@smileid/usesmileid 12.0.0-beta01 → 12.0.1

package/dist/core/models/result.js

@@ -1,16 +1,15 @@
-/** Construct a successful result carrying `value`. */
+/** A successful outcome carrying the resulting value. */
 export function success(value) {
     return { status: "success", value };
 }
-/** Construct a failed result carrying `error`. */
+/** A failed outcome carrying the causing error. */
 export function failure(error) {
     return { status: "failure", error };
 }
 /**
- * Construct a cancelled result — the user deliberately exited the flow
- * (e.g. back-pressed out of the first screen) without completing or
- * failing. Distinct from `failure` so partners can tell a user
- * cancellation apart from an error.
+ * The user deliberately exited the flow without completing or failing it
+ * (e.g. back-pressed out of the first screen) — distinct from a failure
+ * so cancellation can be handled separately.
  */
 export function cancelled() {
     return { status: "cancelled" };

package/dist/core/models/result.js.map

@@ -1 +1 @@
-{"version":3,"file":"result.js","sourceRoot":"","sources":["../../../src/core/models/result.ts"],"names":[],"mappings":"AAaA,sDAAsD;AACtD,MAAM,UAAU,OAAO,CAAI,KAAQ;IACjC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,OAAO,CAAI,KAAc;IACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../../../src/core/models/result.ts"],"names":[],"mappings":"AAeA,yDAAyD;AACzD,MAAM,UAAU,OAAO,CAAI,KAAQ;IACjC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,OAAO,CAAI,KAAc;IACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC"}

package/dist/data/api/interceptors/smile_auth_interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smile_auth_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_auth_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAGvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAwCxD,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC,CAAC;AAEF,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,OAAO,EAAE,2BAA2B;IAKhD;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CAgBzB"}
+{"version":3,"file":"smile_auth_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_auth_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAGvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAyBxD,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC,CAAC;AAEF,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,OAAO,EAAE,2BAA2B;IAKhD;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CAgBzB"}

package/dist/data/api/interceptors/smile_auth_interceptor.js

@@ -1,4 +1,4 @@
-import { Platform } from "react-native";
+import { sourceSdkIdentifier } from "@smileid/usesmileid_bridge";
 import { currentRequestTimestamp } from "../../security/request_timestamp";
 /**
  * Auth interceptor.
@@ -20,21 +20,7 @@ import { currentRequestTimestamp } from "../../security/request_timestamp";
  * value written by `TokenRefreshInterceptor` is observed automatically
  * by the next outgoing request.
  */
-const SDK_VERSION = "12.0.0-beta01";
-/**
- * Source-SDK identifier, suffixed with the runtime platform so the server can
- * attribute the request and resolve the matching per-SDK signing secret.
- */
-function sourceSdk() {
-    switch (Platform.OS) {
-        case "android":
-            return "react-native-expo (android)";
-        case "ios":
-            return "react-native-expo (iOS)";
-        default:
-            return "react-native-expo";
-    }
-}
+const SDK_VERSION = "12.0.1";
 export class SmileAuthInterceptor {
     _partnerConfig;
     _tokenHolder;
@@ -55,7 +41,7 @@ export class SmileAuthInterceptor {
     }
     async _onRequest(config) {
         config.headers.set("smileid-token", this._tokenHolder.current);
-        config.headers.set("smileid-source-sdk", sourceSdk());
+        config.headers.set("smileid-source-sdk", sourceSdkIdentifier());
         config.headers.set("smileid-source-sdk-version", SDK_VERSION);
         config.headers.set("smileid-partner-id", this._partnerConfig.partnerId);
         if (this._partnerConfig.callbackUrl) {

package/dist/data/api/interceptors/smile_auth_interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"smile_auth_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_auth_interceptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAG3E;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,GAAG,eAAe,CAAC;AAEpC;;;GAGG;AACH,SAAS,SAAS;IAChB,QAAQ,QAAQ,CAAC,EAAE,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,6BAA6B,CAAC;QACvC,KAAK,KAAK;YACR,OAAO,yBAAyB,CAAC;QACnC;YACE,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC;AAOD,MAAM,OAAO,oBAAoB;IACd,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE3C,YAAY,OAAoC;QAC9C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACtE,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"smile_auth_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_auth_interceptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAG3E;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,GAAG,QAAQ,CAAC;AAO7B,MAAM,OAAO,oBAAoB;IACd,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE3C,YAAY,OAAoC;QAC9C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACtE,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/data/api/interceptors/smile_integrity_interceptor.d.ts

