@metamask-previews/kyc-controller 0.6.1-preview-1a7a6d6d6 → 0.7.0-preview-1d9e239b6

package/CHANGELOG.md

@@ -7,8 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Bump `@metamask/profile-sync-controller` from `^34.0.2` to `^34.0.3` ([#10761](https://github.com/MetaMask/core/pull/10761))
+
+## [0.7.0]
+
 ### Added
 
+- Add `KycController.readSessionStatus`, which returns `state.sessionStatus` and does not start polling, and `KycController.fetchSessionStatusOnce`, which calls `getSessionStatus` once, writes the result onto state, and does not start the session-status timer. Both are messenger actions ([#10749](https://github.com/MetaMask/core/pull/10749))
 - Add optional `aal2Token` parameter to `KycController.startSession` and the `KycController:startSession` messenger action ([#10632](https://github.com/MetaMask/core/pull/10632))
 
 ### Changed
@@ -20,6 +27,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Reusing the session already in state, or the latest vendor session, does not require `aal2Token`
 - Increase the UKYC capability token lifetime from 4 hours to 72 hours ([#10679](https://github.com/MetaMask/core/pull/10679))
 - Bump `@noble/curves` from `^1.9.2` to `^1.9.7` ([#10720](https://github.com/MetaMask/core/pull/10720))
+- Bump `@metamask/profile-sync-controller` from `^34.0.0` to `^34.0.2` ([#10752](https://github.com/MetaMask/core/pull/10752), [#10756](https://github.com/MetaMask/core/pull/10756))
 
 ## [0.6.1]
 
@@ -122,7 +130,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Initial Release ([#10145](https://github.com/MetaMask/core/pull/10145))
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/kyc-controller@0.6.1...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/kyc-controller@0.7.0...HEAD
+[0.7.0]: https://github.com/MetaMask/core/compare/@metamask/kyc-controller@0.6.1...@metamask/kyc-controller@0.7.0
 [0.6.1]: https://github.com/MetaMask/core/compare/@metamask/kyc-controller@0.6.0...@metamask/kyc-controller@0.6.1
 [0.6.0]: https://github.com/MetaMask/core/compare/@metamask/kyc-controller@0.5.0...@metamask/kyc-controller@0.6.0
 [0.5.0]: https://github.com/MetaMask/core/compare/@metamask/kyc-controller@0.4.0...@metamask/kyc-controller@0.5.0

package/dist/KycController-method-action-types.d.ts

@@ -63,6 +63,29 @@ export type KycControllerRefreshSessionStatusAction = {
     type: `KycController:refreshSessionStatus`;
     handler: KycController['refreshSessionStatus'];
 };
+/**
+ * Returns the persisted session status.
+ *
+ * Does not call the network and does not start session-status polling.
+ *
+ * @returns The session on state, or `null` when none is stored.
+ */
+export type KycControllerReadSessionStatusAction = {
+    type: `KycController:readSessionStatus`;
+    handler: KycController['readSessionStatus'];
+};
+/**
+ * Fetches `GET /sessions/{id}/status` once and writes the result onto state.
+ *
+ * Does not start the session-status polling timer.
+ *
+ * @param sessionId - UKYC session id.
+ * @returns The fetched session status.
+ */
+export type KycControllerFetchSessionStatusOnceAction = {
+    type: `KycController:fetchSessionStatusOnce`;
+    handler: KycController['fetchSessionStatusOnce'];
+};
 /**
  * Starts polling `GET /sessions/{id}/status` for
  * {@link KycControllerState.sessionStatus}'s current `id`. Each tick writes
@@ -177,5 +200,5 @@ export type KycControllerLaunchProviderFlowAction = {
 /**
  * Union of all KycController action types.
  */
-export type KycControllerMethodActions = KycControllerStartSessionAction | KycControllerResetAction | KycControllerClearStateAction | KycControllerGetSessionStatusForVendorAction | KycControllerGetProviderFlowStatusAction | KycControllerRefreshSessionStatusAction | KycControllerStartSessionStatusPollingAction | KycControllerFetchSessionDisclaimersAction | KycControllerRecordSessionDisclaimersAction | KycControllerHasCompletedSessionDisclaimersAction | KycControllerFetchVendorDisclaimersAction | KycControllerRecordVendorDisclaimersAction | KycControllerHasCompletedVendorDisclaimersAction | KycControllerLaunchProviderFlowAction;
+export type KycControllerMethodActions = KycControllerStartSessionAction | KycControllerResetAction | KycControllerClearStateAction | KycControllerGetSessionStatusForVendorAction | KycControllerGetProviderFlowStatusAction | KycControllerRefreshSessionStatusAction | KycControllerReadSessionStatusAction | KycControllerFetchSessionStatusOnceAction | KycControllerStartSessionStatusPollingAction | KycControllerFetchSessionDisclaimersAction | KycControllerRecordSessionDisclaimersAction | KycControllerHasCompletedSessionDisclaimersAction | KycControllerFetchVendorDisclaimersAction | KycControllerRecordVendorDisclaimersAction | KycControllerHasCompletedVendorDisclaimersAction | KycControllerLaunchProviderFlowAction;
 //# sourceMappingURL=KycController-method-action-types.d.ts.map

package/dist/KycController-method-action-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KycController-method-action-types.d.ts","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,4BAA4B,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,aAAa,CAAC,2BAA2B,CAAC,CAAC;CACrD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,aAAa,CAAC,2BAA2B,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,uCAAuC,CAAC;IAC9C,OAAO,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iDAAiD,GAAG;IAC9D,IAAI,EAAE,8CAA8C,CAAC;IACrD,OAAO,EAAE,aAAa,CAAC,gCAAgC,CAAC,CAAC;CAC1D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,yCAAyC,GAAG;IACtD,IAAI,EAAE,sCAAsC,CAAC;IAC7C,OAAO,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;CAClD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,uCAAuC,CAAC;IAC9C,OAAO,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,+BAA+B,GAC/B,wBAAwB,GACxB,6BAA6B,GAC7B,4CAA4C,GAC5C,wCAAwC,GACxC,uCAAuC,GACvC,4CAA4C,GAC5C,0CAA0C,GAC1C,2CAA2C,GAC3C,iDAAiD,GACjD,yCAAyC,GACzC,0CAA0C,GAC1C,gDAAgD,GAChD,qCAAqC,CAAC"}
+{"version":3,"file":"KycController-method-action-types.d.ts","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,4BAA4B,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,aAAa,CAAC,2BAA2B,CAAC,CAAC;CACrD,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,wCAAwC,GAAG;IACrD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,uCAAuC,GAAG;IACpD,IAAI,EAAE,oCAAoC,CAAC;IAC3C,OAAO,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,oCAAoC,GAAG;IACjD,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,yCAAyC,GAAG;IACtD,IAAI,EAAE,sCAAsC,CAAC;IAC7C,OAAO,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;CAClD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,4CAA4C,GAAG;IACzD,IAAI,EAAE,yCAAyC,CAAC;IAChD,OAAO,EAAE,aAAa,CAAC,2BAA2B,CAAC,CAAC;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,uCAAuC,CAAC;IAC9C,OAAO,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,2CAA2C,GAAG;IACxD,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;CACpD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iDAAiD,GAAG;IAC9D,IAAI,EAAE,8CAA8C,CAAC;IACrD,OAAO,EAAE,aAAa,CAAC,gCAAgC,CAAC,CAAC;CAC1D,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,yCAAyC,GAAG;IACtD,IAAI,EAAE,sCAAsC,CAAC;IAC7C,OAAO,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;CAClD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0CAA0C,GAAG;IACvD,IAAI,EAAE,uCAAuC,CAAC;IAC9C,OAAO,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,gDAAgD,GAAG;IAC7D,IAAI,EAAE,6CAA6C,CAAC;IACpD,OAAO,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,qCAAqC,GAAG;IAClD,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,+BAA+B,GAC/B,wBAAwB,GACxB,6BAA6B,GAC7B,4CAA4C,GAC5C,wCAAwC,GACxC,uCAAuC,GACvC,oCAAoC,GACpC,yCAAyC,GACzC,4CAA4C,GAC5C,0CAA0C,GAC1C,2CAA2C,GAC3C,iDAAiD,GACjD,yCAAyC,GACzC,0CAA0C,GAC1C,gDAAgD,GAChD,qCAAqC,CAAC"}

package/dist/KycController-method-action-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"KycController-method-action-types.js","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycController } from './KycController.js';\n\n/**\n * Starts a KYC session for the given vendor and email. Reuses a latest\n * vendor session when one exists; otherwise creates a UKYC session.\n *\n * @param params - The session parameters.\n * @param params.vendor - Identity vendor for the session.\n * @param params.email - Account email associated with the session.\n * @param params.aal2Token - AAL2 authentication token. Required only when a\n * UKYC session must be created, where it is sent as the Authorization bearer\n * value. Omit it when reusing an existing session.\n * @returns The current or newly created session status.\n */\nexport type KycControllerStartSessionAction = {\n  type: `KycController:startSession`;\n  handler: KycController['startSession'];\n};\n\n/**\n * Stops session-status polling and restores default controller state.\n */\nexport type KycControllerResetAction = {\n  type: `KycController:reset`;\n  handler: KycController['reset'];\n};\n\n/**\n * Restores the controller to its default state.\n */\nexport type KycControllerClearStateAction = {\n  type: `KycController:clearState`;\n  handler: KycController['clearState'];\n};\n\n/**\n * Fetches the latest UKYC session status for a vendor.\n *\n * @param vendor - Identity vendor whose latest session should be queried.\n * @returns The session status, or `null` when none exists.\n */\nexport type KycControllerGetSessionStatusForVendorAction = {\n  type: `KycController:getSessionStatusForVendor`;\n  handler: KycController['getSessionStatusForVendor'];\n};\n\n/**\n * Returns the durable outcome of the identity-provider flow.\n *\n * @returns The latest provider-flow status.\n */\nexport type KycControllerGetProviderFlowStatusAction = {\n  type: `KycController:getProviderFlowStatus`;\n  handler: KycController['getProviderFlowStatus'];\n};\n\n/**\n * Returns the current session status and starts polling when it is not yet\n * terminal.\n *\n * @returns The current session status.\n * @throws If there is no session on state.\n */\nexport type KycControllerRefreshSessionStatusAction = {\n  type: `KycController:refreshSessionStatus`;\n  handler: KycController['refreshSessionStatus'];\n};\n\n/**\n * Starts polling `GET /sessions/{id}/status` for\n * {@link KycControllerState.sessionStatus}'s current `id`. Each tick writes\n * the result onto state only when the payload changed. The loop stops once\n * `finalStatus` is `approved`, `rejected`, or `retry`, or when\n * {@link reset} / {@link clearState} runs.\n *\n * @throws If there is no current session id to poll.\n */\nexport type KycControllerStartSessionStatusPollingAction = {\n  type: `KycController:startSessionStatusPolling`;\n  handler: KycController['startSessionStatusPolling'];\n};\n\n/**\n * Fetches the idOS + KYC-provider disclaimer catalog. Pass exactly one of\n * `sessionId` or `country`:\n *\n * - `{ sessionId }` → {@link KycService.fetchSessionDisclaimersBySessionId}\n * (`GET /sessions/{sessionId}/disclaimers`)\n * - `{ country }` → {@link KycService.fetchSessionDisclaimersByCountry}\n * (`GET /disclaimers?country=`)\n *\n * A session-id fetch also writes the catalog to `sessionDisclaimers`.\n *\n * @param params - The parameters. Provide exactly one of `sessionId` or\n * `country`.\n * @param params.sessionId - The UKYC session id.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The catalog. Session fetches include consent state; country\n * fetches do not.\n */\nexport type KycControllerFetchSessionDisclaimersAction = {\n  type: `KycController:fetchSessionDisclaimers`;\n  handler: KycController['fetchSessionDisclaimers'];\n};\n\n/**\n * Fetches the session-scoped disclaimer catalog and records consents\n * derived from the T&C2 flags. Already-consented catalog rows are omitted\n * from the POST. A 409 is re-checked with a GET: continue only when every\n * accepted document is now consented, otherwise fail closed.\n *\n * @param params - Accepted session-disclaimer records.\n * @param params.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.\n * @param params.idosDisclaimersAccepted - Accepted idOS disclaimer records.\n * @param params.credentialReusabilityConsentGiven - Whether credential\n * reuse was accepted.\n */\nexport type KycControllerRecordSessionDisclaimersAction = {\n  type: `KycController:recordSessionDisclaimers`;\n  handler: KycController['recordSessionDisclaimers'];\n};\n\n/**\n * Fetches session-scoped disclaimers and reports whether every document is\n * consented and credential reuse was accepted.\n *\n * @returns Whether session disclaimers are complete.\n * @throws If there is no session on state.\n */\nexport type KycControllerHasCompletedSessionDisclaimersAction = {\n  type: `KycController:hasCompletedSessionDisclaimers`;\n  handler: KycController['hasCompletedSessionDisclaimers'];\n};\n\n/**\n * Fetches the vendor T&Cs the customer must accept before a session is\n * created (`GET /vendors/{vendor}/disclaimers?country=`).\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor. Defaults to `moonpay`.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The disclaimers.\n */\nexport type KycControllerFetchVendorDisclaimersAction = {\n  type: `KycController:fetchVendorDisclaimers`;\n  handler: KycController['fetchVendorDisclaimers'];\n};\n\n/**\n * Records vendor T&C acceptance via {@link KycService.submitVendorDisclaimers}\n * and persists the accepted ids on state.\n *\n * @param params - The parameters.\n * @param params.disclaimerIds - Accepted vendor T&C ids.\n * @returns The vendor signing records.\n * @throws If `vendor` is missing from state.\n */\nexport type KycControllerRecordVendorDisclaimersAction = {\n  type: `KycController:recordVendorDisclaimers`;\n  handler: KycController['recordVendorDisclaimers'];\n};\n\n/**\n * Fetches the current vendor T&C catalog and returns whether every document\n * is already recorded in {@link KycControllerState.vendorDisclaimersAccepted}.\n *\n * @returns Whether persisted acceptance covers the fetched catalog.\n * @throws If `vendor` or `geoCountry` is missing from state.\n */\nexport type KycControllerHasCompletedVendorDisclaimersAction = {\n  type: `KycController:hasCompletedVendorDisclaimers`;\n  handler: KycController['hasCompletedVendorDisclaimers'];\n};\n\n/**\n * Presents the identity-provider verification UI. Currently launches SumSub.\n *\n * @param params - Optional SDK presentation options.\n * @param params.locale - BCP-47 locale for the SDK UI.\n * @param params.debug - Enables SDK debug logging.\n * @returns The durable provider-flow outcome.\n */\nexport type KycControllerLaunchProviderFlowAction = {\n  type: `KycController:launchProviderFlow`;\n  handler: KycController['launchProviderFlow'];\n};\n\n/**\n * Union of all KycController action types.\n */\nexport type KycControllerMethodActions =\n  | KycControllerStartSessionAction\n  | KycControllerResetAction\n  | KycControllerClearStateAction\n  | KycControllerGetSessionStatusForVendorAction\n  | KycControllerGetProviderFlowStatusAction\n  | KycControllerRefreshSessionStatusAction\n  | KycControllerStartSessionStatusPollingAction\n  | KycControllerFetchSessionDisclaimersAction\n  | KycControllerRecordSessionDisclaimersAction\n  | KycControllerHasCompletedSessionDisclaimersAction\n  | KycControllerFetchVendorDisclaimersAction\n  | KycControllerRecordVendorDisclaimersAction\n  | KycControllerHasCompletedVendorDisclaimersAction\n  | KycControllerLaunchProviderFlowAction;\n"]}
+{"version":3,"file":"KycController-method-action-types.js","sourceRoot":"","sources":["../src/KycController-method-action-types.ts"],"names":[],"mappings":"AAAA;;;GAGG","sourcesContent":["/**\n * This file is auto generated.\n * Do not edit manually.\n */\n\nimport type { KycController } from './KycController.js';\n\n/**\n * Starts a KYC session for the given vendor and email. Reuses a latest\n * vendor session when one exists; otherwise creates a UKYC session.\n *\n * @param params - The session parameters.\n * @param params.vendor - Identity vendor for the session.\n * @param params.email - Account email associated with the session.\n * @param params.aal2Token - AAL2 authentication token. Required only when a\n * UKYC session must be created, where it is sent as the Authorization bearer\n * value. Omit it when reusing an existing session.\n * @returns The current or newly created session status.\n */\nexport type KycControllerStartSessionAction = {\n  type: `KycController:startSession`;\n  handler: KycController['startSession'];\n};\n\n/**\n * Stops session-status polling and restores default controller state.\n */\nexport type KycControllerResetAction = {\n  type: `KycController:reset`;\n  handler: KycController['reset'];\n};\n\n/**\n * Restores the controller to its default state.\n */\nexport type KycControllerClearStateAction = {\n  type: `KycController:clearState`;\n  handler: KycController['clearState'];\n};\n\n/**\n * Fetches the latest UKYC session status for a vendor.\n *\n * @param vendor - Identity vendor whose latest session should be queried.\n * @returns The session status, or `null` when none exists.\n */\nexport type KycControllerGetSessionStatusForVendorAction = {\n  type: `KycController:getSessionStatusForVendor`;\n  handler: KycController['getSessionStatusForVendor'];\n};\n\n/**\n * Returns the durable outcome of the identity-provider flow.\n *\n * @returns The latest provider-flow status.\n */\nexport type KycControllerGetProviderFlowStatusAction = {\n  type: `KycController:getProviderFlowStatus`;\n  handler: KycController['getProviderFlowStatus'];\n};\n\n/**\n * Returns the current session status and starts polling when it is not yet\n * terminal.\n *\n * @returns The current session status.\n * @throws If there is no session on state.\n */\nexport type KycControllerRefreshSessionStatusAction = {\n  type: `KycController:refreshSessionStatus`;\n  handler: KycController['refreshSessionStatus'];\n};\n\n/**\n * Returns the persisted session status.\n *\n * Does not call the network and does not start session-status polling.\n *\n * @returns The session on state, or `null` when none is stored.\n */\nexport type KycControllerReadSessionStatusAction = {\n  type: `KycController:readSessionStatus`;\n  handler: KycController['readSessionStatus'];\n};\n\n/**\n * Fetches `GET /sessions/{id}/status` once and writes the result onto state.\n *\n * Does not start the session-status polling timer.\n *\n * @param sessionId - UKYC session id.\n * @returns The fetched session status.\n */\nexport type KycControllerFetchSessionStatusOnceAction = {\n  type: `KycController:fetchSessionStatusOnce`;\n  handler: KycController['fetchSessionStatusOnce'];\n};\n\n/**\n * Starts polling `GET /sessions/{id}/status` for\n * {@link KycControllerState.sessionStatus}'s current `id`. Each tick writes\n * the result onto state only when the payload changed. The loop stops once\n * `finalStatus` is `approved`, `rejected`, or `retry`, or when\n * {@link reset} / {@link clearState} runs.\n *\n * @throws If there is no current session id to poll.\n */\nexport type KycControllerStartSessionStatusPollingAction = {\n  type: `KycController:startSessionStatusPolling`;\n  handler: KycController['startSessionStatusPolling'];\n};\n\n/**\n * Fetches the idOS + KYC-provider disclaimer catalog. Pass exactly one of\n * `sessionId` or `country`:\n *\n * - `{ sessionId }` → {@link KycService.fetchSessionDisclaimersBySessionId}\n * (`GET /sessions/{sessionId}/disclaimers`)\n * - `{ country }` → {@link KycService.fetchSessionDisclaimersByCountry}\n * (`GET /disclaimers?country=`)\n *\n * A session-id fetch also writes the catalog to `sessionDisclaimers`.\n *\n * @param params - The parameters. Provide exactly one of `sessionId` or\n * `country`.\n * @param params.sessionId - The UKYC session id.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The catalog. Session fetches include consent state; country\n * fetches do not.\n */\nexport type KycControllerFetchSessionDisclaimersAction = {\n  type: `KycController:fetchSessionDisclaimers`;\n  handler: KycController['fetchSessionDisclaimers'];\n};\n\n/**\n * Fetches the session-scoped disclaimer catalog and records consents\n * derived from the T&C2 flags. Already-consented catalog rows are omitted\n * from the POST. A 409 is re-checked with a GET: continue only when every\n * accepted document is now consented, otherwise fail closed.\n *\n * @param params - Accepted session-disclaimer records.\n * @param params.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.\n * @param params.idosDisclaimersAccepted - Accepted idOS disclaimer records.\n * @param params.credentialReusabilityConsentGiven - Whether credential\n * reuse was accepted.\n */\nexport type KycControllerRecordSessionDisclaimersAction = {\n  type: `KycController:recordSessionDisclaimers`;\n  handler: KycController['recordSessionDisclaimers'];\n};\n\n/**\n * Fetches session-scoped disclaimers and reports whether every document is\n * consented and credential reuse was accepted.\n *\n * @returns Whether session disclaimers are complete.\n * @throws If there is no session on state.\n */\nexport type KycControllerHasCompletedSessionDisclaimersAction = {\n  type: `KycController:hasCompletedSessionDisclaimers`;\n  handler: KycController['hasCompletedSessionDisclaimers'];\n};\n\n/**\n * Fetches the vendor T&Cs the customer must accept before a session is\n * created (`GET /vendors/{vendor}/disclaimers?country=`).\n *\n * @param params - The parameters.\n * @param params.vendor - Identity vendor. Defaults to `moonpay`.\n * @param params.country - ISO 3166-1 alpha-3 country code.\n * @returns The disclaimers.\n */\nexport type KycControllerFetchVendorDisclaimersAction = {\n  type: `KycController:fetchVendorDisclaimers`;\n  handler: KycController['fetchVendorDisclaimers'];\n};\n\n/**\n * Records vendor T&C acceptance via {@link KycService.submitVendorDisclaimers}\n * and persists the accepted ids on state.\n *\n * @param params - The parameters.\n * @param params.disclaimerIds - Accepted vendor T&C ids.\n * @returns The vendor signing records.\n * @throws If `vendor` is missing from state.\n */\nexport type KycControllerRecordVendorDisclaimersAction = {\n  type: `KycController:recordVendorDisclaimers`;\n  handler: KycController['recordVendorDisclaimers'];\n};\n\n/**\n * Fetches the current vendor T&C catalog and returns whether every document\n * is already recorded in {@link KycControllerState.vendorDisclaimersAccepted}.\n *\n * @returns Whether persisted acceptance covers the fetched catalog.\n * @throws If `vendor` or `geoCountry` is missing from state.\n */\nexport type KycControllerHasCompletedVendorDisclaimersAction = {\n  type: `KycController:hasCompletedVendorDisclaimers`;\n  handler: KycController['hasCompletedVendorDisclaimers'];\n};\n\n/**\n * Presents the identity-provider verification UI. Currently launches SumSub.\n *\n * @param params - Optional SDK presentation options.\n * @param params.locale - BCP-47 locale for the SDK UI.\n * @param params.debug - Enables SDK debug logging.\n * @returns The durable provider-flow outcome.\n */\nexport type KycControllerLaunchProviderFlowAction = {\n  type: `KycController:launchProviderFlow`;\n  handler: KycController['launchProviderFlow'];\n};\n\n/**\n * Union of all KycController action types.\n */\nexport type KycControllerMethodActions =\n  | KycControllerStartSessionAction\n  | KycControllerResetAction\n  | KycControllerClearStateAction\n  | KycControllerGetSessionStatusForVendorAction\n  | KycControllerGetProviderFlowStatusAction\n  | KycControllerRefreshSessionStatusAction\n  | KycControllerReadSessionStatusAction\n  | KycControllerFetchSessionStatusOnceAction\n  | KycControllerStartSessionStatusPollingAction\n  | KycControllerFetchSessionDisclaimersAction\n  | KycControllerRecordSessionDisclaimersAction\n  | KycControllerHasCompletedSessionDisclaimersAction\n  | KycControllerFetchVendorDisclaimersAction\n  | KycControllerRecordVendorDisclaimersAction\n  | KycControllerHasCompletedVendorDisclaimersAction\n  | KycControllerLaunchProviderFlowAction;\n"]}

