@authme/identity-verification 2.8.55 → 2.8.59

package/index.esm.js

@@ -9,7 +9,7 @@ import 'core-js/modules/web.dom-collections.iterator.js';
 import { getTranslateInstance, TrackingEvent, generateStatus, EventListenerService, StatusDescription, AuthmeError, ErrorCode, Feature, StatusEvent, StatusView, StatusAction, setRequestLoggingFunc, setAccessToken, getCustomerState } from '@authme/core';
 import { EAuthMeFASServiceStatus, EAuthMeIDCardAntiFraudStage as EAuthMeIDCardAntiFraudStage$1, EAuthMeCardClass as EAuthMeCardClass$1, AuthmeFunctionModule, MlEngine, EngineModule, EAuthMeEngineReturnCode, AuthmeEngineModuleBase } from '@authme/engine';
 import { CountryCode, IdRecognitionCardType, EAuthMeCardClass, EAuthMeIDCardAntiFraudStatus, thicknessDefaultConfig, EAuthMeIDCardAntiFraudStage, mapCardtypeToAuthmeClass, getRecognitionColumnOrder, cardTypeTitle, cardTypeConfirmTitle, cardTypeHeader, EAuthMeCardOCRStatus, EAuthMeMRZServiceStatus, saveExtraDoc, initScanDocumentResourceBase64, MRZService, ResourceImageType, uploadFrameBase64, finishScanDocument, initScanDocument, initScan, option, themeUI, CardOCR, IdCardAntiFraudService, twoWayAuthmeCardClassMap, RecognitionFileType, recognizeBase64, getCardSubTypes, getCardTypes, confirmScan } from '@authme/id-recognition';
-import { getCssVariable, RGBToLottieColor, colorToRGB, Storage, useState, uiThemeText, uiThemeHint, clearCanvas, getImageData, hidePopup, showPopup, waitTime, TIME_UNIT, AuthmeError as AuthmeError$1, ErrorCode as ErrorCode$1, isMobile, uiThemeButton, requestCamera, showElement, asyncOnLineShowErrorMessage, getCanvasSize, startSpinner, stopSpinner, themeConfigDefault, mergeThemeConfig, uiThemeDirection, fontWeight, hideElement, checkOnlineStatus, showErrorMessage, dataURItoBlob, uiThemeSmallButton, dropMenu, hideErrorMessage, UintArrayToBlob, isIphone14proOrProMax, cropByRatio, switchCamera, asyncShowPopup, retryPromiseWithCondition, asyncShowErrorMessage, uploadModal, backgroundRequest, debugTools, STORAGE_KEY, splitResult, RUN_FUNCTION_NAME, DEVICE_TYPE, combineResult, startLoadingSDK, stopLoadingSDK } from '@authme/util';
+import { getCssVariable, RGBToLottieColor, colorToRGB, Storage, useState, uiThemeText, uiThemeHint, clearCanvas, getImageData, hidePopup, showPopup, waitTime, TIME_UNIT, AuthmeError as AuthmeError$1, ErrorCode as ErrorCode$1, isMobile, uiThemeButton, requestCamera, showElement, asyncOnLineShowErrorMessage, getCanvasSize, startSpinner, stopSpinner, themeConfigDefault, mergeThemeConfig, uiThemeDirection, fontWeight, hideElement, checkOnlineStatus, showErrorMessage, dataURItoBlob, uiThemeSmallButton, safeColor, safeFontSize, safeFontWeight, safeOpacity, dropMenu, hideErrorMessage, UintArrayToBlob, isIphone14proOrProMax, cropByRatio, switchCamera, asyncShowPopup, retryPromiseWithCondition, asyncShowErrorMessage, uploadModal, backgroundRequest, debugTools, STORAGE_KEY, splitResult, RUN_FUNCTION_NAME, DEVICE_TYPE, combineResult, startLoadingSDK, stopLoadingSDK, getSystemInfo, getDeviceInfo, isMobileOrTablet } from '@authme/util';
 import 'core-js/modules/es.array.push.js';
 import { mergeMap, animationFrames, filter, tap, map, from, catchError, EMPTY, concatAll, takeUntil, of, merge, fromEvent, Subject, defer, throttleTime, switchMap, take, concatMap, throwError, finalize, Observable, interval, mapTo, firstValueFrom, shareReplay, switchMapTo, takeWhile as takeWhile$1, timer, race } from 'rxjs';
 import 'core-js/modules/es.iterator.for-each.js';
@@ -68,6 +68,13 @@ import 'core-js/modules/es.uint8-array.set-from-hex.js';
 import 'core-js/modules/es.uint8-array.to-base64.js';
 import 'core-js/modules/es.uint8-array.to-hex.js';
 import 'core-js/modules/es.iterator.some.js';
+import 'core-js/modules/es.set.difference.v2.js';
+import 'core-js/modules/es.set.intersection.v2.js';
+import 'core-js/modules/es.set.is-disjoint-from.v2.js';
+import 'core-js/modules/es.set.is-subset-of.v2.js';
+import 'core-js/modules/es.set.is-superset-of.v2.js';
+import 'core-js/modules/es.set.symmetric-difference.v2.js';
+import 'core-js/modules/es.set.union.v2.js';
 