@@ -1,4 +1,5 @@
 import type { AxiosInstance } from "axios";
+import type { SecurityPolicy } from "../../security/security_policy";
 /**
  * Stamps the `smileid-device-nonce` header on every outbound request
  * whose axios config declares `_useSmileIDAttestation: true`. The
@@ -26,11 +27,21 @@ import type { AxiosInstance } from "axios";
  * Warm-up lives outside the interceptor. Call `Attestation.warmUp()`
  * once at flow mount so the per-request `requestToken` call doesn't
  * pay the multi-second warm-up cost on every submission.
+ *
+ * Attestation is additionally gated by the server-driven {@link SecurityPolicy}:
+ * when the session's policy disables the device-attestation check, an opted-in
+ * request ships without a device nonce. The policy is fail-secure, so a token
+ * that omits the claim attests as before.
  */
 export declare const DEVICE_NONCE_HEADER = "smileid-device-nonce";
 /** Axios config key that opts a request into attestation stamping. */
 export declare const ATTESTATION_OPT_IN_KEY = "_useSmileIDAttestation";
+export type SmileIntegrityInterceptorOptions = {
+    readonly securityPolicy: SecurityPolicy;
+};
 export declare class SmileIntegrityInterceptor {
+    private readonly _securityPolicy;
+    constructor(options: SmileIntegrityInterceptorOptions);
     attach(client: AxiosInstance): {
         request: number;
     };

package/dist/data/api/interceptors/smile_integrity_interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smile_integrity_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_integrity_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAMvE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,qBAAa,yBAAyB;IACpC,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CAwBzB"}
+{"version":3,"file":"smile_integrity_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_integrity_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAIvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,MAAM,MAAM,gCAAgC,GAAG;IAC7C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC,CAAC;AAEF,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;gBAErC,OAAO,EAAE,gCAAgC;IAIrD,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CA4BzB"}

package/dist/data/api/interceptors/smile_integrity_interceptor.js

@@ -27,11 +27,20 @@ import { REQUEST_MAC_HEADER } from "./smile_request_mac_interceptor";
  * Warm-up lives outside the interceptor. Call `Attestation.warmUp()`
  * once at flow mount so the per-request `requestToken` call doesn't
  * pay the multi-second warm-up cost on every submission.
+ *
+ * Attestation is additionally gated by the server-driven {@link SecurityPolicy}:
+ * when the session's policy disables the device-attestation check, an opted-in
+ * request ships without a device nonce. The policy is fail-secure, so a token
+ * that omits the claim attests as before.
  */
 export const DEVICE_NONCE_HEADER = "smileid-device-nonce";
 /** Axios config key that opts a request into attestation stamping. */
 export const ATTESTATION_OPT_IN_KEY = "_useSmileIDAttestation";
 export class SmileIntegrityInterceptor {
+    _securityPolicy;
+    constructor(options) {
+        this._securityPolicy = options.securityPolicy;
+    }
     attach(client) {
         const requestId = client.interceptors.request.use(async (config) => {
             return this._onRequest(config);
@@ -42,6 +51,10 @@ export class SmileIntegrityInterceptor {
         const optedIn = config[ATTESTATION_OPT_IN_KEY] === true;
         if (!optedIn)
             return config;
+        // Server-driven policy can switch device attestation off for this session; when it is off,
+        // ship the opted-in request without requesting a token.
+        if (!this._securityPolicy.isPlayIntegrityCheckActive())
+            return config;
         const macHeader = config.headers.get(REQUEST_MAC_HEADER);
         if (typeof macHeader !== "string")
             return config;

package/dist/data/api/interceptors/smile_integrity_interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"smile_integrity_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_integrity_interceptor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAE/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,MAAM,OAAO,yBAAyB;IACpC,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,OAAO,GACV,MAA+D,CAC9D,sBAAsB,CACvB,KAAK,IAAI,CAAC;QACb,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,GAAG,CAChB,mBAAmB,EACnB,OAAO,kBAAkB,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAChE,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}
+{"version":3,"file":"smile_integrity_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_integrity_interceptor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAM/D,MAAM,OAAO,yBAAyB;IACnB,eAAe,CAAiB;IAEjD,YAAY,OAAyC;QACnD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,OAAO,GACV,MAA+D,CAC9D,sBAAsB,CACvB,KAAK,IAAI,CAAC;QACb,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAE5B,2FAA2F;QAC3F,wDAAwD;QACxD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,0BAA0B,EAAE;YAAE,OAAO,MAAM,CAAC;QAEtE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,GAAG,CAChB,mBAAmB,EACnB,OAAO,kBAAkB,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAChE,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/data/api/interceptors/smile_request_mac_interceptor.d.ts

@@ -1,5 +1,6 @@
 import type { AxiosInstance } from "axios";
 import type { SmileIDCryptoManager } from "../../security/smile_id_crypto_manager";
+import type { SecurityPolicy } from "../../security/security_policy";
 /**
  * Stamps the `smileid-request-mac` header on every outbound request whose axios
  * config declares `_useSmileIDRequestMac: true`. The value is computed by
@@ -15,6 +16,11 @@ import type { SmileIDCryptoManager } from "../../security/smile_id_crypto_manage
  * rather than signed against an invented timestamp.
  *
  * Requests without the opt-in flag pass through unchanged.
+ *
+ * Signing is additionally gated by the server-driven {@link SecurityPolicy}: when the session's
+ * policy disables payload signing, an opted-in request still ships, just unsigned — the same wire
+ * shape as an opt-out request. The policy is fail-secure, so a token that omits the claim signs as
+ * before.
  */
 export declare const REQUEST_MAC_HEADER = "smileid-request-mac";
 export declare const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
@@ -22,9 +28,11 @@ export declare const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
 export declare const REQUEST_MAC_OPT_IN_KEY = "_useSmileIDRequestMac";
 export type SmileRequestMacInterceptorOptions = {
     readonly cryptoManager: SmileIDCryptoManager;
+    readonly securityPolicy: SecurityPolicy;
 };
 export declare class SmileRequestMacInterceptor {
     private readonly _cryptoManager;
+    private readonly _securityPolicy;
     constructor(options: SmileRequestMacInterceptorOptions);
     attach(client: AxiosInstance): {
         request: number;

