@smileid/usesmileid 12.0.0-beta01 → 12.0.1

package/src/data/repository/use_smile_id_repository_impl.ts

@@ -12,6 +12,29 @@ import {
   mapAxiosError,
   type UseSmileIDNetworkException,
 } from "../../core/exception/use_smile_id_network_exception";
+import {
+  PayloadCompressionRunner,
+  type PayloadCompressionSizes,
+} from "../compression/payload_compression_runner";
+import type { MetadataEntry } from "../../metadata/use_smile_id_metadata";
+
+/** Builds the per-image original/final compressed size wire entries, omitting absent/zero sizes. */
+function compressionSizeEntries(
+  sizes: PayloadCompressionSizes,
+): MetadataEntry[] {
+  const entries: MetadataEntry[] = [];
+  const push = (name: string, value: number | undefined) => {
+    if (value !== undefined && value > 0)
+      entries.push({ name, value: String(value) });
+  };
+  push("selfie_original_size", sizes.selfieOriginalMb);
+  push("selfie_final_compressed_size", sizes.selfieFinalMb);
+  push("document_front_original_size", sizes.frontOriginalMb);
+  push("document_front_final_compressed_size", sizes.frontFinalMb);
+  push("document_back_original_size", sizes.backOriginalMb);
+  push("document_back_final_compressed_size", sizes.backFinalMb);
+  return entries;
+}
 
 /**
  * Concrete repository.
@@ -45,9 +68,28 @@ export class UseSmileIDRepositoryImpl {
         }),
       );
     }
+
+    // Pre-flight payload compression — best effort: shrink the captured JPEGs under the Lambda
+    // cap before transmission (runs once, outside the retry loop), but never block submission, so
+    // any compression failure ships the captured images as-is and lets the server validate. The
+    // per-image original + final compressed sizes are stamped onto the metadata for telemetry.
+    let submitted = request;
     try {
-      const response = await withRetry(this._retry, () =>
-        this._dispatch(request),
+      const sizes = await this._compressPayload(request);
+      const sizeEntries = sizes ? compressionSizeEntries(sizes) : [];
+      if (sizeEntries.length > 0) {
+        submitted = {
+          ...request,
+          metadata: request.metadata.withAdditionalEntries(sizeEntries),
+        };
+      }
+    } catch {
+      // Best-effort: compression is an optimization; submit the captured images as-is on failure.
+    }
+
+    try {
+      const response = await withRetry(this._retry, (attempt) =>
+        this._dispatch(submitted, attempt),
       );
       return success(response);
     } catch (error) {
@@ -62,22 +104,67 @@ export class UseSmileIDRepositoryImpl {
     }
   }
 
+  /**
+   * Pre-flight payload compression entry — extracts the captured image URIs for the job type and
+   * compresses the bundle under the transmission cap (metadata is measured, never modified).
+   * No-op for job types that carry no captured images (Enhanced KYC / BVN).
+   */
+  private async _compressPayload(
+    request: JobRequest,
+  ): Promise<PayloadCompressionSizes | undefined> {
+    const metadataBytes = JSON.stringify(request.metadata.toEntries()).length;
+    switch (request.jobType) {
+      case JobType.smartSelfieEnrollment:
+      case JobType.smartSelfieAuthentication:
+      case JobType.biometricKyc:
+        return PayloadCompressionRunner.compress({
+          selfieImage: request.selfieImage,
+          livenessImages: request.livenessImages,
+          metadataBytes,
+        });
+      case JobType.documentVerification:
+      case JobType.enhancedDocumentVerification:
+        return PayloadCompressionRunner.compress({
+          selfieImage: request.selfieImage,
+          livenessImages: request.livenessImages,
+          frontDocument: request.frontDocument,
+          backDocument: request.backDocument,
+          metadataBytes,
+        });
+      default:
+        return undefined;
+    }
+  }
+
   private _dispatch(
     request: Exclude<JobRequest, { jobType: typeof JobType.bvn }>,
+    attempt: number,
   ): Promise<JobSubmissionResponse> {
-    switch (request.jobType) {
+    // Stamp how many network retries preceded this attempt onto the metadata
+    // (re-evaluated per attempt inside the retry loop). Appended as a flow-state
+    // entry so the already-appended document / config entries are preserved.
+    const stamped: typeof request =
+      attempt > 0
+        ? {
+            ...request,
+            metadata: request.metadata.withAdditionalEntries([
+              { name: "network_retries", value: String(attempt) },
+            ]),
+          }
+        : request;
+    switch (stamped.jobType) {
       case JobType.smartSelfieEnrollment:
-        return this._api.smartSelfieEnrollment(request);
+        return this._api.smartSelfieEnrollment(stamped);
       case JobType.smartSelfieAuthentication:
-        return this._api.smartSelfieAuthentication(request);
+        return this._api.smartSelfieAuthentication(stamped);
       case JobType.enhancedKyc:
-        return this._api.enhancedKyc(request);
+        return this._api.enhancedKyc(stamped);
       case JobType.biometricKyc:
-        return this._api.biometricKyc(request);
+        return this._api.biometricKyc(stamped);
       case JobType.documentVerification:
-        return this._api.documentVerification(request);
+        return this._api.documentVerification(stamped);
       case JobType.enhancedDocumentVerification:
-        return this._api.enhancedDocumentVerification(request);
+        return this._api.enhancedDocumentVerification(stamped);
     }
   }
 

