@moonpay/platform-sdk-core 1.6.0 → 1.7.0

package/dist/index.d.cts

@@ -1,7 +1,8 @@
-import { DevPlatformApiError, GetAssetsError, GetQuoteError, GetTransactionsError, CreateIdentityError, GetIdentityError, GetIdentityUploadUrlError, SubmitIdentityFilesError, UpdateIdentityError, VerifyIdentityError, GetPaymentMethodsError } from '@moonpay/platform-protocol/api/errors';
+import { Customer } from '@moonpay/platform-protocol/api/customer';
+import { GetCustomerError, GetCustomerUploadUrlError, SubmitCustomerFilesError, SubmitCustomerKycError, DevPlatformApiError, GetAssetsError, GetQuoteError, GetTransactionsError, CreateIdentityError, GetIdentityError, GetIdentityUploadUrlError, SubmitIdentityFilesError, UpdateIdentityError, VerifyIdentityError, GetPaymentMethodsError } from '@moonpay/platform-protocol/api/errors';
+import { IdentityFileUploadUrlRequestBody, IdentityFileUploadUrl, SubmitIdentityFilesRequestBody, UpdateIdentityRequestBody, CreateIdentityRequestBody, Identity, IdentityVerificationResponse } from '@moonpay/platform-protocol/api/identity';
 import { Result } from '@moonpay/platform-protocol/result';
 import { ListAssetsResponse, GetQuoteParams, Quote, TransactionWithStages, Transaction, PaginationInfo, ListPaymentMethodsResponse } from '@moonpay/platform-protocol/api';
-import { CreateIdentityRequestBody, Identity, IdentityFileUploadUrlRequestBody, IdentityFileUploadUrl, SubmitIdentityFilesRequestBody, UpdateIdentityRequestBody, IdentityVerificationResponse } from '@moonpay/platform-protocol/api/identity';
 import { ProtocolMessage } from '@moonpay/platform-protocol/protocol';
 import { DecryptedCredentials } from '@moonpay/platform-protocol/models/connection';
 
@@ -19,6 +20,18 @@ interface ClientContextOptions {
 }
 declare function createClientContext(options?: ClientContextOptions): ClientContext;
 
+/** The API wraps each customer response in a `{ data: ... }` envelope. */
+interface CustomerEnvelope {
+    data: Customer;
+}
+interface UploadUrlEnvelope$1 {
+    data: IdentityFileUploadUrl;
+}
+declare function getCustomer(ctx: ClientContext, id: string): Promise<Result<CustomerEnvelope, GetCustomerError>>;
+declare function submitCustomerKyc(ctx: ClientContext, id: string, body: UpdateIdentityRequestBody): Promise<Result<CustomerEnvelope, SubmitCustomerKycError>>;
+declare function getCustomerUploadUrl(ctx: ClientContext, id: string, body: IdentityFileUploadUrlRequestBody): Promise<Result<UploadUrlEnvelope$1, GetCustomerUploadUrlError>>;
+declare function submitCustomerFiles(ctx: ClientContext, id: string, body: SubmitIdentityFilesRequestBody): Promise<Result<CustomerEnvelope, SubmitCustomerFilesError>>;
+
 /** Typed fetch that wraps responses in Result<T, E>. */
 declare function apiFetch<T>(ctx: ClientContext, path: string, options?: RequestInit): Promise<Result<T, DevPlatformApiError>>;
 
@@ -67,14 +80,22 @@ interface UploadUrlEnvelope {
 /**
  * Create an identity. Returns the created identity, or `null` when the
  * customer has no outstanding requirements (the API returns 204).
+ *
+ * @deprecated Customers are created automatically now — call `getCustomer`
+ * directly instead.
  */
 declare function createIdentity(ctx: ClientContext, body: CreateIdentityRequestBody): Promise<Result<{
     data: Identity | null;
 }, CreateIdentityError>>;
+/** @deprecated Use `getCustomer` instead. */
 declare function getIdentity(ctx: ClientContext, id: string): Promise<Result<IdentityEnvelope, GetIdentityError>>;
+/** @deprecated Use `submitCustomerKyc` instead. */
 declare function updateIdentity(ctx: ClientContext, id: string, body: UpdateIdentityRequestBody): Promise<Result<IdentityEnvelope, UpdateIdentityError>>;
+/** @deprecated No longer needed — Customer API verification has no direct replacement call. */
 declare function verifyIdentity(ctx: ClientContext, id: string): Promise<Result<VerificationEnvelope, VerifyIdentityError>>;
+/** @deprecated Use `getCustomerUploadUrl` instead. */
 declare function getIdentityUploadUrl(ctx: ClientContext, id: string, body: IdentityFileUploadUrlRequestBody): Promise<Result<UploadUrlEnvelope, GetIdentityUploadUrlError>>;
+/** @deprecated Use `submitCustomerFiles` instead. */
 declare function submitIdentityFiles(ctx: ClientContext, id: string, body: SubmitIdentityFilesRequestBody): Promise<Result<IdentityEnvelope, SubmitIdentityFilesError>>;
 