package/dist/KycController.d.ts

@@ -171,6 +171,23 @@ export declare class KycController extends BaseController<typeof controllerName,
      * @throws If there is no session on state.
      */
     refreshSessionStatus(): KycSessionStatus;
+    /**
+     * Returns the persisted session status.
+     *
+     * Does not call the network and does not start session-status polling.
+     *
+     * @returns The session on state, or `null` when none is stored.
+     */
+    readSessionStatus(): KycSessionStatus | null;
+    /**
+     * Fetches `GET /sessions/{id}/status` once and writes the result onto state.
+     *
+     * Does not start the session-status polling timer.
+     *
+     * @param sessionId - UKYC session id.
+     * @returns The fetched session status.
+     */
+    fetchSessionStatusOnce(sessionId: string): Promise<KycSessionStatus>;
     /**
      * Starts polling `GET /sessions/{id}/status` for
      * {@link KycControllerState.sessionStatus}'s current `id`. Each tick writes

package/dist/KycController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KycController.d.ts","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,4CAA4C,EAC5C,4CAA4C,EAC7C,MAAM,gDAAgD,CAAC;AAKxD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AASnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAM/D,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,4BAA4B,EAC5B,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAmBpB,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAE9C,eAAO,MAAM,0BAA0B,YACrC,aAAa,EACb,WAAW,EACX,WAAW,EACX,QAAQ,CACA,CAAC;AAEX;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAahF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IAEzB,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,wEAAwE;IACxE,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAEvC,oEAAoE;IACpE,kBAAkB,EAAE,qBAAqB,CAAC;IAG1C;;;;OAIG;IACH,yBAAyB,EAAE,4BAA4B,CAAC;IACxD;;;;;;OAMG;IACH,2BAA2B,EAAE,8BAA8B,CAAC;IAC5D;;;;;OAKG;IACH,uBAAuB,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IACnD;;;;;OAKG;IACH,iCAAiC,EAAE,OAAO,GAAG,IAAI,CAAC;CACnD,CAAC;AA2DF;;;;GAIG;AACH,wBAAgB,sCAAsC,IAAI,4BAA4B,CAErF;AAED;;;;GAIG;AACH,wBAAgB,wCAAwC,IAAI,8BAA8B,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,kBAAkB,CAYjE;AAED;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GACrC;IACE,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,GACD;IACE,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB,CAAC;AAqBN,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAChE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,KAAK,cAAc,GACf,uBAAuB,GACvB,4CAA4C,GAC5C,4CAA4C,CAAC;AAEjD,MAAM,MAAM,6BAA6B,GAAG,0BAA0B,CACpE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAEhE,KAAK,aAAa,GAAG,KAAK,CAAC;AAE3B,MAAM,MAAM,sBAAsB,GAAG,SAAS,CAC5C,OAAO,cAAc,EACrB,oBAAoB,GAAG,cAAc,EACrC,mBAAmB,GAAG,aAAa,CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpC;;;OAGG;IACH,cAAc,EAAE,iBAAiB,CAAC;CACnC,CAAC;AAIF;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,cAAc,CAC/C,OAAO,cAAc,EACrB,kBAAkB,EAClB,sBAAsB,CACvB;;IAcC;;;;;;;OAOG;IACH,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,oBAAoB,EAerE;IAED;;;;;;;;;;;OAWG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiE5B;IAED;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAED;;OAEG;IACH,UAAU,IAAI,IAAI,CAejB;IAED;;;;;OAKG;IACH,yBAAyB,CACvB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElC;IAED;;;;OAIG;IACH,qBAAqB,IAAI,qBAAqB,CAE7C;IAED;;;;;;OAMG;IACH,oBAAoB,IAAI,gBAAgB,CAQvC;IAED;;;;;;;;OAQG;IACH,yBAAyB,IAAI,IAAI,CAyBhC;IAuHD;;;;;;;;;;;;;;;;;OAiBG;IACG,uBAAuB,CAC3B,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,CA6BxD;IAED;;;;;;;;;;;OAWG;IACG,wBAAwB,CAAC,MAAM,EAAE;QACrC,2BAA2B,EAAE,gBAAgB,EAAE,CAAC;QAChD,uBAAuB,EAAE,gBAAgB,EAAE,CAAC;QAC5C,iCAAiC,EAAE,OAAO,CAAC;KAC5C,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB;IAED;;;;;;OAMG;IACG,8BAA8B,IAAI,OAAO,CAAC,OAAO,CAAC,CAavD;IAED;;;;;;;;OAQG;IACG,sBAAsB,CAAC,MAAM,EAAE;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAE3B;IAED;;;;;;;;OAQG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA+B9B;IAED;;;;;;OAMG;IACG,6BAA6B,IAAI,OAAO,CAAC,OAAO,CAAC,CAmBtD;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,EACjB,MAAM,EACN,KAAK,GACN,EAAE;QACD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAGjC;CA+LF"}
+{"version":3,"file":"KycController.d.ts","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EACV,4CAA4C,EAC5C,4CAA4C,EAC7C,MAAM,gDAAgD,CAAC;AAKxD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AASnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAM/D,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,4BAA4B,EAC5B,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAmBpB,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAE9C,eAAO,MAAM,0BAA0B,YACrC,aAAa,EACb,WAAW,EACX,WAAW,EACX,QAAQ,CACA,CAAC;AAEX;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAahF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IAEzB,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,wEAAwE;IACxE,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAEvC,oEAAoE;IACpE,kBAAkB,EAAE,qBAAqB,CAAC;IAG1C;;;;OAIG;IACH,yBAAyB,EAAE,4BAA4B,CAAC;IACxD;;;;;;OAMG;IACH,2BAA2B,EAAE,8BAA8B,CAAC;IAC5D;;;;;OAKG;IACH,uBAAuB,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IACnD;;;;;OAKG;IACH,iCAAiC,EAAE,OAAO,GAAG,IAAI,CAAC;CACnD,CAAC;AA2DF;;;;GAIG;AACH,wBAAgB,sCAAsC,IAAI,4BAA4B,CAErF;AAED;;;;GAIG;AACH,wBAAgB,wCAAwC,IAAI,8BAA8B,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,kBAAkB,CAYjE;AAED;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GACrC;IACE,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,GACD;IACE,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB,CAAC;AAuBN,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAChE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,KAAK,cAAc,GACf,uBAAuB,GACvB,4CAA4C,GAC5C,4CAA4C,CAAC;AAEjD,MAAM,MAAM,6BAA6B,GAAG,0BAA0B,CACpE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAEhE,KAAK,aAAa,GAAG,KAAK,CAAC;AAE3B,MAAM,MAAM,sBAAsB,GAAG,SAAS,CAC5C,OAAO,cAAc,EACrB,oBAAoB,GAAG,cAAc,EACrC,mBAAmB,GAAG,aAAa,CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpC;;;OAGG;IACH,cAAc,EAAE,iBAAiB,CAAC;CACnC,CAAC;AAIF;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,cAAc,CAC/C,OAAO,cAAc,EACrB,kBAAkB,EAClB,sBAAsB,CACvB;;IAcC;;;;;;;OAOG;IACH,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,oBAAoB,EAerE;IAED;;;;;;;;;;;OAWG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiE5B;IAED;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAED;;OAEG;IACH,UAAU,IAAI,IAAI,CAejB;IAED;;;;;OAKG;IACH,yBAAyB,CACvB,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElC;IAED;;;;OAIG;IACH,qBAAqB,IAAI,qBAAqB,CAE7C;IAED;;;;;;OAMG;IACH,oBAAoB,IAAI,gBAAgB,CAQvC;IAED;;;;;;OAMG;IACH,iBAAiB,IAAI,gBAAgB,GAAG,IAAI,CAE3C;IAED;;;;;;;OAOG;IACG,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CASzE;IAED;;;;;;;;OAQG;IACH,yBAAyB,IAAI,IAAI,CAyBhC;IAuHD;;;;;;;;;;;;;;;;;OAiBG;IACG,uBAAuB,CAC3B,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,CA6BxD;IAED;;;;;;;;;;;OAWG;IACG,wBAAwB,CAAC,MAAM,EAAE;QACrC,2BAA2B,EAAE,gBAAgB,EAAE,CAAC;QAChD,uBAAuB,EAAE,gBAAgB,EAAE,CAAC;QAC5C,iCAAiC,EAAE,OAAO,CAAC;KAC5C,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB;IAED;;;;;;OAMG;IACG,8BAA8B,IAAI,OAAO,CAAC,OAAO,CAAC,CAavD;IAED;;;;;;;;OAQG;IACG,sBAAsB,CAAC,MAAM,EAAE;QACnC,MAAM,CAAC,EAAE,SAAS,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAE3B;IAED;;;;;;;;OAQG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA+B9B;IAED;;;;;;OAMG;IACG,6BAA6B,IAAI,OAAO,CAAC,OAAO,CAAC,CAmBtD;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,EACjB,MAAM,EACN,KAAK,GACN,EAAE;QACD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAGjC;CA+LF"}

package/dist/KycController.js

@@ -124,6 +124,8 @@ const MESSENGER_EXPOSED_METHODS = [
     'getSessionStatusForVendor',
     'getProviderFlowStatus',
     'refreshSessionStatus',
+    'readSessionStatus',
+    'fetchSessionStatusOnce',
     'startSessionStatusPolling',
     'fetchSessionDisclaimers',
     'recordSessionDisclaimers',
@@ -288,6 +290,31 @@ export class KycController extends BaseController {
         }
         return this.state.sessionStatus;
     }
+    /**
+     * Returns the persisted session status.
+     *
+     * Does not call the network and does not start session-status polling.
+     *
+     * @returns The session on state, or `null` when none is stored.
+     */
+    readSessionStatus() {
+        return this.state.sessionStatus;
+    }
+    /**
+     * Fetches `GET /sessions/{id}/status` once and writes the result onto state.
+     *
+     * Does not start the session-status polling timer.
+     *
+     * @param sessionId - UKYC session id.
+     * @returns The fetched session status.
+     */
+    async fetchSessionStatusOnce(sessionId) {
+        const sessionStatus = await this.messenger.call('KycService:getSessionStatus', { sessionId });
+        this.update((state) => {
+            state.sessionStatus = sessionStatus;
+        });
+        return sessionStatus;
+    }
     /**
      * Starts polling `GET /sessions/{id}/status` for
      * {@link KycControllerState.sessionStatus}'s current `id`. Each tick writes

