Add session-less support

[elpinho]

Description

Adds session-less support to the widgets.

Related issues

• https://uphold.atlassian.net/browse/WL-2340
  • https://uphold.atlassian.net/browse/WL-2525

Deploy notes

Merge and deploy https://github.com/uphold/enterprise-api/pull/1190 and https://github.com/uphold/enterprise-widget/pull/335 first

[Copilot]

🟡 Changes recommended

Unresolved URL query-handling issues can break session-less launches and discard override parameters.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds session-less widget support by passing sessionToken through iframe URLs instead of init messages.

Changes:

• Updates widget initialization, types, examples, and tests.
• Adds session-less coverage for KYC, payment, and Travel Rule widgets.
• Updates test-app URL override handling.

File summaries

File	Summary
projects/widget-test-app/src/shared/api/requests/create-payment-session.ts	Moderate findings (1 vote each): KYC/Travel Rule overrides can lose sessionToken, and payment overrides can discard supplied query parameters instead of merging them.
packages/travel-rule-widget-web-sdk/src/travel-rule-widget.test.ts	Adds session-less Travel Rule coverage.
packages/payment-widget-web-sdk/src/payment-widget.test.ts	Adds session-less payment coverage.
packages/kyc-widget-web-sdk/src/types/kyc-widget.ts	Simplifies KYC session typing.
packages/kyc-widget-web-sdk/src/kyc-widget.ts	Updates session-related examples.
packages/kyc-widget-web-sdk/src/kyc-widget.test.ts	Adds session-less KYC coverage.
packages/core/src/widget.ts	Sends only options during initialization. Moderate finding (2 votes): related KYC/Travel Rule URL overrides can drop sessionToken query parameters.
packages/core/src/widget.test.ts	Tests session-less initialization and token URLs.

Review details

Suppressed comments (2)

projects/widget-test-app/src/shared/api/requests/create-payment-session.ts:54

• Session-less KYC and Travel Rule launches still lose their token in the test app: create-kyc-session.ts and create-travel-rule-session.ts still replace the API URL directly, unlike this query-preserving replacement. Since the API now delivers the session through ?sessionToken=..., the documented urlOverride paths will load the local widgets without a token and fail; apply the same URL handling to both helpers.

      newUrl.search = oldUrl.search;

projects/widget-test-app/src/shared/api/requests/create-payment-session.ts:54

• This replaces the entire override query string with the API URL's query, so any parameters intentionally supplied in paymentSessionUrlOverride are silently lost. For example, an override such as http://localhost:8788/?debug=true will no longer include debug=true; merge the API query parameters into the override instead of assigning search wholesale.

      newUrl.search = oldUrl.search;

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.