 declare function getPaymentMethods(ctx: ClientContext): Promise<Result<{
@@ -119,6 +140,7 @@ declare const FRAME_PATHS: {
     readonly challenge: "/platform/v1/challenge";
     readonly addCard: "/platform/v1/add-card";
     readonly reset: "/platform/v1/reset";
+    readonly customerExport: "/v2/customer-export";
 };
 interface UrlBuilderOptions {
     /** Base URL for MoonPay frames. Defaults to production. */
@@ -177,21 +199,39 @@ interface CoreClient {
         data: TransactionWithStages;
     }, GetTransactionsError>>;
     deletePaymentMethod(id: string): Promise<Result<void, DevPlatformApiError>>;
+    getCustomer(id: string): Promise<Result<{
+        data: Customer;
+    }, GetCustomerError>>;
+    submitCustomerKyc(id: string, body: UpdateIdentityRequestBody): Promise<Result<{
+        data: Customer;
+    }, SubmitCustomerKycError>>;
+    getCustomerUploadUrl(id: string, body: IdentityFileUploadUrlRequestBody): Promise<Result<{
+        data: IdentityFileUploadUrl;
+    }, GetCustomerUploadUrlError>>;
+    submitCustomerFiles(id: string, body: SubmitIdentityFilesRequestBody): Promise<Result<{
+        data: Customer;
+    }, SubmitCustomerFilesError>>;
+    /** @deprecated Customers are created automatically now — call `getCustomer` directly instead. */
     createIdentity(body: CreateIdentityRequestBody): Promise<Result<{
         data: Identity | null;
     }, CreateIdentityError>>;
+    /** @deprecated Use `getCustomer` instead. */
     getIdentity(id: string): Promise<Result<{
         data: Identity;
     }, GetIdentityError>>;
+    /** @deprecated Use `submitCustomerKyc` instead. */
     updateIdentity(id: string, body: UpdateIdentityRequestBody): Promise<Result<{
         data: Identity;
     }, UpdateIdentityError>>;
+    /** @deprecated No longer needed — Customer API verification has no direct replacement call. */
     verifyIdentity(id: string): Promise<Result<{
         data: IdentityVerificationResponse;
     }, VerifyIdentityError>>;
+    /** @deprecated Use `getCustomerUploadUrl` instead. */
     getIdentityUploadUrl(id: string, body: IdentityFileUploadUrlRequestBody): Promise<Result<{
         data: IdentityFileUploadUrl;
     }, GetIdentityUploadUrlError>>;
+    /** @deprecated Use `submitCustomerFiles` instead. */
     submitIdentityFiles(id: string, body: SubmitIdentityFilesRequestBody): Promise<Result<{
         data: Identity;
     }, SubmitIdentityFilesError>>;
@@ -246,4 +286,31 @@ interface FrameHandle {
  */
 declare function createFrameOrchestrator(options: FrameOrchestratorOptions): Promise<FrameHandle>;
 