package/src/data/security/__tests__/request_canonicalizer.test.ts

@@ -0,0 +1,132 @@
+import { describe, expect, it } from "vitest";
+
+import { RequestCanonicalizer } from "../request_canonicalizer";
+import { SmileIDCryptoManager } from "../smile_id_crypto_manager";
+
+/**
+ * Golden-vector suite for `RequestCanonicalizer`: pins the exact canonical bytes and the resulting
+ * `smileid-request-mac` for a fixed key across the shapes `canonicalize()` distinguishes. This
+ * SDK's own contract with the server, not a cross-SDK guarantee.
+ */
+const TIMESTAMP = "1700000000000";
+const SIGNING_SECRET = "golden-vector-secret";
+const cryptoManager = new SmileIDCryptoManager(SIGNING_SECRET);
+
+const BASE_HEADERS = {
+  "smileid-token": "golden-token",
+  "smileid-request-timestamp": TIMESTAMP,
+};
+
+type FormDataPart = { fieldName: string; string?: string; uri?: string };
+
+/** Minimal stand-in for React Native's `FormData` (only `getParts` is read). */
+function formData(parts: readonly FormDataPart[]) {
+  return { getParts: () => parts };
+}
+
+function decode(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString("utf-8");
+}
+
+const MULTIPART_BODY = formData([
+  { fieldName: "country", string: "NG" },
+  { fieldName: "allow_new_enroll", string: "true" },
+  { fieldName: "partner_params", string: '{"job_id":"j1"}' },
+  {
+    fieldName: "selfie_image",
+    uri: "data:application/octet-stream;base64,c2VsZmll",
+  },
+]);
+
+// Same logical fields as MULTIPART_BODY, in reverse part order.
+const MULTIPART_BODY_REORDERED = formData([
+  {
+    fieldName: "selfie_image",
+    uri: "data:application/octet-stream;base64,c2VsZmll",
+  },
+  { fieldName: "partner_params", string: '{"job_id":"j1"}' },
+  { fieldName: "allow_new_enroll", string: "true" },
+  { fieldName: "country", string: "NG" },
+]);
+
+const MIXED_CASE_HEADERS = {
+  "Smileid-Token": "golden-token",
+  "SMILEID-REQUEST-TIMESTAMP": TIMESTAMP,
+};
+
+describe("RequestCanonicalizer golden vectors", () => {
+  it("(a) canonicalizes a bodyless request to the signed headers + `{}`", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      BASE_HEADERS,
+      undefined,
+    );
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
+    );
+    expect(await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, undefined)).toBe(
+      "qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=",
+    );
+  });
+
+  it("(b) canonicalizes a raw JSON-string body the same as a bodyless request — only FormData-shaped bodies are reconstructed", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      BASE_HEADERS,
+      '{"hello":"world"}',
+    );
+    // Same canonical bytes as case (a): a JSON string isn't FormData-like,
+    // so canonicalBody() falls through to the same `{}` as no body at all.
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
+    );
+    expect(
+      await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, '{"hello":"world"}'),
+    ).toBe("qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=");
+  });
+
+  it("(c) canonicalizes a multipart FormData body: scalar, boolean-coerced, JSON, and file parts", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      BASE_HEADERS,
+      MULTIPART_BODY,
+    );
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}' +
+        '{"allow_new_enroll":true,"country":"NG","partner_params":{"job_id":"j1"},"selfie_image":"c2VsZmll"}',
+    );
+    expect(
+      await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, MULTIPART_BODY),
+    ).toBe("eNJqKR45aNiou4JM0yVRNYrTdhfg1VblWvsbrRndoLQ=");
+  });
+
+  it("(d) part ordering does not change the canonical bytes or the MAC", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      BASE_HEADERS,
+      MULTIPART_BODY_REORDERED,
+    );
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}' +
+        '{"allow_new_enroll":true,"country":"NG","partner_params":{"job_id":"j1"},"selfie_image":"c2VsZmll"}',
+    );
+    expect(
+      await cryptoManager.sign(
+        TIMESTAMP,
+        BASE_HEADERS,
+        MULTIPART_BODY_REORDERED,
+      ),
+    ).toBe("eNJqKR45aNiou4JM0yVRNYrTdhfg1VblWvsbrRndoLQ=");
+  });
+
+  it("(e) header key casing does not change the canonical bytes or the MAC", async () => {
+    const bytes = await RequestCanonicalizer.canonicalize(
+      MIXED_CASE_HEADERS,
+      undefined,
+    );
+    // Identical to case (a): canonicalHeaders() lower-cases every header
+    // name before signing, so casing at the call site is not observable.
+    expect(decode(bytes)).toBe(
+      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
+    );
+    expect(
+      await cryptoManager.sign(TIMESTAMP, MIXED_CASE_HEADERS, undefined),
+    ).toBe("qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=");
+  });
+});

