthorizations}.\n *\n * @param params - The session parameters.\n * @returns The UKYC session id and encryption schemas.\n */\nexport type KycServiceCreateUkycSessionAction = {\n  type: `KycService:createUkycSession`;\n  handler: KycService['createUkycSession'];\n};\n\n/**\n * Submits the wrapped `data_encryption_key` and wrapped\n * `ukyc_capability_token` for a UKYC session. Both secrets are sealed with\n * `wrapEncryptionKey` against the encryption schemas returned by\n * {@link KycService.createUkycSession}.\n *\n * @param params - The wrapped authorizations.\n * @returns The session status after the authorizations are applied.\n */\nexport type KycServiceSetAuthorizationsAction = {\n  type: `KycService:setAuthorizations`;\n  handler: KycService['setAuthorizations'];\n};\n\n/**\n * Creates (or refreshes) the SumSub verification journey for a UKYC session,\n * returning the applicant access token used to launch the SDK.\n *\n * @param sessionId - The UKYC session id from `createUkycSession`.\n * @returns The applicant access token and status.\n */\nexport type KycServiceCreateJourneyAction = {\n  type: `KycService:createJourney`;\n  handler: KycService['createJourney'];\n};\n\n/**\n * Fetches the current status of a UKYC session. Polled after the SumSub SDK\n * completes to determine the final verification decision.\n *\n * @param params - The parameters.\n * @param params.sessionId - The UKYC session id.\n * @returns The session status.\n */\nexport type KycServiceGetSessionStatusAction = {\n  type: `KycService:getSessionStatus`;\n  handler: KycService['getSessionStatus'];\n};\n\n/**\n * Union of all KycService action types.\n */\nexport type KycServiceMethodActions =\n  | KycServiceGetGeoCountryAction\n  | KycServiceFetchDisclaimersAction\n  | KycServiceCreateSessionAction\n  | KycServiceCheckKycRequiredAction\n  | KycServiceCreateVendorCustomerAction\n  | KycServiceSubmitVendorDisclaimersAction\n  | KycServiceFetchSessionDisclaimersAction\n  | KycServiceSubmitSessionDisclaimersAction\n  | KycServiceFetchKycStatusAction\n  | KycServiceFetchJwksAction\n  | KycServiceCreateUkycSessionAction\n  | KycServiceSetAuthorizationsAction\n  | KycServiceCreateJourneyAction\n  | KycServiceGetSessionStatusAction;\n"]}
+{"version":3,"file":"KycService-method-action-types.cjs","sourceRoot":"","sources":["../src/KycService-method-action-types.ts"],"names":[],"mappings":";AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycService } from './KycService.js';\n\n/**\n * Resolves the customer's country from the geolocation source and converts it\n * to an ISO 3166-1 alpha-3 code.\n *\n * @returns The alpha-3 country code.\n * @throws If the country cannot be determined or mapped.\n */\nexport type KycServiceGetGeoCountryAction = {\n  type: `KycService:getGeoCountry`;\n  handler: KycService['getGeoCountry'];\n};\n\n/**\n * Fetches the disclaimers the customer must accept before a session is\n * created.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor. Defaults to `moonpay`.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The disclaimers.\n */\nexport type KycServiceFetchDisclaimersAction = {\n  type: `KycService:fetchDisclaimers`;\n  handler: KycService['fetchDisclaimers'];\n};\n\n/**\n * Creates a vendor session via the UKYC backend.\n *\n * @param params - The session parameters.\n * @returns The created session token.\n */\nexport type KycServiceCreateSessionAction = {\n  type: `KycService:createSession`;\n  handler: KycService['createSession'];\n};\n\n/**\n * Checks whether KYC is required for the given vendor, country, and\n * capabilities.\n *\n * @param params - The check parameters.\n * @returns Whether KYC is required.\n */\nexport type KycServiceCheckKycRequiredAction = {\n  type: `KycService:checkKycRequired`;\n  handler: KycService['checkKycRequired'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the authenticated\n * canonical user on the given identity vendor. Must run before showing\n * vendor T&C so the customer exists and resume logic can key off vendor\n * status.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor (e.g. `iron` for Money/VBA).\n * @param params.email - Email associated with the customer.\n * @returns The vendor customer record (subset validated for controller use).\n */\nexport type KycServiceCreateVendorCustomerAction = {\n  type: `KycService:createVendorCustomer`;\n  handler: KycService['createVendorCustomer'];\n};\n\n/**\n * Records vendor T&C acceptance (`POST /vendors/{vendor}/disclaimers`).\n * For Iron this creates content signings from the disclaimer ids the\n * customer accepted. Session-scoped idOS / KYC-provider consents are\n * recorded separately via {@link submitSessionDisclaimers}. Retries re-POST\n * the same ids, matching the legacy `POST /consents` signing step.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor (e.g. `iron`).\n * @param params.disclaimerIds - Accepted vendor T&C ids.\n * @returns The vendor signing records.\n */\nexport type KycServiceSubmitVendorDisclaimersAction = {\n  type: `KycService:submitVendorDisclaimers`;\n  handler: KycService['submitVendorDisclaimers'];\n};\n\n/**\n * Fetches the session-scoped idOS + KYC-provider disclaimer catalog\n * (`GET /sessions/{sessionId}/disclaimers`). Requires an existing UKYC\n * session; vendor T&Cs continue to come from {@link fetchDisclaimers}.\n *\n * @param params - The parameters.\n * @param params.sessionId - The UKYC session id.\n * @returns The catalog, including which documents are already consented.