-export { type ClientContext, type ClientContextOptions, type CoreClient, type CoreClientOptions, FRAME_PATHS, type FrameHandle, type FrameOptions, type FrameOrchestratorOptions, type FrameTransport, type KeyPair, type ListAssetsParams, type ListTransactionsParams, type ThemeOptions, type UrlBuilderOptions, apiFetch, applyThemeParam, buildFrameUrl, createClientContext, createClientCore, createFrameOrchestrator, createIdentity, decryptCredentials, deletePaymentMethod, generateKeyPair, getAssets, getIdentity, getIdentityUploadUrl, getPaymentMethods, getQuote, getTransaction, listTransactions, submitIdentityFiles, themeParams, updateIdentity, verifyIdentity };
+/**
+ * Trusted MoonPay frame origins.
+ *
+ * This set is the single source of truth for two boundaries that MUST stay
+ * aligned so an accepted frame can both render *and* complete the postMessage
+ * handshake (SE-3808):
+ *
+ *   1. Which URLs `setupChallenge()` — and, defensively, the transports — will
+ *      load into a frame.
+ *   2. Which postMessage origins a transport accepts messages from.
+ *
+ * Each pattern encodes its scheme, so MoonPay origins require `https:` and only
+ * `localhost` is permitted over `http:` for local development. This mirrors the
+ * `isTrustedMoonPayUrl()` trust pattern used for `apiBaseUrl`, but the allowlist
+ * is intentionally the frame (postMessage) set rather than the API set.
+ */
+declare const TRUSTED_FRAME_ORIGIN_PATTERNS: readonly RegExp[];
+/** True if `origin` (e.g. `https://platform.moonpay.com`) is a trusted MoonPay frame origin. */
+declare function isTrustedFrameOrigin(origin: string): boolean;
+/**
+ * True if `value` is a well-formed URL served from a trusted MoonPay frame
+ * origin. Fails closed on unparseable input or an untrusted/off-protocol origin,
+ * so a partner-supplied challenge URL can never load non-MoonPay content into a
+ * trusted frame container (SE-3808).
+ */
+declare function isTrustedFrameUrl(value: string): boolean;
+
+export { type ClientContext, type ClientContextOptions, type CoreClient, type CoreClientOptions, FRAME_PATHS, type FrameHandle, type FrameOptions, type FrameOrchestratorOptions, type FrameTransport, type KeyPair, type ListAssetsParams, type ListTransactionsParams, TRUSTED_FRAME_ORIGIN_PATTERNS, type ThemeOptions, type UrlBuilderOptions, apiFetch, applyThemeParam, buildFrameUrl, createClientContext, createClientCore, createFrameOrchestrator, createIdentity, decryptCredentials, deletePaymentMethod, generateKeyPair, getAssets, getCustomer, getCustomerUploadUrl, getIdentity, getIdentityUploadUrl, getPaymentMethods, getQuote, getTransaction, isTrustedFrameOrigin, isTrustedFrameUrl, listTransactions, submitCustomerFiles, submitCustomerKyc, submitIdentityFiles, themeParams, updateIdentity, verifyIdentity };

package/dist/index.d.ts

@@ -1,7 +1,8 @@
-import { DevPlatformApiError, GetAssetsError, GetQuoteError, GetTransactionsError, CreateIdentityError, GetIdentityError, GetIdentityUploadUrlError, SubmitIdentityFilesError, UpdateIdentityError, VerifyIdentityError, GetPaymentMethodsError } from '@moonpay/platform-protocol/api/errors';
+import { Customer } from '@moonpay/platform-protocol/api/customer';
+import { GetCustomerError, GetCustomerUploadUrlError, SubmitCustomerFilesError, SubmitCustomerKycError, DevPlatformApiError, GetAssetsError, GetQuoteError, GetTransactionsError, CreateIdentityError, GetIdentityError, GetIdentityUploadUrlError, SubmitIdentityFilesError, UpdateIdentityError, VerifyIdentityError, GetPaymentMethodsError } from '@moonpay/platform-protocol/api/errors';
+import { IdentityFileUploadUrlRequestBody, IdentityFileUploadUrl, SubmitIdentityFilesRequestBody, UpdateIdentityRequestBody, CreateIdentityRequestBody, Identity, IdentityVerificationResponse } from '@moonpay/platform-protocol/api/identity';
 import { Result } from '@moonpay/platform-protocol/result';
 import { ListAssetsResponse, GetQuoteParams, Quote, TransactionWithStages, Transaction, PaginationInfo, ListPaymentMethodsResponse } from '@moonpay/platform-protocol/api';
-import { CreateIdentityRequestBody, Identity, IdentityFileUploadUrlRequestBody, IdentityFileUploadUrl, SubmitIdentityFilesRequestBody, UpdateIdentityRequestBody, IdentityVerificationResponse } from '@moonpay/platform-protocol/api/identity';
 import { ProtocolMessage } from '@moonpay/platform-protocol/protocol';
 import { DecryptedCredentials } from '@moonpay/platform-protocol/models/connection';
 