package/dist/KycController.js.map

@@ -1 +1 @@
-{"version":3,"file":"KycController.js","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAM3D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAO5C,OAAO,EACL,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAYvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAEhC,kBAAkB;AAElB,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAE9C,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,aAAa;IACb,WAAW;IACX,WAAW;IACX,QAAQ;CACA,CAAC;AAUX,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,wEAAwE;AACxE,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAqD/C,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE;QACL,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;IACD,MAAM,EAAE;QACN,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;KACf;IACD,UAAU,EAAE;QACV,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;KACf;IACD,aAAa,EAAE;QACb,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;KACf;IACD,kBAAkB,EAAE;QAClB,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;KACf;IACD,yBAAyB,EAAE;QACzB,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;IACD,2BAA2B,EAAE;QAC3B,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;IACD,uBAAuB,EAAE;QACvB,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;IACD,iCAAiC,EAAE;QACjC,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;CAC0C,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,sCAAsC;IACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wCAAwC;IACtD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,aAAa;QACjC,yBAAyB,EAAE,sCAAsC,EAAE;QACnE,2BAA2B,EAAE,wCAAwC,EAAE;QACvE,uBAAuB,EAAE,IAAI;QAC7B,iCAAiC,EAAE,IAAI;KACxC,CAAC;AACJ,CAAC;AAkBD,oBAAoB;AAEpB,MAAM,yBAAyB,GAAG;IAChC,cAAc;IACd,OAAO;IACP,YAAY;IACZ,2BAA2B;IAC3B,uBAAuB;IACvB,sBAAsB;IACtB,2BAA2B;IAC3B,yBAAyB;IACzB,0BAA0B;IAC1B,gCAAgC;IAChC,wBAAwB;IACxB,yBAAyB;IACzB,+BAA+B;IAC/B,oBAAoB;CACZ,CAAC;AA4CX,gCAAgC;AAEhC;;;;;;GAMG;AACH,MAAM,OAAO,aAAc,SAAQ,cAIlC;IACU,eAAe,CAAoB;IAEnC,qBAAqB,CAA2B;IAEzD,oEAAoE;IACpE,uBAAuB,GAAyC,IAAI,CAAC;IAErE;;;OAGG;IACH,uBAAuB,GAAG,CAAC,CAAC;IAE5B;;;;;;;OAOG;IACH,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAwB;QACpE,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ,EAAE,qBAAqB;YAC/B,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,4BAA4B,EAAE,EAAE,GAAG,KAAK,EAAE;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,qBAAqB,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,YAAY,CAAC,MAIlB;QACC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzE,IACE,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;YAC9B,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAC9B,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBACjC,KAAK,CAAC,kBAAkB,GAAG,aAAa,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC7C,sCAAsC,EACtC,MAAM,CAAC,MAAM,CACd,CAAC;YACF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;gBACtC,CAAC,CAAC,CAAC;gBACH,OAAO,aAAa,CAAC;YACvB,CAAC;YAED,iGAAiG;YACjG,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC3D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,uEAAuE;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;QAChC,uCAAuC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YACxB,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;YAC3B,KAAK,CAAC,kBAAkB,GAAG,aAAa,CAAC;YACzC,KAAK,CAAC,yBAAyB;gBAC7B,sCAAsC,EAAE,CAAC;YAC3C,KAAK,CAAC,2BAA2B;gBAC/B,wCAAwC,EAAE,CAAC;YAC7C,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACrC,KAAK,CAAC,iCAAiC,GAAG,IAAI,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,CACvB,MAAiB;QAEjB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED;;;;OAIG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB;QAClB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,yBAAyB;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC;QAE3C,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACrC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACvE,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7C,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,8DAA8D;gBAC9D,mEAAmE;gBACnE,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,+BAA+B,CAAC,CAAC;YACpC,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC;QACzC,CAAC,CAAC;QAEF,mEAAmE;QACnE,IAAI,EAAE,CAAC;IACT,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,sBAAsB,CAC1B,SAAiB,EACjB,KAAa;QAEb,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC7C,6BAA6B,EAC7B,EAAE,SAAS,EAAE,CACd,CAAC;YACF,IAAI,IAAI,CAAC,uBAAuB,KAAK,KAAK,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,iCAAiC;YACjC,IACE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBACxC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAC7B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;gBACtC,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,yBAAyB,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,uBAAuB,KAAK,KAAK,CAAC;QAChD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,yBAAyB;QACvB,IAAI,CAAC,uBAAuB,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;YAC1C,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC3C,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAIxB;QACC,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,uBAAuB,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/D,MAAM,sBAAsB,GAAG,WAAW,CACxC,MAAM,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAC7C,CAAC;QACF,mEAAmE;QACnE,wEAAwE;QACxE,qBAAqB;QACrB,MAAM,EACJ,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EAAE,qBAAqB,GAC3C,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC5D,sBAAsB;YACtB,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QAEzE,MAAM,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,GAC5D,MAAM,IAAI,CAAC,8BAA8B,CACvC,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,CACtB,CAAC;QAEJ,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC7C,8BAA8B,EAC9B;YACE,SAAS;YACT,wBAAwB;YACxB,0BAA0B;SAC3B,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,uBAAuB,CAC3B,MAAqC;QAErC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAG9B,CAAC;QACF,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CACxB,6CAA6C,EAC7C,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,+CAA+C,EAC/C,EAAE,SAAS,EAAE,CACd,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,wBAAwB,CAAC,MAI9B;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,8EAA8E;QAC9E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC3C,+CAA+C,EAC/C,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,CAC3C,CAAC;QAEF,MAAM,IAAI,GAAG,8BAA8B,CACzC,WAAW,CAAC,IAAI,EAChB,MAAM,CAAC,uBAAuB,CAC/B,CAAC;QACF,MAAM,WAAW,GAAG,8BAA8B,CAChD,WAAW,CAAC,WAAW,EACvB,MAAM,CAAC,2BAA2B,CACnC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBAC/D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE;gBACtC,IAAI;gBACJ,WAAW;gBACX,iCAAiC,EAC/B,MAAM,CAAC,iCAAiC;aAC3C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,8CAA8C;YAC9C,KAAK,CAAC,2BAA2B,CAAC,MAAM;gBACtC,MAAM,CAAC,2BAA2B,CAAC;YACrC,KAAK,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;YAC/D,KAAK,CAAC,iCAAiC;gBACrC,MAAM,CAAC,iCAAiC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,8BAA8B;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,qDAAqD;QACrD,6DAA6D;QAE7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC3C,+CAA+C,EAC/C,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,CAC3C,CAAC;QAEF,OAAO,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,sBAAsB,CAAC,MAG5B;QACC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,uBAAuB,CAAC,MAE7B;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACxC,oCAAoC,EACpC;YACE,MAAM;YACN,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CACF,CAAC;QAEF,2CAA2C;QAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,yBAAyB,GAAG,gCAAgC,CAChE,KAAK,CAAC,yBAAyB,EAC/B,MAAM,EACN;gBACE,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,6BAA6B;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACzB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,2CAA2C;QAC3C,OAAO,6BAA6B,CAClC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EACpC,IAAI,CAAC,KAAK,CAAC,MAAM,EACjB,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,EACjB,MAAM,EACN,KAAK,GAIN;QACC,+DAA+D;QAC/D,OAAO,IAAI,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACxD,0BAA0B,EAC1B,SAAS,CACV,CAAC;YAEF,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,yBAAyB;YACzB,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,IAAI,SAAS,GAAG,KAAK,CAAC;YAEtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBAC/C,oBAAoB;gBACpB,iBAAiB,EAAE,KAAK,IAAI,EAAE;oBAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,0BAA0B,EAC1B,SAAS,CACV,CAAC;oBACF,OAAO,OAAO,CAAC,oBAAoB,CAAC;gBACtC,CAAC;gBACD,cAAc,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC9B,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,iBAAiB,GAAG,IAAI,CAAC;oBAC3B,CAAC;oBACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,SAAS,GAAG,IAAI,CAAC;oBACnB,CAAC;gBACH,CAAC;gBACD,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI;gBAC9B,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK;aAC9B,CAAC,CAAC;YAEH,iEAAiE;YACjE,sDAAsD;YACtD,iBAAiB,KAAK,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3D,SAAS,KAAK,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEhD,MAAM,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YACtD,IAAI,oBAAoB,EAAE,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;gBACtC,CAAC,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,wEAAwE;gBACxE,6CAA6C;gBAC7C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,aAAa,GAAG;wBACpB,GAAG,oBAAoB;wBACvB,WAAW,EAAE,SAAS;qBACvB,CAAC;oBACF,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC;gBACzC,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACjC,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;gBACtC,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CACvB,iBAAmC,EACnC,qBAAuC;QAEvC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,GACxD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iCAAiC,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC;SACrD,CAAC,CAAC;QACL,6BAA6B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAClE,6BAA6B,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,8BAA8B,CAClC,uBAAmC,EACnC,iBAAmC,EACnC,qBAAuC;QAKvC,MAAM,eAAe,GAAG,MAAM,0BAA0B,CACtD,IAAI,CAAC,qBAAqB,CAC3B,CAAC;QACF,MAAM,cAAc,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAC7D,MAAM,wBAAwB,GAAG,iBAAiB,CAChD,uBAAuB,EACvB,iBAAiB,CAAC,eAAe,CAAC,CAAC,EACnC,cAAc,CAAC,iBAAiB,CACjC,CAAC;QAEF,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;YACjD,QAAQ,EAAE,cAAc;YACxB,wGAAwG;YACxG,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,4BAA4B,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,0BAA0B,GAAG,iBAAiB,CAClD,uBAAuB,EACvB,qBAAqB,CAAC,eAAe,CAAC,CAAC,EACvC,aAAa,CAAC,iCAAiC,CAAC,mBAAmB,CAAC,CAAC,CACtE,CAAC;QAEF,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,CAAC;IAClE,CAAC;CACF","sourcesContent":["import type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport { BaseController } from '@metamask/base-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type {\n  UserStorageControllerPerformGetStorageAction,\n  UserStorageControllerPerformSetStorageAction,\n} from '@metamask/profile-sync-controller/user-storage';\nimport { stringToBytes } from '@metamask/utils';\nimport { x25519 } from '@noble/curves/ed25519';\n\nimport { toBase64Url } from './encoding.js';\nimport type { KycControllerMethodActions } from './KycController-method-action-types.js';\nimport type { KycServiceMethodActions } from './KycService-method-action-types.js';\nimport type {\n  CapabilityAuthorization,\n  EncryptionSchema,\n} from './KycService.js';\nimport {\n  isSumSubFlowCompleted,\n  isSumSubFlowFailed,\n} from './providers/sumsub.js';\nimport type { KycSumSubLauncher } from './providers/sumsub.js';\nimport {\n  areSessionDisclaimersCompleted,\n  consentRecordsFromAcceptedList,\n} from './sessionDisclaimers.js';\nimport { TERMINAL_SESSION_STATUSES } from './types.js';\nimport type {\n  KycConsentRecord,\n  KycDisclaimer,\n  KycDisclaimersCatalog,\n  KycProviderDisclaimersAccepted,\n  KycSessionDisclaimers,\n  KycSessionStatus,\n  KycVendor,\n  KycVendorDisclaimersAccepted,\n  KycVendorSigning,\n} from './types.js';\nimport { deriveClientMaterial } from './ukyc/deriveClientMaterial.js';\nimport { assertAttestedServerPublicKey } from './ukyc/jwtChain.js';\nimport {\n  getOrCreateLocalUserSecret,\n  UkycLocalUserSecretStore,\n} from './ukyc/localUserSecret.js';\nimport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nimport { wrapEncryptionKey } from './ukyc/wrapEncryptionKey.js';\nimport {\n  areVendorDisclaimersCompleted,\n  recordVendorDisclaimerAcceptance,\n} from './vendorDisclaimers.js';\n\n// === GENERAL ===\n\nexport const controllerName = 'KycController';\n\nexport const KYC_PROVIDER_FLOW_STATUSES = [\n  'not_started',\n  'submitted',\n  'abandoned',\n  'failed',\n] as const;\n\n/**\n * Durable outcome of the identity-provider flow.\n *\n * Unlike the KYC session's `finalStatus`, this distinguishes a newly-created\n * pending session from a provider flow that the customer actually submitted.\n */\nexport type KycProviderFlowStatus = (typeof KYC_PROVIDER_FLOW_STATUSES)[number];\n\n// Lifetime of the read-only `ukyc_capability_token` minted when creating a\n// UKYC session. The storage-and-auth spec requires the token's `expires_at` to\n// cover the KYC session's expected lifetime — including the provider journey —\n// rather than a fixed short window, so this is a session-scoped window.\nconst UKYC_CAPABILITY_TOKEN_TTL_MS = 72 * 60 * 60 * 1000;\n\n// How often to poll UKYC session status until a terminal `finalStatus`.\nconst SESSION_STATUS_POLL_INTERVAL_MS = 15_000;\n\n// === STATE ===\n\n/**\n * Describes the shape of the state object for {@link KycController}.\n */\nexport type KycControllerState = {\n  /** Email associated with the session (sourced from the account). */\n  email: string | null;\n\n  vendor: KycVendor | null;\n\n  /** Resolved ISO 3166-1 alpha-3 country code. */\n  geoCountry: string | null;\n\n  /** Latest UKYC session status, or `null` when none has been fetched. */\n  sessionStatus: KycSessionStatus | null;\n\n  /** Last durable identity-provider flow outcome for this session. */\n  providerFlowStatus: KycProviderFlowStatus;\n\n  // TODO: Check if we need truly need to persist these accepted disclaimers\n  /**\n   * Persisted vendor-disclaimer acceptance (T&C1) with fixed `moonpay` and\n   * `iron` keys. MoonPay stores only `termsAcceptedAt`; Iron stores\n   * `disclaimerIds`.\n   */\n  vendorDisclaimersAccepted: KycVendorDisclaimersAccepted;\n  /**\n   * KYC-provider disclaimer documents the customer accepted during the last\n   * terms acceptance (persisted `{ key, version }` records under `sumsub`).\n   * Consents-path vendors require this when resuming a session. `null` for\n   * acceptance recorded before this field existed (treated as requiring\n   * reacceptance).\n   */\n  providerDisclaimersAccepted: KycProviderDisclaimersAccepted;\n  /**\n   * idOS disclaimer documents the customer accepted during the last terms\n   * acceptance (persisted `{ key, version }` records). Consents-path vendors\n   * require this when resuming a session. `null` for acceptance recorded\n   * before this field existed (treated as requiring reacceptance).\n   */\n  idosDisclaimersAccepted: KycConsentRecord[] | null;\n  /**\n   * Whether the customer consented to reuse existing idOS credentials\n   * during this session. Applied when recording session-scoped disclaimers.\n   * Not persisted: a new UKYC session must collect reuse consent again.\n   * `null` when never set (treated as `false`).\n   */\n  credentialReusabilityConsentGiven: boolean | null;\n};\n\nconst kycControllerMetadata = {\n  email: {\n    includeInDebugSnapshot: false,\n    includeInStateLogs: false,\n    persist: true,\n    usedInUi: false,\n  },\n  vendor: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: true,\n  },\n  geoCountry: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: true,\n  },\n  sessionStatus: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: true,\n  },\n  providerFlowStatus: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: true,\n  },\n  vendorDisclaimersAccepted: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: false,\n  },\n  providerDisclaimersAccepted: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: false,\n  },\n  idosDisclaimersAccepted: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: false,\n  },\n  credentialReusabilityConsentGiven: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: false,\n  },\n} satisfies StateMetadata<KycControllerState>;\n\n/**\n * Constructs the default {@link KycVendorDisclaimersAccepted} value.\n *\n * @returns The default vendor-disclaimer acceptance map.\n */\nexport function getDefaultKycVendorDisclaimersAccepted(): KycVendorDisclaimersAccepted {\n  return { moonpay: null, iron: null };\n}\n\n/**\n * Constructs the default {@link KycProviderDisclaimersAccepted} value.\n *\n * @returns The default provider-disclaimer acceptance map.\n */\nexport function getDefaultKycProviderDisclaimersAccepted(): KycProviderDisclaimersAccepted {\n  return { sumsub: null };\n}\n\n/**\n * Constructs the default {@link KycController} state.\n *\n * @returns The default state.\n */\nexport function getDefaultKycControllerState(): KycControllerState {\n  return {\n    email: null,\n    vendor: null,\n    geoCountry: null,\n    sessionStatus: null,\n    providerFlowStatus: 'not_started',\n    vendorDisclaimersAccepted: getDefaultKycVendorDisclaimersAccepted(),\n    providerDisclaimersAccepted: getDefaultKycProviderDisclaimersAccepted(),\n    idosDisclaimersAccepted: null,\n    credentialReusabilityConsentGiven: null,\n  };\n}\n\n/**\n * Parameters for {@link KycController.fetchSessionDisclaimers}. Provide\n * exactly one of `sessionId` or `country`.\n */\nexport type FetchSessionDisclaimersParams =\n  | {\n      /** UKYC session id from `KycService.createUkycSession`. */\n      sessionId: string;\n      country?: never;\n    }\n  | {\n      /** ISO 3166-1 alpha-3 country code for `GET /disclaimers?country=`. */\n      country: string;\n      sessionId?: never;\n    };\n\n// === MESSENGER ===\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'startSession',\n  'reset',\n  'clearState',\n  'getSessionStatusForVendor',\n  'getProviderFlowStatus',\n  'refreshSessionStatus',\n  'startSessionStatusPolling',\n  'fetchSessionDisclaimers',\n  'recordSessionDisclaimers',\n  'hasCompletedSessionDisclaimers',\n  'fetchVendorDisclaimers',\n  'recordVendorDisclaimers',\n  'hasCompletedVendorDisclaimers',\n  'launchProviderFlow',\n] as const;\n\nexport type KycControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  KycControllerState\n>;\n\nexport type KycControllerActions =\n  | KycControllerGetStateAction\n  | KycControllerMethodActions;\n\ntype AllowedActions =\n  | KycServiceMethodActions\n  | UserStorageControllerPerformGetStorageAction\n  | UserStorageControllerPerformSetStorageAction;\n\nexport type KycControllerStateChangeEvent = ControllerStateChangeEvent<\n  typeof controllerName,\n  KycControllerState\n>;\n\nexport type KycControllerEvents = KycControllerStateChangeEvent;\n\ntype AllowedEvents = never;\n\nexport type KycControllerMessenger = Messenger<\n  typeof controllerName,\n  KycControllerActions | AllowedActions,\n  KycControllerEvents | AllowedEvents\n>;\n\n/**\n * Options for constructing a {@link KycController}.