\n */\nexport type KycServiceFetchSessionDisclaimersAction = {\n  type: `KycService:fetchSessionDisclaimers`;\n  handler: KycService['fetchSessionDisclaimers'];\n};\n\n/**\n * Records idOS + KYC-provider consents for a UKYC session\n * (`POST /sessions/{sessionId}/disclaimers`). `key`/`version` pairs must\n * match the current catalog from {@link fetchSessionDisclaimers}. A 409\n * means those document versions were already recorded for the session.\n *\n * @param params - The consent parameters.\n * @returns The updated catalog after recording.\n */\nexport type KycServiceSubmitSessionDisclaimersAction = {\n  type: `KycService:submitSessionDisclaimers`;\n  handler: KycService['submitSessionDisclaimers'];\n};\n\n/**\n * Fetches the user-keyed simplified KYC status used by Money toast / banner\n * surfaces (`GET /kyc/status`).\n *\n * @returns The simplified status payload.\n */\nexport type KycServiceFetchKycStatusAction = {\n  type: `KycService:fetchKycStatus`;\n  handler: KycService['fetchKycStatus'];\n};\n\n/**\n * Fetches the idOS enclave JWKS used to verify the\n * `encryptionDataKey` schema's `jwtChain` from\n * {@link KycService.createUkycSession}.\n *\n * This is an unauthenticated request to a well-known path on the idOS enclave\n * host, distinct from the UKYC base URL.\n *\n * @returns The JWKS keys.\n */\nexport type KycServiceFetchIdosEnclaveJwksAction = {\n  type: `KycService:fetchIdosEnclaveJwks`;\n  handler: KycService['fetchIdosEnclaveJwks'];\n};\n\n/**\n * Fetches the idOS relay JWKS used to verify the `ukycCapabilityToken`\n * schema's `jwtChain` from {@link KycService.createUkycSession}.\n *\n * This is an unauthenticated request to a well-known path on the idOS relay\n * host, distinct from both the UKYC base URL and the idOS enclave.\n *\n * @returns The JWKS keys.\n */\nexport type KycServiceFetchIdosRelayJwksAction = {\n  type: `KycService:fetchIdosRelayJwks`;\n  handler: KycService['fetchIdosRelayJwks'];\n};\n\n/**\n * Creates a UKYC session for the SumSub document-verification sub-flow.\n *\n * The client registers its per-session X25519 public key so the server can\n * later open boxes sealed with the matching private key, and supplies the\n * customer's ISO 3166-1 alpha-3 country of residence. The response\n * carries per-secret encryption schemas (`encryptionDataKey` and\n * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and\n * the read-only `ukyc_capability_token` and submit them via\n * {@link KycService.setAuthorizations}.\n *\n * @param params - The session parameters.\n * @returns The UKYC session id and encryption schemas.\n */\nexport type KycServiceCreateUkycSessionAction = {\n  type: `KycService:createUkycSession`;\n  handler: KycService['createUkycSession'];\n};\n\n/**\n * Submits the wrapped `data_encryption_key` and wrapped\n * `ukyc_capability_token` for a UKYC session. Both secrets are sealed with\n * `wrapEncryptionKey` against the encryption schemas returned by\n * {@link KycService.createUkycSession}.\n *\n * @param params - The wrapped authorizations.\n * @returns The session status after the authorizations are applied.\n */\nexport type KycServiceSetAuthorizationsAction = {\n  type: `KycService:setAuthorizations`;\n  handler: KycService['setAuthorizations'];\n};\n\n/**\n * Creates (or refreshes) the SumSub verification journey for a UKYC session,\n * returning the applicant access token used to launch the SDK.\n *\n * @param sessionId - The UKYC session id from `createUkycSession`.\n * @returns The applicant access token and status.\n */\nexport type KycServiceCreateJourneyAction = {\n  type: `KycService:createJourney`;\n  handler: KycService['createJourney'];\n};\n\n/**\n * Fetches the current status of a UKYC session. Polled after the SumSub SDK\n * completes to determine the final verification decision.\n *\n * @param params - The parameters.\n * @param params.sessionId - The UKYC session id.\n * @returns The session status.\n */\nexport type KycServiceGetSessionStatusAction = {\n  type: `KycService:getSessionStatus`;\n  handler: KycService['getSessionStatus'];\n};\n\n/**\n * Union of all KycService action types.\n */\nexport type KycServiceMethodActions =\n  | KycServiceGetGeoCountryAction\n  | KycServiceFetchDisclaimersAction\n  | KycServiceCreateSessionAction\n  | KycServiceCheckKycRequiredAction\n  | KycServiceCreateVendorCustomerAction\n  | KycServiceSubmitVendorDisclaimersAction\n  | KycServiceFetchSessionDisclaimersAction\n  | KycServiceSubmitSessionDisclaimersAction\n  | KycServiceFetchKycStatusAction\n  | KycServiceFetchIdosEnclaveJwksAction\n  | KycServiceFetchIdosRelayJwksAction\n  | KycServiceCreateUkycSessionAction\n  | KycServiceSetAuthorizationsAction\n  | KycServiceCreateJourneyAction\n  | KycServiceGetSessionStatusAction;\n"]}

package/dist/KycService-method-action-types.d.cts

@@ -116,22 +116,39 @@ export type KycServiceFetchKycStatusAction = {
     handler: KycService['fetchKycStatus'];
 };
 /**
- * Fetches the Fractal encryption service JWKS used to verify the `jwtChain`s
- * returned inside encryption schemas from {@link KycService.createUkycSession}.
+ * Fetches the idOS enclave JWKS used to verify the
+ * `encryptionDataKey` schema's `jwtChain` from
+ * {@link KycService.createUkycSession}.
  *
- * This is an unauthenticated request to a well-known path on the Fractal
+ * This is an unauthenticated request to a well-known path on the idOS enclave
  * host, distinct from the UKYC base URL.
  *
  * @returns The JWKS keys.
  */
-export type KycServiceFetchJwksAction = {
-    type: `KycService:fetchJwks`;
-    handler: KycService['fetchJwks'];
+export type KycServiceFetchIdosEnclaveJwksAction = {
+    type: `KycService:fetchIdosEnclaveJwks`;
+    handler: KycService['fetchIdosEnclaveJwks'];
+};
+/**
+ * Fetches the idOS relay JWKS used to verify the `ukycCapabilityToken`
+ * schema's `jwtChain` from {@link KycService.createUkycSession}.