@@ -19,6 +20,18 @@ interface ClientContextOptions {
 }
 declare function createClientContext(options?: ClientContextOptions): ClientContext;
 
+/** The API wraps each customer response in a `{ data: ... }` envelope. */
+interface CustomerEnvelope {
+    data: Customer;
+}
+interface UploadUrlEnvelope$1 {
+    data: IdentityFileUploadUrl;
+}
+declare function getCustomer(ctx: ClientContext, id: string): Promise<Result<CustomerEnvelope, GetCustomerError>>;
+declare function submitCustomerKyc(ctx: ClientContext, id: string, body: UpdateIdentityRequestBody): Promise<Result<CustomerEnvelope, SubmitCustomerKycError>>;
+declare function getCustomerUploadUrl(ctx: ClientContext, id: string, body: IdentityFileUploadUrlRequestBody): Promise<Result<UploadUrlEnvelope$1, GetCustomerUploadUrlError>>;
+declare function submitCustomerFiles(ctx: ClientContext, id: string, body: SubmitIdentityFilesRequestBody): Promise<Result<CustomerEnvelope, SubmitCustomerFilesError>>;
+
 /** Typed fetch that wraps responses in Result<T, E>. */
 declare function apiFetch<T>(ctx: ClientContext, path: string, options?: RequestInit): Promise<Result<T, DevPlatformApiError>>;
 
@@ -67,14 +80,22 @@ interface UploadUrlEnvelope {
 /**
  * Create an identity. Returns the created identity, or `null` when the
  * customer has no outstanding requirements (the API returns 204).
+ *
+ * @deprecated Customers are created automatically now — call `getCustomer`
+ * directly instead.
  */
 declare function createIdentity(ctx: ClientContext, body: CreateIdentityRequestBody): Promise<Result<{
     data: Identity | null;
 }, CreateIdentityError>>;
+/** @deprecated Use `getCustomer` instead. */
 declare function getIdentity(ctx: ClientContext, id: string): Promise<Result<IdentityEnvelope, GetIdentityError>>;
+/** @deprecated Use `submitCustomerKyc` instead. */
 declare function updateIdentity(ctx: ClientContext, id: string, body: UpdateIdentityRequestBody): Promise<Result<IdentityEnvelope, UpdateIdentityError>>;
+/** @deprecated No longer needed — Customer API verification has no direct replacement call. */
 declare function verifyIdentity(ctx: ClientContext, id: string): Promise<Result<VerificationEnvelope, VerifyIdentityError>>;
+/** @deprecated Use `getCustomerUploadUrl` instead. */
 declare function getIdentityUploadUrl(ctx: ClientContext, id: string, body: IdentityFileUploadUrlRequestBody): Promise<Result<UploadUrlEnvelope, GetIdentityUploadUrlError>>;
+/** @deprecated Use `submitCustomerFiles` instead. */
 declare function submitIdentityFiles(ctx: ClientContext, id: string, body: SubmitIdentityFilesRequestBody): Promise<Result<IdentityEnvelope, SubmitIdentityFilesError>>;
 
