@smileid/usesmileid 12.0.0-beta01

package/dist/data/model/sdk_config_source.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Provenance of the capture parameters used for a given submission.
+ *
+ * Emitted as the `sdk_config_source` metadata entry on every job
+ * submission. The backend gates its dimension-consistency check on this
+ * value — reporting the wrong source causes server-side validation
+ * failures, so these wire strings are parity-critical.
+ *
+ * Wire values are intentionally lowercase snake_case to match the
+ * backend's expected strings.
+ */
+export declare const SdkConfigSource: {
+    /**
+     * Capture parameters were overridden by a valid `sdk_config` claim
+     * decoded from the JWT auth token.
+     */
+    readonly sdkConfig: "sdk_config";
+    /**
+     * No `sdk_config` claim was present (or it was structurally invalid);
+     * the SDK applied its built-in defaults throughout the flow.
+     */
+    readonly defaultSource: "default";
+};
+export type SdkConfigSourceValue = (typeof SdkConfigSource)[keyof typeof SdkConfigSource];
+//# sourceMappingURL=sdk_config_source.d.ts.map

package/dist/data/model/sdk_config_source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk_config_source.d.ts","sourceRoot":"","sources":["../../../src/data/model/sdk_config_source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;IAC1B;;;OAGG;;IAEH;;;OAGG;;CAEK,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAC9B,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC"}

package/dist/data/model/sdk_config_source.js

@@ -0,0 +1,24 @@
+/**
+ * Provenance of the capture parameters used for a given submission.
+ *
+ * Emitted as the `sdk_config_source` metadata entry on every job
+ * submission. The backend gates its dimension-consistency check on this
+ * value — reporting the wrong source causes server-side validation
+ * failures, so these wire strings are parity-critical.
+ *
+ * Wire values are intentionally lowercase snake_case to match the
+ * backend's expected strings.
+ */
+export const SdkConfigSource = {
+    /**
+     * Capture parameters were overridden by a valid `sdk_config` claim
+     * decoded from the JWT auth token.
+     */
+    sdkConfig: "sdk_config",
+    /**
+     * No `sdk_config` claim was present (or it was structurally invalid);
+     * the SDK applied its built-in defaults throughout the flow.
+     */
+    defaultSource: "default",
+};
+//# sourceMappingURL=sdk_config_source.js.map

package/dist/data/model/sdk_config_source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk_config_source.js","sourceRoot":"","sources":["../../../src/data/model/sdk_config_source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;;;OAGG;IACH,SAAS,EAAE,YAAY;IACvB;;;OAGG;IACH,aAAa,EAAE,SAAS;CAChB,CAAC"}

package/dist/data/repository/use_smile_id_repository.d.ts

@@ -0,0 +1,19 @@
+import type { JobRequest } from "../model/job_request";
+import type { JobSubmissionResponse } from "../model/job_submission_response";
+import type { UseSmileIDResult } from "../../core/models/result";
+/**
+ * Repository abstraction over `SmileIDAPI` + retry policy.
+ *
+ * The orchestrator depends on this interface, not the concrete
+ * `UseSmileIDRepositoryImpl`, so tests can substitute an in-memory
+ * repository without spinning up a real axios chain.
+ */
+export interface UseSmileIDRepository {
+    /**
+     * Submit a `JobRequest`, transparently retrying network-class
+     * failures per the configured retry policy. The `request.jobType`
+     * discriminator drives dispatch to the matching API method.
+     */
+    submit(request: JobRequest): Promise<UseSmileIDResult<JobSubmissionResponse>>;
+}
+//# sourceMappingURL=use_smile_id_repository.d.ts.map

package/dist/data/repository/use_smile_id_repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use_smile_id_repository.d.ts","sourceRoot":"","sources":["../../../src/data/repository/use_smile_id_repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;CAC/E"}

package/dist/data/repository/use_smile_id_repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=use_smile_id_repository.js.map

package/dist/data/repository/use_smile_id_repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use_smile_id_repository.js","sourceRoot":"","sources":["../../../src/data/repository/use_smile_id_repository.ts"],"names":[],"mappings":""}