 function _objectWithoutPropertiesLoose(r, e) {
   if (null == r) return {};
@@ -28849,7 +28856,8 @@ const renderBasicUI = userConfig => {
   const closeIcon = document.createElement('div');
   closeIcon.classList.add('video-container__close');
   // closeIcon.src = Icon.CloseIcon;
-  closeIcon.innerHTML = `<svg width="64" height="64" viewBox="0 0 64 64" xmlns="http://www.w3.org/2000/svg"><circle cx="32" cy="32" r="32" fill="#808080" fill-opacity="${uiThemeConfig.ekycCloseButton.backgroundOpacity}"/><path d="M24 24L40 40M40 24L24 40" stroke="#FFFFFF" stroke-width="2" stroke-linecap="round" stroke-opacity="${uiThemeConfig.ekycCloseButton.contentOpacity}"/></svg>`;
+  closeIcon.textContent = '';
+  closeIcon.insertAdjacentHTML('beforeend', `<svg width="64" height="64" viewBox="0 0 64 64" xmlns="http://www.w3.org/2000/svg"><circle cx="32" cy="32" r="32" fill="#808080" fill-opacity="${uiThemeConfig.ekycCloseButton.backgroundOpacity}"/><path d="M24 24L40 40M40 24L24 40" stroke="#FFFFFF" stroke-width="2" stroke-linecap="round" stroke-opacity="${uiThemeConfig.ekycCloseButton.contentOpacity}"/></svg>`);
   if (!userConfig.showCloseButton) {
     closeIcon.classList.add('authme-hide');
   }
@@ -29330,8 +29338,13 @@ const modal = arg => {
   domTitle.innerText = arg.title;
   domSubtitle.innerText = arg.subtitle;
   domImage.src = arg.image;
-  domContent.textContent = arg.content;
-  domClose.innerHTML = `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.1943 6.41714C19.6393 5.97216 19.6393 5.2507 19.1943 4.80571C18.7493 4.36073 18.0278 4.36073 17.5829 4.80571L12 10.3886L6.41714 4.80572C5.97216 4.36073 5.2507 4.36073 4.80571 4.80571C4.36073 5.2507 4.36073 5.97216 4.80571 6.41714L10.3886 12L4.80571 17.5829C4.36073 18.0278 4.36073 18.7493 4.80571 19.1943C5.2507 19.6393 5.97216 19.6393 6.41714 19.1943L12 13.6114L17.5829 19.1943C18.0278 19.6393 18.7493 19.6393 19.1943 19.1943C19.6393 18.7493 19.6393 18.0278 19.1943 17.5829L13.6114 12L19.1943 6.41714Z" fill="${uiThemeConfig.nonEkycCloseButton.contentColor}" fill-opacity="${uiThemeConfig.nonEkycCloseButton.contentOpacity}" /></svg>`;
+  if (arg.content instanceof HTMLElement) {
+    domContent.appendChild(arg.content);
+  } else {
+    domContent.innerHTML = arg.content;
+  }
+  domClose.textContent = '';
+  domClose.insertAdjacentHTML('beforeend', `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.1943 6.41714C19.6393 5.97216 19.6393 5.2507 19.1943 4.80571C18.7493 4.36073 18.0278 4.36073 17.5829 4.80571L12 10.3886L6.41714 4.80572C5.97216 4.36073 5.2507 4.36073 4.80571 4.80571C4.36073 5.2507 4.36073 5.97216 4.80571 6.41714L10.3886 12L4.80571 17.5829C4.36073 18.0278 4.36073 18.7493 4.80571 19.1943C5.2507 19.6393 5.97216 19.6393 6.41714 19.1943L12 13.6114L17.5829 19.1943C18.0278 19.6393 18.7493 19.6393 19.1943 19.1943C19.6393 18.7493 19.6393 18.0278 19.1943 17.5829L13.6114 12L19.1943 6.41714Z" fill="${uiThemeConfig.nonEkycCloseButton.contentColor}" fill-opacity="${uiThemeConfig.nonEkycCloseButton.contentOpacity}" /></svg>`);
   domConfirm.innerText = arg.confirm;
   domClose.addEventListener('click', async () => {
     if (arg.onClose) {
@@ -29619,15 +29632,18 @@ async function startLiveness(config) {
   // Start
   const step1 = defer(() => {
     return new Promise((resolve, reject) => {
+      const hintList = document.createElement('ul');
+      ['sdk.liveness.detection.infopageHint.face', 'sdk.liveness.detection.infopageHint.environment'].forEach(key => {
+        const li = document.createElement('li');
+        li.textContent = translateService.translate(key);
+        hintList.appendChild(li);
+      });
       modal({
         header: translateService.translate('sdk.liveness.detection.header'),
         title: translateService.translate('sdk.liveness.detection.subtitle'),
         subtitle: translateService.translate('sdk.liveness.detection.content'),
         image: LIVENESS_GUIDE_IMG,
-        content: `<ul>
-        <li>${translateService.translate('sdk.liveness.detection.infopageHint.face')}</li>
-        <li>${translateService.translate('sdk.liveness.detection.infopageHint.environment')}</li>
-        </ul>`,
+        content: hintList,
         confirm: translateService.translate('sdk.general.start'),
         onClose: () => {
           sendStatusAction$2(StatusAction.BtnClose);
@@ -30001,10 +30017,11 @@ const renderOCRUI = config => {
