squarefi-bff-api-module 1.36.78 → 1.36.80

package/dist/api/frontend.d.ts

@@ -70,6 +70,12 @@ export declare const frontend: {
             getAll: ({ wallet_id, ...params }: API.Frontend.VirtualAccounts.Programs.List.Request) => Promise<API.Frontend.VirtualAccounts.Programs.List.Response>;
         };
     };
+    kycRails: {
+        getAll: ({ wallet_id }: API.Frontend.KycRails.List.Request) => Promise<API.Frontend.KycRails.List.Response>;
+        getById: ({ wallet_id, rail_id }: API.Frontend.KycRails.Get.Request) => Promise<API.Frontend.KycRails.Get.Response>;
+        submit: ({ wallet_id, rail_id, }: API.Frontend.KycRails.Submit.Request) => Promise<API.Frontend.KycRails.Submit.Response>;
+        confirmTerms: ({ wallet_id, rail_id, }: API.Frontend.KycRails.ConfirmTerms.Request) => Promise<API.Frontend.KycRails.ConfirmTerms.Response>;
+    };
     reference: {
         exchangeRates: {
             list: (params?: API.Frontend.Reference.ExchangeRates.List.Request) => Promise<API.Frontend.Reference.ExchangeRates.List.Response>;

package/dist/api/frontend.js

@@ -144,6 +144,14 @@ export const frontend = {
             getAll: ({ wallet_id, ...params }) => apiClientV1Frontend.getRequest(`/frontend/virtual-accounts/programs/wallet/${wallet_id}`, { params }),
         },
     },
+    // Frontend twin of `kyc.rails.*` (BFF `/kyc/{wallet_id}/rails`). Reads take any wallet member; `submit` and
+    // `confirmTerms` take the wallet admin or owner, and only they get the rail's `extra_actions`.
+    kycRails: {
+        getAll: ({ wallet_id }) => apiClientV1Frontend.getRequest(`/frontend/wallets/${wallet_id}/kyc-rails`),
+        getById: ({ wallet_id, rail_id }) => apiClientV1Frontend.getRequest(`/frontend/wallets/${wallet_id}/kyc-rails/${rail_id}`),
+        submit: ({ wallet_id, rail_id, }) => apiClientV1Frontend.postRequest(`/frontend/wallets/${wallet_id}/kyc-rails/${rail_id}`),
+        confirmTerms: ({ wallet_id, rail_id, }) => apiClientV1Frontend.postRequest(`/frontend/wallets/${wallet_id}/kyc-rails/${rail_id}/terms-and-conditions`),
+    },
     reference: {
         // Frontend twin of `exchange.byOrderType.*` (legacy `GET /exchange/`): the same tenant pairs, but paged in
         // memory — 50 per page by default, 500 at most, in no particular order — and behind the bearer session.

package/dist/api/kyc.d.ts

@@ -17,6 +17,7 @@ export declare const kyc: {
         init: ({ kyc_entity_id, ...params }: API.KYC.Entity.Init.Request) => Promise<API.KYC.Entity.Init.Response>;
         resume: ({ kyc_entity_id, verification_ref, }: API.KYC.Entity.Resume.Request) => Promise<API.KYC.Entity.Resume.Response>;
     };
+    /** @deprecated BFF rails are replaced by CORE `/frontend/wallets/{wallet_id}/kyc-rails` (SFI-2614). Use `frontend.kycRails`. */
     rails: {
         info: {
             getAll: ({ wallet_id }: API.KYC.Rails.RailInfo.List.Request) => Promise<API.KYC.Rails.RailInfo.List.Response>;

package/dist/api/kyc.js

@@ -17,6 +17,7 @@ export const kyc = {
         init: ({ kyc_entity_id, ...params }) => apiClientV2.postRequest(`/kyc/entities/${kyc_entity_id}/init`, { params }),
         resume: ({ kyc_entity_id, verification_ref, }) => apiClientV2.postRequest(`/kyc/entities/${kyc_entity_id}/resume/${verification_ref}`),
     },
+    /** @deprecated BFF rails are replaced by CORE `/frontend/wallets/{wallet_id}/kyc-rails` (SFI-2614). Use `frontend.kycRails`. */
     rails: {
         info: {
             getAll: ({ wallet_id }) => apiClientV2.getRequest(`/kyc/${wallet_id}/rails`),