+ *
+ * This is an unauthenticated request to a well-known path on the idOS relay
+ * host, distinct from both the UKYC base URL and the idOS enclave.
+ *
+ * @returns The JWKS keys.
+ */
+export type KycServiceFetchIdosRelayJwksAction = {
+    type: `KycService:fetchIdosRelayJwks`;
+    handler: KycService['fetchIdosRelayJwks'];
 };
 /**
  * Creates a UKYC session for the SumSub document-verification sub-flow.
  *
- * The response carries per-secret encryption schemas (`encryptionDataKey` and
+ * The client registers its per-session X25519 public key so the server can
+ * later open boxes sealed with the matching private key, and supplies the
+ * customer's ISO 3166-1 alpha-3 country of residence. The response
+ * carries per-secret encryption schemas (`encryptionDataKey` and
  * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and
  * the read-only `ukyc_capability_token` and submit them via
  * {@link KycService.setAuthorizations}.
@@ -182,5 +199,5 @@ export type KycServiceGetSessionStatusAction = {
 /**
  * Union of all KycService action types.
  */
-export type KycServiceMethodActions = KycServiceGetGeoCountryAction | KycServiceFetchDisclaimersAction | KycServiceCreateSessionAction | KycServiceCheckKycRequiredAction | KycServiceCreateVendorCustomerAction | KycServiceSubmitVendorDisclaimersAction | KycServiceFetchSessionDisclaimersAction | KycServiceSubmitSessionDisclaimersAction | KycServiceFetchKycStatusAction | KycServiceFetchJwksAction | KycServiceCreateUkycSessionAction | KycServiceSetAuthorizationsAction | KycServiceCreateJourneyAction | KycServiceGetSessionStatusAction;
+export type KycServiceMethodActions = KycServiceGetGeoCountryAction | KycServiceFetchDisclaimersAction | KycServiceCreateSessionAction | KycServiceCheckKycRequiredAction | KycServiceCreateVendorCustomerAction | KycServiceSubmitVendorDisclaimersAction | KycServiceFetchSessionDisclaimersAction | KycServiceSubmitSessionDisclaimersAction | KycServiceFetchKycStatusAction | KycServiceFetchIdosEnclaveJwksAction | KycServiceFetchIdosRelayJwksAction | KycServiceCreateUkycSessionAction | KycServiceSetAuthorizationsAction | KycServiceCreateJourneyAction | KycServiceGetSessionStatusAction;
 //# sourceMappingURL=KycService-method-action-types.d.cts.map

package/dist/KycService-method-action-types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"KycService-method-action-types.d.cts","sourceRoot":"","sources":["../src/KycService-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,yBAAwB;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,UAAU,CAAC,0BAA0B,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAC/B,6BAA6B,GAC7B,gCAAgC,GAChC,6BAA6B,GAC7B,gCAAgC,GAChC,oCAAoC,GACpC,uCAAuC,GACvC,uCAAuC,GACvC,wCAAwC,GACxC,8BAA8B,GAC9B,yBAAyB,GACzB,iCAAiC,GACjC,iCAAiC,GACjC,6BAA6B,GAC7B,gCAAgC,CAAC"}
+{"version":3,"file":"KycService-method-action-types.d.cts","sourceRoot":"","sources":["../src/KycService-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,yBAAwB;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,UAAU,CAAC,0BAA0B,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAC/B,6BAA6B,GAC7B,gCAAgC,GAChC,6BAA6B,GAC7B,gCAAgC,GAChC,oCAAoC,GACpC,uCAAuC,GACvC,uCAAuC,GACvC,wCAAwC,GACxC,8BAA8B,GAC9B,oCAAoC,GACpC,kCAAkC,GAClC,iCAAiC,GACjC,iCAAiC,GACjC,6BAA6B,GAC7B,gCAAgC,CAAC"}

package/dist/KycService-method-action-types.d.mts

@@ -116,22 +116,39 @@ export type KycServiceFetchKycStatusAction = {
     handler: KycService['fetchKycStatus'];
 };
 /**
- * Fetches the Fractal encryption service JWKS used to verify the `jwtChain`s
- * returned inside encryption schemas from {@link KycService.createUkycSession}.
+ * Fetches the idOS enclave JWKS used to verify the
+ * `encryptionDataKey` schema's `jwtChain` from
+ * {@link KycService.createUkycSession}.
  *
- * This is an unauthenticated request to a well-known path on the Fractal
+ * This is an unauthenticated request to a well-known path on the idOS enclave
  * host, distinct from the UKYC base URL.
  *
  * @returns The JWKS keys.
  */
-export type KycServiceFetchJwksAction = {
-    type: `KycService:fetchJwks`;
-    handler: KycService['fetchJwks'];
+export type KycServiceFetchIdosEnclaveJwksAction = {
+    type: `KycService:fetchIdosEnclaveJwks`;
+    handler: KycService['fetchIdosEnclaveJwks'];
+};
+/**
+ * Fetches the idOS relay JWKS used to verify the `ukycCapabilityToken`
+ * schema's `jwtChain` from {@link KycService.createUkycSession}.
+ *
+ * This is an unauthenticated request to a well-known path on the idOS relay
+ * host, distinct from both the UKYC base URL and the idOS enclave.
+ *
+ * @returns The JWKS keys.
+ */
+export type KycServiceFetchIdosRelayJwksAction = {
+    type: `KycService:fetchIdosRelayJwks`;
+    handler: KycService['fetchIdosRelayJwks'];
 };
 /**
  * Creates a UKYC session for the SumSub document-verification sub-flow.
  *
- * The response carries per-secret encryption schemas (`encryptionDataKey` and
+ * The client registers its per-session X25519 public key so the server can
+ * later open boxes sealed with the matching private key, and supplies the
+ * customer's ISO 3166-1 alpha-3 country of residence. The response
+ * carries per-secret encryption schemas (`encryptionDataKey` and
  * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and
  * the read-only `ukyc_capability_token` and submit them via
  * {@link KycService.setAuthorizations}.