   successBlockDom.classList.add('block');
   const successDom = document.createElement('div');
   // successDom.classList.add('img');
-  successDom.innerHTML = `<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">
+  successDom.textContent = '';
+  successDom.insertAdjacentHTML('beforeend', `<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">
   <path d="M48 24C48 37.2548 37.2548 48 24 48C10.7452 48 0 37.2548 0 24C0 10.7452 10.7452 0 24 0C37.2548 0 48 10.7452 48 24Z" fill="${uiThemeConfig.uploadCompleteView.backgroundColor}" fill-opacity="${uiThemeConfig.fraudIntroStepTitle.backgroundOpacity}"/>
   <path d="M19.9938 28.8441L14.7813 23.6316L13.0063 25.3941L19.9938 32.3816L34.9938 17.3816L33.2313 15.6191L19.9938 28.8441Z" fill="white"/>
-  </svg>`;
+  </svg>`);
   const successText = document.createElement('div');
   uiThemeText(successText, uiThemeConfig.bodyOne);
   successText.textContent = translateService.translate('sdk.general.done');
@@ -31725,7 +31742,8 @@ const fraudScanIntroPage = arg => {
   domImage2.src = arg.image2 || fraudScanIntroPageStep2;
   domBody2.innerText = arg.body2;
   domBody3.innerText = arg.body3;
-  domClose.innerHTML = `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.1943 6.41714C19.6393 5.97216 19.6393 5.2507 19.1943 4.80571C18.7493 4.36073 18.0278 4.36073 17.5829 4.80571L12 10.3886L6.41714 4.80572C5.97216 4.36073 5.2507 4.36073 4.80571 4.80571C4.36073 5.2507 4.36073 5.97216 4.80571 6.41714L10.3886 12L4.80571 17.5829C4.36073 18.0278 4.36073 18.7493 4.80571 19.1943C5.2507 19.6393 5.97216 19.6393 6.41714 19.1943L12 13.6114L17.5829 19.1943C18.0278 19.6393 18.7493 19.6393 19.1943 19.1943C19.6393 18.7493 19.6393 18.0278 19.1943 17.5829L13.6114 12L19.1943 6.41714Z" fill="${uiThemeConfig.nonEkycCloseButton.contentColor}" fill-opacity="${uiThemeConfig.nonEkycCloseButton.contentOpacity}" /></svg>`;
+  domClose.textContent = '';
+  domClose.insertAdjacentHTML('beforeend', `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.1943 6.41714C19.6393 5.97216 19.6393 5.2507 19.1943 4.80571C18.7493 4.36073 18.0278 4.36073 17.5829 4.80571L12 10.3886L6.41714 4.80572C5.97216 4.36073 5.2507 4.36073 4.80571 4.80571C4.36073 5.2507 4.36073 5.97216 4.80571 6.41714L10.3886 12L4.80571 17.5829C4.36073 18.0278 4.36073 18.7493 4.80571 19.1943C5.2507 19.6393 5.97216 19.6393 6.41714 19.1943L12 13.6114L17.5829 19.1943C18.0278 19.6393 18.7493 19.6393 19.1943 19.1943C19.6393 18.7493 19.6393 18.0278 19.1943 17.5829L13.6114 12L19.1943 6.41714Z" fill="${uiThemeConfig.nonEkycCloseButton.contentColor}" fill-opacity="${uiThemeConfig.nonEkycCloseButton.contentOpacity}" /></svg>`);
   domConfirm.innerText = arg.confirm;
   uiThemeButton(domConfirm, uiThemeConfig.majorButton);
   // domBack.addEventListener('click', async () => {
@@ -31939,7 +31957,7 @@ const ocrResultModal = arg => {
         domDropMenuLi.classList.add('active');
       }
       domDropMenuLi.setAttribute('data-value', selection.value);
-      domDropMenuLi.innerHTML = `<span>${selection.name}</span>`;
+      domDropMenuLi.textContent = selection.name;
       domDropMenuUl.appendChild(domDropMenuLi);
     });
     domDropMenu.appendChild(domDropMenuTitle);
@@ -32201,18 +32219,19 @@ const ocrResultModal = arg => {
   uiThemeText(domSubtitle, uiThemeConfig.resultBody);
   domTitle.innerText = arg.title;
   domSubtitle.innerText = arg.subtitle;
-  domHint.innerHTML = arg.hintText;
+  domHint.textContent = arg.hintText;
   domCountDownContainer.style.color = uiThemeConfig.resultPageCountdown.textColor;
   domCountDownContainer.style.fontSize = `${uiThemeConfig.resultPageCountdown.fontSize}px`;
   domCountDownContainer.style.fontWeight = fontWeight[uiThemeConfig.resultPageCountdown.textWeight];
-  domCountDownContainer.innerHTML = `${arg.countDown1Text} <span class="video-container__ocrResultModal-countdown" style="color: ${uiThemeConfig.resultPageCountdown.timeTextColor};font-size:${uiThemeConfig.resultPageCountdown.timeFontSize}px;font-weight:${fontWeight[uiThemeConfig.resultPageCountdown.timeTextWeight]}"> ${formatTime(timer)} </span> ${arg.countDown2Text}`;
+  domCountDownContainer.innerHTML = `${arg.countDown1Text} <span class="video-container__ocrResultModal-countdown" style="color: ${safeColor(uiThemeConfig.resultPageCountdown.timeTextColor)};font-size:${safeFontSize(uiThemeConfig.resultPageCountdown.timeFontSize)}px;font-weight:${safeFontWeight(fontWeight[uiThemeConfig.resultPageCountdown.timeTextWeight])}"> ${formatTime(timer)} </span> ${arg.countDown2Text}`;