package/dist/api/types/autogen/apiV1External.types.d.ts

@@ -2428,6 +2428,8 @@ export interface paths {
                      *     Pass `status=FAILED` to get them back.
                      *      */
                     status?: ("ACTIVE" | "INACTIVE" | "SUSPENDED" | "CANCELED")[];
+                    /** @description Only cards issued to this cardholder. */
+                    cardholder_id?: string;
                     /** @description Filter cards by last 4 digits of the card number (partial, case-insensitive match) */
                     last4?: string;
                     /** @description Number of items to skip */
@@ -4261,7 +4263,10 @@ export interface paths {
         /**
          * Withdraw funds from sub-account
          * @description Withdraws funds from a sub-account back to the associated wallet.
-         *     Currency is automatically determined from sub-account's account_currency.
+         *     The sub-account is debited in its account_currency. The wallet is credited
+         *     in the tenant's base currency when the tenant has auto-exchange on (converted
+         *     at the tenant's WITHDRAW_CARD_SUBACCOUNT rate inside the same order), otherwise
+         *     — or when that pair has no rate — in the sub-account's account_currency.
          *
          *     **Authentication**: x-api-key header required
          *

package/dist/api/types/autogen/apiV1Frontend.types.d.ts

@@ -2903,6 +2903,8 @@ export interface paths {
                      *     client can act on. Pass `status=FAILED` to get them back.
                      *      */
                     status?: ("ACTIVE" | "INACTIVE" | "FROZEN" | "CANCELED" | "CLOSED" | "BLOCKED" | "FAILED" | "PENDING")[];
+                    /** @description Only cards issued to this cardholder. */
+                    cardholder_id?: string;
                     /** @description Filter cards by last 4 digits of the card number (partial, case-insensitive match) */
                     last4?: string;
                     /** @description Number of items to skip */
@@ -4764,7 +4766,10 @@ export interface paths {
         /**
          * Withdraw funds from sub-account
          * @description Withdraws funds from a sub-account back to the associated wallet.
-         *     Currency is automatically determined from sub-account's account_currency.
+         *     The sub-account is debited in its account_currency. The wallet is credited
+         *     in the tenant's base currency when the tenant has auto-exchange on (converted
+         *     at the tenant's WITHDRAW_CARD_SUBACCOUNT rate inside the same order), otherwise
+         *     — or when that pair has no rate — in the sub-account's account_currency.
          *
          *     **Authentication**: Bearer token with x-tenant-id header required
          *
@@ -9633,6 +9638,13 @@ export interface paths {
                      *     Besides order columns it accepts `mass_payout_id` (uuid), which narrows the
                      *     result to the orders of one mass payout batch — the same batch reported by
                      *     the `mass_payout_id` field of each order. A non-uuid value is rejected with 400.
+                     *
+                     *     It also accepts `rfi_case_id` (uuid), e.g. `[{"rfi_case_id":"<uuid>"}]`: only the
+                     *     orders a compliance request covers — the same ones as `transactions` of
+                     *     `GET /frontend/rfi/{wallet_id}/{case_id}`, closed requests included; dust orders
+                     *     among them show only with `show_low_balance=true`, as everywhere in this list. It
+                     *     combines with the other filters and the dates. A request of another account, or an
+                     *     unknown id, gives an empty result; a non-uuid value is rejected with 400.
                      *      */
                     filters?: string;
                     date_from?: string;
@@ -9662,6 +9674,15 @@ export interface paths {
                         };
                     };
                 };
+                /** @description `INVALID_REQUEST` — `filters` is not a JSON array, or `mass_payout_id` / `rfi_case_id` is not a uuid */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
                 /** @description Access denied to wallet */
                 403: {
                     headers: {
@@ -9704,6 +9725,13 @@ export interface paths {
                      *     Besides order columns it accepts `mass_payout_id` (uuid), which narrows the
                      *     result to the orders of one mass payout batch — the same batch reported by
                      *     the `mass_payout_id` field of each order. A non-uuid value is rejected with 400.
+                     *
+                     *     It also accepts `rfi_case_id` (uuid), e.g. `[{"rfi_case_id":"<uuid>"}]`: only the
+                     *     orders a compliance request covers — the same ones as `transactions` of
+                     *     `GET /frontend/rfi/{wallet_id}/{case_id}`, closed requests included; dust orders
+                     *     among them show only with `show_low_balance=true`, as everywhere in this list. It
+                     *     combines with the other filters and the dates. A request of another account, or an
+                     *     unknown id, gives an empty result; a non-uuid value is rejected with 400.
                      *      */
                     filters?: string;
                     /** @description If `true`, includes dust orders (amount below render threshold for either currency). Defaults to `false` — dust orders are hidden. */
@@ -9726,6 +9754,15 @@ export interface paths {
                         "text/csv": string;
                     };
                 };
+                /** @description `INVALID_REQUEST` — `filters` is not a JSON array, or `mass_payout_id` / `rfi_case_id` is not a uuid */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