package/dist/data/api/interceptors/smile_request_mac_interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smile_request_mac_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_request_mac_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAGvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAE9D,MAAM,MAAM,iCAAiC,GAAG;IAC9C,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;CAC9C,CAAC;AAEF,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;gBAE1C,OAAO,EAAE,iCAAiC;IAItD,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CA4BzB"}
+{"version":3,"file":"smile_request_mac_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_request_mac_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAGvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAE9D,MAAM,MAAM,iCAAiC,GAAG;IAC9C,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC,CAAC;AAEF,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;gBAErC,OAAO,EAAE,iCAAiC;IAKtD,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CAgCzB"}

package/dist/data/api/interceptors/smile_request_mac_interceptor.js

@@ -14,6 +14,11 @@ import { SmileIDCryptoError } from "../../security/smile_id_crypto_error";
  * rather than signed against an invented timestamp.
  *
  * Requests without the opt-in flag pass through unchanged.
+ *
+ * Signing is additionally gated by the server-driven {@link SecurityPolicy}: when the session's
+ * policy disables payload signing, an opted-in request still ships, just unsigned — the same wire
+ * shape as an opt-out request. The policy is fail-secure, so a token that omits the claim signs as
+ * before.
  */
 export const REQUEST_MAC_HEADER = "smileid-request-mac";
 export const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
@@ -21,8 +26,10 @@ export const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
 export const REQUEST_MAC_OPT_IN_KEY = "_useSmileIDRequestMac";
 export class SmileRequestMacInterceptor {
     _cryptoManager;
+    _securityPolicy;
     constructor(options) {
         this._cryptoManager = options.cryptoManager;
+        this._securityPolicy = options.securityPolicy;
     }
     attach(client) {
         const requestId = client.interceptors.request.use(async (config) => {
@@ -34,6 +41,10 @@ export class SmileRequestMacInterceptor {
         const optedIn = config[REQUEST_MAC_OPT_IN_KEY] === true;
         if (!optedIn)
             return config;
+        // Server-driven policy can switch payload signing off for this session; when it is off, ship
+        // the opted-in request unsigned and let the server apply its policy.
+        if (!this._securityPolicy.isPayloadSigningActive())
+            return config;
         const timestamp = config.headers.get(REQUEST_TIMESTAMP_HEADER);
         if (typeof timestamp !== "string")
             return config;

package/dist/data/api/interceptors/smile_request_mac_interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"smile_request_mac_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_request_mac_interceptor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAG1E;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAM9D,MAAM,OAAO,0BAA0B;IACpB,cAAc,CAAuB;IAEtD,YAAY,OAA0C;QACpD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,OAAO,GACV,MAA+D,CAC9D,sBAAsB,CACvB,KAAK,IAAI,CAAC;QACb,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC/D,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CACxC,SAAS,EACT,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxD,mEAAmE;YACnE,sEAAsE;YACtE,mDAAmD;QACrD,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,4EAA4E;AAC5E,SAAS,eAAe,CACtB,OAA8C;IAE9C,MAAM,MAAM,GACV,OAAQ,OAAsC,CAAC,MAAM,KAAK,UAAU;QAClE,CAAC,CAAG,OAAqC,CAAC,MAAM,EAG5C;QACJ,CAAC,CAAE,OAA8C,CAAC;IACtD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"smile_request_mac_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_request_mac_interceptor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAI1E;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAO9D,MAAM,OAAO,0BAA0B;IACpB,cAAc,CAAuB;IACrC,eAAe,CAAiB;IAEjD,YAAY,OAA0C;QACpD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,OAAO,GACV,MAA+D,CAC9D,sBAAsB,CACvB,KAAK,IAAI,CAAC;QACb,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAE5B,6FAA6F;QAC7F,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,sBAAsB,EAAE;YAAE,OAAO,MAAM,CAAC;QAElE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC/D,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CACxC,SAAS,EACT,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxD,mEAAmE;YACnE,sEAAsE;YACtE,mDAAmD;QACrD,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,4EAA4E;AAC5E,SAAS,eAAe,CACtB,OAA8C;IAE9C,MAAM,MAAM,GACV,OAAQ,OAAsC,CAAC,MAAM,KAAK,UAAU;QAClE,CAAC,CAAG,OAAqC,CAAC,MAAM,EAG5C;QACJ,CAAC,CAAE,OAA8C,CAAC;IACtD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/data/api/smile_id_api.d.ts

