@smileid/usesmileid 12.0.0-beta01 → 12.0.0

package/src/data/compression/__tests__/payload_compressor_real_jpeg.test.ts

@@ -0,0 +1,222 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import * as jpeg from "jpeg-js";
+
+/**
+ * Integration tests that drive the compressor through `UriCompressibleAsset` with real
+ * JPEG bytes — the actual preserve-source / re-encode / rewrite-in-place path — instead
+ * of the linear in-memory fake used by the unit suite. The native seams are replaced by
+ * stateful mocks backed by an in-memory file store and the pure-JS `jpeg-js` codec, so
+ * the quality→size curve is a real JPEG curve (the on-device encoder is
+ * `expo-image-manipulator`, which cannot run under Node). Deterministic RGB noise is the
+ * JPEG worst case (no spatial redundancy), so it inflates the bundle well past the caps
+ * at capture quality and exercises the full quality-step loop.
+ */
+
+// In-memory file store shared by the expo-file-system and expo-image-manipulator mocks.
+const fileStore = new Map<string, Buffer>();
+let renderCounter = 0;
+
+vi.mock("expo-file-system", () => {
+  class File {
+    constructor(readonly uri: string) {}
+    get exists(): boolean {
+      return fileStore.has(this.uri);
+    }
+    get size(): number {
+      return fileStore.get(this.uri)?.length ?? 0;
+    }
+    copy(destination: File): void {
+      const bytes = fileStore.get(this.uri);
+      if (!bytes) throw new Error(`copy: missing ${this.uri}`);
+      fileStore.set(destination.uri, bytes);
+    }
+    delete(): void {
+      fileStore.delete(this.uri);
+    }
+    move(destination: File): void {
+      const bytes = fileStore.get(this.uri);
+      if (!bytes) throw new Error(`move: missing ${this.uri}`);
+      fileStore.set(destination.uri, bytes);
+      fileStore.delete(this.uri);
+    }
+  }
+  return { __esModule: true, File };
+});
+
+vi.mock("expo-image-manipulator", () => ({
+  __esModule: true,
+  SaveFormat: { JPEG: "jpeg" },
+  ImageManipulator: {
+    manipulate: (uri: string) => ({
+      renderAsync: async () => ({
+        saveAsync: async (options: { compress: number }) => {
+          const source = fileStore.get(uri);
+          if (!source) throw new Error(`manipulate: missing ${uri}`);
+          const decoded = jpeg.decode(source, { useTArray: true });
+          const quality = Math.max(1, Math.round(options.compress * 100));
+          const encoded = jpeg.encode(
+            {
+              data: decoded.data,
+              width: decoded.width,
+              height: decoded.height,
+            },
+            quality,
+          );
+          const outUri = `file:///render/${renderCounter++}.jpg`;
+          fileStore.set(outUri, Buffer.from(encoded.data));
+          return { uri: outUri };
+        },
+      }),
+    }),
+  },
+}));
+
+vi.mock("@smileid/usesmileid_bridge/src/exif/smile_exif_tagger", () => ({
+  __esModule: true,
+  SmileExifTagger: { finalize: vi.fn(async () => undefined) },
+}));
+
+import { ImageType } from "@smileid/usesmileid_bridge";
+
+import { CompressibleAssets } from "../compressible_asset";
+import {
+  base64Len,
+  PayloadCompressionConfig,
+} from "../payload_compression_config";
+import { PayloadCompressionRunner } from "../payload_compression_runner";
+import { PayloadCompressor } from "../payload_compressor";
+import { UriCompressibleAsset } from "../uri_compressible_asset";
+
+/** Deterministic RGBA noise encoded as a real JPEG at `quality`, stored at `uri`. */
+function writeNoiseJpeg(
+  uri: string,
+  width: number,
+  height: number,
+  quality: number,
+): void {
+  let state = 42n;
+  const data = Buffer.alloc(width * height * 4);
+  for (let index = 0; index < data.length; index += 1) {
+    state =
+      (state * 6364136223846793005n + 1442695040888963407n) &
