@moonpay/platform-protocol 1.23.0 → 1.24.2

package/dist/frames/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/frames/auth.ts"],"sourcesContent":["import type {\n  ActiveConnection,\n  ConnectionError,\n  TermsAcceptanceRequiredConnection,\n} from '../models/connection.js';\n\n/**\n * The auth frame is the lighter-weight counterpart to the connect frame:\n * partners (typically headless / Identity-API integrations) drive the\n * customer through email/OTP authentication only, then receive the\n * encrypted credentials.\n */\nexport interface MessageMap {\n  ready: void;\n  error: ConnectionError;\n  complete: ActiveConnection | TermsAcceptanceRequiredConnection;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/frames/auth.ts"],"sourcesContent":["import type {\n  ActiveConnection,\n  ConnectionError,\n  PendingConnection,\n  TermsAcceptanceRequiredConnection,\n} from '../models/connection.js';\n\n/**\n * The auth frame is the lighter-weight counterpart to the connect frame:\n * partners (typically headless / Identity-API integrations) drive the\n * customer through email/OTP authentication only, then receive the\n * encrypted credentials.\n */\nexport interface MessageMap {\n  ready: void;\n  error: ConnectionError;\n  complete: ActiveConnection | PendingConnection | TermsAcceptanceRequiredConnection;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/frames/auth.d.cts

@@ -1,4 +1,4 @@
-import { ConnectionError, ActiveConnection, TermsAcceptanceRequiredConnection } from '../models/connection.cjs';
+import { ConnectionError, ActiveConnection, PendingConnection, TermsAcceptanceRequiredConnection } from '../models/connection.cjs';
 
 /**
  * The auth frame is the lighter-weight counterpart to the connect frame:
@@ -9,7 +9,7 @@ import { ConnectionError, ActiveConnection, TermsAcceptanceRequiredConnection }
 interface MessageMap {
     ready: void;
     error: ConnectionError;
-    complete: ActiveConnection | TermsAcceptanceRequiredConnection;
+    complete: ActiveConnection | PendingConnection | TermsAcceptanceRequiredConnection;
 }
 
 export type { MessageMap };

package/dist/frames/auth.d.ts

@@ -1,4 +1,4 @@
-import { ConnectionError, ActiveConnection, TermsAcceptanceRequiredConnection } from '../models/connection.js';
+import { ConnectionError, ActiveConnection, PendingConnection, TermsAcceptanceRequiredConnection } from '../models/connection.js';
 
 /**
  * The auth frame is the lighter-weight counterpart to the connect frame:
@@ -9,7 +9,7 @@ import { ConnectionError, ActiveConnection, TermsAcceptanceRequiredConnection }
 interface MessageMap {
     ready: void;
     error: ConnectionError;
-    complete: ActiveConnection | TermsAcceptanceRequiredConnection;
+    complete: ActiveConnection | PendingConnection | TermsAcceptanceRequiredConnection;
 }
 
 export type { MessageMap };

package/dist/frames/challenge.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/frames/challenge.ts"],"sourcesContent":["import type { FrameTransaction } from '../models/transaction.js';\nimport type { FrameError } from '../protocol.js';\n\n/**\n * Mirrors the MoonPay API's `GuestCheckoutLimitUpgradeStatus` — a durable,\n * poll-any-time-later fact rather than a short-lived value: `upgraded` and\n * `rejected` reflect a persisted review outcome, not a transient in-progress signal.\n */\nexport type GuestCheckoutLimitUpgradeStatus = 'pending' | 'upgraded' | 'rejected';\n\nexport type CompleteResult = (\n  | { flow: 'buy'; transaction: FrameTransaction }\n  | { flow: 'identity'; identityId: string }\n  | { flow: 'guest_checkout_limit_upgrade'; status: GuestCheckoutLimitUpgradeStatus }\n) & {\n  sessionUpgraded?: true;\n};\n\nexport type Cancellation =\n  | { flow: 'buy'; transactionId?: string; challengeToken?: string }\n  | { flow: 'identity' }\n  | { flow: 'guest_checkout_limit_upgrade' };\n\n/**\n * The challenge frame is fully self-contained — it is driven by the\n * `challengeToken` URL param. There is no parent → child message map.\n */\nexport interface MessageMap {\n  ready: void;\n  complete: CompleteResult;\n  /** User dismissed the challenge. Carry `transactionId` / `challengeToken` to resume. */\n  cancelled: Cancellation;\n  error: FrameError;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/frames/challenge.ts"],"sourcesContent":["import type { FrameTransaction } from '../models/transaction.js';\nimport type { FrameError } from '../protocol.js';\n\n/**\n * Mirrors the MoonPay API's `GuestCheckoutLimitUpgradeStatus` — a durable,\n * poll-any-time-later fact rather than a short-lived value: `upgraded` and\n * `rejected` reflect a persisted review outcome, not a transient in-progress signal.\n */\nexport type GuestCheckoutLimitUpgradeStatus = 'pending' | 'upgraded' | 'rejected';\n\nexport type CompleteResult = (\n  | { flow: 'buy'; transaction: FrameTransaction }\n  | { flow: 'identity'; identityId: string }\n  | { flow: 'guest_checkout_limit_upgrade'; status: GuestCheckoutLimitUpgradeStatus }\n) & {\n  sessionUpgraded?: true;\n};\n\nexport type Cancellation =\n  | { flow: 'buy'; transactionId?: string; challengeToken?: string }\n  | { flow: 'identity' }\n  | { flow: 'guest_checkout_limit_upgrade' };\n\n/**\n * The challenge frame is fully self-contained — it is driven by the\n * `challengeToken` URL param. There is no parent → child message map.\n */\nexport interface MessageMap {\n  ready: void;\n  /**\n   * Fired the instant the user taps the native pay button inside the challenge\n   * frame's payment sheet (Apple Pay / Google Pay), BEFORE the OS payment sheet\n   * is presented. This is an intent-to-buy / tap signal, distinct from\n   * `complete` (the purchase outcome). It fires unconditionally on tap, even if\n   * the user later cancels the sheet.\n   */\n  buttonPressed: void;\n  complete: CompleteResult;\n  /** User dismissed the challenge. Carry `transactionId` / `challengeToken` to resume. */\n  cancelled: Cancellation;\n  error: FrameError;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/frames/challenge.d.cts