@@ -19,7 +19,7 @@ import type { JobSubmissionResponse } from "../model/job_submission_response";
  * infrastructure for future divergence.
  */
 declare const PROD_BASE_URL: "https://api.smileidentity.com/";
-declare const SANDBOX_BASE_URL: "https://devapi.smileidentity.com/";
+declare const SANDBOX_BASE_URL: "https://testapi.smileidentity.com/";
 export declare class SmileIDAPI {
     private readonly _client;
     private readonly _partnerConfig;

package/dist/data/api/smile_id_api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smile_id_api.d.ts","sourceRoot":"","sources":["../../../src/data/api/smile_id_api.ts"],"names":[],"mappings":"AAAA,OAAc,EAAE,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACd,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EACV,mBAAmB,EACnB,2BAA2B,EAC3B,mCAAmC,EACnC,kBAAkB,EAClB,gCAAgC,EAChC,4BAA4B,EAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAG9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAK9E;;;;;;;;;;;;;GAaG;AAQH,QAAA,MAAM,aAAa,kCAAyB,CAAC;AAC7C,QAAA,MAAM,gBAAgB,qCAAsB,CAAC;AAY7C,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;gBAEnC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IAK/D;;;;;;;;;;;;;;;;;OAiBG;IACG,qBAAqB,CACzB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IAYjC;;;;;OAKG;IACG,yBAAyB,CAC7B,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,qBAAqB,CAAC;IAa3B,WAAW,CACf,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,qBAAqB,CAAC;IAuB3B,YAAY,CAChB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IAqB3B,oBAAoB,CACxB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC;IAI3B,4BAA4B,CAChC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,qBAAqB,CAAC;YAOnB,yBAAyB;IAyBvC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAiB5B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAYrC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAavB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB;IAWjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB;YAkBnB,cAAc;CAY7B;AAoHD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAgBrE;AAED,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,GACjB,CAAC"}
+{"version":3,"file":"smile_id_api.d.ts","sourceRoot":"","sources":["../../../src/data/api/smile_id_api.ts"],"names":[],"mappings":"AAAA,OAAc,EAAE,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACd,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EACV,mBAAmB,EACnB,2BAA2B,EAC3B,mCAAmC,EACnC,kBAAkB,EAClB,gCAAgC,EAChC,4BAA4B,EAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAG9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAK9E;;;;;;;;;;;;;GAaG;AAQH,QAAA,MAAM,aAAa,kCAAyB,CAAC;AAC7C,QAAA,MAAM,gBAAgB,sCAAsB,CAAC;AAY7C,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;gBAEnC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa;IAK/D;;;;;;;;;;;;;;;;;OAiBG;IACG,qBAAqB,CACzB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IAYjC;;;;;OAKG;IACG,yBAAyB,CAC7B,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,qBAAqB,CAAC;IAa3B,WAAW,CACf,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,qBAAqB,CAAC;IAuB3B,YAAY,CAChB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IAqB3B,oBAAoB,CACxB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC;IAI3B,4BAA4B,CAChC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,qBAAqB,CAAC;YAOnB,yBAAyB;IAyBvC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAiB5B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAYrC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAavB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB;IAWjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,yBAAyB;YAkBnB,cAAc;CAY7B;AAoHD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAgBrE;AAED,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,GACjB,CAAC"}

package/dist/data/compression/compressible_asset.d.ts

@@ -0,0 +1,41 @@
+import type { ImageTypeId } from "@smileid/usesmileid_bridge";
+/**
+ * A single compressible image, abstracted so the orchestration logic (`PayloadCompressor`) is
+ * pure and unit-testable with in-memory fakes — the real implementation re-encodes the JPEG via
+ * a native module and re-stamps the Smile EXIF `image_digest` the backend validates.
+ *
+ * Contract: `recompress` **must re-encode from the retained source pixels**, never from the
+ * already-compressed bytes, so repeated steps don't stack generational loss and retries are
+ * deterministic. It is asynchronous because the encode/re-stamp delegates to native code.
+ */
+export interface CompressibleAsset {
+    /** The image's wire type — also the EXIF re-stamp's `image_type_id`. */
+    readonly imageType: ImageTypeId;
+    /** Current encoded JPEG size in bytes. */
+    encodedSize(): number;
+    /** Current re-encode quality in `[0, 1]`. Reports the capture quality before any recompress. */
+    quality(): number;
+    /** Re-encode from the retained source at `quality` (caller clamps to the floor). */
+    recompress(quality: number): Promise<void>;
+}
+/**
+ * The full set of images in one submission. Any role may be absent (e.g. SmartSelfie has no
+ * documents; Enhanced KYC has no images at all → the compressor is a no-op).
+ */
+export declare class CompressibleAssets {
+    readonly selfie: CompressibleAsset | undefined;
+    readonly liveness: readonly CompressibleAsset[];
+    readonly documentFront: CompressibleAsset | undefined;
+    readonly documentBack: CompressibleAsset | undefined;
+    constructor(args: {
+        selfie?: CompressibleAsset | undefined;
+        liveness?: readonly CompressibleAsset[] | undefined;
+        documentFront?: CompressibleAsset | undefined;
+        documentBack?: CompressibleAsset | undefined;
+    });
+    /** All present assets, in submission order. */
+    all(): CompressibleAsset[];
+    /** Combined size of the front + back document images (0 when neither is present). */
+    documentCombinedSize(): number;
+}
+//# sourceMappingURL=compressible_asset.d.ts.map

