@moonpay/platform-protocol 1.13.0 → 1.14.0

package/dist/api/customer.d.cts

@@ -124,6 +124,20 @@ type CddEmploymentStatus = 'employedOrSelfEmployed' | 'retired' | 'student' | 'u
  * The customer's primary source of wealth.
  */
 type CddSourceOfWealth = 'salary' | 'savings' | 'investments' | 'cryptoTrading' | 'other';
+/**
+ * A challenge that must be resolved by rendering a MoonPay-hosted frame.
+ */
+type Challenge = {
+    /**
+     * The type of challenge resolution required.
+     */
+    kind: ChallengeKind;
+    /**
+     * Fully-formed challenge frame URL. Render directly without parsing.
+     */
+    url: string;
+};
+type ChallengeKind = 'frame';
 /**
  * Request body for creating an identity.
  */
@@ -542,6 +556,10 @@ type GetQuoteResponse = {
      * An opaque token representing the quote to initiate payment frames.
      */
     signature: string;
+    /**
+     * A challenge the partner must surface and the customer must complete before the quote can proceed — for example, verifying identity to raise guest-checkout limits. Present only when the quote requires one; omitted otherwise.
+     */
+    challenge?: Challenge;
 };
 type IPv4Address = string;
 type IPv6Address = string;
@@ -1174,7 +1192,7 @@ type Requirements = {
 /**
  * The bank-transfer settlement outcome to simulate. Sandbox only.
  */
-type SimulateBankTransferOutcome = 'settled' | 'timeout' | 'mismatch';
+type SimulateBankTransferOutcome = 'settled' | 'timeout';
 /**
  * Request body for simulating bank-transfer settlement.
  */
@@ -1184,7 +1202,7 @@ type SimulateBankTransferRequest = {
      */
     outcome: SimulateBankTransferOutcome;
     /**
-     * Optional sender bank account used to create the customer's bank account (settled) and as the deposit payer (mismatch). Defaults are synthesized per currency when omitted.
+     * Optional sender bank account used to create the customer's bank account when settling. Defaults are synthesized per currency when omitted.
      */
     senderBankAccount?: SimulateSenderBankAccount;
 };

package/dist/api/customer.d.ts

@@ -124,6 +124,20 @@ type CddEmploymentStatus = 'employedOrSelfEmployed' | 'retired' | 'student' | 'u
  * The customer's primary source of wealth.
  */
 type CddSourceOfWealth = 'salary' | 'savings' | 'investments' | 'cryptoTrading' | 'other';
+/**
+ * A challenge that must be resolved by rendering a MoonPay-hosted frame.
+ */
+type Challenge = {
+    /**
+     * The type of challenge resolution required.
+     */
+    kind: ChallengeKind;
+    /**
+     * Fully-formed challenge frame URL. Render directly without parsing.
+     */
+    url: string;
+};
+type ChallengeKind = 'frame';
 /**
  * Request body for creating an identity.
  */
@@ -542,6 +556,10 @@ type GetQuoteResponse = {
      * An opaque token representing the quote to initiate payment frames.
      */
     signature: string;
+    /**
+     * A challenge the partner must surface and the customer must complete before the quote can proceed — for example, verifying identity to raise guest-checkout limits. Present only when the quote requires one; omitted otherwise.
+     */
+    challenge?: Challenge;
 };
 type IPv4Address = string;
 type IPv6Address = string;
@@ -1174,7 +1192,7 @@ type Requirements = {
 /**
  * The bank-transfer settlement outcome to simulate. Sandbox only.
  */
-type SimulateBankTransferOutcome = 'settled' | 'timeout' | 'mismatch';
+type SimulateBankTransferOutcome = 'settled' | 'timeout';
 /**
  * Request body for simulating bank-transfer settlement.
  */
@@ -1184,7 +1202,7 @@ type SimulateBankTransferRequest = {
      */
     outcome: SimulateBankTransferOutcome;
     /**
-     * Optional sender bank account used to create the customer's bank account (settled) and as the deposit payer (mismatch). Defaults are synthesized per currency when omitted.