 declare function getPaymentMethods(ctx: ClientContext): Promise<Result<{
@@ -119,6 +140,7 @@ declare const FRAME_PATHS: {
     readonly challenge: "/platform/v1/challenge";
     readonly addCard: "/platform/v1/add-card";
     readonly reset: "/platform/v1/reset";
+    readonly customerExport: "/v2/customer-export";
 };
 interface UrlBuilderOptions {
     /** Base URL for MoonPay frames. Defaults to production. */
@@ -177,21 +199,39 @@ interface CoreClient {
         data: TransactionWithStages;
     }, GetTransactionsError>>;
     deletePaymentMethod(id: string): Promise<Result<void, DevPlatformApiError>>;
+    getCustomer(id: string): Promise<Result<{
+        data: Customer;
+    }, GetCustomerError>>;
+    submitCustomerKyc(id: string, body: UpdateIdentityRequestBody): Promise<Result<{
+        data: Customer;
+    }, SubmitCustomerKycError>>;
+    getCustomerUploadUrl(id: string, body: IdentityFileUploadUrlRequestBody): Promise<Result<{
+        data: IdentityFileUploadUrl;
+    }, GetCustomerUploadUrlError>>;
+    submitCustomerFiles(id: string, body: SubmitIdentityFilesRequestBody): Promise<Result<{
+        data: Customer;
+    }, SubmitCustomerFilesError>>;
+    /** @deprecated Customers are created automatically now — call `getCustomer` directly instead. */
     createIdentity(body: CreateIdentityRequestBody): Promise<Result<{
         data: Identity | null;
     }, CreateIdentityError>>;
+    /** @deprecated Use `getCustomer` instead. */
     getIdentity(id: string): Promise<Result<{
         data: Identity;
     }, GetIdentityError>>;
+    /** @deprecated Use `submitCustomerKyc` instead. */
     updateIdentity(id: string, body: UpdateIdentityRequestBody): Promise<Result<{
         data: Identity;
     }, UpdateIdentityError>>;
+    /** @deprecated No longer needed — Customer API verification has no direct replacement call. */
     verifyIdentity(id: string): Promise<Result<{
         data: IdentityVerificationResponse;
     }, VerifyIdentityError>>;
+    /** @deprecated Use `getCustomerUploadUrl` instead. */
     getIdentityUploadUrl(id: string, body: IdentityFileUploadUrlRequestBody): Promise<Result<{
         data: IdentityFileUploadUrl;
     }, GetIdentityUploadUrlError>>;
+    /** @deprecated Use `submitCustomerFiles` instead. */
     submitIdentityFiles(id: string, body: SubmitIdentityFilesRequestBody): Promise<Result<{
         data: Identity;
     }, SubmitIdentityFilesError>>;
@@ -246,4 +286,31 @@ interface FrameHandle {
  */
 declare function createFrameOrchestrator(options: FrameOrchestratorOptions): Promise<FrameHandle>;
 
-export { type ClientContext, type ClientContextOptions, type CoreClient, type CoreClientOptions, FRAME_PATHS, type FrameHandle, type FrameOptions, type FrameOrchestratorOptions, type FrameTransport, type KeyPair, type ListAssetsParams, type ListTransactionsParams, type ThemeOptions, type UrlBuilderOptions, apiFetch, applyThemeParam, buildFrameUrl, createClientContext, createClientCore, createFrameOrchestrator, createIdentity, decryptCredentials, deletePaymentMethod, generateKeyPair, getAssets, getIdentity, getIdentityUploadUrl, getPaymentMethods, getQuote, getTransaction, listTransactions, submitIdentityFiles, themeParams, updateIdentity, verifyIdentity };
+/**
+ * Trusted MoonPay frame origins.
+ *
+ * This set is the single source of truth for two boundaries that MUST stay
+ * aligned so an accepted frame can both render *and* complete the postMessage
+ * handshake (SE-3808):
+ *
+ *   1. Which URLs `setupChallenge()` — and, defensively, the transports — will
+ *      load into a frame.
+ *   2. Which postMessage origins a transport accepts messages from.
+ *
+ * Each pattern encodes its scheme, so MoonPay origins require `https:` and only
+ * `localhost` is permitted over `http:` for local development. This mirrors the
+ * `isTrustedMoonPayUrl()` trust pattern used for `apiBaseUrl`, but the allowlist
+ * is intentionally the frame (postMessage) set rather than the API set.
+ */
+declare const TRUSTED_FRAME_ORIGIN_PATTERNS: readonly RegExp[];
+/** True if `origin` (e.g. `https://platform.moonpay.com`) is a trusted MoonPay frame origin. */
+declare function isTrustedFrameOrigin(origin: string): boolean;
+/**
+ * True if `value` is a well-formed URL served from a trusted MoonPay frame
+ * origin. Fails closed on unparseable input or an untrusted/off-protocol origin,
+ * so a partner-supplied challenge URL can never load non-MoonPay content into a
+ * trusted frame container (SE-3808).
+ */
+declare function isTrustedFrameUrl(value: string): boolean;
+
+export { type ClientContext, type ClientContextOptions, type CoreClient, type CoreClientOptions, FRAME_PATHS, type FrameHandle, type FrameOptions, type FrameOrchestratorOptions, type FrameTransport, type KeyPair, type ListAssetsParams, type ListTransactionsParams, TRUSTED_FRAME_ORIGIN_PATTERNS, type ThemeOptions, type UrlBuilderOptions, apiFetch, applyThemeParam, buildFrameUrl, createClientContext, createClientCore, createFrameOrchestrator, createIdentity, decryptCredentials, deletePaymentMethod, generateKeyPair, getAssets, getCustomer, getCustomerUploadUrl, getIdentity, getIdentityUploadUrl, getPaymentMethods, getQuote, getTransaction, isTrustedFrameOrigin, isTrustedFrameUrl, listTransactions, submitCustomerFiles, submitCustomerKyc, submitIdentityFiles, themeParams, updateIdentity, verifyIdentity };