package/dist/data/compression/compressible_asset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compressible_asset.d.ts","sourceRoot":"","sources":["../../../src/data/compression/compressible_asset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,0CAA0C;IAC1C,WAAW,IAAI,MAAM,CAAC;IACtB,gGAAgG;IAChG,OAAO,IAAI,MAAM,CAAC;IAClB,oFAAoF;IACpF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,YAAY,EAAE,iBAAiB,GAAG,SAAS,CAAC;gBAEzC,IAAI,EAAE;QAChB,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;QACvC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,GAAG,SAAS,CAAC;QACpD,aAAa,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;QAC9C,YAAY,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;KAC9C;IAOD,+CAA+C;IAC/C,GAAG,IAAI,iBAAiB,EAAE;IAS1B,qFAAqF;IACrF,oBAAoB,IAAI,MAAM;CAM/B"}

package/dist/data/compression/compressible_asset.js

@@ -0,0 +1,34 @@
+/**
+ * The full set of images in one submission. Any role may be absent (e.g. SmartSelfie has no
+ * documents; Enhanced KYC has no images at all → the compressor is a no-op).
+ */
+export class CompressibleAssets {
+    selfie;
+    liveness;
+    documentFront;
+    documentBack;
+    constructor(args) {
+        this.selfie = args.selfie;
+        this.liveness = args.liveness ?? [];
+        this.documentFront = args.documentFront;
+        this.documentBack = args.documentBack;
+    }
+    /** All present assets, in submission order. */
+    all() {
+        const result = [];
+        if (this.selfie)
+            result.push(this.selfie);
+        result.push(...this.liveness);
+        if (this.documentFront)
+            result.push(this.documentFront);
+        if (this.documentBack)
+            result.push(this.documentBack);
+        return result;
+    }
+    /** Combined size of the front + back document images (0 when neither is present). */
+    documentCombinedSize() {
+        return ((this.documentFront?.encodedSize() ?? 0) +
+            (this.documentBack?.encodedSize() ?? 0));
+    }
+}
+//# sourceMappingURL=compressible_asset.js.map

package/dist/data/compression/compressible_asset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compressible_asset.js","sourceRoot":"","sources":["../../../src/data/compression/compressible_asset.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAgC;IACtC,QAAQ,CAA+B;IACvC,aAAa,CAAgC;IAC7C,YAAY,CAAgC;IAErD,YAAY,IAKX;QACC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED,+CAA+C;IAC/C,GAAG;QACD,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qFAAqF;IACrF,oBAAoB;QAClB,OAAO,CACL,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CACxC,CAAC;IACJ,CAAC;CACF"}

package/dist/data/compression/payload_compression_config.d.ts

@@ -0,0 +1,36 @@
+export declare const PayloadCompressionConfig: {
+    /** 1 MiB. Binary MB is the locked cross-SDK unit. */
+    readonly bytesPerMB: number;
+    /** Primary compression goal for the raw bundle. */
+    readonly rawTarget: number;
+    /** Relaxed raw ceiling, accepted only if the projected encoded size still fits the cap. */
+    readonly rawFallback: number;
+    /** The real guardrail: projected base64-encoded body must stay under this (margin under 6 MB). */
+    readonly hardEncodedCap: number;
+    /** Rule A trigger: combined document images larger than this start the document sub-pass. */
+    readonly docCombinedTrigger: number;
+    /** Rule A sub-target: pull the combined documents under this (back first, then front). */
+    readonly docCombinedTarget: number;
+    /** Rule B trigger: a selfie larger than this marks a face-heavy job (faces compressed first). */
+    readonly selfieTrigger: number;
+    /** Minimum JPEG quality for face images (selfie + liveness) — higher penalty. Pending DS sign-off. */
+    readonly faceMinQ: 0.45;
+    /** Minimum JPEG quality for document images — preserves OCR / MRZ. Pending DS sign-off. */
+    readonly docMinQ: 0.7;
+    /**
+     * Absolute JPEG-quality floor for the hard-guarantee pass. When a bundle is still over
+     * `rawFallback` after every image has hit its per-type floor (`faceMinQ` / `docMinQ`), the
+     * guarantee pass keeps stepping quality down to this value — below the per-type floors — so an
+     * oversized capture never fails submission on size. Matches v11's quality-10 floor.
+     */
+    readonly absoluteMinQ: 0.1;
+    /** Quality decrement per re-encode step. */
+    readonly qualityStep: 0.05;
+    /** Nominal re-encode start point; each asset steps down from its own capture quality. */
+    readonly startQ: 0.9;
+    /** Fixed allowance for multipart field names + part framing not counted in image/metadata totals. */
+    readonly structuralOverheadBytes: 2048;
+};
+/** base64 length of `n` raw bytes: `ceil(n / 3) * 4`. */
+export declare function base64Len(n: number): number;
+//# sourceMappingURL=payload_compression_config.d.ts.map