@@ -34,6 +34,14 @@ type Cancellation = {
  */
 interface MessageMap {
     ready: void;
+    /**
+     * Fired the instant the user taps the native pay button inside the challenge
+     * frame's payment sheet (Apple Pay / Google Pay), BEFORE the OS payment sheet
+     * is presented. This is an intent-to-buy / tap signal, distinct from
+     * `complete` (the purchase outcome). It fires unconditionally on tap, even if
+     * the user later cancels the sheet.
+     */
+    buttonPressed: void;
     complete: CompleteResult;
     /** User dismissed the challenge. Carry `transactionId` / `challengeToken` to resume. */
     cancelled: Cancellation;

package/dist/frames/challenge.d.ts

@@ -34,6 +34,14 @@ type Cancellation = {
  */
 interface MessageMap {
     ready: void;
+    /**
+     * Fired the instant the user taps the native pay button inside the challenge
+     * frame's payment sheet (Apple Pay / Google Pay), BEFORE the OS payment sheet
+     * is presented. This is an intent-to-buy / tap signal, distinct from
+     * `complete` (the purchase outcome). It fires unconditionally on tap, even if
+     * the user later cancels the sheet.
+     */
+    buttonPressed: void;
     complete: CompleteResult;
     /** User dismissed the challenge. Carry `transactionId` / `challengeToken` to resume. */
     cancelled: Cancellation;