\n */\nexport type KycControllerOptions = {\n  messenger: KycControllerMessenger;\n  state?: Partial<KycControllerState>;\n  /**\n   * Platform adapter that presents the SumSub SDK. Injected by each client so\n   * the controller stays platform-agnostic.\n   */\n  sumsubLauncher: KycSumSubLauncher;\n};\n\n// === CONTROLLER DEFINITION ===\n\n/**\n * `KycController` orchestrates the vendor-backed KYC / identity-verification\n * flow (MoonPay identity + SumSub documents) behind a vendor-neutral, per\n * product surface used by ramps and card. It owns all state and HTTP\n * orchestration (via `KycService`), while vendor protocol handling and\n * platform-specific presentation (WebView/iframe, SumSub SDK) are delegated.\n */\nexport class KycController extends BaseController<\n  typeof controllerName,\n  KycControllerState,\n  KycControllerMessenger\n> {\n  readonly #sumsubLauncher: KycSumSubLauncher;\n\n  readonly #localUserSecretStore: UkycLocalUserSecretStore;\n\n  /** Handle for the scheduled next session-status poll, or `null`. */\n  #sessionStatusPollTimer: ReturnType<typeof setTimeout> | null = null;\n\n  /**\n   * Monotonic polling token. Bumped when the loop stops so an in-flight fetch\n   * neither writes state nor schedules a follow-up.\n   */\n  #sessionStatusPollToken = 0;\n\n  /**\n   * Constructs a new {@link KycController}.\n   *\n   * @param options - The constructor options.\n   * @param options.messenger - The messenger suited for this controller.\n   * @param options.state - Partial initial state; merged over defaults.\n   * @param options.sumsubLauncher - The platform SumSub launcher adapter.\n   */\n  constructor({ messenger, state, sumsubLauncher }: KycControllerOptions) {\n    super({\n      messenger,\n      metadata: kycControllerMetadata,\n      name: controllerName,\n      state: { ...getDefaultKycControllerState(), ...state },\n    });\n\n    this.#sumsubLauncher = sumsubLauncher;\n    this.#localUserSecretStore = new UkycLocalUserSecretStore(this.messenger);\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  /**\n   * Starts a KYC session for the given vendor and email. Reuses a latest\n   * vendor session when one exists; otherwise creates a UKYC session.\n   *\n   * @param params - The session parameters.\n   * @param params.vendor - Identity vendor for the session.\n   * @param params.email - Account email associated with the session.\n   * @param params.aal2Token - AAL2 authentication token. Required only when a\n   * UKYC session must be created, where it is sent as the Authorization bearer\n   * value. Omit it when reusing an existing session.\n   * @returns The current or newly created session status.\n   */\n  async startSession(params: {\n    vendor: KycVendor;\n    email: string; // TODO: This will be removed once partnerIdentityTokens are fully ready\n    aal2Token?: string;\n  }): Promise<KycSessionStatus> {\n    if (this.state.email !== null && this.state.email !== params.email) {\n      throw new Error(\n        'KycController already initialized with a different email',\n      );\n    }\n    if (this.state.vendor !== null && this.state.vendor !== params.vendor) {\n      throw new Error(\n        'KycController already initialized with a different vendor',\n      );\n    }\n\n    const geoCountry = await this.messenger.call('KycService:getGeoCountry');\n    if (\n      this.state.geoCountry !== null &&\n      this.state.geoCountry !== geoCountry\n    ) {\n      throw new Error(\n        'KycController already initialized with a different geoCountry',\n      );\n    }\n\n    this.update((state) => {\n      state.email = params.email;\n      state.vendor = params.vendor;\n      state.geoCountry = geoCountry;\n      if (state.sessionStatus === null) {\n        state.providerFlowStatus = 'not_started';\n      }\n    });\n\n    if (this.state.sessionStatus === null) {\n      const sessionStatus = await this.messenger.call(\n        'KycService:getSessionStatusForVendor',\n        params.vendor,\n      );\n      if (sessionStatus !== null) {\n        this.update((state) => {\n          state.sessionStatus = sessionStatus;\n        });\n        return sessionStatus;\n      }\n\n      // TODO: Probably move this into it's own method? Feels like startSession is a little overloaded.\n      // It's assumed that if the session does not exist, the customer does not exist either\n      if (!params.aal2Token) {\n        throw new Error(\n          'KycController.startSession: aal2Token is required to create a KYC session.',\n        );\n      }\n\n      await this.messenger.call('KycService:createVendorCustomer', {\n        vendor: params.vendor,\n        email: params.email,\n      });\n\n      return this.#createUkycSession({\n        vendor: params.vendor,\n        geoCountry,\n        aal2Token: params.aal2Token,\n      });\n    }\n    // TODO: Should this made a call to check if the session is up-to-date?\n    return this.state.sessionStatus;\n    // TODO: Should we resume polling here?\n  }\n\n  /**\n   * Stops session-status polling and restores default controller state.\n   */\n  async reset(): Promise<void> {\n    this.#stopSessionStatusPolling();\n    this.clearState();\n  }\n\n  /**\n   * Restores the controller to its default state.\n   */\n  clearState(): void {\n    this.#stopSessionStatusPolling();\n    this.update((state) => {\n      state.email = null;\n      state.vendor = null;\n      state.geoCountry = null;\n      state.sessionStatus = null;\n      state.providerFlowStatus = 'not_started';\n      state.vendorDisclaimersAccepted =\n        getDefaultKycVendorDisclaimersAccepted();\n      state.providerDisclaimersAccepted =\n        getDefaultKycProviderDisclaimersAccepted();\n      state.idosDisclaimersAccepted = null;\n      state.credentialReusabilityConsentGiven = null;\n    });\n  }\n\n  /**\n   * Fetches the latest UKYC session status for a vendor.\n   *\n   * @param vendor - Identity vendor whose latest session should be queried.\n   * @returns The session status, or `null` when none exists.\n   */\n  getSessionStatusForVendor(\n    vendor: KycVendor,\n  ): Promise<KycSessionStatus | null> {\n    return this.messenger.call('KycService:getSessionStatusForVendor', vendor);\n  }\n\n  /**\n   * Returns the durable outcome of the identity-provider flow.\n   *\n   * @returns The latest provider-flow status.\n   */\n  getProviderFlowStatus(): KycProviderFlowStatus {\n    return this.state.providerFlowStatus;\n  }\n\n  /**\n   * Returns the current session status and starts polling when it is not yet\n   * terminal.\n   *\n   * @returns The current session status.\n   * @throws If there is no session on state.\n   */\n  refreshSessionStatus(): KycSessionStatus {\n    if (!this.state.sessionStatus) {\n      throw new Error('No session was found');\n    }\n    if (!TERMINAL_SESSION_STATUSES.has(this.state.sessionStatus.finalStatus)) {\n      this.startSessionStatusPolling();\n    }\n    return this.state.sessionStatus;\n  }\n\n  /**\n   * Starts polling `GET /sessions/{id}/status` for\n   * {@link KycControllerState.sessionStatus}'s current `id`. Each tick writes\n   * the result onto state only when the payload changed. The loop stops once\n   * `finalStatus` is `approved`, `rejected`, or `retry`, or when\n   * {@link reset} / {@link clearState} runs.\n   *\n   * @throws If there is no current session id to poll.\n   */\n  startSessionStatusPolling(): void {\n    const sessionId = this.state.sessionStatus?.id;\n    if (!sessionId) {\n      throw new Error('No session was found');\n    }\n\n    this.#stopSessionStatusPolling();\n    const token = this.#sessionStatusPollToken;\n\n    const tick = async (): Promise<void> => {\n      const shouldStop = await this.#pollSessionStatusOnce(sessionId, token);\n      if (shouldStop) {\n        return;\n      }\n      this.#sessionStatusPollTimer = setTimeout(() => {\n        this.#sessionStatusPollTimer = null;\n        // `tick` swallows its own errors and therefore never rejects.\n        // eslint-disable-next-line @typescript-eslint/no-floating-promises\n        tick();\n      }, SESSION_STATUS_POLL_INTERVAL_MS);\n      this.#sessionStatusPollTimer.unref?.();\n    };\n\n    // eslint-disable-next-line @typescript-eslint/no-floating-promises\n    tick();\n  }\n\n  /**\n   * Fetches session status for the polled session and records it when it\n   * differs from state.\n   *\n   * @param sessionId - Session the loop started for.\n   * @param token - Polling token captured when the loop started.\n   * @returns Whether the loop should stop.\n   */\n  async #pollSessionStatusOnce(\n    sessionId: string,\n    token: number,\n  ): Promise<boolean> {\n    try {\n      const sessionStatus = await this.messenger.call(\n        'KycService:getSessionStatus',\n        { sessionId },\n      );\n      if (this.#sessionStatusPollToken !== token) {\n        return true;\n      }\n\n      // TODO: This check seems fragile\n      if (\n        JSON.stringify(this.state.sessionStatus) !==\n        JSON.stringify(sessionStatus)\n      ) {\n        this.update((state) => {\n          state.sessionStatus = sessionStatus;\n        });\n      }\n\n      if (TERMINAL_SESSION_STATUSES.has(sessionStatus.finalStatus)) {\n        this.#stopSessionStatusPolling();\n        return true;\n      }\n      return false;\n    } catch {\n      return this.#sessionStatusPollToken !== token;\n    }\n  }\n\n  /**\n   * Stops the session-status polling loop.\n   */\n  #stopSessionStatusPolling(): void {\n    this.#sessionStatusPollToken += 1;\n    if (this.#sessionStatusPollTimer !== null) {\n      clearTimeout(this.#sessionStatusPollTimer);\n      this.#sessionStatusPollTimer = null;\n    }\n  }\n\n  /**\n   * Creates a UKYC session, wraps the `data_encryption_key` and\n   * `ukyc_capability_token` against the returned encryption schemas, and\n   * submits both via authorizations. Stores `sumsub.sessionId`.\n   * kyc-api returns the existing session if one with the same vendor and canonicalUserId already exists.\n   *\n   * @param params - Vendor, country, and AAL2 token used to create the session.\n   * @param params.vendor - Identity vendor for the UKYC session.\n   * @param params.geoCountry - ISO 3166-1 alpha-3 country of residence.\n   * @param params.aal2Token - AAL2 authentication token sent as the\n   * Authorization bearer value for session creation.\n   * @returns The created session.\n   */\n  async #createUkycSession(params: {\n    vendor: KycVendor;\n    geoCountry: string;\n    aal2Token: string;\n  }): Promise<KycSessionStatus> {\n    // Establish a per-session X25519 keypair used to seal both secrets. The\n    // private half stays on the device; the public half is registered on the\n    // session so the server can open later authorizations. Each encryption\n    // schema from session creation supplies the matching server public key.\n    const sessionClientPrivateKey = x25519.utils.randomSecretKey();\n    const sessionClientPublicKey = toBase64Url(\n      x25519.getPublicKey(sessionClientPrivateKey),\n    );\n    // Residence is the ISO 3166-1 alpha-3 country already resolved for\n    // disclaimers / KYC-required; fetch it if this sub-flow started without\n    // that earlier step.\n    const {\n      sessionId,\n      encryptionDataKey,\n      ukycCapabilityToken: capabilityTokenSchema,\n    } = await this.messenger.call('KycService:createUkycSession', {\n      sessionClientPublicKey,\n      residenceCountry: params.geoCountry,\n      vendor: params.vendor,\n      aal2Token: params.aal2Token,\n    });\n\n    await this.#verifyWrappingKeys(encryptionDataKey, capabilityTokenSchema);\n\n    const { wrappedEncryptionDataKey, wrappedUkycCapabilityToken } =\n      await this.#generateWrappedAuthorizations(\n        sessionClientPrivateKey,\n        encryptionDataKey,\n        capabilityTokenSchema,\n      );\n\n    const sessionStatus = await this.messenger.call(\n      'KycService:setAuthorizations',\n      {\n        sessionId,\n        wrappedEncryptionDataKey,\n        wrappedUkycCapabilityToken,\n      },\n    );\n\n    this.update((state) => {\n      state.sessionStatus = sessionStatus;\n    });\n\n    return sessionStatus;\n  }\n\n  /**\n   * Fetches the idOS + KYC-provider disclaimer catalog. Pass exactly one of\n   * `sessionId` or `country`:\n   *\n   * - `{ sessionId }` → {@link KycService.fetchSessionDisclaimersBySessionId}\n   *   (`GET /sessions/{sessionId}/disclaimers`)\n   * - `{ country }` → {@link KycService.fetchSessionDisclaimersByCountry}\n   *   (`GET /disclaimers?country=`)\n   *\n   * A session-id fetch also writes the catalog to `sessionDisclaimers`.\n   *\n   * @param params - The parameters. Provide exactly one of `sessionId` or\n   * `country`.\n   * @param params.sessionId - The UKYC session id.\n   * @param params.country - ISO 3166-1 alpha-3 country code.\n   * @returns The catalog. Session fetches include consent state; country\n   * fetches do not.\n   */\n  async fetchSessionDisclaimers(\n    params: FetchSessionDisclaimersParams,\n  ): Promise<KycSessionDisclaimers | KycDisclaimersCatalog> {\n    const { sessionId, country } = params as {\n      sessionId?: string;\n      country?: string;\n    };\n    if (sessionId && country) {\n      throw new Error(\n        'KycController.fetchSessionDisclaimers: provide exactly one of sessionId or country.',\n      );\n    }\n\n    if (country) {\n      return this.messenger.call(\n        'KycService:fetchSessionDisclaimersByCountry',\n        { country },\n      );\n    }\n\n    if (!sessionId) {\n      throw new Error(\n        'KycController.fetchSessionDisclaimers: provide exactly one of sessionId or country.',\n      );\n    }\n\n    const catalog = await this.messenger.call(\n      'KycService:fetchSessionDisclaimersBySessionId',\n      { sessionId },\n    );\n    return catalog;\n  }\n\n  /**\n   * Fetches the session-scoped disclaimer catalog and records consents\n   * derived from the T&C2 flags. Already-consented catalog rows are omitted\n   * from the POST. A 409 is re-checked with a GET: continue only when every\n   * accepted document is now consented, otherwise fail closed.\n   *\n   * @param params - Accepted session-disclaimer records.\n   * @param params.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.\n   * @param params.idosDisclaimersAccepted - Accepted idOS disclaimer records.\n   * @param params.credentialReusabilityConsentGiven - Whether credential\n   * reuse was accepted.\n   */\n  async recordSessionDisclaimers(params: {\n    providerDisclaimersAccepted: KycConsentRecord[];\n    idosDisclaimersAccepted: KycConsentRecord[];\n    credentialReusabilityConsentGiven: boolean;\n  }): Promise<void> {\n    if (!this.state.sessionStatus) {\n      throw new Error('No session was found');\n    }\n\n    // TODO: Check if these can simply be mapped to `{key, version}` pairs instead\n    const disclaimers = await this.messenger.call(\n      'KycService:fetchSessionDisclaimersBySessionId',\n      { sessionId: this.state.sessionStatus.id },\n    );\n\n    const idOS = consentRecordsFromAcceptedList(\n      disclaimers.idOS,\n      params.idosDisclaimersAccepted,\n    );\n    const kycProvider = consentRecordsFromAcceptedList(\n      disclaimers.kycProvider,\n      params.providerDisclaimersAccepted,\n    );\n\n    try {\n      await this.messenger.call('KycService:submitSessionDisclaimers', {\n        sessionId: this.state.sessionStatus.id,\n        idOS,\n        kycProvider,\n        credentialReusabilityConsentGiven:\n          params.credentialReusabilityConsentGiven,\n      });\n    } catch {\n      // A 409 means the session already recorded these consents.\n    }\n    this.update((state) => {\n      // TODO: This shouldn't be hardcoded to sumsub\n      state.providerDisclaimersAccepted.sumsub =\n        params.providerDisclaimersAccepted;\n      state.idosDisclaimersAccepted = params.idosDisclaimersAccepted;\n      state.credentialReusabilityConsentGiven =\n        params.credentialReusabilityConsentGiven;\n    });\n  }\n\n  /**\n   * Fetches session-scoped disclaimers and reports whether every document is\n   * consented and credential reuse was accepted.\n   *\n   * @returns Whether session disclaimers are complete.\n   * @throws If there is no session on state.\n   */\n  async hasCompletedSessionDisclaimers(): Promise<boolean> {\n    if (!this.state.sessionStatus) {\n      throw new Error('No session was found');\n    }\n    // TODO: validate if this shorcut check is sufficient\n    // return this.state.sessionStatus.consentStatus === 'given';\n\n    const disclaimers = await this.messenger.call(\n      'KycService:fetchSessionDisclaimersBySessionId',\n      { sessionId: this.state.sessionStatus.id },\n    );\n\n    return areSessionDisclaimersCompleted(disclaimers);\n  }\n\n  /**\n   * Fetches the vendor T&Cs the customer must accept before a session is\n   * created (`GET /vendors/{vendor}/disclaimers?country=`).\n   *\n   * @param params - The parameters.\n   * @param params.vendor - Identity vendor. Defaults to `moonpay`.\n   * @param params.country - ISO 3166-1 alpha-3 country code.\n   * @returns The disclaimers.\n   */\n  async fetchVendorDisclaimers(params: {\n    vendor?: KycVendor;\n    country: string;\n  }): Promise<KycDisclaimer[]> {\n    return this.messenger.call('KycService:fetchVendorDisclaimers', params);\n  }\n\n  /**\n   * Records vendor T&C acceptance via {@link KycService.submitVendorDisclaimers}\n   * and persists the accepted ids on state.\n   *\n   * @param params - The parameters.\n   * @param params.disclaimerIds - Accepted vendor T&C ids.\n   * @returns The vendor signing records.\n   * @throws If `vendor` is missing from state.