   domConfirm.innerText = arg.confirmText;
-  domClose.innerHTML = `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.1943 6.41714C19.6393 5.97216 19.6393 5.2507 19.1943 4.80571C18.7493 4.36073 18.0278 4.36073 17.5829 4.80571L12 10.3886L6.41714 4.80572C5.97216 4.36073 5.2507 4.36073 4.80571 4.80571C4.36073 5.2507 4.36073 5.97216 4.80571 6.41714L10.3886 12L4.80571 17.5829C4.36073 18.0278 4.36073 18.7493 4.80571 19.1943C5.2507 19.6393 5.97216 19.6393 6.41714 19.1943L12 13.6114L17.5829 19.1943C18.0278 19.6393 18.7493 19.6393 19.1943 19.1943C19.6393 18.7493 19.6393 18.0278 19.1943 17.5829L13.6114 12L19.1943 6.41714Z" fill="${uiThemeConfig.nonEkycCloseButton.contentColor}" fill-opacity="${uiThemeConfig.nonEkycCloseButton.contentOpacity}" /></svg>`;
+  domClose.textContent = '';
+  domClose.insertAdjacentHTML('beforeend', `<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M19.1943 6.41714C19.6393 5.97216 19.6393 5.2507 19.1943 4.80571C18.7493 4.36073 18.0278 4.36073 17.5829 4.80571L12 10.3886L6.41714 4.80572C5.97216 4.36073 5.2507 4.36073 4.80571 4.80571C4.36073 5.2507 4.36073 5.97216 4.80571 6.41714L10.3886 12L4.80571 17.5829C4.36073 18.0278 4.36073 18.7493 4.80571 19.1943C5.2507 19.6393 5.97216 19.6393 6.41714 19.1943L12 13.6114L17.5829 19.1943C18.0278 19.6393 18.7493 19.6393 19.1943 19.1943C19.6393 18.7493 19.6393 18.0278 19.1943 17.5829L13.6114 12L19.1943 6.41714Z" fill="${safeColor(uiThemeConfig.nonEkycCloseButton.contentColor)}" fill-opacity="${safeOpacity(uiThemeConfig.nonEkycCloseButton.contentOpacity)}" /></svg>`);
   const countdownInterval = setInterval(() => {
     timer -= 1;
     const countdownEl = domModal.querySelector('.video-container__ocrResultModal-countdown');
     if (countdownEl) {
-      countdownEl.innerHTML = formatTime(timer);
+      countdownEl.textContent = formatTime(timer);
     }
     if (timer <= 0) {
       clearInterval(countdownInterval);
@@ -33695,7 +33714,7 @@ async function startOCR(config) {
       container: uiComponentBasic.videoContainer
     });
     let hint = true;
-    cameraHint.innerHTML = translateService.translate('sdk.general.verify.error.switchCamera');
+    cameraHint.textContent = translateService.translate('sdk.general.verify.error.switchCamera');
     cameraSwitchContainer.addEventListener('click', async () => {
       if (hint) {
         setTimeout(() => {
@@ -33771,7 +33790,8 @@ async function startOCR(config) {
 <path d="M15.0559 0.844991C14.0954 0.299519 12.8746 0.635956 12.3291 1.59644C11.7837 2.55693 12.1201 3.77775 13.0806 4.32322L14.0683 2.58411L15.0559 0.844991ZM24.3237 38.8301C25.1047 39.6112 26.371 39.6112 27.1521 38.8301L39.88 26.1022C40.6611 25.3212 40.6611 24.0548 39.88 23.2738C39.099 22.4927 37.8326 22.4927 37.0516 23.2738L25.7379 34.5875L14.4242 23.2738C13.6431 22.4927 12.3768 22.4927 11.5957 23.2738C10.8147 24.0548 10.8147 25.3212 11.5957 26.1022L24.3237 38.8301ZM14.0683 2.58411L13.0806 4.32322C19.6901 8.07682 22.2819 12.7684 23.3088 18.1847C23.836 20.9652 23.9531 23.9667 23.9286 27.2094C23.9163 28.8287 23.8693 30.4812 23.8246 32.1902C23.78 33.8911 23.7379 35.6411 23.7379 37.4159L25.7379 37.4159L27.7379 37.4159C27.7379 35.6988 27.7786 33.9955 27.8232 32.2949C27.8675 30.6023 27.9159 28.9052 27.9285 27.2397C27.9537 23.9128 27.8388 20.6044 27.2388 17.4396C26.0113 10.9653 22.7684 5.225 15.0559 0.844991L14.0683 2.58411Z" fill="#4AD396"/>
 </svg>`
       };
-      container.innerHTML = svgContent[direction];
+      container.textContent = '';
+      container.insertAdjacentHTML('beforeend', svgContent[direction]);
       return container;
     };
     switch (stage) {
@@ -33885,7 +33905,7 @@ const renderExtraUI = config => {
   config.videoContainer.appendChild(titleTextPanel);
   config.videoContainer.appendChild(cardborderContainer);
   // Set init text
-  titleText.innerHTML = translateService.translate('extra.title');
+  titleText.textContent = translateService.translate('extra.title');
   // Picture
   const confirmContainer = document.createElement('div');
   confirmContainer.classList.add('confirm_container');
@@ -36905,6 +36925,11 @@ const [, setFeature] = featureUseState;
 const [, setStatusEvent] = eventUseState;
 const [, setStatusView] = viewUseState;
 