package/src/data/security/__tests__/security_policy.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, it } from "vitest";
+
+import { SecurityPolicy } from "../security_policy";
+
+/**
+ * Pins down the server-driven security policy bit-code mapping (the contract lives in
+ * `docs/Policy.md`):
+ *   - `undefined` is fail-secure (every behaviour active).
+ *   - bit 0 -> payload signing, bit 1 -> payload encryption, bit 2 -> rooted-device check,
+ *     bit 3 -> device attestation (least-significant bit first).
+ *   - Unrelated bits never cross-activate a behaviour.
+ */
+describe("SecurityPolicy", () => {
+  it("undefined bit-code is fail-secure and enables every behaviour", () => {
+    const policy = SecurityPolicy.fromBitCode(undefined);
+
+    expect(policy.isPayloadSigningActive()).toBe(true);
+    expect(policy.isPayloadEncryptionActive()).toBe(true);
+    expect(policy.isRootedDeviceCheckActive()).toBe(true);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(true);
+  });
+
+  it("zero bit-code disables every behaviour", () => {
+    const policy = SecurityPolicy.fromBitCode(0);
+
+    expect(policy.isPayloadSigningActive()).toBe(false);
+    expect(policy.isPayloadEncryptionActive()).toBe(false);
+    expect(policy.isRootedDeviceCheckActive()).toBe(false);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
+  });
+
+  it("bit 0 maps to payload signing only", () => {
+    const policy = SecurityPolicy.fromBitCode(0b0001);
+
+    expect(policy.isPayloadSigningActive()).toBe(true);
+    expect(policy.isPayloadEncryptionActive()).toBe(false);
+    expect(policy.isRootedDeviceCheckActive()).toBe(false);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
+  });
+
+  it("bit 1 maps to payload encryption only", () => {
+    const policy = SecurityPolicy.fromBitCode(0b0010);
+
+    expect(policy.isPayloadSigningActive()).toBe(false);
+    expect(policy.isPayloadEncryptionActive()).toBe(true);
+    expect(policy.isRootedDeviceCheckActive()).toBe(false);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
+  });
+
+  it("bit 2 maps to rooted-device check only", () => {
+    const policy = SecurityPolicy.fromBitCode(0b0100);
+
+    expect(policy.isPayloadSigningActive()).toBe(false);
+    expect(policy.isPayloadEncryptionActive()).toBe(false);
+    expect(policy.isRootedDeviceCheckActive()).toBe(true);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
+  });
+
+  it("bit 3 maps to play integrity check only", () => {
+    const policy = SecurityPolicy.fromBitCode(0b1000);
+
+    expect(policy.isPayloadSigningActive()).toBe(false);
+    expect(policy.isPayloadEncryptionActive()).toBe(false);
+    expect(policy.isRootedDeviceCheckActive()).toBe(false);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(true);
+  });
+
+  it("combined bit-code activates exactly the set behaviours", () => {
+    // 0b1001 = payload signing (bit 0) + device attestation (bit 3).
+    const policy = SecurityPolicy.fromBitCode(0b1001);
+
+    expect(policy.isPayloadSigningActive()).toBe(true);
+    expect(policy.isPayloadEncryptionActive()).toBe(false);
+    expect(policy.isRootedDeviceCheckActive()).toBe(false);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(true);
+  });
+
+  it("all four bits set activates every behaviour", () => {
+    const policy = SecurityPolicy.fromBitCode(0b1111);
+
+    expect(policy.isPayloadSigningActive()).toBe(true);
+    expect(policy.isPayloadEncryptionActive()).toBe(true);
+    expect(policy.isRootedDeviceCheckActive()).toBe(true);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(true);
+  });
+
+  it("higher unmapped bits do not affect the known behaviours", () => {
+    // bit 4 (0b10000) is beyond the defined mapping; the four known behaviours stay off.
+    const policy = SecurityPolicy.fromBitCode(0b10000);
+
+    expect(policy.isPayloadSigningActive()).toBe(false);
+    expect(policy.isPayloadEncryptionActive()).toBe(false);
+    expect(policy.isRootedDeviceCheckActive()).toBe(false);
+    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
+  });
+});