+     * Optional sender bank account used to create the customer's bank account when settling. Defaults are synthesized per currency when omitted.
      */
     senderBankAccount?: SimulateSenderBankAccount;
 };

package/dist/models/connection.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/models/connection.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// Connection statuses\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionStatus {\n  /**\n   * New or expired user — needs the full connect flow.\n   */\n  connectionRequired = 'connectionRequired',\n\n  /**\n   * Valid connection — encrypted credentials are included.\n   */\n  active = 'active',\n\n  /**\n   * Restricted location — connection cannot be used.\n   */\n  unavailable = 'unavailable',\n\n  /**\n   * KYC decision delayed — may resolve on a subsequent visit.\n   */\n  pending = 'pending',\n\n  /**\n   * Terminal failure — KYC fail, rejection, etc.\n   */\n  failed = 'failed',\n\n  /**\n   * Customer has no valid Terms of Use attestation on file (headless/Identity API partners).\n   * Display Terms of Use in your own UI, capture acceptance, call\n   * `POST /platform/v1/terms/attestations`, then retry the connection.\n   */\n  termsAcceptanceRequired = 'termsAcceptanceRequired',\n}\n\nexport interface ConnectionRequired {\n  status: ConnectionStatus.connectionRequired;\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted anonymous token payload.\n   * These are frame-internal tokens used by the connect frame — they cannot be\n   * used to call MoonPay APIs directly. Decrypt via `decryptCredentials()` only\n   * if you need the `clientToken` to bootstrap the connect frame manually.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements available before authentication, if any.\n   * Present when guest checkout is enabled for the partner.\n   */\n  capabilities?: CustomerCapabilities;\n  /**\n   * Set when the session's email and phone number resolve to two different\n   * MoonPay customers (a conflict). Partners should route the customer\n   * through Connect proactively before rendering payment UI (e.g. Apple Pay).\n   *\n   * Note: the check-connection frame does not emit this field yet — treat\n   * it as absent until frame support ships.\n   */\n  mismatch?: boolean;\n}\n\nexport interface ActiveConnection {\n  status: ConnectionStatus.active;\n  /** The authenticated MoonPay customer. */\n  customer: {\n    /** The MoonPay customer ID. */\n    id: string;\n    /** ISO 3166-1 alpha-3 country code for the customer's jurisdiction. */\n    country?: string;\n    /** State or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n    administrativeArea?: string;\n    /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). Present when the customer is in a regulated area. */\n    area?: string;\n  };\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted JSON containing:\n   * ```json\n   * {\n   *   \"accessToken\": \"<token>\",\n   *   \"clientToken\": \"<token>\",\n   *   \"expiresAt\": \"<iso8601>\"\n   * }\n   * ```\n   *\n   * - `accessToken`: A token that can be used to make API requests from the client.\n   * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay.\n   * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements for the authenticated customer.\n   */\n  capabilities: CustomerCapabilities;\n}\n\nexport interface UnavailableConnection {\n  status: ConnectionStatus.unavailable;\n}\n\nexport interface PendingConnection {\n  status: ConnectionStatus.pending;\n}\n\nexport interface FailedConnection {\n  status: ConnectionStatus.failed;\n  reason: string;\n}\n\nexport interface TermsAcceptanceRequiredConnection {\n  status: ConnectionStatus.termsAcceptanceRequired;\n}\n\n/** Discriminated union of all connection result statuses. */\nexport type Connection =\n  | ConnectionRequired\n  | ActiveConnection\n  | UnavailableConnection\n  | PendingConnection\n  | FailedConnection\n  | TermsAcceptanceRequiredConnection;\n\n// ---------------------------------------------------------------------------\n// Decrypted credentials (what the SDK exposes after decryption)\n// ---------------------------------------------------------------------------\n\nexport interface DecryptedCredentials {\n  accessToken: string;\n  clientToken: string;\n  expiresAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Customer capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Capabilities and regulatory requirements for the authenticated customer.