+      0xffffffffffffffffn;
+    data[index] = (index + 1) % 4 === 0 ? 255 : Number((state >> 33n) & 0xffn);
+  }
+  const encoded = jpeg.encode({ data, width, height }, quality);
+  fileStore.set(uri, Buffer.from(encoded.data));
+}
+
+function storedSize(uri: string): number {
+  return fileStore.get(uri)?.length ?? 0;
+}
+
+function decodable(uri: string): { width: number; height: number } {
+  const bytes = fileStore.get(uri);
+  if (!bytes) throw new Error(`missing ${uri}`);
+  const decoded = jpeg.decode(bytes, { useTArray: true });
+  return { width: decoded.width, height: decoded.height };
+}
+
+describe("PayloadCompressor with real JPEG bytes", () => {
+  beforeEach(() => {
+    fileStore.clear();
+    renderCounter = 0;
+  });
+
+  it(
+    "compresses an inflated selfie+liveness bundle under the caps and keeps files decodable",
+    { timeout: 120_000 },
+    async () => {
+      const selfieUri = "file:///capture/selfie.jpg";
+      const livenessUri = "file:///capture/liveness.jpg";
+      writeNoiseJpeg(selfieUri, 1800, 1350, 95);
+      writeNoiseJpeg(livenessUri, 1400, 1050, 95);
+      const metadataBytes = 200 * 1024;
+
+      const initialRaw =
+        storedSize(selfieUri) + storedSize(livenessUri) + metadataBytes;
+      // Precondition: the bundle genuinely exceeds the 4.0 MiB target (the ticket's
+      // artificially inflated payload).
+      expect(initialRaw).toBeGreaterThan(PayloadCompressionConfig.rawTarget);
+
+      const sizes = await PayloadCompressionRunner.compress({
+        selfieImage: selfieUri,
+        livenessImages: [livenessUri],
+        metadataBytes,
+      });
+
+      const finalRaw =
+        storedSize(selfieUri) + storedSize(livenessUri) + metadataBytes;
+      const finalProjected =
+        base64Len(storedSize(selfieUri)) +
+        base64Len(storedSize(livenessUri)) +
+        metadataBytes +
+        PayloadCompressionConfig.structuralOverheadBytes;
+
+      expect(finalRaw).toBeLessThanOrEqual(PayloadCompressionConfig.rawTarget);
+      expect(finalProjected).toBeLessThanOrEqual(
+        PayloadCompressionConfig.hardEncodedCap,
+      );
+
+      // The rewritten bytes are still valid JPEGs at the original dimensions
+      // (quality-only re-encode, no resample).
+      expect(decodable(selfieUri)).toEqual({ width: 1800, height: 1350 });
+      expect(decodable(livenessUri)).toEqual({ width: 1400, height: 1050 });
+
+      // Reported size metadata reflects the shrink.
+      expect(sizes.selfieOriginalMb).toBeDefined();
+      expect(sizes.selfieFinalMb).toBeDefined();
+      expect(sizes.selfieFinalMb!).toBeLessThan(sizes.selfieOriginalMb!);
+    },
+  );
+
+  it(
+    "compresses a document-heavy bundle back-first and lands under the guarantee caps",
+    { timeout: 120_000 },
+    async () => {
+      const frontUri = "file:///capture/front.jpg";
+      const backUri = "file:///capture/back.jpg";
+      writeNoiseJpeg(frontUri, 1900, 1425, 95);
+      writeNoiseJpeg(backUri, 1900, 1425, 95);
+      const metadataBytes = 100 * 1024;
+
+      const front = new UriCompressibleAsset(
+        ImageType.DocumentFront,
+        frontUri,
+        0.95,
+      );
+      const back = new UriCompressibleAsset(
+        ImageType.DocumentBack,
+        backUri,
+        0.95,
+      );
+      const assets = new CompressibleAssets({
+        documentFront: front,
+        documentBack: back,
+      });
+
+      // Precondition: combined documents exceed the 4 MiB Rule-A trigger.
+      expect(assets.documentCombinedSize()).toBeGreaterThan(
+        PayloadCompressionConfig.docCombinedTrigger,
+      );
+
+      await PayloadCompressor.prepareBundleForTransmission(
+        assets,
+        metadataBytes,
+      );
+
+      // Back is compressed before front, so it never ends at a higher quality.