package/dist/index.js

@@ -8,10 +8,8 @@ function isTrustedMoonPayUrl(value) {
   } catch {
     return false;
   }
-  if (hostname === "localhost" || hostname === "127.0.0.1")
-    return true;
-  if (protocol !== "https:")
-    return false;
+  if (hostname === "localhost" || hostname === "127.0.0.1") return true;
+  if (protocol !== "https:") return false;
   return hostname === "moonpay.com" || hostname.endsWith(".moonpay.com") || hostname === "moonpay.dev" || hostname.endsWith(".moonpay.dev") || hostname === "moonpay-dev.com" || hostname.endsWith(".moonpay-dev.com") || hostname === "moonpaycloud.com" || hostname.endsWith(".moonpaycloud.com");
 }
 function createClientContext(options = {}) {
@@ -61,17 +59,37 @@ async function apiFetch(ctx, path, options) {
   return ok(data);
 }
 
+// src/api/customer.ts
+async function getCustomer(ctx, id) {
+  return apiFetch(ctx, `/platform/v1/customers/${encodeURIComponent(id)}`);
+}
+async function submitCustomerKyc(ctx, id, body) {
+  return apiFetch(ctx, `/platform/v1/customers/${encodeURIComponent(id)}/kyc`, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+}
+async function getCustomerUploadUrl(ctx, id, body) {
+  return apiFetch(
+    ctx,
+    `/platform/v1/customers/${encodeURIComponent(id)}/files/upload-url`,
+    { method: "POST", body: JSON.stringify(body) }
+  );
+}
+async function submitCustomerFiles(ctx, id, body) {
+  return apiFetch(ctx, `/platform/v1/customers/${encodeURIComponent(id)}/files`, {
+    method: "POST",
+    body: JSON.stringify(body)
+  });
+}
+
 // src/api/get-assets.ts
 async function getAssets(ctx, params = {}) {
   const searchParams = new URLSearchParams();
-  if (params.source)
-    searchParams.set("source", params.source);
-  if (params.code)
-    searchParams.set("code", params.code);
-  if (params.cursor)
-    searchParams.set("cursor", params.cursor);
-  if (params.limit != null)
-    searchParams.set("limit", String(params.limit));
+  if (params.source) searchParams.set("source", params.source);
+  if (params.code) searchParams.set("code", params.code);
+  if (params.cursor) searchParams.set("cursor", params.cursor);
+  if (params.limit != null) searchParams.set("limit", String(params.limit));
   const query = searchParams.toString();
   const path = `/platform/v1/assets${query ? `?${query}` : ""}`;
   return apiFetch(ctx, path);
@@ -88,14 +106,10 @@ async function getQuote(ctx, params) {
 // src/api/get-transactions.ts
 async function listTransactions(ctx, params = {}) {
   const searchParams = new URLSearchParams();
-  if (params.startDate)
-    searchParams.set("startDate", params.startDate);
-  if (params.endDate)
-    searchParams.set("endDate", params.endDate);
-  if (params.cursor)
-    searchParams.set("cursor", params.cursor);
-  if (params.limit != null)
-    searchParams.set("limit", String(params.limit));
+  if (params.startDate) searchParams.set("startDate", params.startDate);
+  if (params.endDate) searchParams.set("endDate", params.endDate);
+  if (params.cursor) searchParams.set("cursor", params.cursor);
+  if (params.limit != null) searchParams.set("limit", String(params.limit));
   const query = searchParams.toString();
   const path = `/platform/v1/transactions${query ? `?${query}` : ""}`;
   return apiFetch(ctx, path);
@@ -198,6 +212,10 @@ function createClientCore(options) {
     listTransactions: (params) => listTransactions(ctx, params),
     getTransaction: (id) => getTransaction(ctx, id),
     deletePaymentMethod: (id) => deletePaymentMethod(ctx, id),
+    getCustomer: (id) => getCustomer(ctx, id),
+    submitCustomerKyc: (id, body) => submitCustomerKyc(ctx, id, body),
+    getCustomerUploadUrl: (id, body) => getCustomerUploadUrl(ctx, id, body),
+    submitCustomerFiles: (id, body) => submitCustomerFiles(ctx, id, body),
     createIdentity: (body) => createIdentity(ctx, body),
     getIdentity: (id) => getIdentity(ctx, id),
     updateIdentity: (id, body) => updateIdentity(ctx, id, body),
@@ -1538,8 +1556,7 @@ function createFrameOrchestrator(options) {
       }
     }, handshakeTimeout);
     const unsubHandshake = transport.onMessage((msg) => {
-      if (msg.meta?.channelId !== channelId)
-        return;
+      if (msg.meta?.channelId !== channelId) return;
       if (!handshakeComplete && msg.kind === HANDSHAKE_REQUEST_KIND) {
         handshakeComplete = true;
         clearTimeout(timer);
@@ -1565,8 +1582,7 @@ function createFrameOrchestrator(options) {
         messageHandlers.push(handler);
         return () => {
           const idx = messageHandlers.indexOf(handler);
-          if (idx >= 0)
-            messageHandlers.splice(idx, 1);
+          if (idx >= 0) messageHandlers.splice(idx, 1);
         };
       },
       dispose() {
@@ -1580,6 +1596,26 @@ function createFrameOrchestrator(options) {
   });
 }
 