+function escapeHtml(str) {
+  const div = document.createElement('div');
+  div.textContent = str;
+  return div.innerHTML;
+}
 function renderCardTypeAndCountryConfig(config) {
   eventListenerService.start();
   setFeature(Feature.SelectCardTypeAndCountry);
@@ -37056,7 +37081,7 @@ function renderCardTypeAndCountryConfig(config) {
       dom.addEventListener('click', handleCardTypeClick);
       dom.innerHTML = `
         <div class="card-in-frame">
-          <label class="card-label ${item.cardType.toLowerCase()}">${item.display}</label>
+          <label class="card-label ${item.cardType.toLowerCase()}">${escapeHtml(item.display)}</label>
           <i class="card-icon"></i>
         </div>
         `;
@@ -37089,6 +37114,23 @@ function renderCardTypeAndCountryConfig(config) {
   });
 }
 
+const VALID_COUNTRY_CODES = new Set(Object.values(CountryCode));
+/**
+ * Defense-in-depth check for the public `getCardTypeAndCountry` API.
+ *
+ * The `supportCountries` value is interpolated into translation keys like
+ * `sdk.general.country.${country}`. TypeScript's `CountryCode` enum does not
+ * enforce values at runtime, so a misconfigured integrator could pass an
+ * arbitrary string. Reject anything outside the SDK's known country list at
+ * the entry point.
+ */
+function validateSupportCountries(countries) {
+  const invalid = countries.filter(c => !VALID_COUNTRY_CODES.has(c));
+  if (invalid.length > 0) {
+    throw new Error(`Invalid country code in supportCountries: ${invalid.join(', ')}`);
+  }
+}
+
 const _excluded = ["canvas", "loadingLottie"];
 function identityVerificationFeatureIdentityVerification() {
   return 'identity-verification-feature-identity-verification';
@@ -37188,6 +37230,9 @@ class AuthmeIdentityVerification extends AuthmeFunctionModule {
   }
   async getCardTypeAndCountry(userConfig) {
     var _userConfig$supportCo, _userConfig$supportCa;
+    if (userConfig.supportCountries) {
+      validateSupportCountries(userConfig.supportCountries);
+    }
     const defaultCountries = [CountryCode.TWN, CountryCode.JPN, CountryCode.ZAF, CountryCode.USA, CountryCode.CHN, CountryCode.PHL, CountryCode.GBR, CountryCode.KOR, CountryCode.HKG, CountryCode.FRA, CountryCode.ESP, CountryCode.MEX, CountryCode.ITA, CountryCode.IND, CountryCode.COL, CountryCode.RUS, CountryCode.DEU, CountryCode.TUR, CountryCode.CAN, CountryCode.AUS, CountryCode.IDN, CountryCode.MYS, CountryCode.EGY, CountryCode.SAU, CountryCode.NLD, CountryCode.SGP];
     const defaultCountry = userConfig.defaultCountry !== undefined && defaultCountries.includes(userConfig.defaultCountry) ? userConfig.defaultCountry : defaultCountries[0];
     const supportCountries = (_userConfig$supportCo = userConfig.supportCountries) != null ? _userConfig$supportCo : defaultCountries;
@@ -37358,8 +37403,134 @@ class AuthmeIdentityVerification extends AuthmeFunctionModule {
   }
 }
 