\n   */\n  async recordVendorDisclaimers(params: {\n    disclaimerIds: string[];\n  }): Promise<KycVendorSigning[]> {\n    if (!this.state.vendor) {\n      throw new Error('No vendor was found');\n    }\n\n    if (!this.state.email) {\n      throw new Error('No email was found');\n    }\n\n    const { vendor } = this.state;\n\n    const signings = await this.messenger.call(\n      'KycService:submitVendorDisclaimers',\n      {\n        vendor,\n        disclaimerIds: params.disclaimerIds,\n      },\n    );\n\n    // TODO: this only works for Iron right now\n    this.update((state) => {\n      state.vendorDisclaimersAccepted = recordVendorDisclaimerAcceptance(\n        state.vendorDisclaimersAccepted,\n        vendor,\n        {\n          disclaimerIds: params.disclaimerIds,\n        },\n      );\n    });\n\n    return signings;\n  }\n\n  /**\n   * Fetches the current vendor T&C catalog and returns whether every document\n   * is already recorded in {@link KycControllerState.vendorDisclaimersAccepted}.\n   *\n   * @returns Whether persisted acceptance covers the fetched catalog.\n   * @throws If `vendor` or `geoCountry` is missing from state.\n   */\n  async hasCompletedVendorDisclaimers(): Promise<boolean> {\n    if (!this.state.vendor) {\n      throw new Error('No vendor was found');\n    }\n    if (!this.state.geoCountry) {\n      throw new Error('No geoCountry was found');\n    }\n\n    const fetched = await this.fetchVendorDisclaimers({\n      vendor: this.state.vendor,\n      country: this.state.geoCountry,\n    });\n\n    // TODO: this only works for Iron right now\n    return areVendorDisclaimersCompleted(\n      this.state.vendorDisclaimersAccepted,\n      this.state.vendor,\n      fetched,\n    );\n  }\n\n  /**\n   * Presents the identity-provider verification UI. Currently launches SumSub.\n   *\n   * @param params - Optional SDK presentation options.\n   * @param params.locale - BCP-47 locale for the SDK UI.\n   * @param params.debug - Enables SDK debug logging.\n   * @returns The durable provider-flow outcome.\n   */\n  launchProviderFlow({\n    locale,\n    debug,\n  }: {\n    locale?: string;\n    debug?: boolean;\n  }): Promise<KycProviderFlowStatus> {\n    // Currently only sumsub is supported and must be used for Iron\n    return this.#launchSumsubFlow({ locale, debug });\n  }\n\n  /**\n   * Runs the SumSub document-verification sub-flow end to end:\n   *\n   *  1. creates a UKYC session, receiving per-secret encryption schemas;\n   *  2. verifies the `encryptionDataKey` schema's `jwtChain` against the\n   *     idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against\n   *     the idOS relay JWKS, then confirms each attested session server public\n   *     key;\n   *  3. derives the `data_encryption_key` from the wallet's UKYC\n   *     `local_user_secret` and wraps it for the session server;\n   *  4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the\n   *     same way as the encryption key, and submits both via authorizations;\n   *  5. fetches the SumSub applicant access token; and\n   *  6. presents the SDK via the injected launcher.\n   *\n   * If a UKYC session already exists (the consents path creates it before\n   * recording session disclaimers), steps 1–4 are skipped.\n   *\n   * If authorizations report the applicant is already approved on the relay\n   * while the vendor is still finalizing (`kycStatus: approved`,\n   * `finalStatus: pending`), the sub-flow stops at step 4 with a\n   * `vendorProcessing` status and a message rather than launching the SDK.\n   *\n   * @param params - Optional parameters.\n   * @param params.locale - BCP-47 locale for the SDK UI.\n   * @param params.debug - Enables SDK debug logging.\n   * @returns The durable provider-flow outcome.\n   */\n  async #launchSumsubFlow(params?: {\n    locale?: string;\n    debug?: boolean;\n  }): Promise<KycProviderFlowStatus> {\n    const sessionId = this.state.sessionStatus?.id;\n    if (!this.#sumsubLauncher.isAvailable() || !sessionId) {\n      this.update((state) => {\n        state.providerFlowStatus = 'failed';\n      });\n      return 'failed';\n    }\n\n    try {\n      // TODO: check if the sumsub and idos disclaimers are accepted\n      const { applicantAccessToken } = await this.messenger.call(\n        'KycService:createJourney',\n        sessionId,\n      );\n\n      // Track whether the SDK ever reported a successful completion or its own\n      // failure. A resolved `launch` alone does not imply success — the\n      // applicant may have abandoned the flow, or the SDK may have reported\n      // that it could not run.\n      let reachedCompletion = false;\n      let sdkFailed = false;\n\n      const result = await this.#sumsubLauncher.launch({\n        applicantAccessToken,\n        onTokenExpiration: async () => {\n          const journey = await this.messenger.call(\n            'KycService:createJourney',\n            sessionId,\n          );\n          return journey.applicantAccessToken;\n        },\n        onStatusChange: (_prev, next) => {\n          if (isSumSubFlowCompleted(next)) {\n            reachedCompletion = true;\n          }\n          if (isSumSubFlowFailed(next)) {\n            sdkFailed = true;\n          }\n        },\n        locale: params?.locale ?? 'en',\n        debug: params?.debug ?? false,\n      });\n\n      // Some native SDKs resolve with their final status without first\n      // delivering the corresponding state-change callback.\n      reachedCompletion ||= isSumSubFlowCompleted(result.status);\n      sdkFailed ||= isSumSubFlowFailed(result.status);\n\n      const currentSessionStatus = this.state.sessionStatus;\n      if (currentSessionStatus?.id !== sessionId) {\n        return 'failed';\n      }\n\n      if (sdkFailed) {\n        this.update((state) => {\n          state.providerFlowStatus = 'failed';\n        });\n        return 'failed';\n      }\n\n      if (reachedCompletion) {\n        // Once the SDK completes, the authoritative verification decision comes\n        // from the UKYC backend, not the SDK result.\n        this.update((state) => {\n          state.sessionStatus = {\n            ...currentSessionStatus,\n            finalStatus: 'pending',\n          };\n          state.providerFlowStatus = 'submitted';\n        });\n        this.startSessionStatusPolling();\n        return 'submitted';\n      }\n\n      this.update((state) => {\n        state.providerFlowStatus = 'abandoned';\n      });\n      return 'abandoned';\n    } catch {\n      if (this.state.sessionStatus?.id === sessionId) {\n        this.update((state) => {\n          state.providerFlowStatus = 'failed';\n        });\n      }\n      return 'failed';\n    }\n  }\n\n  /**\n   * Verifies each schema's jwtChain against the matching issuer JWKS, then\n   * confirms the returned server public key matches the value attested inside\n   * the verified JWT payload before trusting it for wrapping.\n   * `encryptionDataKey` is attested by the idOS enclave; `ukycCapabilityToken`\n   * by the idOS relay.\n   *\n   * @param encryptionDataKey - Encryption schema for the data encryption key.\n   * @param capabilityTokenSchema - Encryption schema for the capability token.\n   */\n  async #verifyWrappingKeys(\n    encryptionDataKey: EncryptionSchema,\n    capabilityTokenSchema: EncryptionSchema,\n  ): Promise<void> {\n    const [{ keys: idosEnclaveKeys }, { keys: idosRelayKeys }] =\n      await Promise.all([\n        this.messenger.call('KycService:fetchIdosEnclaveJwks'),\n        this.messenger.call('KycService:fetchIdosRelayJwks'),\n      ]);\n    assertAttestedServerPublicKey(idosEnclaveKeys, encryptionDataKey);\n    assertAttestedServerPublicKey(idosRelayKeys, capabilityTokenSchema);\n  }\n\n  /**\n   * Derives the `data_encryption_key` from the `local_user_secret`, mints a\n   * capability token, and wraps both for the session server. Only the wrapped\n   * (encrypted) material ever leaves the device.\n   *\n   * Only the client holds the signing key derived from `local_user_secret`, so\n   * only the client can mint the token.\n   *\n   * @param sessionClientPrivateKey - Per-session X25519 private key used to\n   * seal both secrets.\n   * @param encryptionDataKey - Encryption schema for the data encryption key.\n   * @param capabilityTokenSchema - Encryption schema for the capability token.\n   * @returns The wrapped encryption key and capability token.\n   */\n  async #generateWrappedAuthorizations(\n    sessionClientPrivateKey: Uint8Array,\n    encryptionDataKey: EncryptionSchema,\n    capabilityTokenSchema: EncryptionSchema,\n  ): Promise<{\n    wrappedEncryptionDataKey: CapabilityAuthorization;\n    wrappedUkycCapabilityToken: CapabilityAuthorization;\n  }> {\n    const localUserSecret = await getOrCreateLocalUserSecret(\n      this.#localUserSecretStore,\n    );\n    const clientMaterial = deriveClientMaterial(localUserSecret);\n    const wrappedEncryptionDataKey = wrapEncryptionKey(\n      sessionClientPrivateKey,\n      encryptionDataKey.serverPublicKey.x,\n      clientMaterial.dataEncryptionKey,\n    );\n\n    const ukycCapabilityToken = signStorageAccessToken({\n      material: clientMaterial,\n      // TODO: Confirm with idOS when this can be switched back to read and a separate token is sent for write\n      operations: ['read', 'write'],\n      expiresAt: new Date(Date.now() + UKYC_CAPABILITY_TOKEN_TTL_MS),\n    });\n    const wrappedUkycCapabilityToken = wrapEncryptionKey(\n      sessionClientPrivateKey,\n      capabilityTokenSchema.serverPublicKey.x,\n      stringToBytes(encodeStorageAccessTokenForHeader(ukycCapabilityToken)),\n    );\n\n    return { wrappedEncryptionDataKey, wrappedUkycCapabilityToken };\n  }\n}\n"]}
+{"version":3,"file":"KycController.js","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAM3D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAO5C,OAAO,EACL,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAYvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAEhC,kBAAkB;AAElB,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAE9C,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,aAAa;IACb,WAAW;IACX,WAAW;IACX,QAAQ;CACA,CAAC;AAUX,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,wEAAwE;AACxE,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAqD/C,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE;QACL,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;IACD,MAAM,EAAE;QACN,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;KACf;IACD,UAAU,EAAE;QACV,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;KACf;IACD,aAAa,EAAE;QACb,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;KACf;IACD,kBAAkB,EAAE;QAClB,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;KACf;IACD,yBAAyB,EAAE;QACzB,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;IACD,2BAA2B,EAAE;QAC3B,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;IACD,uBAAuB,EAAE;QACvB,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;IACD,iCAAiC,EAAE;QACjC,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;KAChB;CAC0C,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,sCAAsC;IACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wCAAwC;IACtD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,aAAa;QACjC,yBAAyB,EAAE,sCAAsC,EAAE;QACnE,2BAA2B,EAAE,wCAAwC,EAAE;QACvE,uBAAuB,EAAE,IAAI;QAC7B,iCAAiC,EAAE,IAAI;KACxC,CAAC;AACJ,CAAC;AAkBD,oBAAoB;AAEpB,MAAM,yBAAyB,GAAG;IAChC,cAAc;IACd,OAAO;IACP,YAAY;IACZ,2BAA2B;IAC3B,uBAAuB;IACvB,sBAAsB;IACtB,mBAAmB;IACnB,wBAAwB;IACxB,2BAA2B;IAC3B,yBAAyB;IACzB,0BAA0B;IAC1B,gCAAgC;IAChC,wBAAwB;IACxB,yBAAyB;IACzB,+BAA+B;IAC/B,oBAAoB;CACZ,CAAC;AA4CX,gCAAgC;AAEhC;;;;;;GAMG;AACH,MAAM,OAAO,aAAc,SAAQ,cAIlC;IACU,eAAe,CAAoB;IAEnC,qBAAqB,CAA2B;IAEzD,oEAAoE;IACpE,uBAAuB,GAAyC,IAAI,CAAC;IAErE;;;OAGG;IACH,uBAAuB,GAAG,CAAC,CAAC;IAE5B;;;;;;;OAOG;IACH,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAwB;QACpE,KAAK,CAAC;YACJ,SAAS;YACT,QAAQ,EAAE,qBAAqB;YAC/B,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,EAAE,GAAG,4BAA4B,EAAE,EAAE,GAAG,KAAK,EAAE;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,qBAAqB,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1E,IAAI,CAAC,SAAS,CAAC,4BAA4B,CACzC,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,YAAY,CAAC,MAIlB;QACC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzE,IACE,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI;YAC9B,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAC9B,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBACjC,KAAK,CAAC,kBAAkB,GAAG,aAAa,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC7C,sCAAsC,EACtC,MAAM,CAAC,MAAM,CACd,CAAC;YACF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;gBACtC,CAAC,CAAC,CAAC;gBACH,OAAO,aAAa,CAAC;YACvB,CAAC;YAED,iGAAiG;YACjG,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC3D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,uEAAuE;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;QAChC,uCAAuC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YACpB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YACxB,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;YAC3B,KAAK,CAAC,kBAAkB,GAAG,aAAa,CAAC;YACzC,KAAK,CAAC,yBAAyB;gBAC7B,sCAAsC,EAAE,CAAC;YAC3C,KAAK,CAAC,2BAA2B;gBAC/B,wCAAwC,EAAE,CAAC;YAC7C,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACrC,KAAK,CAAC,iCAAiC,GAAG,IAAI,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,yBAAyB,CACvB,MAAiB;QAEjB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED;;;;OAIG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB;QAClB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,sBAAsB,CAAC,SAAiB;QAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC7C,6BAA6B,EAC7B,EAAE,SAAS,EAAE,CACd,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,yBAAyB;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC;QAE3C,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACrC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACvE,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,CAAC,uBAAuB,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7C,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACpC,8DAA8D;gBAC9D,mEAAmE;gBACnE,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,+BAA+B,CAAC,CAAC;YACpC,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC;QACzC,CAAC,CAAC;QAEF,mEAAmE;QACnE,IAAI,EAAE,CAAC;IACT,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,sBAAsB,CAC1B,SAAiB,EACjB,KAAa;QAEb,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC7C,6BAA6B,EAC7B,EAAE,SAAS,EAAE,CACd,CAAC;YACF,IAAI,IAAI,CAAC,uBAAuB,KAAK,KAAK,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,iCAAiC;YACjC,IACE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBACxC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAC7B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;gBACtC,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,yBAAyB,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,uBAAuB,KAAK,KAAK,CAAC;QAChD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,yBAAyB;QACvB,IAAI,CAAC,uBAAuB,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;YAC1C,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC3C,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAIxB;QACC,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,uBAAuB,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/D,MAAM,sBAAsB,GAAG,WAAW,CACxC,MAAM,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAC7C,CAAC;QACF,mEAAmE;QACnE,wEAAwE;QACxE,qBAAqB;QACrB,MAAM,EACJ,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EAAE,qBAAqB,GAC3C,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC5D,sBAAsB;YACtB,gBAAgB,EAAE,MAAM,CAAC,UAAU;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QAEzE,MAAM,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,GAC5D,MAAM,IAAI,CAAC,8BAA8B,CACvC,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,CACtB,CAAC;QAEJ,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC7C,8BAA8B,EAC9B;YACE,SAAS;YACT,wBAAwB;YACxB,0BAA0B;SAC3B,CACF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,uBAAuB,CAC3B,MAAqC;QAErC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAG9B,CAAC;QACF,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CACxB,6CAA6C,EAC7C,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,+CAA+C,EAC/C,EAAE,SAAS,EAAE,CACd,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,wBAAwB,CAAC,MAI9B;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,8EAA8E;QAC9E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC3C,+CAA+C,EAC/C,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,CAC3C,CAAC;QAEF,MAAM,IAAI,GAAG,8BAA8B,CACzC,WAAW,CAAC,IAAI,EAChB,MAAM,CAAC,uBAAuB,CAC/B,CAAC;QACF,MAAM,WAAW,GAAG,8BAA8B,CAChD,WAAW,CAAC,WAAW,EACvB,MAAM,CAAC,2BAA2B,CACnC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,EAAE;gBAC/D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE;gBACtC,IAAI;gBACJ,WAAW;gBACX,iCAAiC,EAC/B,MAAM,CAAC,iCAAiC;aAC3C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,8CAA8C;YAC9C,KAAK,CAAC,2BAA2B,CAAC,MAAM;gBACtC,MAAM,CAAC,2BAA2B,CAAC;YACrC,KAAK,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;YAC/D,KAAK,CAAC,iCAAiC;gBACrC,MAAM,CAAC,iCAAiC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,8BAA8B;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,qDAAqD;QACrD,6DAA6D;QAE7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC3C,+CAA+C,EAC/C,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,CAC3C,CAAC;QAEF,OAAO,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,sBAAsB,CAAC,MAG5B;QACC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,uBAAuB,CAAC,MAE7B;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACxC,oCAAoC,EACpC;YACE,MAAM;YACN,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CACF,CAAC;QAEF,2CAA2C;QAC3C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpB,KAAK,CAAC,yBAAyB,GAAG,gCAAgC,CAChE,KAAK,CAAC,yBAAyB,EAC/B,MAAM,EACN;gBACE,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,6BAA6B;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACzB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;SAC/B,CAAC,CAAC;QAEH,2CAA2C;QAC3C,OAAO,6BAA6B,CAClC,IAAI,CAAC,KAAK,CAAC,yBAAyB,EACpC,IAAI,CAAC,KAAK,CAAC,MAAM,EACjB,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,EACjB,MAAM,EACN,KAAK,GAIN;QACC,+DAA+D;QAC/D,OAAO,IAAI,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACxD,0BAA0B,EAC1B,SAAS,CACV,CAAC;YAEF,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,yBAAyB;YACzB,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,IAAI,SAAS,GAAG,KAAK,CAAC;YAEtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBAC/C,oBAAoB;gBACpB,iBAAiB,EAAE,KAAK,IAAI,EAAE;oBAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,0BAA0B,EAC1B,SAAS,CACV,CAAC;oBACF,OAAO,OAAO,CAAC,oBAAoB,CAAC;gBACtC,CAAC;gBACD,cAAc,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC9B,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,iBAAiB,GAAG,IAAI,CAAC;oBAC3B,CAAC;oBACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,SAAS,GAAG,IAAI,CAAC;oBACnB,CAAC;gBACH,CAAC;gBACD,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI;gBAC9B,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,KAAK;aAC9B,CAAC,CAAC;YAEH,iEAAiE;YACjE,sDAAsD;YACtD,iBAAiB,KAAK,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3D,SAAS,KAAK,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAEhD,MAAM,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YACtD,IAAI,oBAAoB,EAAE,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;gBACtC,CAAC,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,wEAAwE;gBACxE,6CAA6C;gBAC7C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,aAAa,GAAG;wBACpB,GAAG,oBAAoB;wBACvB,WAAW,EAAE,SAAS;qBACvB,CAAC;oBACF,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC;gBACzC,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACjC,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpB,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC/C,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACpB,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;gBACtC,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CACvB,iBAAmC,EACnC,qBAAuC;QAEvC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,GACxD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iCAAiC,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC;SACrD,CAAC,CAAC;QACL,6BAA6B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAClE,6BAA6B,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,8BAA8B,CAClC,uBAAmC,EACnC,iBAAmC,EACnC,qBAAuC;QAKvC,MAAM,eAAe,GAAG,MAAM,0BAA0B,CACtD,IAAI,CAAC,qBAAqB,CAC3B,CAAC;QACF,MAAM,cAAc,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAC7D,MAAM,wBAAwB,GAAG,iBAAiB,CAChD,uBAAuB,EACvB,iBAAiB,CAAC,eAAe,CAAC,CAAC,EACnC,cAAc,CAAC,iBAAiB,CACjC,CAAC;QAEF,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;YACjD,QAAQ,EAAE,cAAc;YACxB,wGAAwG;YACxG,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,4BAA4B,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,0BAA0B,GAAG,iBAAiB,CAClD,uBAAuB,EACvB,qBAAqB,CAAC,eAAe,CAAC,CAAC,EACvC,aAAa,CAAC,iCAAiC,CAAC,mBAAmB,CAAC,CAAC,CACtE,CAAC;QAEF,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,CAAC;IAClE,CAAC;CACF","sourcesContent":["import