                 /** @description Access denied to wallet */
                 403: {
                     headers: {
@@ -11299,11 +11336,15 @@ export interface paths {
         };
         /**
          * List compliance requests (RFI) of an account, with the banner counters
-         * @description Requests for information compliance sent about this account, newest first. `summary`
-         *     counts every open request regardless of paging — use it for the home-screen banner:
-         *     `action_required > 0` shows it, `overdue > 0` turns it red, `next_due_at` is the
-         *     nearest deadline. Any wallet member except the scoped `user` role may read.
-         *     Refresh on the realtime `data.changed` hint with entity `WALLET_RFI`.
+         * @description Requests for information compliance sent about this account, newest first. RFI in
+         *     the app is being rolled out per workspace: while a workspace still works RFI by
+         *     email, the list is empty, `summary` is all zeros and every request answers 404 —
+         *     its requests stay in the client's mailbox. `summary` counts every open request regardless of paging — use it for the
+         *     home-screen banner: `action_required > 0` shows it, `overdue > 0` turns it red,
+         *     `next_due_at` is the nearest deadline. Any wallet member except the scoped `user` role
+         *     may read. Refresh on the realtime `data.changed` hint with entity `WALLET_RFI`; a new
+         *     question, a new message from compliance and the closing also arrive as the
+         *     `RFI_REQUESTED` / `RFI_RESOLVED` notifications (in-app, push, email).
          *
          */
         get: {
@@ -11313,6 +11354,7 @@ export interface paths {
                     status?: "open" | "action_required" | "awaiting_compliance" | "closed";
                     /** @description Only the requests covering this transaction — what the transaction screen asks by to decide whether to show "compliance has questions". A transaction of another account, or one no request covers, returns an empty page. */
                     order_uuid?: string;
+                    /** @description Page size, from 1 to 100; 20 when omitted. */
                     limit?: number;
                     offset?: number;
                 };
@@ -11333,24 +11375,41 @@ export interface paths {
                     content: {
                         "application/json": {
                             /** @example true */
-                            success?: boolean;
-                            data?: {
-                                summary?: {
-                                    action_required?: number;
-                                    overdue?: number;
-                                    awaiting_compliance?: number;
+                            success: boolean;
+                            data: {
+                                summary: {
+                                    action_required: number;
+                                    overdue: number;
+                                    awaiting_compliance: number;
                                     /** Format: date-time */
-                                    next_due_at?: string | null;
+                                    next_due_at: string | null;
                                 };
-                                items?: components["schemas"]["RfiCase"][];
-                                total?: number;
-                                limit?: number;
-                                offset?: number;
+                                items: components["schemas"]["RfiCase"][];
+                                total: number;
+                                limit: number;
+                                offset: number;
                             };
                         };
                     };
                 };
-                403: components["responses"]["ForbiddenError"];
+                /** @description `VALIDATION_ERROR` — `limit` outside 1–100, a negative `offset`, an unknown `status` */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
+                /** @description `ACCESS_DENIED` — not a member of this account */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
             };
         };
         put?: never;
@@ -11371,7 +11430,8 @@ export interface paths {
         /**
          * Get a compliance request with its conversation and covered transactions
          * @description The conversation holds compliance's questions and the client's answers, oldest first.
-         *     A request of another account answers 404.
+         *     A request of another account answers 404, and so does every request of a workspace
+         *     that still works RFI by email.
          *
          */
         get: {
@@ -11395,12 +11455,38 @@ export interface paths {
                     content: {
                         "application/json": {
                             /** @example true */
-                            success?: boolean;
-                            data?: components["schemas"]["RfiCaseDetail"];
+                            success: boolean;
+                            data: components["schemas"]["RfiCaseDetail"];
                         };
                     };
                 };
-                404: components["responses"]["NotFoundError"];
+                /** @description `VALIDATION_ERROR` — `case_id` is not a UUID */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
+                /** @description `ACCESS_DENIED` — not a member of this account */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
+                /** @description `NOT_FOUND` — no such request on this account */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
             };
         };
         put?: never;
@@ -11422,10 +11508,18 @@ export interface paths {