+      expect(back.quality()).toBeLessThanOrEqual(front.quality());
+      expect(
+        PayloadCompressor.rawBundleSize(assets, metadataBytes),
+      ).toBeLessThanOrEqual(PayloadCompressionConfig.rawFallback);
+      expect(
+        PayloadCompressor.projectedEncodedSize(assets, metadataBytes),
+      ).toBeLessThanOrEqual(PayloadCompressionConfig.hardEncodedCap);
+
+      // Both documents survive as decodable JPEGs.
+      expect(decodable(frontUri)).toEqual({ width: 1900, height: 1425 });
+      expect(decodable(backUri)).toEqual({ width: 1900, height: 1425 });
+    },
+  );
+});

package/src/data/compression/compressible_asset.ts

@@ -0,0 +1,62 @@
+import type { ImageTypeId } from "@smileid/usesmileid_bridge";
+
+/**
+ * A single compressible image, abstracted so the orchestration logic (`PayloadCompressor`) is
+ * pure and unit-testable with in-memory fakes — the real implementation re-encodes the JPEG via
+ * a native module and re-stamps the Smile EXIF `image_digest` the backend validates.
+ *
+ * Contract: `recompress` **must re-encode from the retained source pixels**, never from the
+ * already-compressed bytes, so repeated steps don't stack generational loss and retries are
+ * deterministic. It is asynchronous because the encode/re-stamp delegates to native code.
+ */
+export interface CompressibleAsset {
+  /** The image's wire type — also the EXIF re-stamp's `image_type_id`. */
+  readonly imageType: ImageTypeId;
+  /** Current encoded JPEG size in bytes. */
+  encodedSize(): number;
+  /** Current re-encode quality in `[0, 1]`. Reports the capture quality before any recompress. */
+  quality(): number;
+  /** Re-encode from the retained source at `quality` (caller clamps to the floor). */
+  recompress(quality: number): Promise<void>;
+}
+
+/**
+ * The full set of images in one submission. Any role may be absent (e.g. SmartSelfie has no
+ * documents; Enhanced KYC has no images at all → the compressor is a no-op).
+ */
+export class CompressibleAssets {
+  readonly selfie: CompressibleAsset | undefined;
+  readonly liveness: readonly CompressibleAsset[];
+  readonly documentFront: CompressibleAsset | undefined;
+  readonly documentBack: CompressibleAsset | undefined;
+
+  constructor(args: {
+    selfie?: CompressibleAsset | undefined;
+    liveness?: readonly CompressibleAsset[] | undefined;
+    documentFront?: CompressibleAsset | undefined;
+    documentBack?: CompressibleAsset | undefined;
+  }) {
+    this.selfie = args.selfie;
+    this.liveness = args.liveness ?? [];
+    this.documentFront = args.documentFront;
+    this.documentBack = args.documentBack;
+  }
+
+  /** All present assets, in submission order. */
+  all(): CompressibleAsset[] {
+    const result: CompressibleAsset[] = [];
+    if (this.selfie) result.push(this.selfie);
+    result.push(...this.liveness);
+    if (this.documentFront) result.push(this.documentFront);
+    if (this.documentBack) result.push(this.documentBack);
+    return result;
+  }
+
+  /** Combined size of the front + back document images (0 when neither is present). */
+  documentCombinedSize(): number {
+    return (
+      (this.documentFront?.encodedSize() ?? 0) +
+      (this.documentBack?.encodedSize() ?? 0)
+    );
+  }
+}

package/src/data/compression/payload_compression_config.ts

@@ -0,0 +1,53 @@
+/**
+ * Shared byte-size guardrails and adaptive JPEG-compression constants for keeping a v3
+ * form-data submission under AWS Lambda's 6 MB synchronous payload limit.
+ *
+ * **Cross-SDK source of truth** — the same thresholds, order, floors, and {@link base64Len}
+ * formula are mirrored byte-for-byte in the Android, iOS, and Flutter SDKs. Do not diverge any
+ * value without updating all four platforms.
+ *
+ * Lambda sees the **base64-encoded** body forwarded by API Gateway (base64 expands binary by
+ * ~33%), so the real guardrail is `PayloadCompressor.projectedEncodedSize` against
+ * `hardEncodedCap` — not raw bytes. Units are **binary MB (MiB, 1 << 20)**, locked across all
+ * four SDKs.
