@jupitermetalabs/face-zk-sdk 0.3.4 → 0.3.7

package/dist/config/defaults.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Copyright 2026 JupiterMeta Labs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Face+ZK SDK – Default Config Values
+ *
+ * Default CDN base URL and model filenames used by `npx face-zk setup`
+ * and as fallback URLs when a model source only provides a relative path.
+ */
+import type { FaceZkSetupConfig } from "./types";
+/** Canonical model filenames matching what's tracked in the SDK repo. */
+export declare const DEFAULT_MODEL_FILES: {
+    readonly detection: "det_500m.onnx";
+    readonly recognition: "w600k_mbf.onnx";
+    readonly antispoof: "antispoof.onnx";
+    readonly ageGender: "genderage.onnx";
+    readonly wasm: "zk_face_wasm_bg.wasm";
+    readonly zkWorkerHtml: "zk-worker.html";
+};
+/**
+ * Default setup config used when no face-zk.config.js is found in the project.
+ * The source URL is a placeholder — replace it with your own CDN before use.
+ */
+export declare const DEFAULT_SETUP_CONFIG: FaceZkSetupConfig;
+/**
+ * Build full absolute CDN URLs for all required models.
+ *
+ * @param {string} base - The base CDN URL (e.g. from sdkConfig or environment).
+ * @param {FaceZkSetupConfig["models"]["files"]} [files] - Optional static file name overrides.
+ * @returns {Record<string, string>} A dictionary of fully qualified URIs ready for pre-fetching.
+ */
+export declare function buildModelUrls(base: string, files?: FaceZkSetupConfig["models"]["files"]): {
+    detection: string;
+    recognition: string;
+    antispoof: string;
+    ageGender: string;
+    wasm: string;
+    zkWorkerHtml: string;
+};

package/dist/config/defaults.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Copyright 2026 JupiterMeta Labs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SETUP_CONFIG = exports.DEFAULT_MODEL_FILES = void 0;
+exports.buildModelUrls = buildModelUrls;
+/** Canonical model filenames matching what's tracked in the SDK repo. */
+exports.DEFAULT_MODEL_FILES = {
+    detection: "det_500m.onnx",
+    recognition: "w600k_mbf.onnx",
+    antispoof: "antispoof.onnx",
+    ageGender: "genderage.onnx",
+    wasm: "zk_face_wasm_bg.wasm",
+    zkWorkerHtml: "zk-worker.html",
+};
+/**
+ * Default setup config used when no face-zk.config.js is found in the project.
+ * The source URL is a placeholder — replace it with your own CDN before use.
+ */
+exports.DEFAULT_SETUP_CONFIG = {
+    models: {
+        source: "https://cdn.your-company.com/face-zk/v1",
+        dest: "./assets/face-zk/",
+    },
+    features: {
+        liveness: true,
+        zk: true,
+    },
+};
+/**
+ * Build full absolute CDN URLs for all required models.
+ *
+ * @param {string} base - The base CDN URL (e.g. from sdkConfig or environment).
+ * @param {FaceZkSetupConfig["models"]["files"]} [files] - Optional static file name overrides.
+ * @returns {Record<string, string>} A dictionary of fully qualified URIs ready for pre-fetching.
+ */
+function buildModelUrls(base, files) {
+    const f = { ...exports.DEFAULT_MODEL_FILES, ...files };
+    const b = base.replace(/\/$/, ""); // strip trailing slash
+    return {
+        detection: `${b}/${f.detection}`,
+        recognition: `${b}/${f.recognition}`,
+        antispoof: `${b}/${f.antispoof}`,
+        ageGender: `${b}/${f.ageGender}`,
+        wasm: `${b}/${f.wasm}`,
+        zkWorkerHtml: `${b}/${f.zkWorkerHtml}`,
+    };
+}