\n */\nexport interface CustomerCapabilities {\n  /** Capabilities for the ramps (buy and sell) product. */\n  ramps?: RampsCapability;\n  /** Capabilities for the guest checkout flow. Present when guest checkout is enabled for the partner and the session is a guest-checkout session. */\n  guestCheckout?: RampsCapability;\n}\n\n/**\n * Capabilities and requirements for the ramps (buy and sell) product.\n */\nexport interface RampsCapability {\n  /** Regulatory requirements for ramps operations in the customer's jurisdiction. */\n  requirements: RampsRequirements;\n}\n\n/**\n * Regulatory requirements that apply to ramps operations for the customer.\n */\nexport interface RampsRequirements {\n  /**\n   * Present when the customer's jurisdiction requires payment disclosures\n   * before a ramps transaction. Omitted when no disclosures are required.\n   *\n   * @deprecated Use `customer.country`, `customer.administrativeArea`, and `customer.area`\n   * from the active connection instead. This field will be removed in a future release.\n   */\n  paymentDisclosures?: PaymentDisclosuresRequirement;\n}\n\n/**\n * A jurisdiction that requires payment disclosures before a ramps transaction.\n */\nexport interface PaymentDisclosuresRequirement {\n  /** The ISO 3166-1 alpha-3 country code for the jurisdiction. */\n  country: string;\n  /** The state or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n  administrativeArea?: string;\n  /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). */\n  area?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Connection errors\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionErrorCode {\n  validationError = 'validationError',\n  /** Wire value is `'generic'`. */\n  connectionFailedGeneric = 'generic',\n}\n\nexport interface ConfigValidationFieldError {\n  code: 'invalidSessionToken' | 'invalidClientToken' | 'invalidPublicKey';\n  message: string;\n}\n\nexport type ConnectionError =\n  | {\n      code: ConnectionErrorCode.validationError;\n      errors: ConfigValidationFieldError[];\n    }\n  | {\n      code: ConnectionErrorCode.connectionFailedGeneric;\n      message?: string;\n    };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,IAAK,mBAAL,kBAAKA,sBAAL;AAIL,EAAAA,kBAAA,wBAAqB;AAKrB,EAAAA,kBAAA,YAAS;AAKT,EAAAA,kBAAA,iBAAc;AAKd,EAAAA,kBAAA,aAAU;AAKV,EAAAA,kBAAA,YAAS;AAOT,EAAAA,kBAAA,6BAA0B;AA/BhB,SAAAA;AAAA,GAAA;AAqLL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,qBAAkB;AAElB,EAAAA,qBAAA,6BAA0B;AAHhB,SAAAA;AAAA,GAAA;","names":["ConnectionStatus","ConnectionErrorCode"]}
+{"version":3,"sources":["../../src/models/connection.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// Connection statuses\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionStatus {\n  /**\n   * New or expired user — needs the full connect flow.\n   */\n  connectionRequired = 'connectionRequired',\n\n  /**\n   * Valid connection — encrypted credentials are included.\n   */\n  active = 'active',\n\n  /**\n   * Restricted location — connection cannot be used.\n   */\n  unavailable = 'unavailable',\n\n  /**\n   * KYC decision delayed — may resolve on a subsequent visit.\n   */\n  pending = 'pending',\n\n  /**\n   * Terminal failure — KYC fail, rejection, etc.\n   */\n  failed = 'failed',\n\n  /**\n   * Customer has no valid Terms of Use attestation on file (headless/Identity API partners).\n   * Display Terms of Use in your own UI, capture acceptance, call\n   * `POST /platform/v1/terms/attestations`, then retry the connection.\n   */\n  termsAcceptanceRequired = 'termsAcceptanceRequired',\n}\n\nexport interface ConnectionRequired {\n  status: ConnectionStatus.connectionRequired;\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted anonymous token payload.\n   * These are frame-internal tokens used by the connect frame — they cannot be\n   * used to call MoonPay APIs directly. Decrypt via `decryptCredentials()` only\n   * if you need the `clientToken` to bootstrap the connect frame manually.