         put?: never;
         /**
          * Answer a compliance request
-         * @description `multipart/form-data` with a `body` text field and up to 10 files under `files`
-         *     (PDF, JPEG, PNG, WebP, TXT, DOCX, XLSX; 20 MB each). At least one of the two is required.
+         * @description `multipart/form-data` with a `body` text field (up to 20 000 characters) and up to 10
+         *     files under `files` (PDF, JPEG, PNG, WebP, TXT, DOCX, XLSX; 20 MB each). At least one
+         *     of the two is required.
+         *
+         *     Each file is checked by its content, not by the `Content-Type` the browser sends: the
+         *     content must be one of these formats and the file name must end in its extension
+         *     (`.pdf`, `.jpg`/`.jpeg`, `.png`, `.webp`, `.txt`, `.docx`, `.xlsx`). The file is stored
+         *     under the type its content proves.
+         *
          *     The request moves to `awaiting_compliance`; answering again while compliance reviews is
-         *     allowed, and compliance may ask further rounds. Requires the `admin` role on the wallet.
+         *     allowed, and compliance may ask further rounds. Requires the `owner` or `admin` role on the
+         *     wallet — an `auditor` reads only (`can_reply` is false for them).
          *     Do not set `Content-Type` manually — the browser adds the multipart boundary.
          *
          */
@@ -11443,6 +11537,7 @@ export interface paths {
             requestBody: {
                 content: {
                     "multipart/form-data": {
+                        /** @description The answer, up to 20 000 characters */
                         body?: string;
                         files?: string[];
                     };
@@ -11457,32 +11552,59 @@ export interface paths {
                     content: {
                         "application/json": {
                             /** @example true */
-                            success?: boolean;
-                            data?: components["schemas"]["RfiMessage"];
+                            success: boolean;
+                            data: components["schemas"]["RfiMessage"];
                         };
                     };
                 };
-                /** @description `VALIDATION_ERROR` (empty answer, too many files), `FILE_TOO_LARGE`, `UNSUPPORTED_FILE_TYPE` or `INVALID_REQUEST` (malformed multipart) */
+                /** @description - `VALIDATION_ERROR` — no text and no files, more than 10 files, text over 20 000 characters, an empty file, `case_id` not a UUID
+                 *     - `FILE_TOO_LARGE` — a file over 20 MB
+                 *     - `UNSUPPORTED_FILE_TYPE` — a file whose content is not one of the formats, or does not match its name's extension
+                 *     - `INVALID_REQUEST` — malformed multipart, or files under a field other than `files`
+                 *      */
                 400: {
                     headers: {
                         [name: string]: unknown;
                     };
-                    content?: never;
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
+                /** @description `ACCESS_DENIED` — not a member of this account, or a member who only reads (`auditor`); `can_reply` in the detail is false for them */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
+                /** @description `NOT_FOUND` — no such request on this account */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
                 };
-                404: components["responses"]["NotFoundError"];
                 /** @description `RFI_CLOSED` — the request no longer accepts replies */
                 409: {
                     headers: {
                         [name: string]: unknown;
                     };
-                    content?: never;
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
                 };
-                /** @description Too many replies */
+                /** @description `RATE_LIMIT_EXCEEDED` — more than 20 replies a minute */
                 429: {
                     headers: {
                         [name: string]: unknown;
                     };
-                    content?: never;
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
                 };
             };
         };
@@ -11522,16 +11644,42 @@ export interface paths {
                     content: {
                         "application/json": {
                             /** @example true */
-                            success?: boolean;
-                            data?: {
-                                url?: string;
+                            success: boolean;
+                            data: {
+                                url: string;
                                 /** @example 120 */
-                                expires_in?: number;
+                                expires_in: number;
                             };
                         };
                     };
                 };
-                404: components["responses"]["NotFoundError"];
+                /** @description `VALIDATION_ERROR` — `case_id` or `attachment_id` is not a UUID */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
+                /** @description `ACCESS_DENIED` — not a member of this account */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
+                /** @description `NOT_FOUND` — no such request or file on this account */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ErrorResponse"];
+                    };
+                };
             };
         };
         put?: never;
@@ -15127,6 +15275,279 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/frontend/wallets/{wallet_id}/kyc-rails": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * KYC rails of the wallet
+         * @description The tenant's KYC rails of the wallet's entity type and the universal ones, each with the wallet's