package/dist/data/compression/payload_compression_config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload_compression_config.d.ts","sourceRoot":"","sources":["../../../src/data/compression/payload_compression_config.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,wBAAwB;IACnC,qDAAqD;;IAErD,mDAAmD;;IAEnD,2FAA2F;;IAE3F,kGAAkG;;IAElG,6FAA6F;;IAE7F,0FAA0F;;IAE1F,iGAAiG;;IAEjG,sGAAsG;;IAEtG,2FAA2F;;IAE3F;;;;;OAKG;;IAEH,4CAA4C;;IAE5C,yFAAyF;;IAEzF,qGAAqG;;CAE7F,CAAC;AAEX,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3C"}

package/dist/data/compression/payload_compression_config.js

@@ -0,0 +1,52 @@
+/**
+ * Shared byte-size guardrails and adaptive JPEG-compression constants for keeping a v3
+ * form-data submission under AWS Lambda's 6 MB synchronous payload limit.
+ *
+ * **Cross-SDK source of truth** — the same thresholds, order, floors, and {@link base64Len}
+ * formula are mirrored byte-for-byte in the Android, iOS, and Flutter SDKs. Do not diverge any
+ * value without updating all four platforms.
+ *
+ * Lambda sees the **base64-encoded** body forwarded by API Gateway (base64 expands binary by
+ * ~33%), so the real guardrail is `PayloadCompressor.projectedEncodedSize` against
+ * `hardEncodedCap` — not raw bytes. Units are **binary MB (MiB, 1 << 20)**, locked across all
+ * four SDKs.
+ */
+const BYTES_PER_MB = 1 << 20;
+export const PayloadCompressionConfig = {
+    /** 1 MiB. Binary MB is the locked cross-SDK unit. */
+    bytesPerMB: BYTES_PER_MB,
+    /** Primary compression goal for the raw bundle. */
+    rawTarget: 4 * BYTES_PER_MB,
+    /** Relaxed raw ceiling, accepted only if the projected encoded size still fits the cap. */
+    rawFallback: 4 * BYTES_PER_MB + BYTES_PER_MB / 2, // 4.5 MiB
+    /** The real guardrail: projected base64-encoded body must stay under this (margin under 6 MB). */
+    hardEncodedCap: Math.floor((57 * BYTES_PER_MB) / 10), // 5.7 MiB
+    /** Rule A trigger: combined document images larger than this start the document sub-pass. */
+    docCombinedTrigger: 4 * BYTES_PER_MB,
+    /** Rule A sub-target: pull the combined documents under this (back first, then front). */
+    docCombinedTarget: 3 * BYTES_PER_MB,
+    /** Rule B trigger: a selfie larger than this marks a face-heavy job (faces compressed first). */
+    selfieTrigger: 1 * BYTES_PER_MB,
+    /** Minimum JPEG quality for face images (selfie + liveness) — higher penalty. Pending DS sign-off. */
+    faceMinQ: 0.45,
+    /** Minimum JPEG quality for document images — preserves OCR / MRZ. Pending DS sign-off. */
+    docMinQ: 0.7,
+    /**
+     * Absolute JPEG-quality floor for the hard-guarantee pass. When a bundle is still over
+     * `rawFallback` after every image has hit its per-type floor (`faceMinQ` / `docMinQ`), the
+     * guarantee pass keeps stepping quality down to this value — below the per-type floors — so an
+     * oversized capture never fails submission on size. Matches v11's quality-10 floor.
+     */
+    absoluteMinQ: 0.1,
+    /** Quality decrement per re-encode step. */
+    qualityStep: 0.05,
+    /** Nominal re-encode start point; each asset steps down from its own capture quality. */
+    startQ: 0.9,
+    /** Fixed allowance for multipart field names + part framing not counted in image/metadata totals. */
+    structuralOverheadBytes: 2048,
+};
+/** base64 length of `n` raw bytes: `ceil(n / 3) * 4`. */
+export function base64Len(n) {
+    return Math.ceil(n / 3) * 4;
+}
+//# sourceMappingURL=payload_compression_config.js.map