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements available before authentication, if any.\n   * Present when guest checkout is enabled for the partner.\n   */\n  capabilities?: CustomerCapabilities;\n  /**\n   * Set when the session's email and phone number resolve to two different\n   * MoonPay customers (a conflict). Partners should route the customer\n   * through Connect proactively before rendering payment UI (e.g. Apple Pay or Google Pay).\n   *\n   * Note: the check-connection frame does not emit this field yet — treat\n   * it as absent until frame support ships.\n   */\n  mismatch?: boolean;\n}\n\nexport interface ActiveConnection {\n  status: ConnectionStatus.active;\n  /** The authenticated MoonPay customer. */\n  customer: {\n    /** The MoonPay customer ID. */\n    id: string;\n    /** ISO 3166-1 alpha-3 country code for the customer's jurisdiction. */\n    country?: string;\n    /** State or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n    administrativeArea?: string;\n    /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). Present when the customer is in a regulated area. */\n    area?: string;\n  };\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted JSON containing:\n   * ```json\n   * {\n   *   \"accessToken\": \"<token>\",\n   *   \"clientToken\": \"<token>\",\n   *   \"expiresAt\": \"<iso8601>\"\n   * }\n   * ```\n   *\n   * - `accessToken`: A token that can be used to make API requests from the client.\n   * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay or Google Pay.\n   * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements for the authenticated customer.\n   */\n  capabilities: CustomerCapabilities;\n}\n\nexport interface UnavailableConnection {\n  status: ConnectionStatus.unavailable;\n}\n\nexport interface PendingConnection {\n  status: ConnectionStatus.pending;\n}\n\nexport interface FailedConnection {\n  status: ConnectionStatus.failed;\n  reason: string;\n}\n\nexport interface TermsAcceptanceRequiredConnection {\n  status: ConnectionStatus.termsAcceptanceRequired;\n}\n\n/** Discriminated union of all connection result statuses. */\nexport type Connection =\n  | ConnectionRequired\n  | ActiveConnection\n  | UnavailableConnection\n  | PendingConnection\n  | FailedConnection\n  | TermsAcceptanceRequiredConnection;\n\n// ---------------------------------------------------------------------------\n// Decrypted credentials (what the SDK exposes after decryption)\n// ---------------------------------------------------------------------------\n\nexport interface DecryptedCredentials {\n  accessToken: string;\n  clientToken: string;\n  expiresAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Customer capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Capabilities and regulatory requirements for the authenticated customer.\n */\nexport interface CustomerCapabilities {\n  /** Capabilities for the ramps (buy and sell) product. */\n  ramps?: RampsCapability;\n  /** Capabilities for the guest checkout flow. Present when guest checkout is enabled for the partner and the session is a guest-checkout session. */\n  guestCheckout?: RampsCapability;\n}\n\n/**\n * Capabilities and requirements for the ramps (buy and sell) product.\n */\nexport interface RampsCapability {\n  /** Regulatory requirements for ramps operations in the customer's jurisdiction. */\n  requirements: RampsRequirements;\n}\n\n/**\n * Regulatory requirements that apply to ramps operations for the customer.\n */\nexport interface RampsRequirements {\n  /**\n   * Present when the customer's jurisdiction requires payment disclosures\n   * before a ramps transaction. Omitted when no disclosures are required.\n   *\n   * @deprecated Use `customer.country`, `customer.administrativeArea`, and `customer.area`\n   * from the active connection instead. This field will be removed in a future release.\n   */\n  paymentDisclosures?: PaymentDisclosuresRequirement;\n}\n\n/**\n * A jurisdiction that requires payment disclosures before a ramps transaction.\n */\nexport interface PaymentDisclosuresRequirement {\n  /** The ISO 3166-1 alpha-3 country code for the jurisdiction. */\n  country: string;\n  /** The state or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n  administrativeArea?: string;\n  /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). */\n  area?