+         *     application on it. A rail is listed while it is active; an archived rail stays listed only when the
+         *     wallet is approved on it. `can_submit` tells whether `POST …/kyc-rails/{rail_id}` would be accepted now.
+         *
+         *     Replaces the BFF `GET /kyc/{wallet_id}/rails`; items have its shape plus `can_submit`.
+         *
+         *     **Access Control**: any member of the wallet except the scoped `user` role. No KYC gate.
+         *
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    wallet_id: components["parameters"]["KycRailsWalletId"];
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description Rails of the wallet */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @example true */
+                            success: boolean;
+                            data: components["schemas"]["WalletKycRail"][];
+                            count: number;
+                        };
+                    };
+                };
+                401: components["responses"]["UnauthorizedError"];
+                403: components["responses"]["ForbiddenError"];
+                /** @description Wallet not found (NOT_FOUND) */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/frontend/wallets/{wallet_id}/kyc-rails/{rail_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * One KYC rail of the wallet
+         * @description One rail with the wallet's application on it, under the visibility rule of the list.
+         *
+         *     Replaces the BFF `GET /kyc/{wallet_id}/rails/{rail_id}`.
+         *
+         *     **Access Control**: any member of the wallet except the scoped `user` role. No KYC gate.
+         *
+         */
+        get: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    wallet_id: components["parameters"]["KycRailsWalletId"];
+                    /** @description `kyc_rails.id` of the wallet's tenant */
+                    rail_id: components["parameters"]["KycRailId"];
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description The rail */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["WalletKycRailResponse"];
+                    };
+                };
+                /** @description `rail_id` is not a UUID (VALIDATION_ERROR) */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                401: components["responses"]["UnauthorizedError"];
+                403: components["responses"]["ForbiddenError"];
+                /** @description No such rail on the wallet's tenant, or an archived rail the wallet is not approved on (RAIL_NOT_FOUND) */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        put?: never;
+        /**
+         * Submit the wallet to a KYC rail
+         * @description Puts the wallet on the rail, the way compliance does from the panel: a rail whose vendor CORE onboards
+         *     itself is submitted here, any other goes through the KYC-admin service. A manual rail waits for
+         *     compliance (`WAITING_ON_REVIEW`); a universal rail is approved on the spot. An application the vendor
+         *     sent back (`HOLD`, `SOFT_REJECT`) is resubmitted. No body.
+         *
+         *     Refused unless the rail has an onboarding implementation (Rail.io rails never do), takes submissions,
+         *     fits the entity type, and the entity's KYC is `APPROVED` or `WAITING_ON_REVIEW`. On a tenant without KYC
+         *     only the tenant's default universal rail can be submitted without it.
+         *
+         *     Replaces the BFF `POST /kyc/{wallet_id}/rails/{rail_id}`.
+         *
+         *     **Access Control**: wallet `admin` or `owner`. No KYC gate.
+         *
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    wallet_id: components["parameters"]["KycRailsWalletId"];
+                    /** @description `kyc_rails.id` of the wallet's tenant */
+                    rail_id: components["parameters"]["KycRailId"];
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description The rail after the submission */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["WalletKycRailResponse"];
+                    };
+                };
+                /** @description `rail_id` is not a UUID (VALIDATION_ERROR); the rail has no onboarding implementation, or is a universal
+                 *     rail other than the tenant's default on a tenant without KYC (RAIL_NOT_AVAILABLE); the rail takes no
+                 *     submissions (RAIL_SUBMIT_UNAVAILABLE); the rail is of the other entity type (RAIL_TYPE_MISMATCH); the
+                 *     onboarding behind the rail refused the submission (RAIL_SUBMISSION_REJECTED — the vendor's reason is
+                 *     logged, never returned)
+                 *      */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                401: components["responses"]["UnauthorizedError"];
+                /** @description Not an admin of the wallet (ACCESS_DENIED), or the entity's KYC is not approved or under review (KYC_NOT_APPROVED) */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description No such rail on the wallet's tenant, or an archived one (RAIL_NOT_FOUND) */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Already approved on the rail (RAIL_ALREADY_APPROVED), an application is with the vendor
+                 *     (RAIL_SUBMISSION_IN_PROGRESS), or the same submission is being processed (OPERATION_IN_PROGRESS)
+                 *      */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description The onboarding behind the rail failed or is unreachable (RAIL_SUBMISSION_FAILED), or the lock service is down (SERVICE_UNAVAILABLE) */
+                503: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/frontend/wallets/{wallet_id}/kyc-rails/{rail_id}/terms-and-conditions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Accept the terms of a KYC rail
+         * @description Records that the wallet accepted the rail's terms (`wallet_rail.terms_confirmed`). The wallet must have