package/dist/data/compression/payload_compression_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload_compression_config.js","sourceRoot":"","sources":["../../../src/data/compression/payload_compression_config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,qDAAqD;IACrD,UAAU,EAAE,YAAY;IACxB,mDAAmD;IACnD,SAAS,EAAE,CAAC,GAAG,YAAY;IAC3B,2FAA2F;IAC3F,WAAW,EAAE,CAAC,GAAG,YAAY,GAAG,YAAY,GAAG,CAAC,EAAE,UAAU;IAC5D,kGAAkG;IAClG,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU;IAChE,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,GAAG,YAAY;IACpC,0FAA0F;IAC1F,iBAAiB,EAAE,CAAC,GAAG,YAAY;IACnC,iGAAiG;IACjG,aAAa,EAAE,CAAC,GAAG,YAAY;IAC/B,sGAAsG;IACtG,QAAQ,EAAE,IAAI;IACd,2FAA2F;IAC3F,OAAO,EAAE,GAAG;IACZ;;;;;OAKG;IACH,YAAY,EAAE,GAAG;IACjB,4CAA4C;IAC5C,WAAW,EAAE,IAAI;IACjB,yFAAyF;IACzF,MAAM,EAAE,GAAG;IACX,qGAAqG;IACrG,uBAAuB,EAAE,IAAI;CACrB,CAAC;AAEX,yDAAyD;AACzD,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/data/compression/payload_compression_runner.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Per-role JPEG sizes in MB, measured before compression (`*Original`) and after (`*Final`); equal
+ * when the image was not compressed, `undefined` for an absent role. Stamped into the submission
+ * metadata so the backend sees each file's original size and its compressed size.
+ */
+export interface PayloadCompressionSizes {
+    readonly selfieOriginalMb?: number | undefined;
+    readonly selfieFinalMb?: number | undefined;
+    readonly frontOriginalMb?: number | undefined;
+    readonly frontFinalMb?: number | undefined;
+    readonly backOriginalMb?: number | undefined;
+    readonly backFinalMb?: number | undefined;
+}
+/**
+ * Builds `CompressibleAssets` from a submission's captured JPEG URIs and runs `PayloadCompressor`
+ * to bring the bundle under the transmission cap, re-stamping the Smile EXIF `image_digest` (and
+ * re-encoding natively) per step. Best-effort: it compresses each image down to its quality floor
+ * and resolves — it never throws on size, so submission is never blocked.
+ */
+export declare const PayloadCompressionRunner: {
+    compress(args: {
+        selfieImage?: string | undefined;
+        livenessImages?: readonly string[] | undefined;
+        frontDocument?: string | undefined;
+        backDocument?: string | undefined;
+        metadataBytes: number;
+    }): Promise<PayloadCompressionSizes>;
+};
+//# sourceMappingURL=payload_compression_runner.d.ts.map

package/dist/data/compression/payload_compression_runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload_compression_runner.d.ts","sourceRoot":"","sources":["../../../src/data/compression/payload_compression_runner.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAQD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;mBACd;QACnB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;QAC/C,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACnC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAClC,aAAa,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAoDrC,CAAC"}

package/dist/data/compression/payload_compression_runner.js

@@ -0,0 +1,55 @@
+import { File } from "expo-file-system";
+import { ImageType } from "@smileid/usesmileid_bridge";
+import { CameraDefaults } from "../../camera/camera_defaults";
+import { CompressibleAssets } from "./compressible_asset";
+import { PayloadCompressor } from "./payload_compressor";
+import { UriCompressibleAsset } from "./uri_compressible_asset";
+// RN `CameraDefaults` only exposes the document JPEG quality; selfie/liveness capture quality
+// match the cross-SDK values. These seed only the recompress start, which steps DOWN from here
+// (never re-encoding above the capture quality, which would inflate).
+const SELFIE_CAPTURE_QUALITY = 0.95;
+const LIVENESS_CAPTURE_QUALITY = 0.8;
+const BYTES_PER_MB = 1024 * 1024;
+function sizeInMb(uri) {
+    if (uri === undefined)
+        return undefined;
+    const bytes = new File(uri).size ?? 0;
+    return bytes > 0 ? bytes / BYTES_PER_MB : undefined;
+}
+/**
+ * Builds `CompressibleAssets` from a submission's captured JPEG URIs and runs `PayloadCompressor`
+ * to bring the bundle under the transmission cap, re-stamping the Smile EXIF `image_digest` (and
+ * re-encoding natively) per step. Best-effort: it compresses each image down to its quality floor
+ * and resolves — it never throws on size, so submission is never blocked.
+ */
+export const PayloadCompressionRunner = {
+    async compress(args) {
+        // Original JPEG sizes, measured before the compressor rewrites the files in place.
+        const selfieOriginalMb = sizeInMb(args.selfieImage);
+        const frontOriginalMb = sizeInMb(args.frontDocument);
+        const backOriginalMb = sizeInMb(args.backDocument);
+        const assets = new CompressibleAssets({
+            selfie: args.selfieImage
+                ? new UriCompressibleAsset(ImageType.Selfie, args.selfieImage, SELFIE_CAPTURE_QUALITY)
+                : undefined,
+            liveness: (args.livenessImages ?? []).map((uri) => new UriCompressibleAsset(ImageType.Liveness, uri, LIVENESS_CAPTURE_QUALITY)),
+            documentFront: args.frontDocument
+                ? new UriCompressibleAsset(ImageType.DocumentFront, args.frontDocument, CameraDefaults.documentJpegQuality)
+                : undefined,
+            documentBack: args.backDocument
+                ? new UriCompressibleAsset(ImageType.DocumentBack, args.backDocument, CameraDefaults.documentJpegQuality)
+                : undefined,
+        });
+        await PayloadCompressor.prepareBundleForTransmission(assets, args.metadataBytes);
+        // Final JPEG sizes, measured after compression (equal to the originals when not compressed).
+        return {
+            selfieOriginalMb,
+            selfieFinalMb: sizeInMb(args.selfieImage),
+            frontOriginalMb,
+            frontFinalMb: sizeInMb(args.frontDocument),
+            backOriginalMb,
+            backFinalMb: sizeInMb(args.backDocument),
+        };
+    },
+};
+//# sourceMappingURL=payload_compression_runner.js.map

