@myazahq/kyc-sdk-react-native 2.4.0 → 2.6.0

package/src/services/uploadErrors.ts

@@ -0,0 +1,30 @@
+import { KYCApiError } from './api';
+import { UPLOAD_HINT } from '../config/uploadLimits';
+
+// ---------------------------------------------------------------------------
+// Why an upload failed, in words the person can act on.
+//
+// Every upload used to fail as "we could not upload that document", which tells
+// the applicant nothing about whether to pick a smaller file, a different
+// format, or simply try again on better signal. The server already says which
+// it is; this reads its answer and hands back the sentence that matches.
+// ---------------------------------------------------------------------------
+
+/** The refusal, as something the applicant can do something about. */
+export function uploadFailureMessage(error: unknown): string {
+  const status = error instanceof KYCApiError ? error.statusCode : null;
+  const raw = error instanceof Error ? error.message.toLowerCase() : '';
+
+  if (status === 413 || raw.includes('too large')) {
+    return `That file is too large. ${UPLOAD_HINT}`;
+  }
+  if (raw.includes('mimetype') || raw.includes('mime type') || raw.includes('unsupported')) {
+    return `That file type is not supported. ${UPLOAD_HINT}`;
+  }
+  // A 4xx we have no better words for still says the file is the problem, so
+  // the person retries with a DIFFERENT one rather than the same one twice.
+  if (status !== null && status >= 400 && status < 500) {
+    return `We could not read that file. ${UPLOAD_HINT}`;
+  }
+  return 'We could not upload that document. Please check your connection and try again.';
+}

package/src/services/workflowGate.ts

@@ -102,6 +102,14 @@ export async function resolveWorkflow(
         status: 'ready',
         idTypes: res.idTypes,
         branding: res.branding,
+        geoCountry: res.geoCountry,
+        // The resolution route does not serve these yet, so a workflow mount
+        // reads undefined and the address flow offers no search screen. That
+        // degrades correctly, and the passthrough means it starts working the
+        // day the server carries them.
+        addressSearch: res.addressSearch,
+        addressSearchMode: res.addressSearchMode,
+        mapsFrameUrl: res.mapsFrameUrl ?? null,
         environment: res.environment,
         fatal: false,
       },

package/src/specs/MyazaFaceDetector.nitro.ts

@@ -51,4 +51,33 @@ export interface MyazaFaceDetector extends HybridObject<{ ios: 'swift'; android:
    * `faceCount: 0` when no face is present.
    */
   detectFace(frame: Frame): FaceResult;
+
+  /**
+   * Whether the detector can run RIGHT NOW.
+   *
+   * Android fetches its model through Google Play Services rather than bundling
+   * it (see android/build.gradle), so there is a window — first launch, or a
+   * device with no GMS at all — where detection cannot work. This MUST be
+   * checked before the camera opens: `detectFace` can only answer in
+   * `FaceResult`, where "model missing" and "no face in frame" are the same
+   * `faceCount: 0`, so relying on it would leave the user staring at
+   * "position your face" forever with nothing to explain why.
+   *
+   * iOS is always true — Apple Vision is a system framework with nothing to
+   * fetch.
+   */
+  isModelReady(): boolean;
+
+  /**
+   * Ask Play Services to download the model, resolving `true` once it is usable
+   * and `false` if it cannot be obtained (no GMS, no network, user declined).
+   *
+   * Call this EARLY — the SDK primes it at flow start, so the download overlaps
+   * the consent and ID-type screens and the model is warm by the time liveness
+   * runs. This mirrors the web SDK, which calls `primeFaceMesh()` on mount for
+   * exactly the same reason.
+   *
+   * Safe to call repeatedly; resolves immediately when already ready.
+   */
+  prepareModel(): Promise<boolean>;
 }