package/dist/models/connection.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/models/connection.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// Connection statuses\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionStatus {\n  /**\n   * New or expired user — needs the full connect flow.\n   */\n  connectionRequired = 'connectionRequired',\n\n  /**\n   * Valid connection — encrypted credentials are included.\n   */\n  active = 'active',\n\n  /**\n   * Restricted location — connection cannot be used.\n   */\n  unavailable = 'unavailable',\n\n  /**\n   * KYC decision delayed — may resolve on a subsequent visit.\n   */\n  pending = 'pending',\n\n  /**\n   * Terminal failure — KYC fail, rejection, etc.\n   */\n  failed = 'failed',\n\n  /**\n   * Customer has no valid Terms of Use attestation on file (headless/Identity API partners).\n   * Display Terms of Use in your own UI, capture acceptance, call\n   * `POST /platform/v1/terms/attestations`, then retry the connection.\n   */\n  termsAcceptanceRequired = 'termsAcceptanceRequired',\n}\n\nexport interface ConnectionRequired {\n  status: ConnectionStatus.connectionRequired;\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted anonymous token payload.\n   * These are frame-internal tokens used by the connect frame — they cannot be\n   * used to call MoonPay APIs directly. Decrypt via `decryptCredentials()` only\n   * if you need the `clientToken` to bootstrap the connect frame manually.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements available before authentication, if any.\n   * Present when guest checkout is enabled for the partner.\n   */\n  capabilities?: CustomerCapabilities;\n  /**\n   * Set when the session's email and phone number resolve to two different\n   * MoonPay customers (a conflict). Partners should route the customer\n   * through Connect proactively before rendering payment UI (e.g. Apple Pay or Google Pay).\n   *\n   * Note: the check-connection frame does not emit this field yet — treat\n   * it as absent until frame support ships.\n   */\n  mismatch?: boolean;\n}\n\nexport interface ActiveConnection {\n  status: ConnectionStatus.active;\n  /** The authenticated MoonPay customer. */\n  customer: {\n    /** The MoonPay customer ID. */\n    id: string;\n    /** ISO 3166-1 alpha-3 country code for the customer's jurisdiction. */\n    country?: string;\n    /** State or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n    administrativeArea?: string;\n    /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). Present when the customer is in a regulated area. */\n    area?: string;\n  };\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted JSON containing:\n   * ```json\n   * {\n   *   \"accessToken\": \"<token>\",\n   *   \"clientToken\": \"<token>\",\n   *   \"expiresAt\": \"<iso8601>\"\n   * }\n   * ```\n   *\n   * - `accessToken`: A token that can be used to make API requests from the client.\n   * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay or Google Pay.\n   * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements for the authenticated customer.\n   */\n  capabilities: CustomerCapabilities;\n}\n\nexport interface UnavailableConnection {\n  status: ConnectionStatus.unavailable;\n}\n\nexport interface PendingConnection {\n  status: ConnectionStatus.pending;\n}\n\nexport interface FailedConnection {\n  status: ConnectionStatus.failed;\n  reason: string;\n}\n\nexport interface TermsAcceptanceRequiredConnection {\n  status: ConnectionStatus.termsAcceptanceRequired;\n}\n\n/** Discriminated union of all connection result statuses. */\nexport type Connection =\n  | ConnectionRequired\n  | ActiveConnection\n  | UnavailableConnection\n  | PendingConnection\n  | FailedConnection\n  | TermsAcceptanceRequiredConnection;\n\n// ---------------------------------------------------------------------------\n// Decrypted credentials (what the SDK exposes after decryption)\n// ---------------------------------------------------------------------------\n\nexport interface DecryptedCredentials {\n  accessToken: string;\n  clientToken: string;\n  expiresAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Customer capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Capabilities and regulatory requirements for the authenticated customer.\n */\nexport interface CustomerCapabilities {\n  /** Capabilities for the ramps (buy and sell) product. */\n  ramps?: RampsCapability;\n  /** Capabilities for the guest checkout flow. Present when guest checkout is enabled for the partner and the session is a guest-checkout session. */\n  guestCheckout?: RampsCapability;\n}\n\n/**\n * Capabilities and requirements for the ramps (buy and sell) product.\n */\nexport interface RampsCapability {\n  /** Regulatory requirements for ramps operations in the customer's jurisdiction. */\n  requirements: RampsRequirements;\n}\n\n/**\n * Regulatory requirements that apply to ramps operations for the customer.\n */\nexport interface RampsRequirements {\n  /**\n   * Present when the customer's jurisdiction requires payment disclosures\n   * before a ramps transaction. Omitted when no disclosures are required.\n   *\n   * @deprecated Use `customer.country`, `customer.administrativeArea`, and `customer.area`\n   * from the active connection instead. This field will be removed in a future release.\n   */\n  paymentDisclosures?: PaymentDisclosuresRequirement;\n}\n\n/**\n * A jurisdiction that requires payment disclosures before a ramps transaction.\n */\nexport interface PaymentDisclosuresRequirement {\n  /** The ISO 3166-1 alpha-3 country code for the jurisdiction. */\n  country: string;\n  /** The state or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n  administrativeArea?: string;\n  /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). */\n  area?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Connection errors\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionErrorCode {\n  validationError = 'validationError',\n  /** Wire value is `'generic'`. */\n  connectionFailedGeneric = 'generic',\n}\n\nexport interface ConfigValidationFieldError {\n  code: 'invalidSessionToken' | 'invalidClientToken' | 'invalidPublicKey';\n  message: string;\n}\n\nexport type ConnectionError =\n  | {\n      code: ConnectionErrorCode.validationError;\n      errors: ConfigValidationFieldError[];\n    }\n  | {\n      code: ConnectionErrorCode.connectionFailedGeneric;\n      message?: string;\n    };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,IAAK,mBAAL,kBAAKA,sBAAL;AAIL,EAAAA,kBAAA,wBAAqB;AAKrB,EAAAA,kBAAA,YAAS;AAKT,EAAAA,kBAAA,iBAAc;AAKd,EAAAA,kBAAA,aAAU;AAKV,EAAAA,kBAAA,YAAS;AAOT,EAAAA,kBAAA,6BAA0B;AA/BhB,SAAAA;AAAA,GAAA;AAqLL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,qBAAkB;AAElB,EAAAA,qBAAA,6BAA0B;AAHhB,SAAAA;AAAA,GAAA;","names":["ConnectionStatus","ConnectionErrorCode"]}