package/dist/data/compression/payload_compression_runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload_compression_runner.js","sourceRoot":"","sources":["../../../src/data/compression/payload_compression_runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,8FAA8F;AAC9F,+FAA+F;AAC/F,sEAAsE;AACtE,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC;AAgBjC,SAAS,QAAQ,CAAC,GAAuB;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACtC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,KAAK,CAAC,QAAQ,CAAC,IAMd;QACC,mFAAmF;QACnF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,WAAW;gBACtB,CAAC,CAAC,IAAI,oBAAoB,CACtB,SAAS,CAAC,MAAM,EAChB,IAAI,CAAC,WAAW,EAChB,sBAAsB,CACvB;gBACH,CAAC,CAAC,SAAS;YACb,QAAQ,EAAE,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CACvC,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,oBAAoB,CACtB,SAAS,CAAC,QAAQ,EAClB,GAAG,EACH,wBAAwB,CACzB,CACJ;YACD,aAAa,EAAE,IAAI,CAAC,aAAa;gBAC/B,CAAC,CAAC,IAAI,oBAAoB,CACtB,SAAS,CAAC,aAAa,EACvB,IAAI,CAAC,aAAa,EAClB,cAAc,CAAC,mBAAmB,CACnC;gBACH,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC7B,CAAC,CAAC,IAAI,oBAAoB,CACtB,SAAS,CAAC,YAAY,EACtB,IAAI,CAAC,YAAY,EACjB,cAAc,CAAC,mBAAmB,CACnC;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,MAAM,iBAAiB,CAAC,4BAA4B,CAClD,MAAM,EACN,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,6FAA6F;QAC7F,OAAO;YACL,gBAAgB;YAChB,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;YACzC,eAAe;YACf,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;YAC1C,cAAc;YACd,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;SACzC,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/data/compression/payload_compressor.d.ts

@@ -0,0 +1,40 @@
+import { type CompressibleAsset, CompressibleAssets } from "./compressible_asset";
+/**
+ * Adaptive image-compression orchestrator that keeps a v3 submission under the Lambda payload
+ * cap. Pure decision logic over `CompressibleAssets` — the native JPEG encode + EXIF re-stamp
+ * lives behind `CompressibleAsset.recompress`.
+ *
+ * **Cross-SDK source of truth.** The size formulas, plan order, sub-rules, and loop here are
+ * mirrored byte-for-byte with the Android / iOS / Flutter SDKs. See `PayloadCompressionConfig`.
+ *
+ * Scope: image compression only. Metadata is **measured** (it counts toward the bundle and the
+ * projected encoded size) but never modified.
+ */
+export declare const PayloadCompressor: {
+    /** Raw bundle size: sum of current image bytes + serialized metadata JSON bytes. */
+    rawBundleSize(assets: CompressibleAssets, metadataBytes: number): number;
+    /**
+     * Projected size of the base64-encoded body API Gateway forwards to Lambda: images are
+     * base64-expanded, metadata JSON is counted raw, plus a fixed structural allowance. The real
+     * guardrail.
+     */
+    projectedEncodedSize(assets: CompressibleAssets, metadataBytes: number): number;
+    /**
+     * Ordered (asset, minQuality) plan. Faces take the higher penalty (lower floor); documents are
+     * preserved. Rule B (selfie > 1 MB → faces first), Rule A (documents > 4 MB → back, front,
+     * faces last), else generic (faces first).
+     */
+    buildCompressionPlan(assets: CompressibleAssets): Array<[CompressibleAsset, number]>;
+    /**
+     * Compress `assets` in place until the bundle is guaranteed to ship. Steps: early-out → Rule A
+     * document sub-target → walk the global plan to the per-type floors → hard-guarantee pass that
+     * drops past the floors (down to `absoluteMinQ`) until the bundle fits both caps. Never throws;
+     * a job never fails submission purely on payload size.
+     */
+    prepareBundleForTransmission(assets: CompressibleAssets, metadataBytes: number): Promise<void>;
+    /** True while the bundle exceeds the relaxed raw ceiling or the projected encoded cap. */
+    _overRelaxedCap(assets: CompressibleAssets, metadataBytes: number): boolean;
+    /** Reduce each asset in `group` (order matters) toward `target` as measured by `measure`. */
+    _compressGroupToTarget(group: CompressibleAsset[], minQuality: number, target: number, measure: () => number): Promise<void>;
+};
+//# sourceMappingURL=payload_compressor.d.ts.map

package/dist/data/compression/payload_compressor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload_compressor.d.ts","sourceRoot":"","sources":["../../../src/data/compression/payload_compressor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EACtB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;IAC5B,oFAAoF;0BAC9D,kBAAkB,iBAAiB,MAAM,GAAG,MAAM;IAOxE;;;;OAIG;iCAEO,kBAAkB,iBACX,MAAM,GACpB,MAAM;IAUT;;;;OAIG;iCAEO,kBAAkB,GACzB,KAAK,CAAC,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAwBrC;;;;;OAKG;yCAEO,kBAAkB,iBACX,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAoDhB,0FAA0F;4BAClE,kBAAkB,iBAAiB,MAAM,GAAG,OAAO;IAO3E,6FAA6F;kCAEpF,iBAAiB,EAAE,cACd,MAAM,UACV,MAAM,WACL,MAAM,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;CAUjB,CAAC"}