@@ -182,5 +199,5 @@ export type KycServiceGetSessionStatusAction = {
 /**
  * Union of all KycService action types.
  */
-export type KycServiceMethodActions = KycServiceGetGeoCountryAction | KycServiceFetchDisclaimersAction | KycServiceCreateSessionAction | KycServiceCheckKycRequiredAction | KycServiceCreateVendorCustomerAction | KycServiceSubmitVendorDisclaimersAction | KycServiceFetchSessionDisclaimersAction | KycServiceSubmitSessionDisclaimersAction | KycServiceFetchKycStatusAction | KycServiceFetchJwksAction | KycServiceCreateUkycSessionAction | KycServiceSetAuthorizationsAction | KycServiceCreateJourneyAction | KycServiceGetSessionStatusAction;
+export type KycServiceMethodActions = KycServiceGetGeoCountryAction | KycServiceFetchDisclaimersAction | KycServiceCreateSessionAction | KycServiceCheckKycRequiredAction | KycServiceCreateVendorCustomerAction | KycServiceSubmitVendorDisclaimersAction | KycServiceFetchSessionDisclaimersAction | KycServiceSubmitSessionDisclaimersAction | KycServiceFetchKycStatusAction | KycServiceFetchIdosEnclaveJwksAction | KycServiceFetchIdosRelayJwksAction | KycServiceCreateUkycSessionAction | KycServiceSetAuthorizationsAction | KycServiceCreateJourneyAction | KycServiceGetSessionStatusAction;
 //# sourceMappingURL=KycService-method-action-types.d.mts.map

package/dist/KycService-method-action-types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"KycService-method-action-types.d.mts","sourceRoot":"","sources":["../src/KycService-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,yBAAwB;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,UAAU,CAAC,0BAA0B,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAC/B,6BAA6B,GAC7B,gCAAgC,GAChC,6BAA6B,GAC7B,gCAAgC,GAChC,oCAAoC,GACpC,uCAAuC,GACvC,uCAAuC,GACvC,wCAAwC,GACxC,8BAA8B,GAC9B,yBAAyB,GACzB,iCAAiC,GACjC,iCAAiC,GACjC,6BAA6B,GAC7B,gCAAgC,CAAC"}
+{"version":3,"file":"KycService-method-action-types.d.mts","sourceRoot":"","sources":["../src/KycService-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,yBAAwB;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,UAAU,CAAC,0BAA0B,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;CACvC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,IAAI,EAAE,+BAA+B,CAAC;IACtC,OAAO,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;CAC3C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,8BAA8B,CAAC;IACrC,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAC/B,6BAA6B,GAC7B,gCAAgC,GAChC,6BAA6B,GAC7B,gCAAgC,GAChC,oCAAoC,GACpC,uCAAuC,GACvC,uCAAuC,GACvC,wCAAwC,GACxC,8BAA8B,GAC9B,oCAAoC,GACpC,kCAAkC,GAClC,iCAAiC,GACjC,iCAAiC,GACjC,6BAA6B,GAC7B,gCAAgC,CAAC"}

package/dist/KycService-method-action-types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"KycService-method-action-types.mjs","sourceRoot":"","sources":["../src/KycService-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycService } from './KycService.js';\n\n/**\n * Resolves the customer's country from the geolocation source and converts it\n * to an ISO 3166-1 alpha-3 code.\n *\n * @returns The alpha-3 country code.\n * @throws If the country cannot be determined or mapped.\n */\nexport type KycServiceGetGeoCountryAction = {\n  type: `KycService:getGeoCountry`;\n  handler: KycService['getGeoCountry'];\n};\n\n/**\n * Fetches the disclaimers the customer must accept before a session is\n * created.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor. Defaults to `moonpay`.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The disclaimers.\n */\nexport type KycServiceFetchDisclaimersAction = {\n  type: `KycService:fetchDisclaimers`;\n  handler: KycService['fetchDisclaimers'];\n};\n\n/**\n * Creates a vendor session via the UKYC backend.\n *\n * @param params - The session parameters.\n * @returns The created session token.\n */\nexport type KycServiceCreateSessionAction = {\n  type: `KycService:createSession`;\n  handler: KycService['createSession'];\n};\n\n/**\n * Checks whether KYC is required for the given vendor, country, and\n * capabilities.\n *\n * @param params - The check parameters.\n * @returns Whether KYC is required.\n */\nexport type KycServiceCheckKycRequiredAction = {\n  type: `KycService:checkKycRequired`;\n  handler: KycService['checkKycRequired'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the authenticated\n * canonical user on the given identity vendor. Must run before showing\n * vendor T&C so the customer exists and resume logic can key off vendor\n * status.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor (e.g. `iron` for Money/VBA).\n * @param params.email - Email associated with the customer.\n * @returns The vendor customer record (subset validated for controller use).\n */\nexport type KycServiceCreateVendorCustomerAction = {\n  type: `KycService:createVendorCustomer`;\n  handler: KycService['createVendorCustomer'];\n};\n\n/**\n * Records vendor T&C acceptance (`POST /vendors/{vendor}/disclaimers`).\n * For Iron this creates content signings from the disclaimer ids the\n * customer accepted. Session-scoped idOS / KYC-provider consents are\n * recorded separately via {@link submitSessionDisclaimers}. Retries re-POST\n * the same ids, matching the legacy `POST /consents` signing step.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor (e.g. `iron`).\n * @param params.disclaimerIds - Accepted vendor T&C ids.\n * @returns The vendor signing records.\n */\nexport type KycServiceSubmitVendorDisclaimersAction = {\n  type: `KycService:submitVendorDisclaimers`;\n  handler: KycService['submitVendorDisclaimers'];\n};\n\n/**\n * Fetches the session-scoped idOS + KYC-provider disclaimer catalog\n * (`GET /sessions/{sessionId}/disclaimers`). Requires an existing UKYC\n * session; vendor T&Cs continue to come from {@link fetchDisclaimers}.