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Connection errors\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionErrorCode {\n  validationError = 'validationError',\n  /** Wire value is `'generic'`. */\n  connectionFailedGeneric = 'generic',\n}\n\nexport interface ConfigValidationFieldError {\n  code: 'invalidSessionToken' | 'invalidClientToken' | 'invalidPublicKey';\n  message: string;\n}\n\nexport type ConnectionError =\n  | {\n      code: ConnectionErrorCode.validationError;\n      errors: ConfigValidationFieldError[];\n    }\n  | {\n      code: ConnectionErrorCode.connectionFailedGeneric;\n      message?: string;\n    };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,IAAK,mBAAL,kBAAKA,sBAAL;AAIL,EAAAA,kBAAA,wBAAqB;AAKrB,EAAAA,kBAAA,YAAS;AAKT,EAAAA,kBAAA,iBAAc;AAKd,EAAAA,kBAAA,aAAU;AAKV,EAAAA,kBAAA,YAAS;AAOT,EAAAA,kBAAA,6BAA0B;AA/BhB,SAAAA;AAAA,GAAA;AAqLL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,qBAAkB;AAElB,EAAAA,qBAAA,6BAA0B;AAHhB,SAAAA;AAAA,GAAA;","names":["ConnectionStatus","ConnectionErrorCode"]}

package/dist/models/connection.d.cts

@@ -43,7 +43,7 @@ interface ConnectionRequired {
     /**
      * Set when the session's email and phone number resolve to two different
      * MoonPay customers (a conflict). Partners should route the customer
-     * through Connect proactively before rendering payment UI (e.g. Apple Pay).
+     * through Connect proactively before rendering payment UI (e.g. Apple Pay or Google Pay).
      *
      * Note: the check-connection frame does not emit this field yet — treat
      * it as absent until frame support ships.
@@ -74,7 +74,7 @@ interface ActiveConnection {
      * ```
      *
      * - `accessToken`: A token that can be used to make API requests from the client.
-     * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay.
+     * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay or Google Pay.
      * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.
      */
     credentials: string;

package/dist/models/connection.d.ts

@@ -43,7 +43,7 @@ interface ConnectionRequired {
     /**
      * Set when the session's email and phone number resolve to two different
      * MoonPay customers (a conflict). Partners should route the customer
-     * through Connect proactively before rendering payment UI (e.g. Apple Pay).
+     * through Connect proactively before rendering payment UI (e.g. Apple Pay or Google Pay).
      *
      * Note: the check-connection frame does not emit this field yet — treat
      * it as absent until frame support ships.
@@ -74,7 +74,7 @@ interface ActiveConnection {
      * ```
      *
      * - `accessToken`: A token that can be used to make API requests from the client.
-     * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay.
+     * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay or Google Pay.
      * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.
      */
     credentials: string;

package/dist/models/connection.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/models/connection.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// Connection statuses\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionStatus {\n  /**\n   * New or expired user — needs the full connect flow.\n   */\n  connectionRequired = 'connectionRequired',\n\n  /**\n   * Valid connection — encrypted credentials are included.\n   */\n  active = 'active',\n\n  /**\n   * Restricted location — connection cannot be used.\n   */\n  unavailable = 'unavailable',\n\n  /**\n   * KYC decision delayed — may resolve on a subsequent visit.\n   */\n  pending = 'pending',\n\n  /**\n   * Terminal failure — KYC fail, rejection, etc.\n   */\n  failed = 'failed',\n\n  /**\n   * Customer has no valid Terms of Use attestation on file (headless/Identity API partners).\n   * Display Terms of Use in your own UI, capture acceptance, call\n   * `POST /platform/v1/terms/attestations`, then retry the connection.\n   */\n  termsAcceptanceRequired = 'termsAcceptanceRequired',\n}\n\nexport interface ConnectionRequired {\n  status: ConnectionStatus.connectionRequired;\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted anonymous token payload.