+const MIN_IOS_MAJOR = 16;
+const MIN_IOS_MINOR_FOR_16 = 4;
+const MIN_ANDROID_MAJOR = 9;
+const IN_APP_WEBVIEW_PATTERNS = [{
+  key: 'line',
+  pattern: /\bLine\//i
+}, {
+  key: 'messenger',
+  pattern: /\bMessenger\b/i
+}, {
+  key: 'fb',
+  pattern: /\bFBAN|FBAV|FB_IAB\b/i
+}, {
+  key: 'instagram',
+  pattern: /\bInstagram\b/i
+}, {
+  key: 'wechat',
+  pattern: /MicroMessenger|WeChat/i
+}];
+function detectWebAssembly() {
+  return typeof WebAssembly !== 'undefined';
+}
+function detectWebAssemblySimd() {
+  if (!detectWebAssembly()) return false;
+  // Mirrors libs/engine/src/lib/engine.ts isSimdSupported(); kept independent
+  // so callers don't have to load the engine bundle just to introspect.
+  try {
+    if (/iPad|iPhone|iPod/.test(navigator.userAgent)) {
+      return false;
+    }
+    return WebAssembly.validate(new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 10, 9, 1, 7, 0, 65, 0, 253, 15, 26, 11]));
+  } catch (_unused) {
+    return false;
+  }
+}
+function detectMediaDevices() {
+  var _navigator$mediaDevic;
+  return typeof navigator !== 'undefined' && 'mediaDevices' in navigator && typeof ((_navigator$mediaDevic = navigator.mediaDevices) == null ? void 0 : _navigator$mediaDevic.getUserMedia) === 'function';
+}
+function detectSecureContext() {
+  var _window$location;
+  if (typeof window === 'undefined') return false;
+  if (typeof window.isSecureContext === 'boolean') {
+    return window.isSecureContext;
+  }
+  return ((_window$location = window.location) == null ? void 0 : _window$location.protocol) === 'https:';
+}
+function detectInAppWebView() {
+  var _navigator$userAgent;
+  const ua = (_navigator$userAgent = navigator.userAgent) != null ? _navigator$userAgent : '';
+  for (const {
+    key,
+    pattern
+  } of IN_APP_WEBVIEW_PATTERNS) {
+    if (pattern.test(ua)) return key;
+  }
+  return 'none';
+}
+function parseIosVersion() {
+  const m = navigator.userAgent.match(/OS (\d+)[._](\d+)(?:[._](\d+))?/);
+  if (!m) return null;
+  return {
+    major: Number(m[1]),
+    minor: Number(m[2])
+  };
+}
+function parseAndroidMajor() {
+  const m = navigator.userAgent.match(/Android\s+(\d+)/i);
+  if (!m) return null;
+  return Number(m[1]);
+}
+function detectHardwareConcurrency() {
+  if (typeof navigator === 'undefined') return null;
+  const v = navigator.hardwareConcurrency;
+  return typeof v === 'number' && v > 0 ? v : null;
+}
+function detectDeviceMemory() {
+  if (typeof navigator === 'undefined') return null;
+  const v = navigator.deviceMemory;
+  return typeof v === 'number' && v > 0 ? v : null;
+}
+/**
+ * Synchronous pre-flight check that the current browser/device can run the
+ * eKYC SDK. Returns a binary `supported` flag plus the reasons it failed
+ * (when applicable) and a snapshot of the detected environment.
+ *
+ * The check is UA + feature detection only — it does not request the camera,
+ * load the engine, or make network requests. Typical execution time < 5 ms.
+ */
+function isSupported() {
+  const info = {
+    device: getDeviceInfo(),
+    system: getSystemInfo(),
+    webAssembly: detectWebAssembly(),
+    webAssemblySimd: detectWebAssemblySimd(),
+    mediaDevices: detectMediaDevices(),
+    secureContext: detectSecureContext(),
+    inAppWebView: detectInAppWebView(),
+    hardwareConcurrency: detectHardwareConcurrency(),
+    deviceMemory: detectDeviceMemory()
+  };
+  const reasons = [];
+  if (!info.webAssembly) reasons.push('NO_WEBASSEMBLY');
+  if (!info.mediaDevices) reasons.push('NO_MEDIA_DEVICES');
+  if (isMobileOrTablet() && !info.secureContext) {
+    // Camera APIs require a secure context on mobile; localhost is always
+    // treated as secure by the platform, so this fires for true plaintext only.
+    reasons.push('INSECURE_CONTEXT');
+  }
+  if (info.inAppWebView !== 'none') reasons.push('IN_APP_WEBVIEW');
+  const ios = parseIosVersion();
+  if (ios) {
+    const tooOld = ios.major < MIN_IOS_MAJOR || ios.major === MIN_IOS_MAJOR && ios.minor < MIN_IOS_MINOR_FOR_16;
+    if (tooOld) reasons.push('OLD_IOS');
+  }
+  const android = parseAndroidMajor();
+  if (android !== null && android < MIN_ANDROID_MAJOR) {
+    reasons.push('OLD_ANDROID');
+  }
+  return {
+    supported: reasons.length === 0,
+    reasons,
+    info
+  };
+}
+
 var name = "authme/sdk";
-var version$1 = "2.8.55";
+var version$1 = "2.8.59";
 var packageInfo = {
 	name: name,
 	version: version$1};
@@ -37369,4 +37540,4 @@ const version = packageInfo.version;
 (_window$_Symbol$for = (_window = window)[_Symbol$for = Symbol.for('authme-sdk')]) != null ? _window$_Symbol$for : _window[_Symbol$for] = {};
 window[Symbol.for('authme-sdk')][packageInfo.name] = version;
 