package/src/store/address.ts

@@ -0,0 +1,97 @@
+import type { AddressState } from './state';
+
+// ---------------------------------------------------------------------------
+// Restoring a saved address pin.
+//
+// The whole address object is written into session progress verbatim, so the
+// snapshot was written by WHATEVER build saved it: coerce every field back to
+// its declared type and degrade to restoring less, never to breaking the flow.
+//
+// Deliberately does NOT restore the device fix (deviceLat / deviceLng /
+// deviceAccuracy / capturedAt). That is the attest-presence reading, and it is
+// taken fresh at confirm — a stale one would claim the applicant stood at the
+// address on a day they did not.
+//
+// Split from session.ts per the 200-line rule. A MIRROR of the web SDK's
+// RESTORE_PROGRESS address branch and the Flutter port.
+// ---------------------------------------------------------------------------
+
+function str(v: unknown): string | null {
+  return typeof v === 'string' ? v : null;
+}
+
+/** The `parts` breakdown, when the snapshot carries an object for it. */
+function restoreParts(v: unknown): Pick<AddressState, 'parts'> {
+  if (!v || typeof v !== 'object') return {};
+  const p = v as Record<string, unknown>;
+  return {
+    parts: {
+      street: str(p['street']),
+      area: str(p['area']),
+      city: str(p['city']),
+      state: str(p['state']),
+      postcode: str(p['postcode']),
+      country: str(p['country']),
+    },
+  };
+}
+
+/** The picked-label anchor, only when it is a real coordinate pair. */
+function restorePickedAt(v: unknown): Pick<AddressState, 'pickedAt'> {
+  if (!v || typeof v !== 'object') return {};
+  const p = v as Record<string, unknown>;
+  return typeof p['lat'] === 'number' && typeof p['lng'] === 'number'
+    ? { pickedAt: { lat: p['lat'], lng: p['lng'] } }
+    : {};
+}
+
+/** The Street View frame, only when every field of it survived. A partial
+ *  frame cannot be re-rendered, and half of one is not a capture. */
+function restoreStreetView(v: unknown): Pick<AddressState, 'streetView'> {
+  if (!v || typeof v !== 'object') return {};
+  const sv = v as Record<string, unknown>;
+  return typeof sv['panoId'] === 'string' &&
+    typeof sv['heading'] === 'number' &&
+    typeof sv['pitch'] === 'number' &&
+    typeof sv['fov'] === 'number'
+    ? {
+        streetView: {
+          panoId: sv['panoId'],
+          heading: sv['heading'],
+          pitch: sv['pitch'],
+          fov: sv['fov'],
+        },
+      }
+    : {};
+}
+
+/**
+ * Rebuild the address from a progress snapshot. The caller has already checked
+ * that `lat` and `lng` are numbers — without those there is no pin, and there
+ * is nothing to restore.
+ */
+export function restoreAddress(a: Record<string, unknown>): AddressState {
+  return {
+    lat: a['lat'] as number,
+    lng: a['lng'] as number,
+    accuracy: typeof a['accuracy'] === 'number' ? a['accuracy'] : null,
+    directions: typeof a['directions'] === 'string' ? a['directions'] : '',
+    propertyName: typeof a['propertyName'] === 'string' ? a['propertyName'] : '',
+    propertyNumber: typeof a['propertyNumber'] === 'string' ? a['propertyNumber'] : '',
+    // The resolved line and its breakdown survive a restart too. Dropping them
+    // is why a resumed session showed raw coordinates where the applicant had
+    // picked an address.
+    ...(typeof a['label'] === 'string' ? { label: a['label'] } : {}),
+    ...(typeof a['street'] === 'string' ? { street: a['street'] } : {}),
+    // The edit-details claims survive a restart like every other typed field.
+    ...(typeof a['unit'] === 'string' ? { unit: a['unit'] } : {}),
+    ...(typeof a['neighbourhood'] === 'string' ? { neighbourhood: a['neighbourhood'] } : {}),
+    ...(typeof a['city'] === 'string' ? { city: a['city'] } : {}),
+    ...(typeof a['state'] === 'string' ? { state: a['state'] } : {}),
+    ...(typeof a['postcode'] === 'string' ? { postcode: a['postcode'] } : {}),
+    ...(a['labelKept'] === true ? { labelKept: true } : {}),
+    ...restorePickedAt(a['pickedAt']),
+    ...restoreParts(a['parts']),
+    ...restoreStreetView(a['streetView']),
+  };
+}