+{"version":3,"sources":["../../src/models/connection.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// Connection statuses\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionStatus {\n  /**\n   * New or expired user — needs the full connect flow.\n   */\n  connectionRequired = 'connectionRequired',\n\n  /**\n   * Valid connection — encrypted credentials are included.\n   */\n  active = 'active',\n\n  /**\n   * Restricted location — connection cannot be used.\n   */\n  unavailable = 'unavailable',\n\n  /**\n   * KYC decision delayed — may resolve on a subsequent visit.\n   */\n  pending = 'pending',\n\n  /**\n   * Terminal failure — KYC fail, rejection, etc.\n   */\n  failed = 'failed',\n\n  /**\n   * Customer has no valid Terms of Use attestation on file (headless/Identity API partners).\n   * Display Terms of Use in your own UI, capture acceptance, call\n   * `POST /platform/v1/terms/attestations`, then retry the connection.\n   */\n  termsAcceptanceRequired = 'termsAcceptanceRequired',\n}\n\nexport interface ConnectionRequired {\n  status: ConnectionStatus.connectionRequired;\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted anonymous token payload.\n   * These are frame-internal tokens used by the connect frame — they cannot be\n   * used to call MoonPay APIs directly. Decrypt via `decryptCredentials()` only\n   * if you need the `clientToken` to bootstrap the connect frame manually.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements available before authentication, if any.\n   * Present when guest checkout is enabled for the partner.\n   */\n  capabilities?: CustomerCapabilities;\n  /**\n   * Set when the session's email and phone number resolve to two different\n   * MoonPay customers (a conflict). Partners should route the customer\n   * through Connect proactively before rendering payment UI (e.g. Apple Pay or Google Pay).\n   *\n   * Note: the check-connection frame does not emit this field yet — treat\n   * it as absent until frame support ships.\n   */\n  mismatch?: boolean;\n}\n\nexport interface ActiveConnection {\n  status: ConnectionStatus.active;\n  /** The authenticated MoonPay customer. */\n  customer: {\n    /** The MoonPay customer ID. */\n    id: string;\n    /** ISO 3166-1 alpha-3 country code for the customer's jurisdiction. */\n    country?: string;\n    /** State or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n    administrativeArea?: string;\n    /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). Present when the customer is in a regulated area. */\n    area?: string;\n  };\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted JSON containing:\n   * ```json\n   * {\n   *   \"accessToken\": \"<token>\",\n   *   \"clientToken\": \"<token>\",\n   *   \"expiresAt\": \"<iso8601>\"\n   * }\n   * ```\n   *\n   * - `accessToken`: A token that can be used to make API requests from the client.\n   * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay or Google Pay.\n   * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements for the authenticated customer.\n   */\n  capabilities: CustomerCapabilities;\n}\n\nexport interface UnavailableConnection {\n  status: ConnectionStatus.unavailable;\n}\n\nexport interface PendingConnection {\n  status: ConnectionStatus.pending;\n  /** The MoonPay customer. Use `customer.id` to poll `GET /platform/v1/customers/{id}` until KYC resolves. */\n  customer?: ActiveConnection['customer'];\n  /**\n   * Encrypted credentials, same format as {@link ActiveConnection.credentials}.\n   * They allow quotes and KYC status polling while the connection is pending.\n   */\n  credentials?: string;\n  /** Capabilities for the customer; `ramps.status` is `pending`. */\n  capabilities?: CustomerCapabilities;\n}\n\nexport interface FailedConnection {\n  status: ConnectionStatus.failed;\n  reason: string;\n}\n\nexport interface TermsAcceptanceRequiredConnection {\n  status: ConnectionStatus.termsAcceptanceRequired;\n}\n\n/** Discriminated union of all connection result statuses. */\nexport type Connection =\n  | ConnectionRequired\n  | ActiveConnection\n  | UnavailableConnection\n  | PendingConnection\n  | FailedConnection\n  | TermsAcceptanceRequiredConnection;\n\n// ---------------------------------------------------------------------------\n// Decrypted credentials (what the SDK exposes after decryption)\n// ---------------------------------------------------------------------------\n\nexport interface DecryptedCredentials {\n  accessToken: string;\n  clientToken: string;\n  expiresAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Customer capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Capabilities and regulatory requirements for the authenticated customer.\n */\nexport interface CustomerCapabilities {\n  /** Capabilities for the ramps (buy and sell) product. */\n  ramps?: RampsCapability;\n  /** Capabilities for the guest checkout flow. Present when guest checkout is enabled for the partner and the session is a guest-checkout session. */\n  guestCheckout?: RampsCapability;\n}\n\n/**\n * Capabilities and requirements for the ramps (buy and sell) product.\n */\nexport interface RampsCapability {\n  /** Regulatory requirements for ramps operations in the customer's jurisdiction. */\n  requirements: RampsRequirements;\n}\n\n/**\n * Regulatory requirements that apply to ramps operations for the customer.\n */\nexport interface RampsRequirements {\n  /**\n   * Present when the customer's jurisdiction requires payment disclosures\n   * before a ramps transaction. Omitted when no disclosures are required.\n   *\n   * @deprecated Use `customer.country`, `customer.administrativeArea`, and `customer.area`\n   * from the active connection instead. This field will be removed in a future release.\n   */\n  paymentDisclosures?: PaymentDisclosuresRequirement;\n}\n\n/**\n * A jurisdiction that requires payment disclosures before a ramps transaction.\n */\nexport interface PaymentDisclosuresRequirement {\n  /** The ISO 3166-1 alpha-3 country code for the jurisdiction. */\n  country: string;\n  /** The state or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n  administrativeArea?: string;\n  /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). */\n  area?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Connection errors\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionErrorCode {\n  validationError = 'validationError',\n  /** Wire value is `'generic'`. */\n  connectionFailedGeneric = 'generic',\n}\n\nexport interface ConfigValidationFieldError {\n  code: 'invalidSessionToken' | 'invalidClientToken' | 'invalidPublicKey';\n  message: string;\n}\n\nexport type ConnectionError =\n  | {\n      code: ConnectionErrorCode.validationError;\n      errors: ConfigValidationFieldError[];\n    }\n  | {\n      code: ConnectionErrorCode.connectionFailedGeneric;\n      message?: string;\n    };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,IAAK,mBAAL,kBAAKA,sBAAL;AAIL,EAAAA,kBAAA,wBAAqB;AAKrB,EAAAA,kBAAA,YAAS;AAKT,EAAAA,kBAAA,iBAAc;AAKd,EAAAA,kBAAA,aAAU;AAKV,EAAAA,kBAAA,YAAS;AAOT,EAAAA,kBAAA,6BAA0B;AA/BhB,SAAAA;AAAA,GAAA;AA8LL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,qBAAkB;AAElB,EAAAA,qBAAA,6BAA0B;AAHhB,SAAAA;AAAA,GAAA;","names":["ConnectionStatus","ConnectionErrorCode"]}