package/dist/config/types.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Copyright 2026 JupiterMeta Labs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Face+ZK SDK – Config Types
+ *
+ * Defines the configuration interfaces for SDK initialization and CLI setup.
+ */
+/**
+ * Describes where to find a model binary. Provide exactly one of:
+ *   - `module`    – result of require('./path/to/model.onnx'); bundled by Metro at build time (fastest)
+ *   - `url`       – remote CDN/HTTP URL; downloaded and cached on first use
+ *   - `localUri`  – pre-resolved local file:// URI (e.g., already on device)
+ */
+export interface ModelSource {
+    /** Result of require('./assets/model.onnx') – bundled asset, resolved by Metro. */
+    module?: any;
+    /** Remote URL to download from at runtime (stored persistently in FileSystem.documentDirectory). */
+    url?: string;
+    /** Already-resolved local file URI (e.g., file:///data/user/0/.../model.onnx). */
+    localUri?: string;
+}
+export interface FaceZkModelsConfig {
+    /** Face detection model – det_500m.onnx */
+    detection: ModelSource;
+    /** Face recognition / embedding model – w600k_mbf.onnx */
+    recognition: ModelSource;
+    /** Anti-spoof model – antispoof.onnx (optional; falls back to bundled) */
+    antispoof?: ModelSource;
+    /** Age/Gender model – genderage.onnx (optional) */
+    ageGender?: ModelSource;
+    /** ZK proof WASM binary – zk_face_wasm_bg.wasm (optional; falls back to bundled) */
+    wasm?: ModelSource;
+    /** ZK proof worker HTML – zk-worker.html (optional; falls back to bundled) */
+    zkWorkerHtml?: ModelSource;
+}
+export interface FaceZkFeaturesConfig {
+    /** Enable liveness / anti-spoof checks. Default: true */
+    liveness?: boolean;
+    /** Enable ZK proof generation. Default: true */
+    zk?: boolean;
+}
+/**
+ * Optional overrides for runtime WebView assets (HTML, JS bundles, WASM binaries).
+ * Every field defaults to the SDK's bundled copy when omitted.
+ *
+ * Use this to supply CDN-hosted or pre-downloaded versions of any asset so that
+ * the SDK ships without forcing Metro to bundle large files into the consumer app.
+ *
+ * Each field accepts the same `ModelSource` union as the model fields:
+ *   - `{ module: require('./myAsset.html') }` – Metro-bundled asset
+ *   - `{ url: 'https://cdn.example.com/v1/liveness.html' }` – downloaded & cached
+ *   - `{ localUri: 'file:///...' }` – pre-resolved on-device URI
+ */
+export interface FaceZkRuntimeAssetsConfig {
+    /** ort.min.js text content — inlined into the ONNX Runtime WebView */
+    ortJs?: ModelSource;
+    /** ort-wasm-simd.wasm binary — sent to the ONNX Runtime WebView as base64 */
+    ortWasm?: ModelSource;
+    /** liveness/index.html — the liveness WebView page */
+    livenessHtml?: ModelSource;
+    /** liveness/antispoof.js — anti-spoof inference script */
+    antispoofJs?: ModelSource;
+    /** liveness/liveness.js — liveness challenge script */
+    livenessJs?: ModelSource;
+    /** mediapipe/face_mesh.js — MediaPipe Face Mesh JS bundle */
+    mediapipeFaceMeshJs?: ModelSource;
+    /** mediapipe/face_mesh_solution_simd_wasm_bin.wasm — SIMD WASM binary */
+    mediapipeSimdWasm?: ModelSource;
+    /** mediapipe/face_mesh_solution_wasm_bin.wasm — non-SIMD WASM binary */
+    mediapipeWasm?: ModelSource;
+    /** mediapipe/face_mesh_solution_packed_assets.data — packed assets blob */
+    mediapipeData?: ModelSource;
+    /** face-guidance/index.html — the face pose guidance WebView page */
+    faceGuidanceHtml?: ModelSource;
+    /** face-guidance/pose-guidance.js — pose guidance script */
+    faceGuidancePoseJs?: ModelSource;
+    /** face-guidance/face-logic.js — face detection logic script */
+    faceGuidanceLogicJs?: ModelSource;
+}
+/**
+ * Config passed to `FaceZkSdk.init()` at app startup.
+ *
+ * @example – bundled assets (user copies models into their app)
+ * ```ts
+ * FaceZkSdk.init({
+ *   models: {
+ *     detection:    { module: require('./assets/face-zk/det_500m.onnx') },
+ *     recognition:  { module: require('./assets/face-zk/w600k_mbf.onnx') },
+ *   },
+ * })
+ * ```
+ *
+ * @example – CDN download (models fetched on first use)
+ * ```ts
+ * FaceZkSdk.init({
+ *   models: {
+ *     detection:   { url: 'https://cdn.example.com/face-zk/det_500m.onnx' },
+ *     recognition: { url: 'https://cdn.example.com/face-zk/w600k_mbf.onnx' },
+ *   },
+ * })
+ * ```
+ */
+export interface FaceZkConfig {
+    models: FaceZkModelsConfig;
+    /**
+     * Optional overrides for runtime WebView assets. Every field falls back to the
+     * SDK's bundled copy when omitted. See `FaceZkRuntimeAssetsConfig` for details.
+     */
+    runtimeAssets?: FaceZkRuntimeAssetsConfig;
+    features?: FaceZkFeaturesConfig;
+    /**
+     * Allowlist of hostnames that the SDK is permitted to download models from.
+     * Only applies to `ModelSource.url` entries — module and localUri sources
+     * are unaffected.
+     *
+     * When provided, any URL whose hostname is not in this list is rejected
+     * before a network request is made. Omitting this field disables the check
+     * (permissive — suitable for development; not recommended for production).
+     *
+     * @example
+     * allowedDomains: ["cdn.yourcompany.com"]
+     */
+    allowedDomains?: string[];
+}
+/**
+ * Shape of `face-zk.config.js` read by `npx face-zk setup`.
+ * This file is for developer tooling only – NOT read at runtime by the app.
+ *
+ * @example face-zk.config.js
+ * ```js
+ * module.exports = {
+ *   models: {
+ *     source: 'https://cdn.jmdt.io/face-zk/v1',
+ *     dest: './assets/face-zk/',
+ *   },
+ * }
+ * ```
+ */
+export interface FaceZkSetupConfig {
+    models: {
+        /** Base URL of the model CDN (no trailing slash). */
+        source: string;
+        /** Local directory to download models into (relative to project root). */
+        dest: string;
+        /** Override individual file names if your CDN uses different names. */
+        files?: {
+            detection?: string;
+            recognition?: string;
+            antispoof?: string;
+            ageGender?: string;
+            wasm?: string;
+            zkWorkerHtml?: string;
+        };
+    };
+    features?: FaceZkFeaturesConfig;
+}