+         *     submitted to the rail first. No body.
+         *
+         *     Replaces the BFF `POST /kyc/{wallet_id}/rails/{rail_id}/terms-and-conditions`.
+         *
+         *     **Access Control**: wallet `admin` or `owner`. No KYC gate.
+         *
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    wallet_id: components["parameters"]["KycRailsWalletId"];
+                    /** @description `kyc_rails.id` of the wallet's tenant */
+                    rail_id: components["parameters"]["KycRailId"];
+                };
+                cookie?: never;
+            };
+            requestBody?: never;
+            responses: {
+                /** @description The rail with the terms accepted */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["WalletKycRailResponse"];
+                    };
+                };
+                /** @description `rail_id` is not a UUID (VALIDATION_ERROR) */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                401: components["responses"]["UnauthorizedError"];
+                403: components["responses"]["ForbiddenError"];
+                /** @description No such rail (RAIL_NOT_FOUND), or the wallet never submitted to it (RAIL_NOT_SUBMITTED) */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/frontend/notifications/test": {
         parameters: {
             query?: never;
@@ -17007,6 +17428,50 @@ export interface components {
             email: string | null;
             phone: string | null;
         };
+        /** @description A terms-and-conditions document of a KYC rail. */
+        WalletKycRailTerms: {
+            title: string;
+            description: string | null;
+            link: string | null;
+        };
+        /** @description Something the user has to do with the rail vendor: `verification` — a vendor self-verification link (`type` names it, `full_name` the person it is for); `kyb_onboarding` — the vendor-hosted onboarding link. */
+        WalletKycRailExtraAction: {
+            /** @enum {string} */
+            action: "verification" | "kyb_onboarding";
+            type: string;
+            full_name: string | null;
+            /** Format: uri */
+            url: string;
+        };
+        /** @description The wallet's application on the rail. `null` on the rail while the wallet never submitted to it. */
+        WalletKycRailApplication: {
+            /**
+             * @description `APPROVED` — onboarded. `PROCESSING` / `PENDING` — with the vendor. `HOLD` / `SOFT_REJECT` — the vendor asked for a resubmission. `WAITING_ON_REVIEW` — a manual rail waiting for compliance.
+             * @enum {string}
+             */
+            status: "APPROVED" | "DECLINED" | "PENDING" | "PROCESSING" | "HOLD" | "NEEDS_ATTENTION" | "DOUBLE" | "SOFT_REJECT" | "REJECT" | "UNVERIFIED" | "WAITING_ON_UBOS" | "WAITING_ON_REVIEW";
+            /** @description Neutral text for the status, for display. Never the vendor's or compliance's own words. */
+            message: string | null;
+            terms_confirmed: boolean;
+            /** @description Vendor links to follow. Always empty for a caller below wallet `admin` — the links are one-time capabilities. */
+            extra_actions: components["schemas"]["WalletKycRailExtraAction"][];
+            /** @description The terms the rail had when the wallet first submitted — what the user accepted. */
+            terms_and_conditions: components["schemas"]["WalletKycRailTerms"][];
+        };
+        /** @description A KYC rail of the wallet's tenant with the wallet's application on it. Same shape as the BFF `GET /kyc/{wallet_id}/rails` item, plus `can_submit`. Vendor texts are not returned: `wallet_rail.message` is a neutral text for the status. */
+        WalletKycRail: {
+            /** Format: uuid */
+            id: string;
+            code: string | null;
+            name: string;
+            /** @description The rail takes submissions at all. */
+            is_submit_available: boolean;
+            /** @description The wallet can submit to the rail right now: it has an onboarding implementation, is of the entity's type or universal, the entity's KYC is approved or under review, and no application is approved or with the vendor. */
+            can_submit: boolean;
+            /** @description The rail's active terms, in display order. */
+            terms_and_conditions: components["schemas"]["WalletKycRailTerms"][];
+            wallet_rail: components["schemas"]["WalletKycRailApplication"] | null;
+        };
         /** @description One aggregated crypto balance of the wallet: every balance row sharing the same symbol is merged into a single entry, and `details[]` keeps the per-row breakdown. */
         WalletBalanceEntry: {
             symbol: string;
@@ -17864,87 +18329,97 @@ export interface components {
         };
         RfiCase: {
             /** Format: uuid */
-            id?: string;
+            id: string;
             /**
              * @description Human-facing id — quoted in the notification email
              * @example RFI-000042
              */
-            reference?: string;
+            reference: string;
             /** @enum {string} */
-            type?: "onboarding" | "transaction" | "ongoing";
+            type: "onboarding" | "transaction" | "ongoing";
+            /**
+             * @description What the request is about — the subject compliance wrote when opening it. Show it as is above the conversation; `messages` hold the question itself.
+             * @example Incoming payments of $10,970 and $7,500
+             */
+            subject: string;
             /**
              * @description `action_required` — compliance asked and waits for the client; `awaiting_compliance` — the client answered, compliance is reviewing; `closed` — no longer accepts replies.
              * @enum {string}