-export { AuthmeIdentityVerification, arrow_down, arrow_left, arrow_right, arrow_up, card_lr, card_rotate_down, card_rotate_left, card_rotate_right, card_rotate_up, card_ud, circle_large_to_sm_mask, circle_sm_to_large_mask, defaultExtraDocumentConfig, defaultIdRecognitionConfig, defaultIdentityVerificationConfig, defaultLivenessConfig, fraudScanIntroPageStep1, identityVerificationFeatureIdentityVerification, renderExtraUI, scan, startExtra, startLiveness, startOCR, success, tutorial, version };
+export { AuthmeIdentityVerification, arrow_down, arrow_left, arrow_right, arrow_up, card_lr, card_rotate_down, card_rotate_left, card_rotate_right, card_rotate_up, card_ud, circle_large_to_sm_mask, circle_sm_to_large_mask, defaultExtraDocumentConfig, defaultIdRecognitionConfig, defaultIdentityVerificationConfig, defaultLivenessConfig, fraudScanIntroPageStep1, identityVerificationFeatureIdentityVerification, isSupported, renderExtraUI, scan, startExtra, startLiveness, startOCR, success, tutorial, version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authme/identity-verification",
-  "version": "2.8.55",
+  "version": "2.8.59",
   "peerDependencies": {
     "core-js": "^3.6.0",
     "lottie-web": "^5.9.2",