package/dist/models/connection.d.cts

@@ -88,6 +88,15 @@ interface UnavailableConnection {
 }
 interface PendingConnection {
     status: ConnectionStatus.pending;
+    /** The MoonPay customer. Use `customer.id` to poll `GET /platform/v1/customers/{id}` until KYC resolves. */
+    customer?: ActiveConnection['customer'];
+    /**
+     * Encrypted credentials, same format as {@link ActiveConnection.credentials}.
+     * They allow quotes and KYC status polling while the connection is pending.
+     */
+    credentials?: string;
+    /** Capabilities for the customer; `ramps.status` is `pending`. */
+    capabilities?: CustomerCapabilities;
 }
 interface FailedConnection {
     status: ConnectionStatus.failed;

package/dist/models/connection.d.ts

@@ -88,6 +88,15 @@ interface UnavailableConnection {
 }
 interface PendingConnection {
     status: ConnectionStatus.pending;
+    /** The MoonPay customer. Use `customer.id` to poll `GET /platform/v1/customers/{id}` until KYC resolves. */
+    customer?: ActiveConnection['customer'];
+    /**
+     * Encrypted credentials, same format as {@link ActiveConnection.credentials}.
+     * They allow quotes and KYC status polling while the connection is pending.
+     */
+    credentials?: string;
+    /** Capabilities for the customer; `ramps.status` is `pending`. */
+    capabilities?: CustomerCapabilities;
 }
 interface FailedConnection {
     status: ConnectionStatus.failed;