package/dist/config/types.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Copyright 2026 JupiterMeta Labs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/core/enrollment-core.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Copyright 2026 JupiterMeta Labs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Face+ZK SDK – Enrollment Core
+ *
+ * Headless enrollment functions for creating reference templates from images.
+ * This module orchestrates the face embedding extraction and reference template creation.
+ */
+import type { ReferenceTemplate, EnrollmentOptions, FaceZkRuntimeConfig } from "./types";
+/**
+ * Interface for face embedding provider.
+ * This will be implemented by platform-specific adapters (e.g., wrapping faceRecognitionService).
+ */
+export interface FaceEmbeddingProvider {
+    /**
+     * Process an image and extract face embedding + pose.
+     *
+     * @param imageUri URI of the image to process
+     * @returns Result containing embedding, pose, and status
+     */
+    processImageForEmbedding(imageUri: string): Promise<{
+        status: "ok" | "no_face" | "multiple_faces" | "error";
+        embedding?: number[];
+        pose?: {
+            yaw: number;
+            pitch: number;
+            roll: number;
+        };
+        message?: string;
+        gender?: "Male" | "Female" | "Unknown";
+        age?: number;
+    }>;
+}
+/**
+ * Creates a reference template from an image URI to be used in future verification attempts.
+ *
+ * This is the primary enrollment function. It orchestrates:
+ * 1. Image processing to extract the facial embedding and head pose via the injected `FaceEmbeddingProvider`.
+ * 2. Creation of a `ReferenceTemplate` paired with a cryptographically safe `ReferenceId`.
+ * 3. Optional persistence of the template via the configured `StorageAdapter`.
+ *
+ * **Crypto/ZK Context:** The embedding generated here acts as the ground truth. When a user authenticates later, the ZK WASM circuit will prove that their live facial embedding matches this enrolled blueprint without storing the face image itself.
+ *
+ * @param {string} imageUri - URI of the reference image (e.g. `file://` or `content://`).
+ * @param {FaceZkRuntimeConfig} sdkConfig - Global SDK configuration requiring at least a working logger and optional storage adapter.
+ * @param {FaceEmbeddingProvider} embeddingProvider - The platform-specific adapter capable of running ONNX inference.
+ * @param {EnrollmentOptions} [options={}] - Options dictating metadata injection and whether to persist the result.
+ * @returns {Promise<ReferenceTemplate>} The enrolled identity containing the ID, embedding, and baseline pose.
+ * @throws {SdkError} Throws if no face is found, multiple faces are found, or pose estimation fails.
+ *
+ * @example
+ * const template = await createReferenceFromImage(
+ *   'file:///tmp/face.jpg', config, provider, { persist: true }
+ * );
+ * console.log(`Enrolled ID: ${template.referenceId}`);
+ */
+export declare function createReferenceFromImage(imageUri: string, sdkConfig: FaceZkRuntimeConfig, embeddingProvider: FaceEmbeddingProvider, options?: EnrollmentOptions): Promise<ReferenceTemplate>;