\n *\n * @param params - The parameters.\n * @param params.sessionId - The UKYC session id.\n * @returns The catalog, including which documents are already consented.\n */\nexport type KycServiceFetchSessionDisclaimersAction = {\n  type: `KycService:fetchSessionDisclaimers`;\n  handler: KycService['fetchSessionDisclaimers'];\n};\n\n/**\n * Records idOS + KYC-provider consents for a UKYC session\n * (`POST /sessions/{sessionId}/disclaimers`). `key`/`version` pairs must\n * match the current catalog from {@link fetchSessionDisclaimers}. A 409\n * means those document versions were already recorded for the session.\n *\n * @param params - The consent parameters.\n * @returns The updated catalog after recording.\n */\nexport type KycServiceSubmitSessionDisclaimersAction = {\n  type: `KycService:submitSessionDisclaimers`;\n  handler: KycService['submitSessionDisclaimers'];\n};\n\n/**\n * Fetches the user-keyed simplified KYC status used by Money toast / banner\n * surfaces (`GET /kyc/status`).\n *\n * @returns The simplified status payload.\n */\nexport type KycServiceFetchKycStatusAction = {\n  type: `KycService:fetchKycStatus`;\n  handler: KycService['fetchKycStatus'];\n};\n\n/**\n * Fetches the Fractal encryption service JWKS used to verify the `jwtChain`s\n * returned inside encryption schemas from {@link KycService.createUkycSession}.\n *\n * This is an unauthenticated request to a well-known path on the Fractal\n * host, distinct from the UKYC base URL.\n *\n * @returns The JWKS keys.\n */\nexport type KycServiceFetchJwksAction = {\n  type: `KycService:fetchJwks`;\n  handler: KycService['fetchJwks'];\n};\n\n/**\n * Creates a UKYC session for the SumSub document-verification sub-flow.\n *\n * The response carries per-secret encryption schemas (`encryptionDataKey` and\n * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and\n * the read-only `ukyc_capability_token` and submit them via\n * {@link KycService.setAuthorizations}.\n *\n * @param params - The session parameters.\n * @returns The UKYC session id and encryption schemas.\n */\nexport type KycServiceCreateUkycSessionAction = {\n  type: `KycService:createUkycSession`;\n  handler: KycService['createUkycSession'];\n};\n\n/**\n * Submits the wrapped `data_encryption_key` and wrapped\n * `ukyc_capability_token` for a UKYC session. Both secrets are sealed with\n * `wrapEncryptionKey` against the encryption schemas returned by\n * {@link KycService.createUkycSession}.\n *\n * @param params - The wrapped authorizations.\n * @returns The session status after the authorizations are applied.\n */\nexport type KycServiceSetAuthorizationsAction = {\n  type: `KycService:setAuthorizations`;\n  handler: KycService['setAuthorizations'];\n};\n\n/**\n * Creates (or refreshes) the SumSub verification journey for a UKYC session,\n * returning the applicant access token used to launch the SDK.\n *\n * @param sessionId - The UKYC session id from `createUkycSession`.\n * @returns The applicant access token and status.\n */\nexport type KycServiceCreateJourneyAction = {\n  type: `KycService:createJourney`;\n  handler: KycService['createJourney'];\n};\n\n/**\n * Fetches the current status of a UKYC session. Polled after the SumSub SDK\n * completes to determine the final verification decision.\n *\n * @param params - The parameters.\n * @param params.sessionId - The UKYC session id.\n * @returns The session status.\n */\nexport type KycServiceGetSessionStatusAction = {\n  type: `KycService:getSessionStatus`;\n  handler: KycService['getSessionStatus'];\n};\n\n/**\n * Union of all KycService action types.\n */\nexport type KycServiceMethodActions =\n  | KycServiceGetGeoCountryAction\n  | KycServiceFetchDisclaimersAction\n  | KycServiceCreateSessionAction\n  | KycServiceCheckKycRequiredAction\n  | KycServiceCreateVendorCustomerAction\n  | KycServiceSubmitVendorDisclaimersAction\n  | KycServiceFetchSessionDisclaimersAction\n  | KycServiceSubmitSessionDisclaimersAction\n  | KycServiceFetchKycStatusAction\n  | KycServiceFetchJwksAction\n  | KycServiceCreateUkycSessionAction\n  | KycServiceSetAuthorizationsAction\n  | KycServiceCreateJourneyAction\n  | KycServiceGetSessionStatusAction;\n"]}
+{"version":3,"file":"KycService-method-action-types.mjs","sourceRoot":"","sources":["../src/KycService-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycService } from './KycService.js';\n\n/**\n * Resolves the customer's country from the geolocation source and converts it\n * to an ISO 3166-1 alpha-3 code.\n *\n * @returns The alpha-3 country code.\n * @throws If the country cannot be determined or mapped.\n */\nexport type KycServiceGetGeoCountryAction = {\n  type: `KycService:getGeoCountry`;\n  handler: KycService['getGeoCountry'];\n};\n\n/**\n * Fetches the disclaimers the customer must accept before a session is\n * created.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor. Defaults to `moonpay`.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The disclaimers.\n */\nexport type KycServiceFetchDisclaimersAction = {\n  type: `KycService:fetchDisclaimers`;\n  handler: KycService['fetchDisclaimers'];\n};\n\n/**\n * Creates a vendor session via the UKYC backend.\n *\n * @param params - The session parameters.\n * @returns The created session token.\n */\nexport type KycServiceCreateSessionAction = {\n  type: `KycService:createSession`;\n  handler: KycService['createSession'];\n};\n\n/**\n * Checks whether KYC is required for the given vendor, country, and\n * capabilities.\n *\n * @param params - The check parameters.\n * @returns Whether KYC is required.