package/dist/models/connection.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/models/connection.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// Connection statuses\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionStatus {\n  /**\n   * New or expired user — needs the full connect flow.\n   */\n  connectionRequired = 'connectionRequired',\n\n  /**\n   * Valid connection — encrypted credentials are included.\n   */\n  active = 'active',\n\n  /**\n   * Restricted location — connection cannot be used.\n   */\n  unavailable = 'unavailable',\n\n  /**\n   * KYC decision delayed — may resolve on a subsequent visit.\n   */\n  pending = 'pending',\n\n  /**\n   * Terminal failure — KYC fail, rejection, etc.\n   */\n  failed = 'failed',\n\n  /**\n   * Customer has no valid Terms of Use attestation on file (headless/Identity API partners).\n   * Display Terms of Use in your own UI, capture acceptance, call\n   * `POST /platform/v1/terms/attestations`, then retry the connection.\n   */\n  termsAcceptanceRequired = 'termsAcceptanceRequired',\n}\n\nexport interface ConnectionRequired {\n  status: ConnectionStatus.connectionRequired;\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted anonymous token payload.\n   * These are frame-internal tokens used by the connect frame — they cannot be\n   * used to call MoonPay APIs directly. Decrypt via `decryptCredentials()` only\n   * if you need the `clientToken` to bootstrap the connect frame manually.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements available before authentication, if any.\n   * Present when guest checkout is enabled for the partner.\n   */\n  capabilities?: CustomerCapabilities;\n  /**\n   * Set when the session's email and phone number resolve to two different\n   * MoonPay customers (a conflict). Partners should route the customer\n   * through Connect proactively before rendering payment UI (e.g. Apple Pay or Google Pay).\n   *\n   * Note: the check-connection frame does not emit this field yet — treat\n   * it as absent until frame support ships.\n   */\n  mismatch?: boolean;\n}\n\nexport interface ActiveConnection {\n  status: ConnectionStatus.active;\n  /** The authenticated MoonPay customer. */\n  customer: {\n    /** The MoonPay customer ID. */\n    id: string;\n    /** ISO 3166-1 alpha-3 country code for the customer's jurisdiction. */\n    country?: string;\n    /** State or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n    administrativeArea?: string;\n    /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). Present when the customer is in a regulated area. */\n    area?: string;\n  };\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted JSON containing:\n   * ```json\n   * {\n   *   \"accessToken\": \"<token>\",\n   *   \"clientToken\": \"<token>\",\n   *   \"expiresAt\": \"<iso8601>\"\n   * }\n   * ```\n   *\n   * - `accessToken`: A token that can be used to make API requests from the client.\n   * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay or Google Pay.\n   * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements for the authenticated customer.\n   */\n  capabilities: CustomerCapabilities;\n}\n\nexport interface UnavailableConnection {\n  status: ConnectionStatus.unavailable;\n}\n\nexport interface PendingConnection {\n  status: ConnectionStatus.pending;\n}\n\nexport interface FailedConnection {\n  status: ConnectionStatus.failed;\n  reason: string;\n}\n\nexport interface TermsAcceptanceRequiredConnection {\n  status: ConnectionStatus.termsAcceptanceRequired;\n}\n\n/** Discriminated union of all connection result statuses. */\nexport type Connection =\n  | ConnectionRequired\n  | ActiveConnection\n  | UnavailableConnection\n  | PendingConnection\n  | FailedConnection\n  | TermsAcceptanceRequiredConnection;\n\n// ---------------------------------------------------------------------------\n// Decrypted credentials (what the SDK exposes after decryption)\n// ---------------------------------------------------------------------------\n\nexport interface DecryptedCredentials {\n  accessToken: string;\n  clientToken: string;\n  expiresAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Customer capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Capabilities and regulatory requirements for the authenticated customer.\n */\nexport interface CustomerCapabilities {\n  /** Capabilities for the ramps (buy and sell) product. */\n  ramps?: RampsCapability;\n  /** Capabilities for the guest checkout flow. Present when guest checkout is enabled for the partner and the session is a guest-checkout session. */\n  guestCheckout?: RampsCapability;\n}\n\n/**\n * Capabilities and requirements for the ramps (buy and sell) product.\n */\nexport interface RampsCapability {\n  /** Regulatory requirements for ramps operations in the customer's jurisdiction. */\n  requirements: RampsRequirements;\n}\n\n/**\n * Regulatory requirements that apply to ramps operations for the customer.\n */\nexport interface RampsRequirements {\n  /**\n   * Present when the customer's jurisdiction requires payment disclosures\n   * before a ramps transaction. Omitted when no disclosures are required.\n   *\n   * @deprecated Use `customer.country`, `customer.administrativeArea`, and `customer.area`\n   * from the active connection instead. This field will be removed in a future release.\n   */\n  paymentDisclosures?: PaymentDisclosuresRequirement;\n}\n\n/**\n * A jurisdiction that requires payment disclosures before a ramps transaction.\n */\nexport interface PaymentDisclosuresRequirement {\n  /** The ISO 3166-1 alpha-3 country code for the jurisdiction. */\n  country: string;\n  /** The state or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n  administrativeArea?: string;\n  /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). */\n  area?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Connection errors\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionErrorCode {\n  validationError = 'validationError',\n  /** Wire value is `'generic'`. */\n  connectionFailedGeneric = 'generic',\n}\n\nexport interface ConfigValidationFieldError {\n  code: 'invalidSessionToken' | 'invalidClientToken' | 'invalidPublicKey';\n  message: string;\n}\n\nexport type ConnectionError =\n  | {\n      code: ConnectionErrorCode.validationError;\n      errors: ConfigValidationFieldError[];\n    }\n  | {\n      code: ConnectionErrorCode.connectionFailedGeneric;\n      message?: string;\n    };\n"],"mappings":";AAIO,IAAK,mBAAL,kBAAKA,sBAAL;AAIL,EAAAA,kBAAA,wBAAqB;AAKrB,EAAAA,kBAAA,YAAS;AAKT,EAAAA,kBAAA,iBAAc;AAKd,EAAAA,kBAAA,aAAU;AAKV,EAAAA,kBAAA,YAAS;AAOT,EAAAA,kBAAA,6BAA0B;AA/BhB,SAAAA;AAAA,GAAA;AAqLL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,qBAAkB;AAElB,EAAAA,qBAAA,6BAA0B;AAHhB,SAAAA;AAAA,GAAA;","names":["ConnectionStatus","ConnectionErrorCode"]}