package/src/data/security/__tests__/smile_id_crypto_manager.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 
 import { SigningCrypto, base64Encode, utf8Bytes } from "../signing_crypto";
 import { SmileIDCryptoManager } from "../smile_id_crypto_manager";
+import { SmileIDCryptoError } from "../smile_id_crypto_error";
 
 /**
  * Pins down the request-signing contract:
@@ -58,6 +59,23 @@ describe("SmileIDCryptoManager", () => {
     expect(mac).toBe("nW0HenQOrKH/qAwQBveK+TSXvg70oVWfD0aGGtfI1bk=");
   });
 
+  it("wraps an unreadable file part as SmileIDCryptoError (signing fails open, never crashes)", async () => {
+    // A `file://` URI the runtime's `fetch` rejects — the same rejection a
+    // captured-image local read produces when the device is offline (Expo vs
+    // bare-RN runtimes differ here). The canonicalizer must surface it as a
+    // SmileIDCryptoError so the request-MAC interceptor's narrow catch fails
+    // open instead of letting the rejection escape and crash the submission.
+    await expect(
+      subject.sign(
+        TIMESTAMP,
+        KAT_HEADERS,
+        formData([
+          { fieldName: "selfie_image", uri: "file:///nonexistent/selfie.jpg" },
+        ]),
+      ),
+    ).rejects.toBeInstanceOf(SmileIDCryptoError);
+  });
+
   it("multipart body MAC is independent of part order", async () => {
     const headers = { "smileid-request-timestamp": TIMESTAMP };
     const first = await subject.sign(

package/src/data/security/request_canonicalizer.ts

@@ -1,4 +1,5 @@
 import { base64Encode, utf8Bytes } from "./signing_crypto";
+import { SmileIDCryptoError } from "./smile_id_crypto_error";
 
 /**
  * Reduces a request to the canonical bytes that get signed: the signed headers
@@ -86,8 +87,20 @@ async function canonicalBody(body: unknown): Promise<Uint8Array> {
 /** File parts (a `uri`) → Base64 of bytes; JSON fields → parsed; else string with bool coercion. */
 async function partValue(part: FormDataPart): Promise<unknown> {
   if (part.uri != null) {
-    const response = await fetch(part.uri);
-    return base64Encode(new Uint8Array(await response.arrayBuffer()));
+    // Reading a file part can reject — e.g. the captured-image `file://` URI is
+    // unreadable, or the RN runtime rejects a local-file `fetch` when the device
+    // is offline (behaviour differs between the Expo and bare-RN runtimes).
+    // Surface it as a SmileIDCryptoError so the signing interceptor's narrow
+    // catch fails open (ships the request unsigned) instead of letting the
+    // rejection escape and crash the submission flow.
+    try {
+      const response = await fetch(part.uri);
+      return base64Encode(new Uint8Array(await response.arrayBuffer()));
+    } catch (cause) {
+      throw new SmileIDCryptoError(
+        `Failed to read request part "${part.fieldName}" for signing: ${String(cause)}`,
+      );
+    }
   }
   const value = part.string ?? "";
   if (JSON_FIELDS.has(part.fieldName)) {