\n */\nexport type KycServiceCheckKycRequiredAction = {\n  type: `KycService:checkKycRequired`;\n  handler: KycService['checkKycRequired'];\n};\n\n/**\n * Creates (or resumes) an empty-shell customer for the authenticated\n * canonical user on the given identity vendor. Must run before showing\n * vendor T&C so the customer exists and resume logic can key off vendor\n * status.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor (e.g. `iron` for Money/VBA).\n * @param params.email - Email associated with the customer.\n * @returns The vendor customer record (subset validated for controller use).\n */\nexport type KycServiceCreateVendorCustomerAction = {\n  type: `KycService:createVendorCustomer`;\n  handler: KycService['createVendorCustomer'];\n};\n\n/**\n * Records vendor T&C acceptance (`POST /vendors/{vendor}/disclaimers`).\n * For Iron this creates content signings from the disclaimer ids the\n * customer accepted. Session-scoped idOS / KYC-provider consents are\n * recorded separately via {@link submitSessionDisclaimers}. Retries re-POST\n * the same ids, matching the legacy `POST /consents` signing step.\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor (e.g. `iron`).\n * @param params.disclaimerIds - Accepted vendor T&C ids.\n * @returns The vendor signing records.\n */\nexport type KycServiceSubmitVendorDisclaimersAction = {\n  type: `KycService:submitVendorDisclaimers`;\n  handler: KycService['submitVendorDisclaimers'];\n};\n\n/**\n * Fetches the session-scoped idOS + KYC-provider disclaimer catalog\n * (`GET /sessions/{sessionId}/disclaimers`). Requires an existing UKYC\n * session; vendor T&Cs continue to come from {@link fetchDisclaimers}.\n *\n * @param params - The parameters.\n * @param params.sessionId - The UKYC session id.\n * @returns The catalog, including which documents are already consented.\n */\nexport type KycServiceFetchSessionDisclaimersAction = {\n  type: `KycService:fetchSessionDisclaimers`;\n  handler: KycService['fetchSessionDisclaimers'];\n};\n\n/**\n * Records idOS + KYC-provider consents for a UKYC session\n * (`POST /sessions/{sessionId}/disclaimers`). `key`/`version` pairs must\n * match the current catalog from {@link fetchSessionDisclaimers}. A 409\n * means those document versions were already recorded for the session.\n *\n * @param params - The consent parameters.\n * @returns The updated catalog after recording.\n */\nexport type KycServiceSubmitSessionDisclaimersAction = {\n  type: `KycService:submitSessionDisclaimers`;\n  handler: KycService['submitSessionDisclaimers'];\n};\n\n/**\n * Fetches the user-keyed simplified KYC status used by Money toast / banner\n * surfaces (`GET /kyc/status`).\n *\n * @returns The simplified status payload.\n */\nexport type KycServiceFetchKycStatusAction = {\n  type: `KycService:fetchKycStatus`;\n  handler: KycService['fetchKycStatus'];\n};\n\n/**\n * Fetches the idOS enclave JWKS used to verify the\n * `encryptionDataKey` schema's `jwtChain` from\n * {@link KycService.createUkycSession}.\n *\n * This is an unauthenticated request to a well-known path on the idOS enclave\n * host, distinct from the UKYC base URL.\n *\n * @returns The JWKS keys.\n */\nexport type KycServiceFetchIdosEnclaveJwksAction = {\n  type: `KycService:fetchIdosEnclaveJwks`;\n  handler: KycService['fetchIdosEnclaveJwks'];\n};\n\n/**\n * Fetches the idOS relay JWKS used to verify the `ukycCapabilityToken`\n * schema's `jwtChain` from {@link KycService.createUkycSession}.\n *\n * This is an unauthenticated request to a well-known path on the idOS relay\n * host, distinct from both the UKYC base URL and the idOS enclave.\n *\n * @returns The JWKS keys.\n */\nexport type KycServiceFetchIdosRelayJwksAction = {\n  type: `KycService:fetchIdosRelayJwks`;\n  handler: KycService['fetchIdosRelayJwks'];\n};\n\n/**\n * Creates a UKYC session for the SumSub document-verification sub-flow.\n *\n * The client registers its per-session X25519 public key so the server can\n * later open boxes sealed with the matching private key, and supplies the\n * customer's ISO 3166-1 alpha-3 country of residence. The response\n * carries per-secret encryption schemas (`encryptionDataKey` and\n * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and\n * the read-only `ukyc_capability_token` and submit them via\n * {@link KycService.setAuthorizations}.\n *\n * @param params - The session parameters.\n * @returns The UKYC session id and encryption schemas.\n */\nexport type KycServiceCreateUkycSessionAction = {\n  type: `KycService:createUkycSession`;\n  handler: KycService['createUkycSession'];\n};\n\n/**\n * Submits the wrapped `data_encryption_key` and wrapped\n * `ukyc_capability_token` for a UKYC session. Both secrets are sealed with\n * `wrapEncryptionKey` against the encryption schemas returned by\n * {@link KycService.createUkycSession}.\n *\n * @param params - The wrapped authorizations.\n * @returns The session status after the authorizations are applied.\n */\nexport type KycServiceSetAuthorizationsAction = {\n  type: `KycService:setAuthorizations`;\n  handler: KycService['setAuthorizations'];\n};\n\n/**\n * Creates (or refreshes) the SumSub verification journey for a UKYC session,\n * returning the applicant access token used to launch the SDK.\n *\n * @param sessionId - The UKYC session id from `createUkycSession`.\n * @returns The applicant access token and status.\n */\nexport type KycServiceCreateJourneyAction = {\n  type: `KycService:createJourney`;\n  handler: KycService['createJourney'];\n};\n\n/**\n * Fetches the current status of a UKYC session. Polled after the SumSub SDK\n * completes to determine the final verification decision.\n *\n * @param params - The parameters.\n * @param params.sessionId - The UKYC session id.\n * @returns The session status.\n */\nexport type KycServiceGetSessionStatusAction = {\n  type: `KycService:getSessionStatus`;\n  handler: KycService['getSessionStatus'];\n};\n\n/**\n * Union of all KycService action types.\n */\nexport type KycServiceMethodActions =\n  | KycServiceGetGeoCountryAction\n  | KycServiceFetchDisclaimersAction\n  | KycServiceCreateSessionAction\n  | KycServiceCheckKycRequiredAction\n  | KycServiceCreateVendorCustomerAction\n  | KycServiceSubmitVendorDisclaimersAction\n  | KycServiceFetchSessionDisclaimersAction\n  | KycServiceSubmitSessionDisclaimersAction\n  | KycServiceFetchKycStatusAction\n  | KycServiceFetchIdosEnclaveJwksAction\n  | KycServiceFetchIdosRelayJwksAction\n  | KycServiceCreateUkycSessionAction\n  | KycServiceSetAuthorizationsAction\n  | KycServiceCreateJourneyAction\n  | KycServiceGetSessionStatusAction;\n"]}