package/dist/core/enrollment-core.js

@@ -0,0 +1,206 @@
+"use strict";
+/**
+ * Copyright 2026 JupiterMeta Labs
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createReferenceFromImage = createReferenceFromImage;
+const types_1 = require("./types");
+const idGenerator_1 = require("./idGenerator");
+/**
+ * Creates a reference template from an image URI to be used in future verification attempts.
+ *
+ * This is the primary enrollment function. It orchestrates:
+ * 1. Image processing to extract the facial embedding and head pose via the injected `FaceEmbeddingProvider`.
+ * 2. Creation of a `ReferenceTemplate` paired with a cryptographically safe `ReferenceId`.
+ * 3. Optional persistence of the template via the configured `StorageAdapter`.
+ *
+ * **Crypto/ZK Context:** The embedding generated here acts as the ground truth. When a user authenticates later, the ZK WASM circuit will prove that their live facial embedding matches this enrolled blueprint without storing the face image itself.
+ *
+ * @param {string} imageUri - URI of the reference image (e.g. `file://` or `content://`).
+ * @param {FaceZkRuntimeConfig} sdkConfig - Global SDK configuration requiring at least a working logger and optional storage adapter.
+ * @param {FaceEmbeddingProvider} embeddingProvider - The platform-specific adapter capable of running ONNX inference.
+ * @param {EnrollmentOptions} [options={}] - Options dictating metadata injection and whether to persist the result.
+ * @returns {Promise<ReferenceTemplate>} The enrolled identity containing the ID, embedding, and baseline pose.
+ * @throws {SdkError} Throws if no face is found, multiple faces are found, or pose estimation fails.
+ *
+ * @example
+ * const template = await createReferenceFromImage(
+ *   'file:///tmp/face.jpg', config, provider, { persist: true }
+ * );
+ * console.log(`Enrolled ID: ${template.referenceId}`);
+ */
+async function createReferenceFromImage(imageUri, sdkConfig, embeddingProvider, options = {}) {
+    const { metadata, persist = false } = options;
+    // Log enrollment start
+    sdkConfig.onLog?.({
+        level: "info",
+        message: "Starting reference enrollment",
+        context: { imageUri, persist },
+    });
+    try {
+        // Step 1: Extract embedding + pose using the embedding provider
+        sdkConfig.onLog?.({
+            level: "debug",
+            message: "Extracting face embedding and pose",
+            context: { imageUri },
+        });
+        const result = await embeddingProvider.processImageForEmbedding(imageUri);
+        // Handle errors from embedding provider
+        if (result.status !== "ok") {
+            const errorCode = result.status === "no_face"
+                ? "NO_FACE"
+                : result.status === "multiple_faces"
+                    ? "MULTIPLE_FACES"
+                    : "SYSTEM_ERROR";
+            const error = {
+                code: errorCode,
+                message: result.message || `Face processing failed: ${result.status}`,
+                details: { stage: "embedding", status: result.status },
+            };
+            sdkConfig.onLog?.({
+                level: "error",
+                message: "Enrollment failed during face processing",
+                context: { ...error.details, code: error.code },
+            });
+            throw error;
+        }
+        // Validate that we have embedding
+        if (!result.embedding || result.embedding.length === 0) {
+            const error = {
+                code: "SYSTEM_ERROR",
+                message: "Face processing succeeded but missing or empty embedding",
+                details: {
+                    stage: "embedding",
+                    hasEmbedding: !!result.embedding,
+                    embeddingLength: result.embedding?.length || 0,
+                },
+            };
+            sdkConfig.onLog?.({
+                level: "error",
+                message: "Enrollment failed: missing embedding",
+                context: { ...error.details, code: error.code },
+            });
+            throw error;
+        }
+        // Validate that we have pose with all required fields
+        if (!result.pose ||
+            typeof result.pose.yaw !== "number" ||
+            typeof result.pose.pitch !== "number" ||
+            typeof result.pose.roll !== "number" ||
+            !isFinite(result.pose.yaw) ||
+            !isFinite(result.pose.pitch) ||
+            !isFinite(result.pose.roll)) {
+            const error = {
+                code: "SYSTEM_ERROR",
+                message: "Face processing succeeded but pose estimation failed or invalid",
+                details: {
+                    stage: "pose_estimation",
+                    hasPose: !!result.pose,
+                    pose: result.pose,
+                    reason: !result.pose
+                        ? "Pose object is null/undefined"
+                        : typeof result.pose.yaw !== "number"
+                            ? "Yaw is not a number"
+                            : typeof result.pose.pitch !== "number"
+                                ? "Pitch is not a number"
+                                : typeof result.pose.roll !== "number"
+                                    ? "Roll is not a number"
+                                    : !isFinite(result.pose.yaw) ||
+                                        !isFinite(result.pose.pitch) ||
+                                        !isFinite(result.pose.roll)
+                                        ? "Pose contains NaN or Infinity"
+                                        : "Unknown error",
+                },
+            };
+            sdkConfig.onLog?.({
+                level: "error",
+                message: "Enrollment failed: invalid pose",
+                context: { ...error.details, code: error.code },
+            });
+            throw error;
+        }
+        // Step 2: Build reference template
+        const referenceId = (0, idGenerator_1.generateReferenceId)();
+        const templateMetadata = {
+            ...(metadata ?? {}),
+            sdkResponse: {
+                gender: result.gender ?? "Unknown",
+                age: result.age ?? null,
+                embeddingGenerated: true,
+                pose: result.pose,
+            },
+        };
+        const template = {
+            referenceId,
+            embedding: result.embedding,
+            pose: result.pose,
+            metadata: templateMetadata,
+        };
+        sdkConfig.onLog?.({
+            level: "debug",
+            message: "Reference template created",
+            context: {
+                referenceId,
+                embeddingDim: result.embedding.length,
+                pose: result.pose,
+            },
+        });
+        // Step 3: Optionally persist via storage adapter
+        if (persist && sdkConfig.storage) {
+            sdkConfig.onLog?.({
+                level: "debug",
+                message: "Persisting reference template",
+                context: { referenceId },
+            });
+            await sdkConfig.storage.saveReference(template);
+            sdkConfig.onLog?.({
+                level: "info",
+                message: "Reference template persisted successfully",
+                context: { referenceId },
+            });
+        }
+        else if (persist && !sdkConfig.storage) {
+            sdkConfig.onLog?.({
+                level: "warn",
+                message: "Persist requested but no storage adapter configured, skipping persistence",
+                context: { referenceId },
+            });
+        }
+        sdkConfig.onLog?.({
+            level: "info",
+            message: "Reference enrollment completed successfully",
+            context: { referenceId },
+        });
+        return template;
+    }
+    catch (error) {
+        // Re-throw SdkError as-is
+        if ((0, types_1.isSdkError)(error)) {
+            throw error;
+        }
+        // Wrap unexpected errors
+        const sdkError = {
+            code: "SYSTEM_ERROR",
+            message: error instanceof Error ? error.message : "Unknown error",
+            details: { stage: "enrollment", originalError: String(error) },
+        };
+        sdkConfig.onLog?.({
+            level: "error",
+            message: "Unexpected error during enrollment",
+            context: { ...sdkError.details, code: sdkError.code },
+        });
+        throw sdkError;
+    }
+}