package/src/data/security/security_policy.ts

@@ -0,0 +1,70 @@
+/**
+ * Server-driven security policy decoded from the integer `policy` bit-code carried as a top-level
+ * claim on the SmileID JWT — a sibling of the `sdk_config` claim, not nested inside it (see
+ * `decodeSecurityPolicyBitCode` and `docs/Policy.md`).
+ *
+ * Each bit toggles one SDK security behaviour, so the backend can dial protection up or down per
+ * session without shipping a new SDK build. The bit-code contract — which bit means what — is
+ * documented in `docs/Policy.md`, not here, so the four SDKs share one source of truth.
+ *
+ * **Fail-secure:** an absent (`undefined`) bit-code enables every behaviour, so a token that omits
+ * the claim — or a malformed token that fails to decode — runs with full protection rather than
+ * silently dropping security. This matches the value `undefined` produces in
+ * {@link SecurityPolicy.fromBitCode}.
+ *
+ * **Internal by design:** this class is not exported from the package entrypoint (`src/index.ts`),
+ * so it never becomes part of the partner-facing API; it exists only so the SDK can gate its own
+ * request signing and device attestation.
+ */
+export class SecurityPolicy {
+  private static readonly _BIT_PAYLOAD_SIGNING = 0;
+  private static readonly _BIT_PAYLOAD_ENCRYPTION = 1;
+  private static readonly _BIT_ROOTED_DEVICE_CHECK = 2;
+  private static readonly _BIT_PLAY_INTEGRITY_CHECK = 3;
+
+  // Fail-secure default for an absent bit-code: every known behaviour active.
+  private static readonly _ALL_ACTIVE =
+    (1 << SecurityPolicy._BIT_PAYLOAD_SIGNING) |
+    (1 << SecurityPolicy._BIT_PAYLOAD_ENCRYPTION) |
+    (1 << SecurityPolicy._BIT_ROOTED_DEVICE_CHECK) |
+    (1 << SecurityPolicy._BIT_PLAY_INTEGRITY_CHECK);
+
+  private readonly _bitCode: number;
+
+  private constructor(bitCode: number) {
+    this._bitCode = bitCode;
+  }
+
+  /**
+   * Decode a `bitCode` into a typed policy. An `undefined` code is fail-secure — every behaviour
+   * is active. For a defined code, behaviour `b` is active when bit `b` is set, least-significant
+   * bit first.
+   */
+  static fromBitCode(bitCode: number | undefined): SecurityPolicy {
+    return new SecurityPolicy(bitCode ?? SecurityPolicy._ALL_ACTIVE);
+  }
+
+  /** True when the server enabled request-payload HMAC signing for this session. */
+  isPayloadSigningActive(): boolean {
+    return this._isSet(SecurityPolicy._BIT_PAYLOAD_SIGNING);
+  }
+
+  /** True when the server enabled request-payload encryption for this session. */
+  isPayloadEncryptionActive(): boolean {
+    return this._isSet(SecurityPolicy._BIT_PAYLOAD_ENCRYPTION);
+  }
+
+  /** True when the server enabled the rooted / jailbroken device check for this session. */
+  isRootedDeviceCheckActive(): boolean {
+    return this._isSet(SecurityPolicy._BIT_ROOTED_DEVICE_CHECK);
+  }
+
+  /** True when the server enabled device attestation for this session. */
+  isPlayIntegrityCheckActive(): boolean {
+    return this._isSet(SecurityPolicy._BIT_PLAY_INTEGRITY_CHECK);
+  }
+
+  private _isSet(bit: number): boolean {
+    return ((this._bitCode >> bit) & 1) === 1;
+  }
+}

package/src/data/smile_id_urls.ts

@@ -5,7 +5,7 @@
  * kept so the production host can diverge without touching call sites.
  */
 export const SmileIDUrls = {
-  sandbox: "https://devapi.smileidentity.com/",
+  sandbox: "https://testapi.smileidentity.com/",
   production: "https://api.smileidentity.com/",
   forConfig(useSandbox: boolean): string {
     return useSandbox ? this.sandbox : this.production;

package/src/data/util/__tests__/retry_util.test.ts

@@ -154,4 +154,29 @@ describe("withRetry", () => {
     });
     expect(block).toHaveBeenCalledTimes(3); // maxAttempts
   });
+
+  it('strategy="none" never retries, even with an attempt budget', async () => {
+    // A config can carry both; the strategy wins.
+    const block = vi.fn().mockRejectedValue(makeAxiosError(503));
+    const config: RetryConfig = {
+      ...exponentialConfig,
+      strategy: RetryStrategy.none,
+    };
+
+    await expect(withRetry(config, block)).rejects.toMatchObject({
+      response: { status: 503 },
+    });
+    expect(block).toHaveBeenCalledTimes(1);
+  });
+
+  it("makes one attempt and surfaces the real error when maxAttempts is 0", async () => {
+    // `attempt < 0` never ran the body, so the old code rejected with `undefined`.
+    const block = vi.fn().mockRejectedValue(makeAxiosError(503));
+    const config: RetryConfig = { ...exponentialConfig, maxAttempts: 0 };
+
+    await expect(withRetry(config, block)).rejects.toMatchObject({
+      response: { status: 503 },
+    });
+    expect(block).toHaveBeenCalledTimes(1);
+  });
 });