\n   * These are frame-internal tokens used by the connect frame — they cannot be\n   * used to call MoonPay APIs directly. Decrypt via `decryptCredentials()` only\n   * if you need the `clientToken` to bootstrap the connect frame manually.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements available before authentication, if any.\n   * Present when guest checkout is enabled for the partner.\n   */\n  capabilities?: CustomerCapabilities;\n  /**\n   * Set when the session's email and phone number resolve to two different\n   * MoonPay customers (a conflict). Partners should route the customer\n   * through Connect proactively before rendering payment UI (e.g. Apple Pay).\n   *\n   * Note: the check-connection frame does not emit this field yet — treat\n   * it as absent until frame support ships.\n   */\n  mismatch?: boolean;\n}\n\nexport interface ActiveConnection {\n  status: ConnectionStatus.active;\n  /** The authenticated MoonPay customer. */\n  customer: {\n    /** The MoonPay customer ID. */\n    id: string;\n    /** ISO 3166-1 alpha-3 country code for the customer's jurisdiction. */\n    country?: string;\n    /** State or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n    administrativeArea?: string;\n    /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). Present when the customer is in a regulated area. */\n    area?: string;\n  };\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted JSON containing:\n   * ```json\n   * {\n   *   \"accessToken\": \"<token>\",\n   *   \"clientToken\": \"<token>\",\n   *   \"expiresAt\": \"<iso8601>\"\n   * }\n   * ```\n   *\n   * - `accessToken`: A token that can be used to make API requests from the client.\n   * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay.\n   * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements for the authenticated customer.\n   */\n  capabilities: CustomerCapabilities;\n}\n\nexport interface UnavailableConnection {\n  status: ConnectionStatus.unavailable;\n}\n\nexport interface PendingConnection {\n  status: ConnectionStatus.pending;\n}\n\nexport interface FailedConnection {\n  status: ConnectionStatus.failed;\n  reason: string;\n}\n\nexport interface TermsAcceptanceRequiredConnection {\n  status: ConnectionStatus.termsAcceptanceRequired;\n}\n\n/** Discriminated union of all connection result statuses. */\nexport type Connection =\n  | ConnectionRequired\n  | ActiveConnection\n  | UnavailableConnection\n  | PendingConnection\n  | FailedConnection\n  | TermsAcceptanceRequiredConnection;\n\n// ---------------------------------------------------------------------------\n// Decrypted credentials (what the SDK exposes after decryption)\n// ---------------------------------------------------------------------------\n\nexport interface DecryptedCredentials {\n  accessToken: string;\n  clientToken: string;\n  expiresAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Customer capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Capabilities and regulatory requirements for the authenticated customer.\n */\nexport interface CustomerCapabilities {\n  /** Capabilities for the ramps (buy and sell) product. */\n  ramps?: RampsCapability;\n  /** Capabilities for the guest checkout flow. Present when guest checkout is enabled for the partner and the session is a guest-checkout session. */\n  guestCheckout?: RampsCapability;\n}\n\n/**\n * Capabilities and requirements for the ramps (buy and sell) product.\n */\nexport interface RampsCapability {\n  /** Regulatory requirements for ramps operations in the customer's jurisdiction. */\n  requirements: RampsRequirements;\n}\n\n/**\n * Regulatory requirements that apply to ramps operations for the customer.\n */\nexport interface RampsRequirements {\n  /**\n   * Present when the customer's jurisdiction requires payment disclosures\n   * before a ramps transaction. Omitted when no disclosures are required.\n   *\n   * @deprecated Use `customer.country`, `customer.administrativeArea`, and `customer.area`\n   * from the active connection instead. This field will be removed in a future release.