+{"version":3,"sources":["../../src/models/connection.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// Connection statuses\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionStatus {\n  /**\n   * New or expired user — needs the full connect flow.\n   */\n  connectionRequired = 'connectionRequired',\n\n  /**\n   * Valid connection — encrypted credentials are included.\n   */\n  active = 'active',\n\n  /**\n   * Restricted location — connection cannot be used.\n   */\n  unavailable = 'unavailable',\n\n  /**\n   * KYC decision delayed — may resolve on a subsequent visit.\n   */\n  pending = 'pending',\n\n  /**\n   * Terminal failure — KYC fail, rejection, etc.\n   */\n  failed = 'failed',\n\n  /**\n   * Customer has no valid Terms of Use attestation on file (headless/Identity API partners).\n   * Display Terms of Use in your own UI, capture acceptance, call\n   * `POST /platform/v1/terms/attestations`, then retry the connection.\n   */\n  termsAcceptanceRequired = 'termsAcceptanceRequired',\n}\n\nexport interface ConnectionRequired {\n  status: ConnectionStatus.connectionRequired;\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted anonymous token payload.\n   * These are frame-internal tokens used by the connect frame — they cannot be\n   * used to call MoonPay APIs directly. Decrypt via `decryptCredentials()` only\n   * if you need the `clientToken` to bootstrap the connect frame manually.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements available before authentication, if any.\n   * Present when guest checkout is enabled for the partner.\n   */\n  capabilities?: CustomerCapabilities;\n  /**\n   * Set when the session's email and phone number resolve to two different\n   * MoonPay customers (a conflict). Partners should route the customer\n   * through Connect proactively before rendering payment UI (e.g. Apple Pay or Google Pay).\n   *\n   * Note: the check-connection frame does not emit this field yet — treat\n   * it as absent until frame support ships.\n   */\n  mismatch?: boolean;\n}\n\nexport interface ActiveConnection {\n  status: ConnectionStatus.active;\n  /** The authenticated MoonPay customer. */\n  customer: {\n    /** The MoonPay customer ID. */\n    id: string;\n    /** ISO 3166-1 alpha-3 country code for the customer's jurisdiction. */\n    country?: string;\n    /** State or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n    administrativeArea?: string;\n    /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). Present when the customer is in a regulated area. */\n    area?: string;\n  };\n  /**\n   * Base64-encoded, X25519+AES-GCM encrypted JSON containing:\n   * ```json\n   * {\n   *   \"accessToken\": \"<token>\",\n   *   \"clientToken\": \"<token>\",\n   *   \"expiresAt\": \"<iso8601>\"\n   * }\n   * ```\n   *\n   * - `accessToken`: A token that can be used to make API requests from the client.\n   * - `clientToken`: A token that can be used to initialize sensitive frames such as Apple Pay or Google Pay.\n   * - `expiresAt`: An ISO 8601 formatted string indicating when the tokens expire.\n   */\n  credentials: string;\n  /**\n   * Capabilities and regulatory requirements for the authenticated customer.\n   */\n  capabilities: CustomerCapabilities;\n}\n\nexport interface UnavailableConnection {\n  status: ConnectionStatus.unavailable;\n}\n\nexport interface PendingConnection {\n  status: ConnectionStatus.pending;\n  /** The MoonPay customer. Use `customer.id` to poll `GET /platform/v1/customers/{id}` until KYC resolves. */\n  customer?: ActiveConnection['customer'];\n  /**\n   * Encrypted credentials, same format as {@link ActiveConnection.credentials}.\n   * They allow quotes and KYC status polling while the connection is pending.\n   */\n  credentials?: string;\n  /** Capabilities for the customer; `ramps.status` is `pending`. */\n  capabilities?: CustomerCapabilities;\n}\n\nexport interface FailedConnection {\n  status: ConnectionStatus.failed;\n  reason: string;\n}\n\nexport interface TermsAcceptanceRequiredConnection {\n  status: ConnectionStatus.termsAcceptanceRequired;\n}\n\n/** Discriminated union of all connection result statuses. */\nexport type Connection =\n  | ConnectionRequired\n  | ActiveConnection\n  | UnavailableConnection\n  | PendingConnection\n  | FailedConnection\n  | TermsAcceptanceRequiredConnection;\n\n// ---------------------------------------------------------------------------\n// Decrypted credentials (what the SDK exposes after decryption)\n// ---------------------------------------------------------------------------\n\nexport interface DecryptedCredentials {\n  accessToken: string;\n  clientToken: string;\n  expiresAt: string;\n}\n\n// ---------------------------------------------------------------------------\n// Customer capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Capabilities and regulatory requirements for the authenticated customer.\n */\nexport interface CustomerCapabilities {\n  /** Capabilities for the ramps (buy and sell) product. */\n  ramps?: RampsCapability;\n  /** Capabilities for the guest checkout flow. Present when guest checkout is enabled for the partner and the session is a guest-checkout session. */\n  guestCheckout?: RampsCapability;\n}\n\n/**\n * Capabilities and requirements for the ramps (buy and sell) product.\n */\nexport interface RampsCapability {\n  /** Regulatory requirements for ramps operations in the customer's jurisdiction. */\n  requirements: RampsRequirements;\n}\n\n/**\n * Regulatory requirements that apply to ramps operations for the customer.\n */\nexport interface RampsRequirements {\n  /**\n   * Present when the customer's jurisdiction requires payment disclosures\n   * before a ramps transaction. Omitted when no disclosures are required.\n   *\n   * @deprecated Use `customer.country`, `customer.administrativeArea`, and `customer.area`\n   * from the active connection instead. This field will be removed in a future release.\n   */\n  paymentDisclosures?: PaymentDisclosuresRequirement;\n}\n\n/**\n * A jurisdiction that requires payment disclosures before a ramps transaction.\n */\nexport interface PaymentDisclosuresRequirement {\n  /** The ISO 3166-1 alpha-3 country code for the jurisdiction. */\n  country: string;\n  /** The state or province code within the country (e.g. `'NY'` for New York). Present for US customers only. */\n  administrativeArea?: string;\n  /** Supra-national regulatory area code (e.g. `'EEA'`, `'EFTA'`). */\n  area?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Connection errors\n// ---------------------------------------------------------------------------\n\nexport enum ConnectionErrorCode {\n  validationError = 'validationError',\n  /** Wire value is `'generic'`. */\n  connectionFailedGeneric = 'generic',\n}\n\nexport interface ConfigValidationFieldError {\n  code: 'invalidSessionToken' | 'invalidClientToken' | 'invalidPublicKey';\n  message: string;\n}\n\nexport type ConnectionError =\n  | {\n      code: ConnectionErrorCode.validationError;\n      errors: ConfigValidationFieldError[];\n    }\n  | {\n      code: ConnectionErrorCode.connectionFailedGeneric;\n      message?: string;\n    };\n"],"mappings":";AAIO,IAAK,mBAAL,kBAAKA,sBAAL;AAIL,EAAAA,kBAAA,wBAAqB;AAKrB,EAAAA,kBAAA,YAAS;AAKT,EAAAA,kBAAA,iBAAc;AAKd,EAAAA,kBAAA,aAAU;AAKV,EAAAA,kBAAA,YAAS;AAOT,EAAAA,kBAAA,6BAA0B;AA/BhB,SAAAA;AAAA,GAAA;AA8LL,IAAK,sBAAL,kBAAKC,yBAAL;AACL,EAAAA,qBAAA,qBAAkB;AAElB,EAAAA,qBAAA,6BAA0B;AAHhB,SAAAA;AAAA,GAAA;","names":["ConnectionStatus","ConnectionErrorCode"]}