package/dist/KycService.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _KycService_instances, _KycService_fetch, _KycService_baseUrl, _KycService_fractalEncryptionBaseUrl, _KycService_validateResponse, _KycService_requestJson;
+var _KycService_instances, _KycService_fetch, _KycService_baseUrl, _KycService_idosEnclaveBaseUrl, _KycService_idosRelayBaseUrl, _KycService_fetchWellKnownJwks, _KycService_validateResponse, _KycService_requestJson;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KycService = exports.serviceName = void 0;
 const base_data_service_1 = require("@metamask/base-data-service");
@@ -35,7 +35,8 @@ const MESSENGER_EXPOSED_METHODS = [
     'fetchSessionDisclaimers',
     'submitSessionDisclaimers',
     'fetchKycStatus',
-    'fetchJwks',
+    'fetchIdosEnclaveJwks',
+    'fetchIdosRelayJwks',
     'createUkycSession',
     'setAuthorizations',
     'createJourney',
@@ -143,10 +144,10 @@ const SessionDisclaimersResponseStruct = (0, superstruct_1.type)({
  * It extends {@link BaseDataService}, so every request is routed through
  * `fetchQuery`: it is wrapped in the shared service policy (retries, circuit
  * breaker) and its result is exposed via the service's `QueryClient`. Read-only
- * endpoints (`fetchDisclaimers`, `fetchJwks`) are cached with a `staleTime`;
- * vendor-disclaimer, session-scoped disclaimer, session-creating, and
- * status-polling endpoints opt out of caching (`staleTime`/`gcTime` of `0`)
- * so they never serve a stale result.
+ * endpoints (`fetchDisclaimers`, `fetchIdosEnclaveJwks`, `fetchIdosRelayJwks`) are cached
+ * with a `staleTime`; vendor-disclaimer, session-scoped disclaimer,
+ * session-creating, and status-polling endpoints opt out of caching
+ * (`staleTime`/`gcTime` of `0`) so they never serve a stale result.
  */
 class KycService extends base_data_service_1.BaseDataService {
     /**
@@ -157,14 +158,17 @@ class KycService extends base_data_service_1.BaseDataService {
      * @param options.fetch - A function used to make HTTP requests. Defaults to
      * the runtime's native `fetch`.
      * @param options.baseUrl - Base URL of the KYC API
-     * @param options.fractalEncryptionBaseUrl - Base URL of the Fractal
-     * encryption service, from which the JWKS used to verify encryption-schema
-     * `jwtChain`s is fetched.
+     * @param options.idosEnclaveBaseUrl - Base URL of the idOS enclave, from
+     * which the JWKS used to verify the `encryptionDataKey` schema's `jwtChain`
+     * is fetched.
+     * @param options.idosRelayBaseUrl - Base URL of the idOS relay, from which
+     * the JWKS used to verify the `ukycCapabilityToken` schema's `jwtChain` is
+     * fetched.
      * @param options.queryClientConfig - Shared configuration for all queries
      * exposed by the service.
      * @param options.policyOptions - Options for the request service policy.
      */
-    constructor({ messenger, fetch: fetchFunction, baseUrl, fractalEncryptionBaseUrl, queryClientConfig = {}, policyOptions = {}, }) {
+    constructor({ messenger, fetch: fetchFunction, baseUrl, idosEnclaveBaseUrl, idosRelayBaseUrl, queryClientConfig = {}, policyOptions = {}, }) {
         super({
             name: exports.serviceName,
             messenger,
@@ -174,7 +178,8 @@ class KycService extends base_data_service_1.BaseDataService {
         _KycService_instances.add(this);
         _KycService_fetch.set(this, void 0);
         _KycService_baseUrl.set(this, void 0);
-        _KycService_fractalEncryptionBaseUrl.set(this, void 0);
+        _KycService_idosEnclaveBaseUrl.set(this, void 0);
+        _KycService_idosRelayBaseUrl.set(this, void 0);
         // Fall back to the runtime's native `fetch`, bound to `globalThis` so it
         // can be invoked as a method of this instance without an illegal-invocation
         // error on platforms that check the receiver.
@@ -191,7 +196,8 @@ class KycService extends base_data_service_1.BaseDataService {
             throw new Error('KycService: baseUrl is required');
         }
         __classPrivateFieldSet(this, _KycService_baseUrl, baseUrl, "f");
-        __classPrivateFieldSet(this, _KycService_fractalEncryptionBaseUrl, fractalEncryptionBaseUrl ?? '', "f");
+        __classPrivateFieldSet(this, _KycService_idosEnclaveBaseUrl, idosEnclaveBaseUrl ?? '', "f");
+        __classPrivateFieldSet(this, _KycService_idosRelayBaseUrl, idosRelayBaseUrl ?? '', "f");
         this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
     }
     /**
@@ -435,30 +441,37 @@ class KycService extends base_data_service_1.BaseDataService {
         return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, KycUserStatusResponseStruct, 'kyc status');
     }
     /**
-     * Fetches the Fractal encryption service JWKS used to verify the `jwtChain`s
-     * returned inside encryption schemas from {@link KycService.createUkycSession}.
+     * Fetches the idOS enclave JWKS used to verify the
+     * `encryptionDataKey` schema's `jwtChain` from
+     * {@link KycService.createUkycSession}.