type {\n  ControllerGetStateAction,\n  ControllerStateChangeEvent,\n  StateMetadata,\n} from '@metamask/base-controller';\nimport { BaseController } from '@metamask/base-controller';\nimport type { Messenger } from '@metamask/messenger';\nimport type {\n  UserStorageControllerPerformGetStorageAction,\n  UserStorageControllerPerformSetStorageAction,\n} from '@metamask/profile-sync-controller/user-storage';\nimport { stringToBytes } from '@metamask/utils';\nimport { x25519 } from '@noble/curves/ed25519';\n\nimport { toBase64Url } from './encoding.js';\nimport type { KycControllerMethodActions } from './KycController-method-action-types.js';\nimport type { KycServiceMethodActions } from './KycService-method-action-types.js';\nimport type {\n  CapabilityAuthorization,\n  EncryptionSchema,\n} from './KycService.js';\nimport {\n  isSumSubFlowCompleted,\n  isSumSubFlowFailed,\n} from './providers/sumsub.js';\nimport type { KycSumSubLauncher } from './providers/sumsub.js';\nimport {\n  areSessionDisclaimersCompleted,\n  consentRecordsFromAcceptedList,\n} from './sessionDisclaimers.js';\nimport { TERMINAL_SESSION_STATUSES } from './types.js';\nimport type {\n  KycConsentRecord,\n  KycDisclaimer,\n  KycDisclaimersCatalog,\n  KycProviderDisclaimersAccepted,\n  KycSessionDisclaimers,\n  KycSessionStatus,\n  KycVendor,\n  KycVendorDisclaimersAccepted,\n  KycVendorSigning,\n} from './types.js';\nimport { deriveClientMaterial } from './ukyc/deriveClientMaterial.js';\nimport { assertAttestedServerPublicKey } from './ukyc/jwtChain.js';\nimport {\n  getOrCreateLocalUserSecret,\n  UkycLocalUserSecretStore,\n} from './ukyc/localUserSecret.js';\nimport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nimport { wrapEncryptionKey } from './ukyc/wrapEncryptionKey.js';\nimport {\n  areVendorDisclaimersCompleted,\n  recordVendorDisclaimerAcceptance,\n} from './vendorDisclaimers.js';\n\n// === GENERAL ===\n\nexport const controllerName = 'KycController';\n\nexport const KYC_PROVIDER_FLOW_STATUSES = [\n  'not_started',\n  'submitted',\n  'abandoned',\n  'failed',\n] as const;\n\n/**\n * Durable outcome of the identity-provider flow.\n *\n * Unlike the KYC session's `finalStatus`, this distinguishes a newly-created\n * pending session from a provider flow that the customer actually submitted.\n */\nexport type KycProviderFlowStatus = (typeof KYC_PROVIDER_FLOW_STATUSES)[number];\n\n// Lifetime of the read-only `ukyc_capability_token` minted when creating a\n// UKYC session. The storage-and-auth spec requires the token's `expires_at` to\n// cover the KYC session's expected lifetime — including the provider journey —\n// rather than a fixed short window, so this is a session-scoped window.\nconst UKYC_CAPABILITY_TOKEN_TTL_MS = 72 * 60 * 60 * 1000;\n\n// How often to poll UKYC session status until a terminal `finalStatus`.\nconst SESSION_STATUS_POLL_INTERVAL_MS = 15_000;\n\n// === STATE ===\n\n/**\n * Describes the shape of the state object for {@link KycController}.\n */\nexport type KycControllerState = {\n  /** Email associated with the session (sourced from the account). */\n  email: string | null;\n\n  vendor: KycVendor | null;\n\n  /** Resolved ISO 3166-1 alpha-3 country code. */\n  geoCountry: string | null;\n\n  /** Latest UKYC session status, or `null` when none has been fetched. */\n  sessionStatus: KycSessionStatus | null;\n\n  /** Last durable identity-provider flow outcome for this session. */\n  providerFlowStatus: KycProviderFlowStatus;\n\n  // TODO: Check if we need truly need to persist these accepted disclaimers\n  /**\n   * Persisted vendor-disclaimer acceptance (T&C1) with fixed `moonpay` and\n   * `iron` keys. MoonPay stores only `termsAcceptedAt`; Iron stores\n   * `disclaimerIds`.\n   */\n  vendorDisclaimersAccepted: KycVendorDisclaimersAccepted;\n  /**\n   * KYC-provider disclaimer documents the customer accepted during the last\n   * terms acceptance (persisted `{ key, version }` records under `sumsub`).\n   * Consents-path vendors require this when resuming a session. `null` for\n   * acceptance recorded before this field existed (treated as requiring\n   * reacceptance).\n   */\n  providerDisclaimersAccepted: KycProviderDisclaimersAccepted;\n  /**\n   * idOS disclaimer documents the customer accepted during the last terms\n   * acceptance (persisted `{ key, version }` records). Consents-path vendors\n   * require this when resuming a session. `null` for acceptance recorded\n   * before this field existed (treated as requiring reacceptance).\n   */\n  idosDisclaimersAccepted: KycConsentRecord[] | null;\n  /**\n   * Whether the customer consented to reuse existing idOS credentials\n   * during this session. Applied when recording session-scoped disclaimers.\n   * Not persisted: a new UKYC session must collect reuse consent again.\n   * `null` when never set (treated as `false`).\n   */\n  credentialReusabilityConsentGiven: boolean | null;\n};\n\nconst kycControllerMetadata = {\n  email: {\n    includeInDebugSnapshot: false,\n    includeInStateLogs: false,\n    persist: true,\n    usedInUi: false,\n  },\n  vendor: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: true,\n  },\n  geoCountry: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: true,\n  },\n  sessionStatus: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: true,\n  },\n  providerFlowStatus: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: true,\n  },\n  vendorDisclaimersAccepted: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: false,\n  },\n  providerDisclaimersAccepted: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: false,\n  },\n  idosDisclaimersAccepted: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: false,\n  },\n  credentialReusabilityConsentGiven: {\n    includeInDebugSnapshot: true,\n    includeInStateLogs: true,\n    persist: true,\n    usedInUi: false,\n  },\n} satisfies StateMetadata<KycControllerState>;\n\n/**\n * Constructs the default {@link KycVendorDisclaimersAccepted} value.\n *\n * @returns The default vendor-disclaimer acceptance map.\n */\nexport function getDefaultKycVendorDisclaimersAccepted(): KycVendorDisclaimersAccepted {\n  return { moonpay: null, iron: null };\n}\n\n/**\n * Constructs the default {@link KycProviderDisclaimersAccepted} value.\n *\n * @returns The default provider-disclaimer acceptance map.\n */\nexport function getDefaultKycProviderDisclaimersAccepted(): KycProviderDisclaimersAccepted {\n  return { sumsub: null };\n}\n\n/**\n * Constructs the default {@link KycController} state.\n *\n * @returns The default state.\n */\nexport function getDefaultKycControllerState(): KycControllerState {\n  return {\n    email: null,\n    vendor: null,\n    geoCountry: null,\n    sessionStatus: null,\n    providerFlowStatus: 'not_started',\n    vendorDisclaimersAccepted: getDefaultKycVendorDisclaimersAccepted(),\n    providerDisclaimersAccepted: getDefaultKycProviderDisclaimersAccepted(),\n    idosDisclaimersAccepted: null,\n    credentialReusabilityConsentGiven: null,\n  };\n}\n\n/**\n * Parameters for {@link KycController.fetchSessionDisclaimers}. Provide\n * exactly one of `sessionId` or `country`.\n */\nexport type FetchSessionDisclaimersParams =\n  | {\n      /** UKYC session id from `KycService.createUkycSession`. */\n      sessionId: string;\n      country?: never;\n    }\n  | {\n      /** ISO 3166-1 alpha-3 country code for `GET /disclaimers?country=`. */\n      country: string;\n      sessionId?: never;\n    };\n\n// === MESSENGER ===\n\nconst MESSENGER_EXPOSED_METHODS = [\n  'startSession',\n  'reset',\n  'clearState',\n  'getSessionStatusForVendor',\n  'getProviderFlowStatus',\n  'refreshSessionStatus',\n  'readSessionStatus',\n  'fetchSessionStatusOnce',\n  'startSessionStatusPolling',\n  'fetchSessionDisclaimers',\n  'recordSessionDisclaimers',\n  'hasCompletedSessionDisclaimers',\n  'fetchVendorDisclaimers',\n  'recordVendorDisclaimers',\n  'hasCompletedVendorDisclaimers',\n  'launchProviderFlow',\n] as const;\n\nexport type KycControllerGetStateAction = ControllerGetStateAction<\n  typeof controllerName,\n  KycControllerState\n>;\n\nexport type KycControllerActions =\n  | KycControllerGetStateAction\n  | KycControllerMethodActions;\n\ntype AllowedActions =\n  | KycServiceMethodActions\n  | UserStorageControllerPerformGetStorageAction\n  | UserStorageControllerPerformSetStorageAction;\n\nexport type KycControllerStateChangeEvent = ControllerStateChangeEvent<\n  typeof controllerName,\n  KycControllerState\n>;\n\nexport type KycControllerEvents = KycControllerStateChangeEvent;\n\ntype AllowedEvents = never;\n\nexport type KycControllerMessenger = Messenger<\n  typeof controllerName,\n  KycControllerActions | AllowedActions,\n  KycControllerEvents | AllowedEvents\n>;\n\n/**\n * Options for constructing a {@link KycController}.\n */\nexport type KycControllerOptions = {\n  messenger: KycControllerMessenger;\n  state?: Partial<KycControllerState>;\n  /**\n   * Platform adapter that presents the SumSub SDK. Injected by each client so\n   * the controller stays platform-agnostic.\n   */\n  sumsubLauncher: KycSumSubLauncher;\n};\n\n// === CONTROLLER DEFINITION ===\n\n/**\n * `KycController` orchestrates the vendor-backed KYC / identity-verification\n * flow (MoonPay identity + SumSub documents) behind a vendor-neutral, per\n * product surface used by ramps and card. It owns all state and HTTP\n * orchestration (via `KycService`), while vendor protocol handling and\n * platform-specific presentation (WebView/iframe, SumSub SDK) are delegated.\n */\nexport class KycController extends BaseController<\n  typeof controllerName,\n  KycControllerState,\n  KycControllerMessenger\n> {\n  readonly #sumsubLauncher: KycSumSubLauncher;\n\n  readonly #localUserSecretStore: UkycLocalUserSecretStore;\n\n  /** Handle for the scheduled next session-status poll, or `null`. */\n  #sessionStatusPollTimer: ReturnType<typeof setTimeout> | null = null;\n\n  /**\n   * Monotonic polling token. Bumped when the loop stops so an in-flight fetch\n   * neither writes state nor schedules a follow-up.\n   */\n  #sessionStatusPollToken = 0;\n\n  /**\n   * Constructs a new {@link KycController}.\n   *\n   * @param options - The constructor options.\n   * @param options.messenger - The messenger suited for this controller.\n   * @param options.state - Partial initial state; merged over defaults.\n   * @param options.sumsubLauncher - The platform SumSub launcher adapter.\n   */\n  constructor({ messenger, state, sumsubLauncher }: KycControllerOptions) {\n    super({\n      messenger,\n      metadata: kycControllerMetadata,\n      name: controllerName,\n      state: { ...getDefaultKycControllerState(), ...state },\n    });\n\n    this.#sumsubLauncher = sumsubLauncher;\n    this.#localUserSecretStore = new UkycLocalUserSecretStore(this.messenger);\n\n    this.messenger.registerMethodActionHandlers(\n      this,\n      MESSENGER_EXPOSED_METHODS,\n    );\n  }\n\n  /**\n   * Starts a KYC session for the given vendor and email. Reuses a latest\n   * vendor session when one exists; otherwise creates a UKYC session.\n   *\n   * @param params - The session parameters.\n   * @param params.vendor - Identity vendor for the session.\n   * @param params.email - Account email associated with the session.\n   * @param params.aal2Token - AAL2 authentication token. Required only when a\n   * UKYC session must be created, where it is sent as the Authorization bearer\n   * value. Omit it when reusing an existing session.\n   * @returns The current or newly created session status.\n   */\n  async startSession(params: {\n    vendor: KycVendor;\n    email: string; // TODO: This will be removed once partnerIdentityTokens are fully ready\n    aal2Token?: string;\n  }): Promise<KycSessionStatus> {\n    if (this.state.email !== null && this.state.email !== params.email) {\n      throw new Error(\n        'KycController already initialized with a different email',\n      );\n    }\n    if (this.state.vendor !== null && this.state.vendor !== params.vendor) {\n      throw new Error(\n        'KycController already initialized with a different vendor',\n      );\n    }\n\n    const geoCountry = await this.messenger.call('KycService:getGeoCountry');\n    if (\n      this.state.geoCountry !== null &&\n      this.state.geoCountry !== geoCountry\n    ) {\n      throw new Error(\n        'KycController already initialized with a different geoCountry',\n      );\n    }\n\n    this.update((state) => {\n      state.email = params.email;\n      state.vendor = params.vendor;\n      state.geoCountry = geoCountry;\n      if (state.sessionStatus === null) {\n        state.providerFlowStatus = 'not_started';\n      }\n    });\n\n    if (this.state.sessionStatus === null) {\n      const sessionStatus = await this.messenger.call(\n        'KycService:getSessionStatusForVendor',\n        params.vendor,\n      );\n      if (sessionStatus !== null) {\n        this.update((state) => {\n          state.sessionStatus = sessionStatus;\n        });\n        return sessionStatus;\n      }\n\n      // TODO: Probably move this into it's own method? Feels like startSession is a little overloaded.\n      // It's assumed that if the session does not exist, the customer does not exist either\n      if (!params.aal2Token) {\n        throw new Error(\n          'KycController.startSession: aal2Token is required to create a KYC session.',\n        );\n      }\n\n      await this.messenger.call('KycService:createVendorCustomer', {\n        vendor: params.vendor,\n        email: params.email,\n      });\n\n      return this.#createUkycSession({\n        vendor: params.vendor,\n        geoCountry,\n        aal2Token: params.aal2Token,\n      });\n    }\n    // TODO: Should this made a call to check if the session is up-to-date?\n    return this.state.sessionStatus;\n    // TODO: Should we resume polling here?\n  }\n\n  /**\n   * Stops session-status polling and restores default controller state.\n   */\n  async reset(): Promise<void> {\n    this.#stopSessionStatusPolling();\n    this.clearState();\n  }\n\n  /**\n   * Restores the controller to its default state.\n   */\n  clearState(): void {\n    this.#stopSessionStatusPolling();\n    this.update((state) => {\n      state.email = null;\n      state.vendor = null;\n      state.geoCountry = null;\n      state.sessionStatus = null;\n      state.providerFlowStatus = 'not_started';\n      state.vendorDisclaimersAccepted =\n        getDefaultKycVendorDisclaimersAccepted();\n      state.providerDisclaimersAccepted =\n        getDefaultKycProviderDisclaimersAccepted();\n      state.idosDisclaimersAccepted = null;\n      state.credentialReusabilityConsentGiven = null;\n    });\n  }\n\n  /**\n   * Fetches the latest UKYC session status for a vendor.\n   *\n   * @param vendor - Identity vendor whose latest session should be queried.\n   * @returns The session status, or `null` when none exists.\n   */\n  getSessionStatusForVendor(\n    vendor: KycVendor,\n  ): Promise<KycSessionStatus | null> {\n    return this.messenger.call('KycService:getSessionStatusForVendor', vendor);\n  }\n\n  /**\n   * Returns the durable outcome of the identity-provider flow.\n   *\n   * @returns The latest provider-flow status.\n   */\n  getProviderFlowStatus(): KycProviderFlowStatus {\n    return this.state.providerFlowStatus;\n  }\n\n  /**\n   * Returns the current session status and starts polling when it is not yet\n   * terminal.\n   *\n   * @returns The current session status.\n   * @throws If there is no session on state.\n   */\n  refreshSessionStatus(): KycSessionStatus {\n    if (!this.state.sessionStatus) {\n      throw new Error('No session was found');\n    }\n    if (!TERMINAL_SESSION_STATUSES.has(this.state.sessionStatus.finalStatus)) {\n      this.startSessionStatusPolling();\n    }\n    return this.state.sessionStatus;\n  }\n\n  /**\n   * Returns the persisted session status.\n   *\n   * Does not call the network and does not start session-status polling.\n   *\n   * @returns The session on state, or `null` when none is stored.\n   */\n  readSessionStatus(): KycSessionStatus | null {\n    return this.state.sessionStatus;\n  }\n\n  /**\n   * Fetches `GET /sessions/{id}/status` once and writes the result onto state.\n   *\n   * Does not start the session-status polling timer.\n   *\n   * @param sessionId - UKYC session id.\n   * @returns The fetched session status.