              */
-            status?: "action_required" | "awaiting_compliance" | "closed";
+            status: "action_required" | "awaiting_compliance" | "closed";
             /**
              * Format: date-time
              * @description When the answer is due
              */
-            due_at?: string | null;
+            due_at: string | null;
             /** @description True only while `action_required` and past `due_at` (red banner) */
-            overdue?: boolean;
+            overdue: boolean;
             /** @description One of the covered transactions is held until the request closes */
-            holds_transaction?: boolean;
+            holds_transaction: boolean;
             /** @description The account is on hold while the request is open */
-            holds_account?: boolean;
+            holds_account: boolean;
             /** @description How many transactions the request covers */
-            transactions_count?: number;
+            transactions_count: number;
             /** @description The last message of the conversation, for the card — null while nothing is visible yet */
-            last_message?: {
+            last_message: {
                 /** @enum {string} */
-                author?: "compliance" | "client";
+                author: "compliance" | "client";
                 /** @description One line of the message, up to 140 characters, cut at a word */
-                preview?: string | null;
+                preview: string | null;
                 /** Format: date-time */
-                created_at?: string;
+                created_at: string;
             } | null;
             /** Format: date-time */
-            created_at?: string;
+            created_at: string;
             /** Format: date-time */
-            updated_at?: string;
+            updated_at: string;
             /** Format: date-time */
-            closed_at?: string | null;
+            closed_at: string | null;
         };
         RfiAttachment: {
             /** Format: uuid */
-            id?: string;
-            file_name?: string;
-            content_type?: string | null;
-            size_bytes?: number | null;
+            id: string;
+            file_name: string;
+            /** @description The type the file's content proves (for files sent in the app); null only on some files that came by email */
+            content_type: string | null;
+            size_bytes: number | null;
             /** Format: date-time */
-            created_at?: string;
+            created_at: string;
         };
         RfiMessage: {
             /** Format: uuid */
-            id?: string;
-            /** @enum {string} */
-            author?: "compliance" | "client";
+            id: string;
             /**
-             * @description The analyst's signature on a compliance message — first name and last initial, from the analyst's current name. Null on the client's own messages (render them as "You") and when no name is on record.
-             * @example Polina S
+             * @description Which side wrote the message. The analyst is never named — show a placeholder (e.g. "Compliance team") for `compliance` and "You" for `client`.
+             * @enum {string}
              */
-            author_name?: string | null;
-            body?: string;
-            attachments?: components["schemas"]["RfiAttachment"][];
+            author: "compliance" | "client";
+            body: string;
+            attachments: components["schemas"]["RfiAttachment"][];
             /** Format: date-time */
-            created_at?: string;
+            created_at: string;
         };
         RfiTransaction: {
-            order_uuid?: string;
-            order_type?: string | null;
-            status?: string | null;
-            amount_from?: number | null;
-            amount_to?: number | null;
+            order_uuid: string;
+            order_type: string | null;
+            status: string | null;
+            amount_from: number | null;
+            amount_to: number | null;
             /** Format: date-time */
-            created_at?: string | null;
+            created_at: string | null;
         };
         RfiCaseDetail: components["schemas"]["RfiCase"] & {
-            can_reply?: boolean;
+            /** @description Whether YOU may answer this request now: it is open (`action_required` or `awaiting_compliance`) and your role on the account writes — `owner` or `admin`. False on a closed request and for an `auditor`, who reads the conversation only: show it read-only, without the answer box. Otherwise `POST …/messages` answers 409 `RFI_CLOSED` or 403 `ACCESS_DENIED` respectively. */
+            can_reply: boolean;
             /** @description The conversation, oldest first */
-            messages?: components["schemas"]["RfiMessage"][];
-            /** @description Every transaction the request covers, in the order compliance linked them */
-            transactions?: components["schemas"]["RfiTransaction"][];
+            messages: components["schemas"]["RfiMessage"][];
+            /** @description Every transaction the request covers, in the order compliance linked them. For the full table (currencies, paging) open the order list with `filters=[{"rfi_case_id":"<id>"}]`. */
+            transactions: components["schemas"]["RfiTransaction"][];
+        };
+        WalletKycRailResponse: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["WalletKycRail"];
         };
     };
     responses: {
@@ -18021,6 +18496,9 @@ export interface components {
         /** @description The account the requests are about. Requests and their conversations are kept per account. */
         RfiWalletId: string;
         RfiCaseId: string;
+        KycRailsWalletId: string;
+        /** @description `kyc_rails.id` of the wallet's tenant */
+        KycRailId: string;
     };
     requestBodies: never;
     headers: never;