      *
-     * This is an unauthenticated request to a well-known path on the Fractal
+     * This is an unauthenticated request to a well-known path on the idOS enclave
      * host, distinct from the UKYC base URL.
      *
      * @returns The JWKS keys.
      */
-    async fetchJwks() {
-        if (!__classPrivateFieldGet(this, _KycService_fractalEncryptionBaseUrl, "f")) {
-            throw new Error('KycService: fractalEncryptionBaseUrl is not configured; cannot fetch JWKS to verify encryption schemas.');
-        }
-        const url = new URL(constants_js_1.UKYC_JWKS_PATH, __classPrivateFieldGet(this, _KycService_fractalEncryptionBaseUrl, "f"));
-        const data = await this.fetchQuery({
-            queryKey: [`${this.name}:fetchJwks`, __classPrivateFieldGet(this, _KycService_fractalEncryptionBaseUrl, "f")],
-            queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }, { authenticated: false }),
-            staleTime: (0, utils_1.inMilliseconds)(1, utils_1.Duration.Hour),
-        });
-        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, JwksResponseStruct, 'JWKS');
+    async fetchIdosEnclaveJwks() {
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_fetchWellKnownJwks).call(this, __classPrivateFieldGet(this, _KycService_idosEnclaveBaseUrl, "f"), 'fetchIdosEnclaveJwks', 'idOS enclave JWKS', 'KycService: idosEnclaveBaseUrl is not configured; cannot fetch JWKS to verify the encryptionDataKey schema.');
+    }
+    /**
+     * Fetches the idOS relay JWKS used to verify the `ukycCapabilityToken`
+     * schema's `jwtChain` from {@link KycService.createUkycSession}.
+     *
+     * This is an unauthenticated request to a well-known path on the idOS relay
+     * host, distinct from both the UKYC base URL and the idOS enclave.
+     *
+     * @returns The JWKS keys.
+     */
+    async fetchIdosRelayJwks() {
+        return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_fetchWellKnownJwks).call(this, __classPrivateFieldGet(this, _KycService_idosRelayBaseUrl, "f"), 'fetchIdosRelayJwks', 'idOS relay JWKS', 'KycService: idosRelayBaseUrl is not configured; cannot fetch JWKS to verify the ukycCapabilityToken schema.');
     }
     /**
      * Creates a UKYC session for the SumSub document-verification sub-flow.
      *
-     * The response carries per-secret encryption schemas (`encryptionDataKey` and
+     * The client registers its per-session X25519 public key so the server can
+     * later open boxes sealed with the matching private key, and supplies the
+     * customer's ISO 3166-1 alpha-3 country of residence. The response
+     * carries per-secret encryption schemas (`encryptionDataKey` and
      * `ukycCapabilityToken`) so the client can wrap the `data_encryption_key` and
      * the read-only `ukyc_capability_token` and submit them via
      * {@link KycService.setAuthorizations}.
@@ -476,6 +489,8 @@ class KycService extends base_data_service_1.BaseDataService {
                     vendorId: params.vendor ?? 'moonpay',
                     vendorUserId: 'mockedId',
                     jwtToken: params.jwtToken,
+                    sessionClientPublicKey: params.sessionClientPublicKey,
+                    residenceCountry: params.residenceCountry,
                     vendorMetadata: params.vendorMetadata ?? {},
                 }),
             }),
@@ -549,7 +564,28 @@ class KycService extends base_data_service_1.BaseDataService {
     }
 }
 exports.KycService = KycService;
-_KycService_fetch = new WeakMap(), _KycService_baseUrl = new WeakMap(), _KycService_fractalEncryptionBaseUrl = new WeakMap(), _KycService_instances = new WeakSet(), _KycService_validateResponse = function _KycService_validateResponse(data, struct, apiName) {
+_KycService_fetch = new WeakMap(), _KycService_baseUrl = new WeakMap(), _KycService_idosEnclaveBaseUrl = new WeakMap(), _KycService_idosRelayBaseUrl = new WeakMap(), _KycService_instances = new WeakSet(), _KycService_fetchWellKnownJwks = 
+/**
+ * Fetches a well-known JWKS from `baseUrl`, caching the result for an hour.
+ *
+ * @param baseUrl - Host base URL that serves `/.well-known/jwks.json`.
+ * @param queryName - Cache query-key segment.
+ * @param responseLabel - Label used in malformed-response errors.
+ * @param missingConfigMessage - Error thrown when `baseUrl` is empty.
+ * @returns The JWKS keys.
+ */
+async function _KycService_fetchWellKnownJwks(baseUrl, queryName, responseLabel, missingConfigMessage) {
+    if (!baseUrl) {
+        throw new Error(missingConfigMessage);
+    }
+    const url = new URL(constants_js_1.UKYC_JWKS_PATH, baseUrl);
+    const data = await this.fetchQuery({
+        queryKey: [`${this.name}:${queryName}`, baseUrl],
+        queryFn: async () => __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_requestJson).call(this, url, { method: 'GET' }, { authenticated: false }),
+        staleTime: (0, utils_1.inMilliseconds)(1, utils_1.Duration.Hour),
+    });
+    return __classPrivateFieldGet(this, _KycService_instances, "m", _KycService_validateResponse).call(this, data, JwksResponseStruct, responseLabel);
+}, _KycService_validateResponse = function _KycService_validateResponse(data, struct, apiName) {
     try {
         (0, superstruct_1.assert)(data, struct);
         return data;
@@ -571,7 +607,7 @@ _KycService_fetch = new WeakMap(), _KycService_baseUrl = new WeakMap(), _KycServ
  * wraps it in the shared service policy (retries, circuit breaker). Requests
  * are authenticated with the wallet bearer token by default; pass
  * `{ authenticated: false }` for calls to services that do not expect it
- * (e.g. the Fractal JWKS endpoint).
+ * (e.g. the idOS enclave or idOS relay JWKS endpoints).
  *
  * @param url - The request URL.
  * @param init - The request init (method, body).