\n   */\n  async fetchSessionStatusOnce(sessionId: string): Promise<KycSessionStatus> {\n    const sessionStatus = await this.messenger.call(\n      'KycService:getSessionStatus',\n      { sessionId },\n    );\n    this.update((state) => {\n      state.sessionStatus = sessionStatus;\n    });\n    return sessionStatus;\n  }\n\n  /**\n   * Starts polling `GET /sessions/{id}/status` for\n   * {@link KycControllerState.sessionStatus}'s current `id`. Each tick writes\n   * the result onto state only when the payload changed. The loop stops once\n   * `finalStatus` is `approved`, `rejected`, or `retry`, or when\n   * {@link reset} / {@link clearState} runs.\n   *\n   * @throws If there is no current session id to poll.\n   */\n  startSessionStatusPolling(): void {\n    const sessionId = this.state.sessionStatus?.id;\n    if (!sessionId) {\n      throw new Error('No session was found');\n    }\n\n    this.#stopSessionStatusPolling();\n    const token = this.#sessionStatusPollToken;\n\n    const tick = async (): Promise<void> => {\n      const shouldStop = await this.#pollSessionStatusOnce(sessionId, token);\n      if (shouldStop) {\n        return;\n      }\n      this.#sessionStatusPollTimer = setTimeout(() => {\n        this.#sessionStatusPollTimer = null;\n        // `tick` swallows its own errors and therefore never rejects.\n        // eslint-disable-next-line @typescript-eslint/no-floating-promises\n        tick();\n      }, SESSION_STATUS_POLL_INTERVAL_MS);\n      this.#sessionStatusPollTimer.unref?.();\n    };\n\n    // eslint-disable-next-line @typescript-eslint/no-floating-promises\n    tick();\n  }\n\n  /**\n   * Fetches session status for the polled session and records it when it\n   * differs from state.\n   *\n   * @param sessionId - Session the loop started for.\n   * @param token - Polling token captured when the loop started.\n   * @returns Whether the loop should stop.\n   */\n  async #pollSessionStatusOnce(\n    sessionId: string,\n    token: number,\n  ): Promise<boolean> {\n    try {\n      const sessionStatus = await this.messenger.call(\n        'KycService:getSessionStatus',\n        { sessionId },\n      );\n      if (this.#sessionStatusPollToken !== token) {\n        return true;\n      }\n\n      // TODO: This check seems fragile\n      if (\n        JSON.stringify(this.state.sessionStatus) !==\n        JSON.stringify(sessionStatus)\n      ) {\n        this.update((state) => {\n          state.sessionStatus = sessionStatus;\n        });\n      }\n\n      if (TERMINAL_SESSION_STATUSES.has(sessionStatus.finalStatus)) {\n        this.#stopSessionStatusPolling();\n        return true;\n      }\n      return false;\n    } catch {\n      return this.#sessionStatusPollToken !== token;\n    }\n  }\n\n  /**\n   * Stops the session-status polling loop.\n   */\n  #stopSessionStatusPolling(): void {\n    this.#sessionStatusPollToken += 1;\n    if (this.#sessionStatusPollTimer !== null) {\n      clearTimeout(this.#sessionStatusPollTimer);\n      this.#sessionStatusPollTimer = null;\n    }\n  }\n\n  /**\n   * Creates a UKYC session, wraps the `data_encryption_key` and\n   * `ukyc_capability_token` against the returned encryption schemas, and\n   * submits both via authorizations. Stores `sumsub.sessionId`.\n   * kyc-api returns the existing session if one with the same vendor and canonicalUserId already exists.\n   *\n   * @param params - Vendor, country, and AAL2 token used to create the session.\n   * @param params.vendor - Identity vendor for the UKYC session.\n   * @param params.geoCountry - ISO 3166-1 alpha-3 country of residence.\n   * @param params.aal2Token - AAL2 authentication token sent as the\n   * Authorization bearer value for session creation.\n   * @returns The created session.\n   */\n  async #createUkycSession(params: {\n    vendor: KycVendor;\n    geoCountry: string;\n    aal2Token: string;\n  }): Promise<KycSessionStatus> {\n    // Establish a per-session X25519 keypair used to seal both secrets. The\n    // private half stays on the device; the public half is registered on the\n    // session so the server can open later authorizations. Each encryption\n    // schema from session creation supplies the matching server public key.\n    const sessionClientPrivateKey = x25519.utils.randomSecretKey();\n    const sessionClientPublicKey = toBase64Url(\n      x25519.getPublicKey(sessionClientPrivateKey),\n    );\n    // Residence is the ISO 3166-1 alpha-3 country already resolved for\n    // disclaimers / KYC-required; fetch it if this sub-flow started without\n    // that earlier step.\n    const {\n      sessionId,\n      encryptionDataKey,\n      ukycCapabilityToken: capabilityTokenSchema,\n    } = await this.messenger.call('KycService:createUkycSession', {\n      sessionClientPublicKey,\n      residenceCountry: params.geoCountry,\n      vendor: params.vendor,\n      aal2Token: params.aal2Token,\n    });\n\n    await this.#verifyWrappingKeys(encryptionDataKey, capabilityTokenSchema);\n\n    const { wrappedEncryptionDataKey, wrappedUkycCapabilityToken } =\n      await this.#generateWrappedAuthorizations(\n        sessionClientPrivateKey,\n        encryptionDataKey,\n        capabilityTokenSchema,\n      );\n\n    const sessionStatus = await this.messenger.call(\n      'KycService:setAuthorizations',\n      {\n        sessionId,\n        wrappedEncryptionDataKey,\n        wrappedUkycCapabilityToken,\n      },\n    );\n\n    this.update((state) => {\n      state.sessionStatus = sessionStatus;\n    });\n\n    return sessionStatus;\n  }\n\n  /**\n   * Fetches the idOS + KYC-provider disclaimer catalog. Pass exactly one of\n   * `sessionId` or `country`:\n   *\n   * - `{ sessionId }` → {@link KycService.fetchSessionDisclaimersBySessionId}\n   *   (`GET /sessions/{sessionId}/disclaimers`)\n   * - `{ country }` → {@link KycService.fetchSessionDisclaimersByCountry}\n   *   (`GET /disclaimers?country=`)\n   *\n   * A session-id fetch also writes the catalog to `sessionDisclaimers`.\n   *\n   * @param params - The parameters. Provide exactly one of `sessionId` or\n   * `country`.\n   * @param params.sessionId - The UKYC session id.\n   * @param params.country - ISO 3166-1 alpha-3 country code.\n   * @returns The catalog. Session fetches include consent state; country\n   * fetches do not.\n   */\n  async fetchSessionDisclaimers(\n    params: FetchSessionDisclaimersParams,\n  ): Promise<KycSessionDisclaimers | KycDisclaimersCatalog> {\n    const { sessionId, country } = params as {\n      sessionId?: string;\n      country?: string;\n    };\n    if (sessionId && country) {\n      throw new Error(\n        'KycController.fetchSessionDisclaimers: provide exactly one of sessionId or country.',\n      );\n    }\n\n    if (country) {\n      return this.messenger.call(\n        'KycService:fetchSessionDisclaimersByCountry',\n        { country },\n      );\n    }\n\n    if (!sessionId) {\n      throw new Error(\n        'KycController.fetchSessionDisclaimers: provide exactly one of sessionId or country.',\n      );\n    }\n\n    const catalog = await this.messenger.call(\n      'KycService:fetchSessionDisclaimersBySessionId',\n      { sessionId },\n    );\n    return catalog;\n  }\n\n  /**\n   * Fetches the session-scoped disclaimer catalog and records consents\n   * derived from the T&C2 flags. Already-consented catalog rows are omitted\n   * from the POST. A 409 is re-checked with a GET: continue only when every\n   * accepted document is now consented, otherwise fail closed.\n   *\n   * @param params - Accepted session-disclaimer records.\n   * @param params.providerDisclaimersAccepted - Accepted Sumsub disclaimer records.\n   * @param params.idosDisclaimersAccepted - Accepted idOS disclaimer records.\n   * @param params.credentialReusabilityConsentGiven - Whether credential\n   * reuse was accepted.\n   */\n  async recordSessionDisclaimers(params: {\n    providerDisclaimersAccepted: KycConsentRecord[];\n    idosDisclaimersAccepted: KycConsentRecord[];\n    credentialReusabilityConsentGiven: boolean;\n  }): Promise<void> {\n    if (!this.state.sessionStatus) {\n      throw new Error('No session was found');\n    }\n\n    // TODO: Check if these can simply be mapped to `{key, version}` pairs instead\n    const disclaimers = await this.messenger.call(\n      'KycService:fetchSessionDisclaimersBySessionId',\n      { sessionId: this.state.sessionStatus.id },\n    );\n\n    const idOS = consentRecordsFromAcceptedList(\n      disclaimers.idOS,\n      params.idosDisclaimersAccepted,\n    );\n    const kycProvider = consentRecordsFromAcceptedList(\n      disclaimers.kycProvider,\n      params.providerDisclaimersAccepted,\n    );\n\n    try {\n      await this.messenger.call('KycService:submitSessionDisclaimers', {\n        sessionId: this.state.sessionStatus.id,\n        idOS,\n        kycProvider,\n        credentialReusabilityConsentGiven:\n          params.credentialReusabilityConsentGiven,\n      });\n    } catch {\n      // A 409 means the session already recorded these consents.\n    }\n    this.update((state) => {\n      // TODO: This shouldn't be hardcoded to sumsub\n      state.providerDisclaimersAccepted.sumsub =\n        params.providerDisclaimersAccepted;\n      state.idosDisclaimersAccepted = params.idosDisclaimersAccepted;\n      state.credentialReusabilityConsentGiven =\n        params.credentialReusabilityConsentGiven;\n    });\n  }\n\n  /**\n   * Fetches session-scoped disclaimers and reports whether every document is\n   * consented and credential reuse was accepted.\n   *\n   * @returns Whether session disclaimers are complete.\n   * @throws If there is no session on state.\n   */\n  async hasCompletedSessionDisclaimers(): Promise<boolean> {\n    if (!this.state.sessionStatus) {\n      throw new Error('No session was found');\n    }\n    // TODO: validate if this shorcut check is sufficient\n    // return this.state.sessionStatus.consentStatus === 'given';\n\n    const disclaimers = await this.messenger.call(\n      'KycService:fetchSessionDisclaimersBySessionId',\n      { sessionId: this.state.sessionStatus.id },\n    );\n\n    return areSessionDisclaimersCompleted(disclaimers);\n  }\n\n  /**\n   * Fetches the vendor T&Cs the customer must accept before a session is\n   * created (`GET /vendors/{vendor}/disclaimers?country=`).\n   *\n   * @param params - The parameters.\n   * @param params.vendor - Identity vendor. Defaults to `moonpay`.\n   * @param params.country - ISO 3166-1 alpha-3 country code.\n   * @returns The disclaimers.\n   */\n  async fetchVendorDisclaimers(params: {\n    vendor?: KycVendor;\n    country: string;\n  }): Promise<KycDisclaimer[]> {\n    return this.messenger.call('KycService:fetchVendorDisclaimers', params);\n  }\n\n  /**\n   * Records vendor T&C acceptance via {@link KycService.submitVendorDisclaimers}\n   * and persists the accepted ids on state.\n   *\n   * @param params - The parameters.\n   * @param params.disclaimerIds - Accepted vendor T&C ids.\n   * @returns The vendor signing records.\n   * @throws If `vendor` is missing from state.\n   */\n  async recordVendorDisclaimers(params: {\n    disclaimerIds: string[];\n  }): Promise<KycVendorSigning[]> {\n    if (!this.state.vendor) {\n      throw new Error('No vendor was found');\n    }\n\n    if (!this.state.email) {\n      throw new Error('No email was found');\n    }\n\n    const { vendor } = this.state;\n\n    const signings = await this.messenger.call(\n      'KycService:submitVendorDisclaimers',\n      {\n        vendor,\n        disclaimerIds: params.disclaimerIds,\n      },\n    );\n\n    // TODO: this only works for Iron right now\n    this.update((state) => {\n      state.vendorDisclaimersAccepted = recordVendorDisclaimerAcceptance(\n        state.vendorDisclaimersAccepted,\n        vendor,\n        {\n          disclaimerIds: params.disclaimerIds,\n        },\n      );\n    });\n\n    return signings;\n  }\n\n  /**\n   * Fetches the current vendor T&C catalog and returns whether every document\n   * is already recorded in {@link KycControllerState.vendorDisclaimersAccepted}.\n   *\n   * @returns Whether persisted acceptance covers the fetched catalog.\n   * @throws If `vendor` or `geoCountry` is missing from state.\n   */\n  async hasCompletedVendorDisclaimers(): Promise<boolean> {\n    if (!this.state.vendor) {\n      throw new Error('No vendor was found');\n    }\n    if (!this.state.geoCountry) {\n      throw new Error('No geoCountry was found');\n    }\n\n    const fetched = await this.fetchVendorDisclaimers({\n      vendor: this.state.vendor,\n      country: this.state.geoCountry,\n    });\n\n    // TODO: this only works for Iron right now\n    return areVendorDisclaimersCompleted(\n      this.state.vendorDisclaimersAccepted,\n      this.state.vendor,\n      fetched,\n    );\n  }\n\n  /**\n   * Presents the identity-provider verification UI. Currently launches SumSub.\n   *\n   * @param params - Optional SDK presentation options.\n   * @param params.locale - BCP-47 locale for the SDK UI.\n   * @param params.debug - Enables SDK debug logging.\n   * @returns The durable provider-flow outcome.\n   */\n  launchProviderFlow({\n    locale,\n    debug,\n  }: {\n    locale?: string;\n    debug?: boolean;\n  }): Promise<KycProviderFlowStatus> {\n    // Currently only sumsub is supported and must be used for Iron\n    return this.#launchSumsubFlow({ locale, debug });\n  }\n\n  /**\n   * Runs the SumSub document-verification sub-flow end to end:\n   *\n   *  1. creates a UKYC session, receiving per-secret encryption schemas;\n   *  2. verifies the `encryptionDataKey` schema's `jwtChain` against the\n   *     idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against\n   *     the idOS relay JWKS, then confirms each attested session server public\n   *     key;\n   *  3. derives the `data_encryption_key` from the wallet's UKYC\n   *     `local_user_secret` and wraps it for the session server;\n   *  4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the\n   *     same way as the encryption key, and submits both via authorizations;\n   *  5. fetches the SumSub applicant access token; and\n   *  6. presents the SDK via the injected launcher.\n   *\n   * If a UKYC session already exists (the consents path creates it before\n   * recording session disclaimers), steps 1–4 are skipped.\n   *\n   * If authorizations report the applicant is already approved on the relay\n   * while the vendor is still finalizing (`kycStatus: approved`,\n   * `finalStatus: pending`), the sub-flow stops at step 4 with a\n   * `vendorProcessing` status and a message rather than launching the SDK.\n   *\n   * @param params - Optional parameters.\n   * @param params.locale - BCP-47 locale for the SDK UI.\n   * @param params.debug - Enables SDK debug logging.\n   * @returns The durable provider-flow outcome.\n   */\n  async #launchSumsubFlow(params?: {\n    locale?: string;\n    debug?: boolean;\n  }): Promise<KycProviderFlowStatus> {\n    const sessionId = this.state.sessionStatus?.id;\n    if (!this.#sumsubLauncher.isAvailable() || !sessionId) {\n      this.update((state) => {\n        state.providerFlowStatus = 'failed';\n      });\n      return 'failed';\n    }\n\n    try {\n      // TODO: check if the sumsub and idos disclaimers are accepted\n      const { applicantAccessToken } = await this.messenger.call(\n        'KycService:createJourney',\n        sessionId,\n      );\n\n      // Track whether the SDK ever reported a successful completion or its own\n      // failure. A resolved `launch` alone does not imply success — the\n      // applicant may have abandoned the flow, or the SDK may have reported\n      // that it could not run.\n      let reachedCompletion = false;\n      let sdkFailed = false;\n\n      const result = await this.#sumsubLauncher.launch({\n        applicantAccessToken,\n        onTokenExpiration: async () => {\n          const journey = await this.messenger.call(\n            'KycService:createJourney',\n            sessionId,\n          );\n          return journey.applicantAccessToken;\n        },\n        onStatusChange: (_prev, next) => {\n          if (isSumSubFlowCompleted(next)) {\n            reachedCompletion = true;\n          }\n          if (isSumSubFlowFailed(next)) {\n            sdkFailed = true;\n          }\n        },\n        locale: params?.locale ?? 'en',\n        debug: params?.debug ?? false,\n      });\n\n      // Some native SDKs resolve with their final status without first\n      // delivering the corresponding state-change callback.\n      reachedCompletion ||= isSumSubFlowCompleted(result.status);\n      sdkFailed ||= isSumSubFlowFailed(result.status);\n\n      const currentSessionStatus = this.state.sessionStatus;\n      if (currentSessionStatus?.id !== sessionId) {\n        return 'failed';\n      }\n\n      if (sdkFailed) {\n        this.update((state) => {\n          state.providerFlowStatus = 'failed';\n        });\n        return 'failed';\n      }\n\n      if (reachedCompletion) {\n        // Once the SDK completes, the authoritative verification decision comes\n        // from the UKYC backend, not the SDK result.\n        this.update((state) => {\n          state.sessionStatus = {\n            ...currentSessionStatus,\n            finalStatus: 'pending',\n          };\n          state.providerFlowStatus = 'submitted';\n        });\n        this.startSessionStatusPolling();\n        return 'submitted';\n      }\n\n      this.update((state) => {\n        state.providerFlowStatus = 'abandoned';\n      });\n      return 'abandoned';\n    } catch {\n      if (this.state.sessionStatus?.id === sessionId) {\n        this.update((state) => {\n          state.providerFlowStatus = 'failed';\n        });\n      }\n      return 'failed';\n    }\n  }\n\n  /**\n   * Verifies each schema's jwtChain against the matching issuer JWKS, then\n   * confirms the returned server public key matches the value attested inside\n   * the verified JWT payload before trusting it for wrapping.\n   * `encryptionDataKey` is attested by the idOS enclave; `ukycCapabilityToken`\n   * by the idOS relay.\n   *\n   * @param encryptionDataKey - Encryption schema for the data encryption key.\n   * @param capabilityTokenSchema - Encryption schema for the capability token.\n   */\n  async #verifyWrappingKeys(\n    encryptionDataKey: EncryptionSchema,\n    capabilityTokenSchema: EncryptionSchema,\n  ): Promise<void> {\n    const [{ keys: idosEnclaveKeys }, { keys: idosRelayKeys }] =\n      await Promise.all([\n        this.messenger.call('KycService:fetchIdosEnclaveJwks'),\n        this.messenger.call('KycService:fetchIdosRelayJwks'),\n      ]);\n    assertAttestedServerPublicKey(idosEnclaveKeys, encryptionDataKey);\n    assertAttestedServerPublicKey(idosRelayKeys, capabilityTokenSchema);\n  }\n\n  /**\n   * Derives the `data_encryption_key` from the `local_user_secret`, mints a\n   * capability token, and wraps both for the session server. Only the wrapped\n   * (encrypted) material ever leaves the device.\n   *\n   * Only the client holds the signing key derived from `local_user_secret`, so\n   * only the client can mint the token.\n   *\n   * @param sessionClientPrivateKey - Per-session X25519 private key used to\n   * seal both secrets.\n   * @param encryptionDataKey - Encryption schema for the data encryption key.\n   * @param capabilityTokenSchema - Encryption schema for the capability token.\n   * @returns The wrapped encryption key and capability token.\n   */\n  async #generateWrappedAuthorizations(\n    sessionClientPrivateKey: Uint8Array,\n    encryptionDataKey: EncryptionSchema,\n    capabilityTokenSchema: EncryptionSchema,\n  ): Promise<{\n    wrappedEncryptionDataKey: CapabilityAuthorization;\n    wrappedUkycCapabilityToken: CapabilityAuthorization;\n  }> {\n    const localUserSecret = await getOrCreateLocalUserSecret(\n      this.#localUserSecretStore,\n    );\n    const clientMaterial = deriveClientMaterial(localUserSecret);\n    const wrappedEncryptionDataKey = wrapEncryptionKey(\n      sessionClientPrivateKey,\n      encryptionDataKey.serverPublicKey.x,\n      clientMaterial.dataEncryptionKey,\n    );\n\n    const ukycCapabilityToken = signStorageAccessToken({\n      material: clientMaterial,\n      // TODO: Confirm with idOS when this can be switched back to read and a separate token is sent for write\n      operations: ['read', 'write'],\n      expiresAt: new Date(Date.now() + UKYC_CAPABILITY_TOKEN_TTL_MS),\n    });\n    const wrappedUkycCapabilityToken = wrapEncryptionKey(\n      sessionClientPrivateKey,\n      capabilityTokenSchema.serverPublicKey.x,\n      stringToBytes(encodeStorageAccessTokenForHeader(ukycCapabilityToken)),\n    );\n\n    return { wrappedEncryptionDataKey, wrappedUkycCapabilityToken };\n  }\n}\n"]}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { KycController, getDefaultKycControllerState, getDefaultKycProviderDisclaimersAccepted, getDefaultKycVendorDisclaimersAccepted, KYC_PROVIDER_FLOW_STATUSES, controllerName, } from './KycController.js';