package/src/store/businessCheck.ts

@@ -0,0 +1,113 @@
+import type { BusinessCheckResult, KycState } from './state';
+import { EMPTY_BUSINESS_CHECK } from './state';
+
+// ---------------------------------------------------------------------------
+// The paid registry check at SELECTION, split from kycStore.ts (200-line rule).
+//
+// Run when the applicant confirms their company, so the register answers
+// BEFORE the details screen asks them to confirm what it said — and its key
+// people arrive before that step asks for them. Only a definitive "not on the
+// register" stops the flow: everything else (a short balance, an outage, a
+// spent lookup budget) continues and is checked at submission, exactly as it
+// was before this existed. Mirrors the web SDK's useBusinessCheck — keep the
+// two in lockstep.
+// ---------------------------------------------------------------------------
+
+type Set = (partial: Partial<KycState> | ((s: KycState) => Partial<KycState>)) => void;
+
+export async function runBusinessCheck(
+  get: () => KycState,
+  set: Set,
+): Promise<BusinessCheckResult> {
+  const s = get();
+  const registrationNumber = s.business.registrationNumber?.trim();
+  if (!registrationNumber) return { canContinue: true, company: null };
+
+  // Already checked this exact company — do not pay to be told again.
+  //
+  // Only a SETTLED answer is reused. 'unavailable' is deliberately not one: an
+  // outage said nothing about the company, so a repeat press retries the
+  // register rather than replaying the outage. And a remembered answer keeps
+  // its meaning — a stored not_found still blocks.
+  const normalized = registrationNumber.toUpperCase();
+  const settled =
+    s.businessCheck.status !== 'idle' &&
+    s.businessCheck.status !== 'checking' &&
+    s.businessCheck.status !== 'unavailable';
+  if (s.businessCheck.checkedNumber === normalized && settled) {
+    return {
+      canContinue: s.businessCheck.status !== 'not_found',
+      company: s.businessCheck.company,
+    };
+  }
+
+  // No session means no anchor for the charge, so there is nothing to run
+  // against. The check happens at submission, exactly as it did before.
+  if (!s.sessionId) return { canContinue: true, company: null };
+
+  set((cur) => ({
+    businessCheck: { ...cur.businessCheck, status: 'checking', checkedNumber: normalized },
+  }));
+  try {
+    const res = await s.api.businessSelect({
+      sessionId: s.sessionId,
+      country: s.business.country || s.config.business?.country || '',
+      ...(s.business.subdivisionCode.trim()
+        ? { subdivisionCode: s.business.subdivisionCode.trim() }
+        : {}),
+      ...(s.business.registrationName.trim()
+        ? { registrationName: s.business.registrationName.trim() }
+        : {}),
+      ...(s.business.product ? { product: s.business.product } : {}),
+      registrationNumber,
+    });
+
+    if (!res.checked) {
+      // The organisation could not be charged. Not the applicant's problem and
+      // not something they can fix, so it is not shown as an error — the flow
+      // continues and the check runs at submission. `lookup_limit_reached` is
+      // the one they DID cause, by re-picking company after company, and the
+      // one they can act on: check the number rather than keep trying.
+      set((cur) => ({
+        businessCheck: {
+          ...cur.businessCheck,
+          status: res.reason === 'lookup_limit_reached' ? 'limit_reached' : 'skipped',
+        },
+      }));
+      return { canContinue: true, company: null };
+    }
+
+    if (!res.found) {
+      // A definitive "not on the register" is worth stopping for: continuing
+      // would spend the applicant's time on documents for a company that will
+      // fail anyway.
+      set((cur) => ({
+        businessCheck: { ...cur.businessCheck, status: 'not_found', company: null, officers: [] },
+      }));
+      return { canContinue: false, company: null };
+    }
+
+    const { keyPeople, ...company } = res.business!;
+    set((cur) => ({
+      businessCheck: {
+        ...cur.businessCheck,
+        status: 'found',
+        company,
+        officers: keyPeople ?? [],
+      },
+    }));
+    return { canContinue: true, company };
+  } catch {
+    // A register outage is NOT "this company does not exist" — telling the
+    // applicant their business is unregistered on the strength of a 503 is the
+    // one wrong answer here. Retryable, and it never blocks: the check still
+    // happens at submission.
+    set((cur) => ({ businessCheck: { ...cur.businessCheck, status: 'unavailable' } }));
+    return { canContinue: true, company: null };
+  }
+}
+
+/** Back to square one — called when WHICH company this is about changes. */
+export function resetBusinessCheck(set: Set): void {
+  set({ businessCheck: { ...EMPTY_BUSINESS_CHECK } });
+}

package/src/store/derive.ts

@@ -7,14 +7,19 @@
 // keeps a single answer to each of those questions.
 // ---------------------------------------------------------------------------
 