\n   */\n  paymentDisclosures?: PaymentDisclosuresRequirement;\n}\n\n/**\n * A jurisdiction that requires payment disclosures before a ramps transaction.\n */\nexport interface PaymentDisclosuresRequirement {\n  /** The ISO 3166-1 alpha-3 country code for the jurisdiction. */\n  country: string;\n  /** The state or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n  administrativeArea?: string;\n  /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). */\n  area?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Connection errors\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionErrorCode {\n  validationError = 'validationError',\n  /** Wire value is `'generic'`. */\n  connectionFailedGeneric = 'generic',\n}\n\nexport interface ConfigValidationFieldError {\n  code: 'invalidSessionToken' | 'invalidClientToken' | 'invalidPublicKey';\n  message: string;\n}\n\nexport type ConnectionError =\n  | {\n      code: ConnectionErrorCode.validationError;\n      errors: ConfigValidationFieldError[];\n    }\n  | {\n      code: ConnectionErrorCode.connectionFailedGeneric;\n      message?: string;\n    };\n"],"mappings":";AAIO,IAAK,mBAAL,kBAAKA,sBAAL;AAIL,EAAAA,kBAAA,wBAAqB;AAKrB,EAAAA,kBAAA,YAAS;AAKT,EAAAA,kBAAA,iBAAc;AAKd,EAAAA,kBAAA,aAAU;AAKV,EAAAA,kBAAA,YAAS;AAOT,EAAAA,kBAAA,6BAA0B;AA/BhB,SAAAA;AAAA,GAAA;AAqLL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,qBAAkB;AAElB,EAAAA,qBAAA,6BAA0B;AAHhB,SAAAA;AAAA,GAAA;","names":["ConnectionStatus","ConnectionErrorCode"]}
+{"version":3,"sources":["../../src/models/connection.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// Connection statuses\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionStatus {\n  /**\n   * New or expired user — needs the full connect flow.\n   */\n  connectionRequired = 'connectionRequired',\n\n  /**\n   * Valid connection — encrypted credentials are included.\n   */\n  active = 'active',\n\n  /**\n   * Restricted location — connection cannot be used.\n   */\n  unavailable = 'unavailable',\n\n  /**\n   * KYC decision delayed — may resolve on a subsequent visit.\n   */\n  pending = 'pending',\n\n  /**\n   * Terminal failure — KYC fail, rejection, etc.\n   */\n  failed = 'failed',\n\n  /**\n   * Customer has no valid Terms of Use attestation on file (headless/Identity API partners).\n   * Display Terms of Use in your own UI, capture acceptance, call\n   * `POST /platform/v1/terms/attestations`, then retry the connection.\n   */\n  termsAcceptanceRequired = 'termsAcceptanceRequired',\n}\n\nexport interface ConnectionRequired {\n  status: ConnectionStatus.connectionRequired;\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted anonymous token payload.\n   * These are frame-internal tokens used by the connect frame — they cannot be\n   * used to call MoonPay APIs directly. Decrypt via `decryptCredentials()` only\n   * if you need the `clientToken` to bootstrap the connect frame manually.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements available before authentication, if any.\n   * Present when guest checkout is enabled for the partner.\n   */\n  capabilities?: CustomerCapabilities;\n  /**\n   * Set when the session's email and phone number resolve to two different\n   * MoonPay customers (a conflict). Partners should route the customer\n   * through Connect proactively before rendering payment UI (e.g. Apple Pay or Google Pay).\n   *\n   * Note: the check-connection frame does not emit this field yet — treat\n   * it as absent until frame support ships.\n   */\n  mismatch?: boolean;\n}\n\nexport interface ActiveConnection {\n  status: ConnectionStatus.active;\n  /** The authenticated MoonPay customer. */\n  customer: {\n    /** The MoonPay customer ID. */\n    id: string;\n    /** ISO 3166-1 alpha-3 country code for the customer's jurisdiction. */\n    country?: string;\n    /** State or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n    administrativeArea?: string;\n    /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). Present when the customer is in a regulated area. */\n    area?: string;\n  };\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted JSON containing:\n   * ```json\n   * {\n   *   \"accessToken\": \"<token>\",\n   *   \"clientToken\": \"<token>\",\n   *   \"expiresAt\": \"<iso8601>\"\n   * }\n   * ```\n   *\n   * - `accessToken`: A token that can be used to make API requests from the client.