package/src/data/util/__tests__/use_smile_id_token_decoder.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, it } from "vitest";
-import { decodeSmileIDToken } from "../use_smile_id_token_decoder";
+import {
+  decodeSmileIDToken,
+  decodeSecurityPolicyBitCode,
+} from "../use_smile_id_token_decoder";
 
 // ---------------------------------------------------------------------------
 // Helper — mint a structurally valid JWT with a caller-supplied payload.
@@ -14,6 +17,59 @@ function makeJwt(payload: Record<string, unknown>): string {
   return `eyJhbGciOiJub25lIn0.${payloadSegment}.stub-sig`;
 }
 
+// ---------------------------------------------------------------------------
+// Security policy bit-code extraction
+// ---------------------------------------------------------------------------
+describe("decodeSecurityPolicyBitCode", () => {
+  it("parses the top-level policy bit-code alongside sdk_config", () => {
+    const token = makeJwt({
+      policy: 9,
+      sdk_config: { selfie: { quality: 85 } },
+    });
+    expect(decodeSecurityPolicyBitCode(token)).toBe(9);
+  });
+
+  it("parses the top-level policy bit-code when sdk_config is absent", () => {
+    const token = makeJwt({ policy: 0 });
+    expect(decodeSecurityPolicyBitCode(token)).toBe(0);
+  });
+
+  it("returns undefined when the token omits policy", () => {
+    const token = makeJwt({ sdk_config: { selfie: { quality: 85 } } });
+    expect(decodeSecurityPolicyBitCode(token)).toBeUndefined();
+  });
+
+  it("returns undefined for a structurally invalid token", () => {
+    expect(decodeSecurityPolicyBitCode("not-a-jwt")).toBeUndefined();
+  });
+
+  it("returns undefined when policy is not a number", () => {
+    const token = makeJwt({ policy: "9" });
+    expect(decodeSecurityPolicyBitCode(token)).toBeUndefined();
+  });
+});
+
+describe("decodeSmileIDToken — partner_id claim (stamped onto the EXIF tag)", () => {
+  it("parses the canonical top-level partner_id claim", () => {
+    // The EXIF tagger keys on this, so it must be the server-canonical form (e.g. "002").
+    const token = makeJwt({
+      partner_id: "002",
+      sdk_config: { selfie: { width: 640 } },
+    });
+    expect(decodeSmileIDToken(token)?.partnerId).toBe("002");
+  });
+
+  it("leaves partnerId undefined when the claim is absent", () => {
+    const token = makeJwt({ sdk_config: { selfie: { quality: 85 } } });
+    expect(decodeSmileIDToken(token)?.partnerId).toBeUndefined();
+  });
+
+  it("leaves partnerId undefined when the claim is not a string", () => {
+    const token = makeJwt({ partner_id: 2 });
+    expect(decodeSmileIDToken(token)?.partnerId).toBeUndefined();
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Structural failure paths → undefined
 // ---------------------------------------------------------------------------

package/src/data/util/retry_util.ts

@@ -1,5 +1,8 @@
 import { isAxiosError } from "axios";
-import type { RetryConfig } from "../../core/models/network_config";
+import {
+  RetryStrategy,
+  type RetryConfig,
+} from "../../core/models/network_config";
 
 /**
  * Retry helper. Retries `block` until success or `maxAttempts`
@@ -13,12 +16,18 @@ import type { RetryConfig } from "../../core/models/network_config";
  */
 export async function withRetry<T>(
   config: RetryConfig,
-  block: () => Promise<T>,
+  block: (attempt: number) => Promise<T>,
 ): Promise<T> {
+  // Without this the loop below never runs and rejects with `undefined`.
+  if (config.strategy === RetryStrategy.none || config.maxAttempts <= 1) {
+    return block(0);
+  }
+
   let lastError: unknown;
   for (let attempt = 0; attempt < config.maxAttempts; attempt++) {
     try {
-      return await block();
+      // `attempt` is the number of retries that preceded this try (0 first).
+      return await block(attempt);
     } catch (error) {
       lastError = error;
       if (!isRetryable(error) || attempt === config.maxAttempts - 1) {