+ */
+const BYTES_PER_MB = 1 << 20;
+
+export const PayloadCompressionConfig = {
+  /** 1 MiB. Binary MB is the locked cross-SDK unit. */
+  bytesPerMB: BYTES_PER_MB,
+  /** Primary compression goal for the raw bundle. */
+  rawTarget: 4 * BYTES_PER_MB,
+  /** Relaxed raw ceiling, accepted only if the projected encoded size still fits the cap. */
+  rawFallback: 4 * BYTES_PER_MB + BYTES_PER_MB / 2, // 4.5 MiB
+  /** The real guardrail: projected base64-encoded body must stay under this (margin under 6 MB). */
+  hardEncodedCap: Math.floor((57 * BYTES_PER_MB) / 10), // 5.7 MiB
+  /** Rule A trigger: combined document images larger than this start the document sub-pass. */
+  docCombinedTrigger: 4 * BYTES_PER_MB,
+  /** Rule A sub-target: pull the combined documents under this (back first, then front). */
+  docCombinedTarget: 3 * BYTES_PER_MB,
+  /** Rule B trigger: a selfie larger than this marks a face-heavy job (faces compressed first). */
+  selfieTrigger: 1 * BYTES_PER_MB,
+  /** Minimum JPEG quality for face images (selfie + liveness) — higher penalty. Pending DS sign-off. */
+  faceMinQ: 0.45,
+  /** Minimum JPEG quality for document images — preserves OCR / MRZ. Pending DS sign-off. */
+  docMinQ: 0.7,
+  /**
+   * Absolute JPEG-quality floor for the hard-guarantee pass. When a bundle is still over
+   * `rawFallback` after every image has hit its per-type floor (`faceMinQ` / `docMinQ`), the
+   * guarantee pass keeps stepping quality down to this value — below the per-type floors — so an
+   * oversized capture never fails submission on size. Matches v11's quality-10 floor.
+   */
+  absoluteMinQ: 0.1,
+  /** Quality decrement per re-encode step. */
+  qualityStep: 0.05,
+  /** Nominal re-encode start point; each asset steps down from its own capture quality. */
+  startQ: 0.9,
+  /** Fixed allowance for multipart field names + part framing not counted in image/metadata totals. */
+  structuralOverheadBytes: 2048,
+} as const;
+
+/** base64 length of `n` raw bytes: `ceil(n / 3) * 4`. */
+export function base64Len(n: number): number {
+  return Math.ceil(n / 3) * 4;
+}

package/src/data/compression/payload_compression_runner.ts

@@ -0,0 +1,102 @@
+import { File } from "expo-file-system";
+import { ImageType } from "@smileid/usesmileid_bridge";
+
+import { CameraDefaults } from "../../camera/camera_defaults";
+import { CompressibleAssets } from "./compressible_asset";
+import { PayloadCompressor } from "./payload_compressor";
+import { UriCompressibleAsset } from "./uri_compressible_asset";
+
+// RN `CameraDefaults` only exposes the document JPEG quality; selfie/liveness capture quality
+// match the cross-SDK values. These seed only the recompress start, which steps DOWN from here
+// (never re-encoding above the capture quality, which would inflate).
+const SELFIE_CAPTURE_QUALITY = 0.95;
+const LIVENESS_CAPTURE_QUALITY = 0.8;
+
+const BYTES_PER_MB = 1024 * 1024;
+
+/**
+ * Per-role JPEG sizes in MB, measured before compression (`*Original`) and after (`*Final`); equal
+ * when the image was not compressed, `undefined` for an absent role. Stamped into the submission
+ * metadata so the backend sees each file's original size and its compressed size.
+ */
+export interface PayloadCompressionSizes {
+  readonly selfieOriginalMb?: number | undefined;
+  readonly selfieFinalMb?: number | undefined;
+  readonly frontOriginalMb?: number | undefined;
+  readonly frontFinalMb?: number | undefined;
+  readonly backOriginalMb?: number | undefined;
+  readonly backFinalMb?: number | undefined;
+}
+
+function sizeInMb(uri: string | undefined): number | undefined {
+  if (uri === undefined) return undefined;
+  const bytes = new File(uri).size ?? 0;
+  return bytes > 0 ? bytes / BYTES_PER_MB : undefined;
+}
+
+/**
+ * Builds `CompressibleAssets` from a submission's captured JPEG URIs and runs `PayloadCompressor`
+ * to bring the bundle under the transmission cap, re-stamping the Smile EXIF `image_digest` (and
+ * re-encoding natively) per step. Best-effort: it compresses each image down to its quality floor
+ * and resolves — it never throws on size, so submission is never blocked.