package/dist/core/idGenerator.d.ts

@@ -0,0 +1,11 @@
+import type { ReferenceId } from "./types";
+/**
+ * Generates a unique reference ID using platform-native crypto.
+ * Format: ref_<12-char-ms-timestamp-hex>_<20-char-random-hex>
+ *
+ * Uses crypto.getRandomValues() — available natively in:
+ * - Node.js 15.7+ (Jest test environment)
+ * - All modern browsers
+ * - Hermes (React Native 0.71+) — no polyfill required
+ */
+export declare function generateReferenceId(): ReferenceId;

package/dist/core/idGenerator.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateReferenceId = generateReferenceId;
+/**
+ * Generates a unique reference ID using platform-native crypto.
+ * Format: ref_<12-char-ms-timestamp-hex>_<20-char-random-hex>
+ *
+ * Uses crypto.getRandomValues() — available natively in:
+ * - Node.js 15.7+ (Jest test environment)
+ * - All modern browsers
+ * - Hermes (React Native 0.71+) — no polyfill required
+ */
+function generateReferenceId() {
+    const tsHex = Date.now().toString(16).padStart(12, "0");
+    const randomBytes = new Uint8Array(10);
+    const cryptoApi = typeof globalThis !== "undefined" &&
+        globalThis.crypto &&
+        typeof globalThis.crypto.getRandomValues === "function"
+        ? globalThis.crypto
+        : undefined;
+    if (cryptoApi) {
+        cryptoApi.getRandomValues(randomBytes);
+    }
+    else {
+        // Fallback for runtimes where Web Crypto is unavailable.
+        for (let i = 0; i < randomBytes.length; i += 1) {
+            randomBytes[i] = Math.floor(Math.random() * 256);
+        }
+    }
+    const randomHex = Array.from(randomBytes, (b) => b.toString(16).padStart(2, "0")).join("");
+    return `ref_${tsHex}_${randomHex}`;
+}