package/dist/api/types/autogen/apiV1Tenant.types.d.ts

@@ -6513,6 +6513,8 @@ export interface paths {
                      *     Accepts a single value or a comma-separated list, e.g. `status=ACTIVE,CANCELED`.
                      *      */
                     status?: ("ACTIVE" | "INACTIVE" | "SUSPENDED" | "CANCELED")[];
+                    /** @description Only cards issued to this cardholder. */
+                    cardholder_id?: string;
                     sub_account_type?: "balance" | "prepaid";
                     offset?: number;
                     limit?: number;

package/dist/api/types/types.d.ts

@@ -816,6 +816,33 @@ export declare namespace API {
             }
             export {};
         }
+        namespace KycRails {
+            type ListRoot = pathsV1Frontend['/frontend/wallets/{wallet_id}/kyc-rails'];
+            type RailRoot = pathsV1Frontend['/frontend/wallets/{wallet_id}/kyc-rails/{rail_id}'];
+            type TermsRoot = pathsV1Frontend['/frontend/wallets/{wallet_id}/kyc-rails/{rail_id}/terms-and-conditions'];
+            export type WalletKycRail = componentsV1Frontend['schemas']['WalletKycRail'];
+            export type WalletKycRailApplication = componentsV1Frontend['schemas']['WalletKycRailApplication'];
+            export type WalletKycRailExtraAction = componentsV1Frontend['schemas']['WalletKycRailExtraAction'];
+            export type WalletKycRailTerms = componentsV1Frontend['schemas']['WalletKycRailTerms'];
+            export type RailStatus = WalletKycRailApplication['status'];
+            export namespace List {
+                type Request = ListRoot['get']['parameters']['path'];
+                type Response = ListRoot['get']['responses'][200]['content']['application/json'];
+            }
+            export namespace Get {
+                type Request = RailRoot['get']['parameters']['path'];
+                type Response = RailRoot['get']['responses'][200]['content']['application/json'];
+            }
+            export namespace Submit {
+                type Request = RailRoot['post']['parameters']['path'];
+                type Response = RailRoot['post']['responses'][200]['content']['application/json'];
+            }
+            export namespace ConfirmTerms {
+                type Request = TermsRoot['post']['parameters']['path'];
+                type Response = TermsRoot['post']['responses'][200]['content']['application/json'];
+            }
+            export {};
+        }
         namespace Reference {
             namespace ExchangeRates {
                 type ExchangeRatesRoot = pathsV1Frontend['/frontend/reference/exchange_rates'];
@@ -1666,8 +1693,7 @@ export declare namespace API {
      * transactions, answered by the account's team with text and files.
      *
      * Every path is scoped by `wallet_id`, so each Request carries it. Responses are the frontend
-     * `{ success, data }` envelope as the spec declares it. Every `Rfi*` field is optional for now
-     * because the spec declares no `required`; the types tighten on the regeneration that adds it.
+     * `{ success, data }` envelope as the spec declares it.
      */
     namespace Rfi {
         type CasesRoot = pathsV1Frontend['/frontend/rfi/{wallet_id}'];
@@ -1679,12 +1705,17 @@ export declare namespace API {
         export type Message = componentsV1Frontend['schemas']['RfiMessage'];
         export type Attachment = componentsV1Frontend['schemas']['RfiAttachment'];
         export type Transaction = componentsV1Frontend['schemas']['RfiTransaction'];
-        export type CaseStatus = NonNullable<Case['status']>;
-        export type CaseType = NonNullable<Case['type']>;
-        export type MessageAuthor = NonNullable<Message['author']>;
+        /**
+         * The body of every RFI error response (`400`, `403`, `404`, `409`, `429`). The client rejects with
+         * the `AxiosError`, so read it from `response.data`; the RFI code is its `error.code`.
+         */
+        export type ErrorResponse = componentsV1Frontend['schemas']['ErrorResponse'];
+        export type CaseStatus = Case['status'];
+        export type CaseType = Case['type'];
+        export type MessageAuthor = Message['author'];
         /** The list's `status` filter. `open` = `action_required` + `awaiting_compliance`; no case has it. */
         export type ListStatus = NonNullable<List.Request['status']>;
-        export type Summary = NonNullable<NonNullable<List.Response['data']>['summary']>;
+        export type Summary = List.Response['data']['summary'];
         export namespace List {
             type Request = CasesRoot['get']['parameters']['path'] & NonNullable<CasesRoot['get']['parameters']['query']>;
             type Response = CasesRoot['get']['responses']['200']['content']['application/json'];
@@ -2395,7 +2426,13 @@ export declare namespace API {
                      * is refused with 400.
                      */
                     type OrderListMassPayoutFilter = Record<'mass_payout_id', string>;
-                    type OrderListFilter = OrderListStatusFilter | OrderListOrderTypeFilter | OrderListFromUuidFilter | OrderListToUuidFilter | OrderListMassPayoutFilter;
+                    /**
+                     * Narrows the feed to the orders a compliance request covers — the same ones as
+                     * `transactions` in the request's detail, closed requests included. A single uuid only
+                     * (not an array); a non-uuid value is refused with 400.
+                     */
+                    type OrderListRfiCaseFilter = Record<'rfi_case_id', string>;
+                    type OrderListFilter = OrderListStatusFilter | OrderListOrderTypeFilter | OrderListFromUuidFilter | OrderListToUuidFilter | OrderListMassPayoutFilter | OrderListRfiCaseFilter;
                     interface Request {
                         wallet_uuid: string;
                         offset?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squarefi-bff-api-module",
-  "version": "1.36.78",
+  "version": "1.36.80",
   "description": "Squarefi BFF API client module",
   "type": "module",
   "main": "./dist/index.js",