+import { configScope } from '../lib/scope';
 import { requiresDocumentCapture, supportsNfcChip } from '../config/idTypes';
 import {
+  buildStepOrder,
   getStepProgress,
   nextStepInOrder,
   previousStepInOrder,
   type StepOrderOptions,
 } from '../config/stepOrder';
 import { hasProofOfAddressStep } from '../config/proofOfAddress';
+import { addressFlowFor, hasAddressCollectionStep } from '../config/addressCollection';
+import { webViewAvailable } from '../lib/webview-available';
+import { addressVendorsStubbed } from '../lib/address-flow';
 import { businessProductsForCountry, isBusinessFlow } from '../config/business';
 import {
   hasApplicantVerification,
@@ -22,6 +27,7 @@ import {
   hasKeyPeopleCollection,
 } from '../config/businessSteps';
 import { hasActiveQuestionnaire } from '../config/questionnaire';
+import { hasConsentStep, openingStepOf } from '../config/consentStep';
 import { applicantSelfCountry, keyPeoplePayload } from '../config/keyPeople';
 import { featuresFor } from './serverConfig';
 import type { VerifyRequest } from '../services/api';
@@ -58,6 +64,7 @@ export function stepOrderOptions(state: KycState): StepOrderOptions {
   const idType = state.selectedIdType;
   return {
     isBusiness: isBusinessFlow(config),
+    scope: configScope(config),
     business: config.business,
     hasDocCapture: idType ? requiresDocumentCapture(idType) : true,
     hasNfc: nfcEnabled(state),
@@ -72,10 +79,25 @@ export function stepOrderOptions(state: KycState): StepOrderOptions {
     hasCountrySelect:
       countrySelectOptions(state).length > 1 &&
       applicantSelfCountry(state.businessApplication) === null,
+    hasConsent: hasConsentStep(config),
     hasEmailVerification: config.emailVerification?.enabled === true,
     hasPhoneVerification: config.phoneVerification?.enabled === true,
     hasPoa: hasProofOfAddressStep(config.proofOfAddress),
+    hasAddressCollection: hasAddressCollectionStep(config.addressCollection),
+    // An absent search flag means no search SCREEN, never an error: the
+    // applicant places the pin by hand, the fallback every address failure
+    // degrades to.
+    addressFlow: addressFlowFor(
+      config,
+      state.serverConfig.addressSearch === true,
+      addressVendorsStubbed({ environment: state.serverConfig.environment }),
+      Boolean(state.serverConfig.mapsFrameUrl) && webViewAvailable(),
+    ),
     hasQuestionnaire: hasActiveQuestionnaire(config.questionnaire),
+    // Present only on a session a reviewer sent back. Narrows the order to the
+    // steps they ticked, so somebody fixing one blurry photo is not walked
+    // through the whole flow again.
+    resubmit: config.resubmit,
   };
 }
 
@@ -148,6 +170,15 @@ export function businessSubmission(state: KycState): {
       ...(text(b.email) ? { email: text(b.email) } : {}),
       ...(text(b.phone) ? { phone: text(b.phone) } : {}),
       ...(text(b.website) ? { website: text(b.website) } : {}),
+      // The five registry facts, sent only when filled. The server drops any
+      // the workflow has switched off, so an over-send is validate-and-drop
+      // rather than an error, and an under-send is what the required-field
+      // 422 is for.
+      ...(text(b.dateOfIncorporation) ? { dateOfIncorporation: text(b.dateOfIncorporation) } : {}),
+      ...(text(b.taxId) ? { taxId: text(b.taxId) } : {}),
+      ...(text(b.vatNumber) ? { vatNumber: text(b.vatNumber) } : {}),
+      ...(text(b.companyType) ? { companyType: text(b.companyType) } : {}),
+      ...(text(b.natureOfBusiness) ? { natureOfBusiness: text(b.natureOfBusiness) } : {}),
       // Extras ride along ONLY when the workflow configures them — the server
       // ignores an unconfigured block, but sending one is a claim we did not
       // collect properly.
@@ -155,6 +186,8 @@ export function businessSubmission(state: KycState): {
         ? { documents: app.documents.map((d) => ({ type: d.type, mediaId: d.mediaId })) }
         : {}),
       ...(hasKeyPeopleCollection(config) && people.length > 0 ? { keyPeople: people } : {}),
+      // The FATF fallback, attested: no natural person qualifies as a UBO.
+      ...(app.uboUnidentifiable ? { uboUnidentifiable: true } : {}),
       ...(hasApplicantVerification(config) && app.applicantRole
         ? {
             applicant: {
@@ -222,11 +255,18 @@ export function previousStepBefore(step: KYCStep, state: KycState): KYCStep {
   return previousStepInOrder(step, stepOrderOptions(state));
 }
 
+/**
+ * The step this flow OPENS on: 'consent', or the first real step when the
+ * workflow switched the consent screen off (`consentStep: false`). The store
+ * starts and resets here, the progress watcher judges "untouched" against it,
+ * and the flow hides Back on it. Never depends on anything the applicant has
+ * yet to choose: only later steps do.
+ */
+export function openingStep(state: KycState): KYCStep {
+  return openingStepOf(buildStepOrder(stepOrderOptions(state)));
+}
+
 /** Percentage complete, for the sheet's progress indicator. */
 export function stepProgress(step: KYCStep, state: KycState): number {
   return getStepProgress(step, stepOrderOptions(state));
 }
-
-// ---------------------------------------------------------------------------
-// Store factory
-// ---------------------------------------------------------------------------