\n   * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay or Google Pay.\n   * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements for the authenticated customer.\n   */\n  capabilities: CustomerCapabilities;\n}\n\nexport interface UnavailableConnection {\n  status: ConnectionStatus.unavailable;\n}\n\nexport interface PendingConnection {\n  status: ConnectionStatus.pending;\n}\n\nexport interface FailedConnection {\n  status: ConnectionStatus.failed;\n  reason: string;\n}\n\nexport interface TermsAcceptanceRequiredConnection {\n  status: ConnectionStatus.termsAcceptanceRequired;\n}\n\n/** Discriminated union of all connection result statuses. */\nexport type Connection =\n  | ConnectionRequired\n  | ActiveConnection\n  | UnavailableConnection\n  | PendingConnection\n  | FailedConnection\n  | TermsAcceptanceRequiredConnection;\n\n// ---------------------------------------------------------------------------\n// Decrypted credentials (what the SDK exposes after decryption)\n// ---------------------------------------------------------------------------\n\nexport interface DecryptedCredentials {\n  accessToken: string;\n  clientToken: string;\n  expiresAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Customer capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Capabilities and regulatory requirements for the authenticated customer.\n */\nexport interface CustomerCapabilities {\n  /** Capabilities for the ramps (buy and sell) product. */\n  ramps?: RampsCapability;\n  /** Capabilities for the guest checkout flow. Present when guest checkout is enabled for the partner and the session is a guest-checkout session. */\n  guestCheckout?: RampsCapability;\n}\n\n/**\n * Capabilities and requirements for the ramps (buy and sell) product.\n */\nexport interface RampsCapability {\n  /** Regulatory requirements for ramps operations in the customer's jurisdiction. */\n  requirements: RampsRequirements;\n}\n\n/**\n * Regulatory requirements that apply to ramps operations for the customer.\n */\nexport interface RampsRequirements {\n  /**\n   * Present when the customer's jurisdiction requires payment disclosures\n   * before a ramps transaction. Omitted when no disclosures are required.\n   *\n   * @deprecated Use `customer.country`, `customer.administrativeArea`, and `customer.area`\n   * from the active connection instead. This field will be removed in a future release.\n   */\n  paymentDisclosures?: PaymentDisclosuresRequirement;\n}\n\n/**\n * A jurisdiction that requires payment disclosures before a ramps transaction.\n */\nexport interface PaymentDisclosuresRequirement {\n  /** The ISO 3166-1 alpha-3 country code for the jurisdiction. */\n  country: string;\n  /** The state or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n  administrativeArea?: string;\n  /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). */\n  area?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Connection errors\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionErrorCode {\n  validationError = 'validationError',\n  /** Wire value is `'generic'`. */\n  connectionFailedGeneric = 'generic',\n}\n\nexport interface ConfigValidationFieldError {\n  code: 'invalidSessionToken' | 'invalidClientToken' | 'invalidPublicKey';\n  message: string;\n}\n\nexport type ConnectionError =\n  | {\n      code: ConnectionErrorCode.validationError;\n      errors: ConfigValidationFieldError[];\n    }\n  | {\n      code: ConnectionErrorCode.connectionFailedGeneric;\n      message?: string;\n    };\n"],"mappings":";AAIO,IAAK,mBAAL,kBAAKA,sBAAL;AAIL,EAAAA,kBAAA,wBAAqB;AAKrB,EAAAA,kBAAA,YAAS;AAKT,EAAAA,kBAAA,iBAAc;AAKd,EAAAA,kBAAA,aAAU;AAKV,EAAAA,kBAAA,YAAS;AAOT,EAAAA,kBAAA,6BAA0B;AA/BhB,SAAAA;AAAA,GAAA;AAqLL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,qBAAkB;AAElB,EAAAA,qBAAA,6BAA0B;AAHhB,SAAAA;AAAA,GAAA;","names":["ConnectionStatus","ConnectionErrorCode"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonpay/platform-protocol",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Shared protocol types for the MoonPay Developer Platform",
   "type": "module",
   "exports": {