package/src/index.d.ts

@@ -2,4 +2,5 @@ export * from './lib/identity-verification-feature-identity-verification';
 export * from './lib/interface';
 export * from './lib/ui';
 export * from './lib/lottie';
+export * from './lib/support';
 export { version } from './lib/version';

package/src/lib/support.d.ts

@@ -0,0 +1,27 @@
+export type SupportReason = 'NO_WEBASSEMBLY' | 'NO_MEDIA_DEVICES' | 'INSECURE_CONTEXT' | 'OLD_IOS' | 'OLD_ANDROID' | 'IN_APP_WEBVIEW';
+export type InAppWebView = 'none' | 'line' | 'fb' | 'messenger' | 'instagram' | 'wechat' | 'other';
+export interface SupportInfo {
+    device: string;
+    system: string;
+    webAssembly: boolean;
+    webAssemblySimd: boolean;
+    mediaDevices: boolean;
+    secureContext: boolean;
+    inAppWebView: InAppWebView;
+    hardwareConcurrency: number | null;
+    deviceMemory: number | null;
+}
+export interface SupportCheckResult {
+    supported: boolean;
+    reasons: SupportReason[];
+    info: SupportInfo;
+}
+/**
+ * Synchronous pre-flight check that the current browser/device can run the
+ * eKYC SDK. Returns a binary `supported` flag plus the reasons it failed
+ * (when applicable) and a snapshot of the detected environment.
+ *
+ * The check is UA + feature detection only — it does not request the camera,
+ * load the engine, or make network requests. Typical execution time < 5 ms.
+ */
+export declare function isSupported(): SupportCheckResult;

package/src/lib/v2/ui/modal.d.ts

@@ -3,7 +3,7 @@ export declare const modal: (arg: {
     title: string;
     subtitle: string;
     image: string;
-    content: string;
+    content: string | HTMLElement;
     confirm: string;
     copyRight?: string;
     onClose?: () => void;

package/src/lib/validate-config.d.ts

@@ -0,0 +1,11 @@
+import { CountryCode } from '@authme/id-recognition';
+/**
+ * Defense-in-depth check for the public `getCardTypeAndCountry` API.
+ *
+ * The `supportCountries` value is interpolated into translation keys like
+ * `sdk.general.country.${country}`. TypeScript's `CountryCode` enum does not
+ * enforce values at runtime, so a misconfigured integrator could pass an
+ * arbitrary string. Reject anything outside the SDK's known country list at
+ * the entry point.
+ */
+export declare function validateSupportCountries(countries: readonly CountryCode[]): void;