package/dist/sdks/challenge.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/sdks/challenge.ts"],"sourcesContent":["import type * as ChallengeFrame from '../frames/challenge.js';\n\nexport type Event =\n  | { kind: 'ready' }\n  | { kind: 'complete'; payload: ChallengeFrame.CompleteResult }\n  | { kind: 'cancelled'; payload: ChallengeFrame.Cancellation }\n  | { kind: 'error'; payload: ChallengeFrame.MessageMap['error'] };\n\nexport interface SetupError {\n  kind: 'configurationError' | 'genericError';\n  message: string;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/sdks/challenge.ts"],"sourcesContent":["import type * as ChallengeFrame from '../frames/challenge.js';\n\nexport type Event =\n  | { kind: 'ready' }\n  | { kind: 'buttonPressed' }\n  | { kind: 'complete'; payload: ChallengeFrame.CompleteResult }\n  | { kind: 'cancelled'; payload: ChallengeFrame.Cancellation }\n  | { kind: 'error'; payload: ChallengeFrame.MessageMap['error'] };\n\nexport interface SetupError {\n  kind: 'configurationError' | 'genericError';\n  message: string;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/sdks/challenge.d.cts

@@ -4,6 +4,8 @@ import '../protocol.cjs';
 
 type Event = {
     kind: 'ready';
+} | {
+    kind: 'buttonPressed';
 } | {
     kind: 'complete';
     payload: CompleteResult;

package/dist/sdks/challenge.d.ts

@@ -4,6 +4,8 @@ import '../protocol.js';
 
 type Event = {
     kind: 'ready';
+} | {
+    kind: 'buttonPressed';
 } | {
     kind: 'complete';
     payload: CompleteResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonpay/platform-protocol",
-  "version": "1.23.0",
+  "version": "1.24.2",
   "description": "Shared protocol types for the MoonPay Developer Platform",
   "type": "module",
   "exports": {