+// src/frames/frame-origin.ts
+var TRUSTED_FRAME_ORIGIN_PATTERNS = [
+  /^https:\/\/([a-zA-Z0-9-]+\.)*moonpay\.com$/,
+  /^https:\/\/([a-zA-Z0-9-]+\.)*moonpaycloud\.com$/,
+  /^https:\/\/([a-zA-Z0-9-]+\.)*preview\.moonpay-dev\.com$/,
+  /^http:\/\/localhost(:\d+)?$/
+];
+function isTrustedFrameOrigin(origin) {
+  return TRUSTED_FRAME_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));
+}
+function isTrustedFrameUrl(value) {
+  let origin;
+  try {
+    ({ origin } = new URL(value));
+  } catch {
+    return false;
+  }
+  return isTrustedFrameOrigin(origin);
+}
+
 // src/frames/url-builder.ts
 var FRAME_PATHS = {
   connect: "/platform/v1/connect",
@@ -1592,12 +1628,12 @@ var FRAME_PATHS = {
   buyButton: "/platform/v1/buy-button",
   challenge: "/platform/v1/challenge",
   addCard: "/platform/v1/add-card",
-  reset: "/platform/v1/reset"
+  reset: "/platform/v1/reset",
+  customerExport: "/v2/customer-export"
 };
 var DEFAULT_FRAME_BASE_URL = "https://platform.moonpay.com";
 function stringifyQueryValue(value) {
-  if (value == null)
-    return null;
+  if (value == null) return null;
   if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
     return String(value);
   }
@@ -1621,8 +1657,7 @@ function themeParams(theme) {
   return theme?.appearance ? { theme: theme.appearance } : {};
 }
 function applyThemeParam(url, theme) {
-  if (!theme?.appearance)
-    return url;
+  if (!theme?.appearance) return url;
   const parsed = new URL(url);
   if (!parsed.searchParams.has("theme")) {
     parsed.searchParams.set("theme", theme.appearance);
@@ -1631,6 +1666,7 @@ function applyThemeParam(url, theme) {
 }
 export {
   FRAME_PATHS,
+  TRUSTED_FRAME_ORIGIN_PATTERNS,
   apiFetch,
   applyThemeParam,
   buildFrameUrl,
@@ -1642,12 +1678,18 @@ export {
   deletePaymentMethod,
   generateKeyPair,
   getAssets,
+  getCustomer,
+  getCustomerUploadUrl,
   getIdentity,
   getIdentityUploadUrl,
   getPaymentMethods,
   getQuote,
   getTransaction,
+  isTrustedFrameOrigin,
+  isTrustedFrameUrl,
   listTransactions,
+  submitCustomerFiles,
+  submitCustomerKyc,
   submitIdentityFiles,
   themeParams,
   updateIdentity,