 export type { KycControllerActions, KycControllerEvents, KycControllerGetStateAction, KycControllerMessenger, KycControllerOptions, KycControllerState, KycControllerStateChangeEvent, FetchSessionDisclaimersParams, KycProviderFlowStatus, } from './KycController.js';
-export type { KycControllerClearStateAction, KycControllerFetchSessionDisclaimersAction, KycControllerFetchVendorDisclaimersAction, KycControllerGetProviderFlowStatusAction, KycControllerGetSessionStatusForVendorAction, KycControllerHasCompletedSessionDisclaimersAction, KycControllerHasCompletedVendorDisclaimersAction, KycControllerLaunchProviderFlowAction, KycControllerRecordSessionDisclaimersAction, KycControllerRecordVendorDisclaimersAction, KycControllerRefreshSessionStatusAction, KycControllerResetAction, KycControllerStartSessionAction, KycControllerStartSessionStatusPollingAction, } from './KycController-method-action-types.js';
+export type { KycControllerClearStateAction, KycControllerFetchSessionDisclaimersAction, KycControllerFetchVendorDisclaimersAction, KycControllerGetProviderFlowStatusAction, KycControllerGetSessionStatusForVendorAction, KycControllerHasCompletedSessionDisclaimersAction, KycControllerHasCompletedVendorDisclaimersAction, KycControllerLaunchProviderFlowAction, KycControllerRecordSessionDisclaimersAction, KycControllerRecordVendorDisclaimersAction, KycControllerFetchSessionStatusOnceAction, KycControllerReadSessionStatusAction, KycControllerRefreshSessionStatusAction, KycControllerResetAction, KycControllerStartSessionAction, KycControllerStartSessionStatusPollingAction, } from './KycController-method-action-types.js';
 export { KycService, serviceName } from './KycService.js';
 export type { ApplicantAccessTokenResponse, CapabilityAuthorization, CreateVendorCustomerParams, CreateMoonpaySessionParams, CreateUkycSessionParams, EncryptionSchema, FetchSessionDisclaimersByCountryParams, FetchSessionDisclaimersBySessionIdParams, GetSessionStatusParams, VendorCustomerResponse, JwksResponse, KycServiceActions, KycServiceCacheUpdatedEvent, KycServiceEvents, KycServiceGranularCacheUpdatedEvent, KycServiceInvalidateQueriesAction, KycServiceMessenger, KycServiceOptions, SetAuthorizationsParams, SubmitSessionDisclaimersParams, SubmitVendorDisclaimersParams, UkycSessionResponse, } from './KycService.js';
 export type { KycServiceCreateVendorCustomerAction, KycServiceCreateJourneyAction, KycServiceCreateMoonpaySessionAction, KycServiceCreateUkycSessionAction, KycServiceFetchIdosEnclaveJwksAction, KycServiceFetchIdosRelayJwksAction, KycServiceFetchSessionDisclaimersByCountryAction, KycServiceFetchSessionDisclaimersBySessionIdAction, KycServiceFetchVendorDisclaimersAction, KycServiceGetGeoCountryAction, KycServiceGetSessionStatusAction, KycServiceGetSessionStatusForVendorAction, KycServiceSetAuthorizationsAction, KycServiceSubmitSessionDisclaimersAction, KycServiceSubmitVendorDisclaimersAction, } from './KycService-method-action-types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,wCAAwC,EACxC,sCAAsC,EACtC,0BAA0B,EAC1B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,6BAA6B,EAC7B,0CAA0C,EAC1C,yCAAyC,EACzC,wCAAwC,EACxC,4CAA4C,EAC5C,iDAAiD,EACjD,gDAAgD,EAChD,qCAAqC,EACrC,2CAA2C,EAC3C,0CAA0C,EAC1C,uCAAuC,EACvC,wBAAwB,EACxB,+BAA+B,EAC/B,4CAA4C,GAC7C,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC1D,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,gBAAgB,EAChB,sCAAsC,EACtC,wCAAwC,EACxC,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,oCAAoC,EACpC,6BAA6B,EAC7B,oCAAoC,EACpC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gDAAgD,EAChD,kDAAkD,EAClD,sCAAsC,EACtC,6BAA6B,EAC7B,gCAAgC,EAChC,yCAAyC,EACzC,iCAAiC,EACjC,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,EACV,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,gCAAgC,EAChC,mCAAmC,EACnC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,wCAAwC,EACxC,sCAAsC,EACtC,0BAA0B,EAC1B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,6BAA6B,EAC7B,0CAA0C,EAC1C,yCAAyC,EACzC,wCAAwC,EACxC,4CAA4C,EAC5C,iDAAiD,EACjD,gDAAgD,EAChD,qCAAqC,EACrC,2CAA2C,EAC3C,0CAA0C,EAC1C,yCAAyC,EACzC,oCAAoC,EACpC,uCAAuC,EACvC,wBAAwB,EACxB,+BAA+B,EAC/B,4CAA4C,GAC7C,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC1D,YAAY,EACV,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,EACvB,gBAAgB,EAChB,sCAAsC,EACtC,wCAAwC,EACxC,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,EAChB,mCAAmC,EACnC,iCAAiC,EACjC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,oCAAoC,EACpC,6BAA6B,EAC7B,oCAAoC,EACpC,iCAAiC,EACjC,oCAAoC,EACpC,kCAAkC,EAClC,gDAAgD,EAChD,kDAAkD,EAClD,sCAAsC,EACtC,6BAA6B,EAC7B,gCAAgC,EAChC,yCAAyC,EACzC,iCAAiC,EACjC,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,4BAA4B,EAC5B,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,UAAU,EACV,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,SAAS,EACT,gCAAgC,EAChC,mCAAmC,EACnC,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,4BAA4B,EAC5B,sBAAsB,EACtB,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,wCAAwC,EACxC,sCAAsC,EACtC,0BAA0B,EAC1B,cAAc,GACf,MAAM,oBAAoB,CAAC;AA6B5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA2C1D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgClE,iFAAiF;AACjF,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AAKxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AAQtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAMxD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC","sourcesContent":["export {\n  KycController,\n  getDefaultKycControllerState,\n  getDefaultKycProviderDisclaimersAccepted,\n  getDefaultKycVendorDisclaimersAccepted,\n  KYC_PROVIDER_FLOW_STATUSES,\n  controllerName,\n} from './KycController.js';\nexport type {\n  KycControllerActions,\n  KycControllerEvents,\n  KycControllerGetStateAction,\n  KycControllerMessenger,\n  KycControllerOptions,\n  KycControllerState,\n  KycControllerStateChangeEvent,\n  FetchSessionDisclaimersParams,\n  KycProviderFlowStatus,\n} from './KycController.js';\nexport type {\n  KycControllerClearStateAction,\n  KycControllerFetchSessionDisclaimersAction,\n  KycControllerFetchVendorDisclaimersAction,\n  KycControllerGetProviderFlowStatusAction,\n  KycControllerGetSessionStatusForVendorAction,\n  KycControllerHasCompletedSessionDisclaimersAction,\n  KycControllerHasCompletedVendorDisclaimersAction,\n  KycControllerLaunchProviderFlowAction,\n  KycControllerRecordSessionDisclaimersAction,\n  KycControllerRecordVendorDisclaimersAction,\n  KycControllerRefreshSessionStatusAction,\n  KycControllerResetAction,\n  KycControllerStartSessionAction,\n  KycControllerStartSessionStatusPollingAction,\n} from './KycController-method-action-types.js';\n\nexport { KycService, serviceName } from './KycService.js';\nexport type {\n  ApplicantAccessTokenResponse,\n  CapabilityAuthorization,\n  CreateVendorCustomerParams,\n  CreateMoonpaySessionParams,\n  CreateUkycSessionParams,\n  EncryptionSchema,\n  FetchSessionDisclaimersByCountryParams,\n  FetchSessionDisclaimersBySessionIdParams,\n  GetSessionStatusParams,\n  VendorCustomerResponse,\n  JwksResponse,\n  KycServiceActions,\n  KycServiceCacheUpdatedEvent,\n  KycServiceEvents,\n  KycServiceGranularCacheUpdatedEvent,\n  KycServiceInvalidateQueriesAction,\n  KycServiceMessenger,\n  KycServiceOptions,\n  SetAuthorizationsParams,\n  SubmitSessionDisclaimersParams,\n  SubmitVendorDisclaimersParams,\n  UkycSessionResponse,\n} from './KycService.js';\nexport type {\n  KycServiceCreateVendorCustomerAction,\n  KycServiceCreateJourneyAction,\n  KycServiceCreateMoonpaySessionAction,\n  KycServiceCreateUkycSessionAction,\n  KycServiceFetchIdosEnclaveJwksAction,\n  KycServiceFetchIdosRelayJwksAction,\n  KycServiceFetchSessionDisclaimersByCountryAction,\n  KycServiceFetchSessionDisclaimersBySessionIdAction,\n  KycServiceFetchVendorDisclaimersAction,\n  KycServiceGetGeoCountryAction,\n  KycServiceGetSessionStatusAction,\n  KycServiceGetSessionStatusForVendorAction,\n  KycServiceSetAuthorizationsAction,\n  KycServiceSubmitSessionDisclaimersAction,\n  KycServiceSubmitVendorDisclaimersAction,\n} from './KycService-method-action-types.js';\n\nexport { selectKycSessionStatus, selectKycVendor } from './selectors.js';\n\nexport { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from './countryCodes.js';\nexport { decryptCredentials, generateKeyPair } from './crypto.js';\nexport type {\n  DecryptedCredentials,\n  DecryptResult,\n  EncryptedCredentialsEnvelope,\n  X25519KeyPair,\n} from './crypto.js';\n\nexport type {\n  KycCatalogDocument,\n  KycConsentDocument,\n  KycConsentRecord,\n  KycDisclaimer,\n  KycDisclaimersCatalog,\n  KycPhase,\n  KycProduct,\n  KycProviderDisclaimersAccepted,\n  KycSessionDisclaimers,\n  KycSessionStatus,\n  KycVendor,\n  KycIronVendorDisclaimersAccepted,\n  KycMoonpayVendorDisclaimersAccepted,\n  KycVendorDisclaimersAccepted,\n  KycVendorSigning,\n} from './types.js';\nexport type {\n  KycSumSubLaunchParams,\n  KycSumSubLauncher,\n  KycSumSubSdkStatus,\n  KycSumSubStatus,\n} from './providers/sumsub.js';\n\n// UKYC storage-access-token utilities. Exported so a signed capability token can\n// be minted for testing UKYC Storage (see `mintUkycTestToken`).\nexport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_KWIL_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './ukyc/constants.js';\nexport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport type {\n  EncodedUkycClientMaterial,\n  UkycClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nexport type {\n  SignStorageAccessTokenParams,\n  UkycStorageAccessToken,\n  UkycStorageAccessTokenPayload,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './ukyc/storageAccessToken.js';\nexport { mintUkycTestToken } from './ukyc/testToken.js';\nexport type {\n  MintedUkycTestToken,\n  MintUkycTestTokenParams,\n} from './ukyc/testToken.js';\n\nexport {\n  clearMoonPaySession,\n  MoonPayFrameHandler,\n} from './vendors/MoonPayFrameHandler.js';\nexport type { MoonPayFrameHandlerOptions } from './vendors/MoonPayFrameHandler.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,wCAAwC,EACxC,sCAAsC,EACtC,0BAA0B,EAC1B,cAAc,GACf,MAAM,oBAAoB,CAAC;AA+B5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA2C1D,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgClE,iFAAiF;AACjF,gEAAgE;AAChE,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,kCAAkC,EAClC,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AAKxC,OAAO,EACL,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AAQtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAMxD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC","sourcesContent":["export {\n  KycController,\n  getDefaultKycControllerState,\n  getDefaultKycProviderDisclaimersAccepted,\n  getDefaultKycVendorDisclaimersAccepted,\n  KYC_PROVIDER_FLOW_STATUSES,\n  controllerName,\n} from './KycController.js';\nexport type {\n  KycControllerActions,\n  KycControllerEvents,\n  KycControllerGetStateAction,\n  KycControllerMessenger,\n  KycControllerOptions,\n  KycControllerState,\n  KycControllerStateChangeEvent,\n  FetchSessionDisclaimersParams,\n  KycProviderFlowStatus,\n} from './KycController.js';\nexport type {\n  KycControllerClearStateAction,\n  KycControllerFetchSessionDisclaimersAction,\n  KycControllerFetchVendorDisclaimersAction,\n  KycControllerGetProviderFlowStatusAction,\n  KycControllerGetSessionStatusForVendorAction,\n  KycControllerHasCompletedSessionDisclaimersAction,\n  KycControllerHasCompletedVendorDisclaimersAction,\n  KycControllerLaunchProviderFlowAction,\n  KycControllerRecordSessionDisclaimersAction,\n  KycControllerRecordVendorDisclaimersAction,\n  KycControllerFetchSessionStatusOnceAction,\n  KycControllerReadSessionStatusAction,\n  KycControllerRefreshSessionStatusAction,\n  KycControllerResetAction,\n  KycControllerStartSessionAction,\n  KycControllerStartSessionStatusPollingAction,\n} from './KycController-method-action-types.js';\n\nexport { KycService, serviceName } from './KycService.js';\nexport type {\n  ApplicantAccessTokenResponse,\n  CapabilityAuthorization,\n  CreateVendorCustomerParams,\n  CreateMoonpaySessionParams,\n  CreateUkycSessionParams,\n  EncryptionSchema,\n  FetchSessionDisclaimersByCountryParams,\n  FetchSessionDisclaimersBySessionIdParams,\n  GetSessionStatusParams,\n  VendorCustomerResponse,\n  JwksResponse,\n  KycServiceActions,\n  KycServiceCacheUpdatedEvent,\n  KycServiceEvents,\n  KycServiceGranularCacheUpdatedEvent,\n  KycServiceInvalidateQueriesAction,\n  KycServiceMessenger,\n  KycServiceOptions,\n  SetAuthorizationsParams,\n  SubmitSessionDisclaimersParams,\n  SubmitVendorDisclaimersParams,\n  UkycSessionResponse,\n} from './KycService.js';\nexport type {\n  KycServiceCreateVendorCustomerAction,\n  KycServiceCreateJourneyAction,\n  KycServiceCreateMoonpaySessionAction,\n  KycServiceCreateUkycSessionAction,\n  KycServiceFetchIdosEnclaveJwksAction,\n  KycServiceFetchIdosRelayJwksAction,\n  KycServiceFetchSessionDisclaimersByCountryAction,\n  KycServiceFetchSessionDisclaimersBySessionIdAction,\n  KycServiceFetchVendorDisclaimersAction,\n  KycServiceGetGeoCountryAction,\n  KycServiceGetSessionStatusAction,\n  KycServiceGetSessionStatusForVendorAction,\n  KycServiceSetAuthorizationsAction,\n  KycServiceSubmitSessionDisclaimersAction,\n  KycServiceSubmitVendorDisclaimersAction,\n} from './KycService-method-action-types.js';\n\nexport { selectKycSessionStatus, selectKycVendor } from './selectors.js';\n\nexport { alpha2ToAlpha3, ALPHA2_TO_ALPHA3 } from './countryCodes.js';\nexport { decryptCredentials, generateKeyPair } from './crypto.js';\nexport type {\n  DecryptedCredentials,\n  DecryptResult,\n  EncryptedCredentialsEnvelope,\n  X25519KeyPair,\n} from './crypto.js';\n\nexport type {\n  KycCatalogDocument,\n  KycConsentDocument,\n  KycConsentRecord,\n  KycDisclaimer,\n  KycDisclaimersCatalog,\n  KycPhase,\n  KycProduct,\n  KycProviderDisclaimersAccepted,\n  KycSessionDisclaimers,\n  KycSessionStatus,\n  KycVendor,\n  KycIronVendorDisclaimersAccepted,\n  KycMoonpayVendorDisclaimersAccepted,\n  KycVendorDisclaimersAccepted,\n  KycVendorSigning,\n} from './types.js';\nexport type {\n  KycSumSubLaunchParams,\n  KycSumSubLauncher,\n  KycSumSubSdkStatus,\n  KycSumSubStatus,\n} from './providers/sumsub.js';\n\n// UKYC storage-access-token utilities. Exported so a signed capability token can\n// be minted for testing UKYC Storage (see `mintUkycTestToken`).\nexport {\n  UKYC_CAPABILITY_AUTH_SCHEME,\n  UKYC_KWIL_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCE,\n  UKYC_STORAGE_ACCESS_TOKEN_AUDIENCES,\n  UKYC_STORAGE_ACCESS_TOKEN_VERSION,\n} from './ukyc/constants.js';\nexport {\n  deriveClientMaterial,\n  encodeClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport type {\n  EncodedUkycClientMaterial,\n  UkycClientMaterial,\n} from './ukyc/deriveClientMaterial.js';\nexport {\n  encodeStorageAccessTokenForHeader,\n  signStorageAccessToken,\n} from './ukyc/storageAccessToken.js';\nexport type {\n  SignStorageAccessTokenParams,\n  UkycStorageAccessToken,\n  UkycStorageAccessTokenPayload,\n  UkycStorageOperation,\n  UkycTokenPresenter,\n} from './ukyc/storageAccessToken.js';\nexport { mintUkycTestToken } from './ukyc/testToken.js';\nexport type {\n  MintedUkycTestToken,\n  MintUkycTestTokenParams,\n} from './ukyc/testToken.js';\n\nexport {\n  clearMoonPaySession,\n  MoonPayFrameHandler,\n} from './vendors/MoonPayFrameHandler.js';\nexport type { MoonPayFrameHandlerOptions } from './vendors/MoonPayFrameHandler.js';\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask-previews/kyc-controller",
-  "version": "0.6.1-preview-1a7a6d6d6",
+  "version": "0.7.0-preview-1d9e239b6",
   "description": "Shared KYC / identity verification controller used across MetaMask clients",
   "keywords": [
     "Ethereum",
@@ -57,7 +57,7 @@
     "@metamask/controller-utils": "^13.0.0",
     "@metamask/geolocation-controller": "^2.0.0",
     "@metamask/messenger": "^3.0.0",
-    "@metamask/profile-sync-controller": "^34.0.0",
+    "@metamask/profile-sync-controller": "^34.0.3",
     "@metamask/superstruct": "^3.4.1",
     "@metamask/utils": "^12.0.0",
     "@noble/ciphers": "^1.3.0",
@@ -78,7 +78,7 @@
     "rimraf": "^6.1.3",
     "ts-jest": "^29.4.14",
     "typedoc": "^0.28.20",
-    "typedoc-plugin-missing-exports": "^2.0.0",
+    "typedoc-plugin-missing-exports": "^4.1.4",
     "typescript": "npm:@typescript/typescript6@^6.0.2"
   },
   "engines": {