+ */
+export const PayloadCompressionRunner = {
+  async compress(args: {
+    selfieImage?: string | undefined;
+    livenessImages?: readonly string[] | undefined;
+    frontDocument?: string | undefined;
+    backDocument?: string | undefined;
+    metadataBytes: number;
+  }): Promise<PayloadCompressionSizes> {
+    // Original JPEG sizes, measured before the compressor rewrites the files in place.
+    const selfieOriginalMb = sizeInMb(args.selfieImage);
+    const frontOriginalMb = sizeInMb(args.frontDocument);
+    const backOriginalMb = sizeInMb(args.backDocument);
+
+    const assets = new CompressibleAssets({
+      selfie: args.selfieImage
+        ? new UriCompressibleAsset(
+            ImageType.Selfie,
+            args.selfieImage,
+            SELFIE_CAPTURE_QUALITY,
+          )
+        : undefined,
+      liveness: (args.livenessImages ?? []).map(
+        (uri) =>
+          new UriCompressibleAsset(
+            ImageType.Liveness,
+            uri,
+            LIVENESS_CAPTURE_QUALITY,
+          ),
+      ),
+      documentFront: args.frontDocument
+        ? new UriCompressibleAsset(
+            ImageType.DocumentFront,
+            args.frontDocument,
+            CameraDefaults.documentJpegQuality,
+          )
+        : undefined,
+      documentBack: args.backDocument
+        ? new UriCompressibleAsset(
+            ImageType.DocumentBack,
+            args.backDocument,
+            CameraDefaults.documentJpegQuality,
+          )
+        : undefined,
+    });
+    await PayloadCompressor.prepareBundleForTransmission(
+      assets,
+      args.metadataBytes,
+    );
+
+    // Final JPEG sizes, measured after compression (equal to the originals when not compressed).
+    return {
+      selfieOriginalMb,
+      selfieFinalMb: sizeInMb(args.selfieImage),
+      frontOriginalMb,
+      frontFinalMb: sizeInMb(args.frontDocument),
+      backOriginalMb,
+      backFinalMb: sizeInMb(args.backDocument),
+    };
+  },
+};

package/src/data/compression/payload_compressor.ts

@@ -0,0 +1,164 @@
+import {
+  type CompressibleAsset,
+  CompressibleAssets,
+} from "./compressible_asset";
+import {
+  base64Len,
+  PayloadCompressionConfig as C,
+} from "./payload_compression_config";
+
+/**
+ * Adaptive image-compression orchestrator that keeps a v3 submission under the Lambda payload
+ * cap. Pure decision logic over `CompressibleAssets` — the native JPEG encode + EXIF re-stamp
+ * lives behind `CompressibleAsset.recompress`.
+ *
+ * **Cross-SDK source of truth.** The size formulas, plan order, sub-rules, and loop here are
+ * mirrored byte-for-byte with the Android / iOS / Flutter SDKs. See `PayloadCompressionConfig`.
+ *
+ * Scope: image compression only. Metadata is **measured** (it counts toward the bundle and the
+ * projected encoded size) but never modified.
+ */
+export const PayloadCompressor = {
+  /** Raw bundle size: sum of current image bytes + serialized metadata JSON bytes. */
+  rawBundleSize(assets: CompressibleAssets, metadataBytes: number): number {
+    return (
+      assets.all().reduce((sum, asset) => sum + asset.encodedSize(), 0) +
+      metadataBytes
+    );
+  },
+
+  /**
+   * Projected size of the base64-encoded body API Gateway forwards to Lambda: images are
+   * base64-expanded, metadata JSON is counted raw, plus a fixed structural allowance. The real
+   * guardrail.
+   */
+  projectedEncodedSize(
+    assets: CompressibleAssets,
+    metadataBytes: number,
+  ): number {
+    return (
+      assets
+        .all()
+        .reduce((sum, asset) => sum + base64Len(asset.encodedSize()), 0) +
+      metadataBytes +
+      C.structuralOverheadBytes
+    );
+  },
+
+  /**
+   * Ordered (asset, minQuality) plan. Faces take the higher penalty (lower floor); documents are
+   * preserved. Rule B (selfie > 1 MB → faces first), Rule A (documents > 4 MB → back, front,
+   * faces last), else generic (faces first).
+   */
+  buildCompressionPlan(
+    assets: CompressibleAssets,
+  ): Array<[CompressibleAsset, number]> {
+    const plan: Array<[CompressibleAsset, number]> = [];
+    const selfieSize = assets.selfie?.encodedSize() ?? 0;
+    const docCombined = assets.documentCombinedSize();
+
+    if (assets.selfie && selfieSize > C.selfieTrigger) {
+      plan.push([assets.selfie, C.faceMinQ]);
+      for (const frame of assets.liveness) plan.push([frame, C.faceMinQ]);
+      if (assets.documentBack) plan.push([assets.documentBack, C.docMinQ]);
+      if (assets.documentFront) plan.push([assets.documentFront, C.docMinQ]);
+    } else if (docCombined > C.docCombinedTrigger) {
+      if (assets.documentBack) plan.push([assets.documentBack, C.docMinQ]);
+      if (assets.documentFront) plan.push([assets.documentFront, C.docMinQ]);
+      if (assets.selfie) plan.push([assets.selfie, C.faceMinQ]);
+      for (const frame of assets.liveness) plan.push([frame, C.faceMinQ]);
+    } else {
+      if (assets.selfie) plan.push([assets.selfie, C.faceMinQ]);
+      for (const frame of assets.liveness) plan.push([frame, C.faceMinQ]);
+      if (assets.documentBack) plan.push([assets.documentBack, C.docMinQ]);
+      if (assets.documentFront) plan.push([assets.documentFront, C.docMinQ]);
+    }
+    return plan;
+  },
+
+  /**
+   * Compress `assets` in place until the bundle is guaranteed to ship. Steps: early-out → Rule A
+   * document sub-target → walk the global plan to the per-type floors → hard-guarantee pass that
+   * drops past the floors (down to `absoluteMinQ`) until the bundle fits both caps. Never throws;
+   * a job never fails submission purely on payload size.
+   */
+  async prepareBundleForTransmission(
+    assets: CompressibleAssets,
+    metadataBytes: number,
+  ): Promise<void> {
+    // Step 0: already within both guardrails.
+    if (
+      this.projectedEncodedSize(assets, metadataBytes) <= C.hardEncodedCap &&
+      this.rawBundleSize(assets, metadataBytes) <= C.rawTarget
+    ) {
+      return;
+    }
+
+    // Step 1 (Rule A): pull the documents under the combined sub-target first (back, then front).
+    if (assets.documentCombinedSize() > C.docCombinedTrigger) {
+      const group = [assets.documentBack, assets.documentFront].filter(
+        (a): a is CompressibleAsset => a !== undefined,
+      );
+      await this._compressGroupToTarget(
+        group,
+        C.docMinQ,
+        C.docCombinedTarget,
+        () => assets.documentCombinedSize(),
+      );
+    }
+
+    // Step 2: walk the global plan, re-measuring after each decrement, down to the per-type floors.
+    for (const [asset, minQuality] of this.buildCompressionPlan(assets)) {
+      while (
+        this.rawBundleSize(assets, metadataBytes) > C.rawTarget &&
+        asset.quality() > minQuality
+      ) {
+        await asset.recompress(
+          Math.max(minQuality, asset.quality() - C.qualityStep),
+        );
+      }
+      if (this.rawBundleSize(assets, metadataBytes) <= C.rawTarget) return;
+    }
+
+    // Step 3 (hard guarantee): if the bundle is still over the relaxed raw ceiling or the encoded
+    // cap after every image hit its per-type floor, keep stepping quality down past the floors to
+    // `absoluteMinQ` — faces first per the plan order — so the bundle always ships under the cap
+    // regardless of any per-type quality floor.
+    for (const [asset] of this.buildCompressionPlan(assets)) {
+      while (
+        this._overRelaxedCap(assets, metadataBytes) &&
+        asset.quality() > C.absoluteMinQ
+      ) {
+        await asset.recompress(
+          Math.max(C.absoluteMinQ, asset.quality() - C.qualityStep),
+        );
+      }
+      if (!this._overRelaxedCap(assets, metadataBytes)) return;
+    }
+  },
+
+  /** True while the bundle exceeds the relaxed raw ceiling or the projected encoded cap. */
+  _overRelaxedCap(assets: CompressibleAssets, metadataBytes: number): boolean {
+    return (
+      this.rawBundleSize(assets, metadataBytes) > C.rawFallback ||
+      this.projectedEncodedSize(assets, metadataBytes) > C.hardEncodedCap
+    );
+  },
+
+  /** Reduce each asset in `group` (order matters) toward `target` as measured by `measure`. */
+  async _compressGroupToTarget(
+    group: CompressibleAsset[],
+    minQuality: number,
+    target: number,
+    measure: () => number,
+  ): Promise<void> {
+    for (const asset of group) {
+      while (measure() > target && asset.quality() > minQuality) {
+        await asset.recompress(
+          Math.max(minQuality, asset.quality() - C.qualityStep),
+        );
+      }
+      if (measure() <= target) return;
+    }
+  },
+};

package/src/data/compression/uri_compressible_asset.ts

@@ -0,0 +1,85 @@
+import { File } from "expo-file-system";
+import { ImageManipulator, SaveFormat } from "expo-image-manipulator";
+import type { ImageTypeId } from "@smileid/usesmileid_bridge";
+// SmileExifTagger is SDK-internal (not on the public barrel) — deep import, matching the capture screen.
+import { SmileExifTagger } from "@smileid/usesmileid_bridge/src/exif/smile_exif_tagger";
+
+import type { CompressibleAsset } from "./compressible_asset";
+
+/**
+ * `CompressibleAsset` backed by a captured JPEG at `uri`.
+ *
+ * The re-encode is **native** (`expo-image-manipulator`, per the spec's "do not reimplement
+ * compression in JS" rule), and the Smile EXIF `image_digest` re-stamp is **native**
+ * (`SmileExifTagger.finalize`). The original bytes are preserved once on the first `recompress`
+ * so every step re-encodes from source (no generational stacking; deterministic retries).
+ */
+export class UriCompressibleAsset implements CompressibleAsset {
+  private _quality: number;
+  private _size: number;
+  private _sourceUri: string | undefined;
+
+  constructor(
+    readonly imageType: ImageTypeId,
+    private readonly uri: string,
+    captureQuality: number,
+  ) {
+    this._quality = Math.min(Math.max(captureQuality, 0), 1);
+    this._size = UriCompressibleAsset._fileSize(uri);
+  }
+
+  encodedSize(): number {
+    return this._size;
+  }
+
+  quality(): number {
+    return this._quality;
+  }
+
+  async recompress(quality: number): Promise<void> {
+    const target = new File(this.uri);
+    if (!target.exists) return;
+
+    // Preserve the source once so each step re-encodes from the original (no generational loss).
+    if (this._sourceUri === undefined) {
+      const originalUri = `${this.uri}.orig`;
+      try {
+        target.copy(new File(originalUri));
+        this._sourceUri = originalUri;
+      } catch {
+        // Copy failed — fall back to re-encoding in place (still functional, mild generational loss).
+        this._sourceUri = this.uri;
+      }
+    }
+
+    const clamped = Math.min(Math.max(quality, 0), 1);
+    const context = ImageManipulator.manipulate(this._sourceUri);
+    const rendered = await context.renderAsync();
+    const result = await rendered.saveAsync({
+      compress: clamped,
+      format: SaveFormat.JPEG,
+    });
+
+    // Overwrite the request's path with the re-encoded bytes.
+    try {
+      if (target.exists) target.delete();
+      new File(result.uri).move(target);
+    } catch {
+      // Move failed — leave the request pointing at its original path; best effort.
+    }
+
+    // Re-stamp the Smile EXIF image_digest over the new bytes (native; context set at capture).
+    await SmileExifTagger.finalize(this.uri, this.imageType);
+
+    this._quality = quality;
+    this._size = UriCompressibleAsset._fileSize(this.uri);
+  }
+
+  private static _fileSize(uri: string): number {
+    try {
+      return new File(uri).size ?? 0;
+    } catch {
+      return 0;
+    }
+  }
+}