package/dist/data/repository/use_smile_id_repository_impl.d.ts

@@ -0,0 +1,29 @@
+import type { JobRequest } from "../model/job_request";
+import type { JobSubmissionResponse } from "../model/job_submission_response";
+import type { SmileIDAPI } from "../api/smile_id_api";
+import type { RetryConfig } from "../../core/models/network_config";
+import type { UseSmileIDResult } from "../../core/models/result";
+/**
+ * Concrete repository.
+ *
+ * Exhaustive-switch dispatch over the `JobRequest` discriminated
+ * union — adding a new variant fails to compile here until the new
+ * dispatch case lands, so partner orchestrator code never silently
+ * skips a request type.
+ */
+export declare class UseSmileIDRepositoryImpl {
+    private readonly _api;
+    private readonly _retry;
+    constructor(api: SmileIDAPI, retry: RetryConfig);
+    submit(request: JobRequest): Promise<UseSmileIDResult<JobSubmissionResponse>>;
+    private _dispatch;
+    /**
+     * Translate any caught error into the typed
+     * [UseSmileIDNetworkException] hierarchy. Delegates to the canonical
+     * [mapAxiosError] so a single mapper implementation covers both the
+     * repository layer and any future call sites (interceptors,
+     * partner-supplied error wrappers).
+     */
+    private _mapError;
+}
+//# sourceMappingURL=use_smile_id_repository_impl.d.ts.map

package/dist/data/repository/use_smile_id_repository_impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use_smile_id_repository_impl.d.ts","sourceRoot":"","sources":["../../../src/data/repository/use_smile_id_repository_impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAWjE;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW;IAKzC,MAAM,CACV,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;IA8BnD,OAAO,CAAC,SAAS;IAmBjB;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;CAGlB"}

package/dist/data/repository/use_smile_id_repository_impl.js

@@ -0,0 +1,75 @@
+import { failure, success } from "../../core/models/result";
+import { JobType } from "../../core/models/job_type";
+import { withRetry } from "../util/retry_util";
+import { InvalidFieldValueException } from "../../core/exception/job_validation_exceptions";
+import { UseSmileIDValidationException } from "../../core/exception/use_smile_id_validation_exception";
+import { mapAxiosError, } from "../../core/exception/use_smile_id_network_exception";
+/**
+ * Concrete repository.
+ *
+ * Exhaustive-switch dispatch over the `JobRequest` discriminated
+ * union — adding a new variant fails to compile here until the new
+ * dispatch case lands, so partner orchestrator code never silently
+ * skips a request type.
+ */
+export class UseSmileIDRepositoryImpl {
+    _api;
+    _retry;
+    constructor(api, retry) {
+        this._api = api;
+        this._retry = retry;
+    }
+    async submit(request) {
+        // BVN is not yet supported. Fail fast at the repository boundary
+        // with the canonical typed exception so partner `onResult` sees a
+        // structured error rather than a wire-level failure from the
+        // server.
+        if (request.jobType === JobType.bvn) {
+            return failure(new InvalidFieldValueException({
+                fieldName: "jobType",
+                reason: "BVN submission is not yet supported",
+            }));
+        }
+        try {
+            const response = await withRetry(this._retry, () => this._dispatch(request));
+            return success(response);
+        }
+        catch (error) {
+            // A validation failure (e.g. a liveness-count mismatch) is a
+            // pre-network constraint violation — surface the typed exception
+            // directly rather than collapsing it into the network hierarchy, so
+            // partners can catch it as the validation error it is.
+            if (error instanceof UseSmileIDValidationException) {
+                return failure(error);
+            }
+            return failure(this._mapError(error));
+        }
+    }
+    _dispatch(request) {
+        switch (request.jobType) {
+            case JobType.smartSelfieEnrollment:
+                return this._api.smartSelfieEnrollment(request);
+            case JobType.smartSelfieAuthentication:
+                return this._api.smartSelfieAuthentication(request);
+            case JobType.enhancedKyc:
+                return this._api.enhancedKyc(request);
+            case JobType.biometricKyc:
+                return this._api.biometricKyc(request);
+            case JobType.documentVerification:
+                return this._api.documentVerification(request);
+            case JobType.enhancedDocumentVerification:
+                return this._api.enhancedDocumentVerification(request);
+        }
+    }
+    /**
+     * Translate any caught error into the typed
+     * [UseSmileIDNetworkException] hierarchy. Delegates to the canonical
+     * [mapAxiosError] so a single mapper implementation covers both the
+     * repository layer and any future call sites (interceptors,
+     * partner-supplied error wrappers).
+     */
+    _mapError(error) {
+        return mapAxiosError(error);
+    }
+}
+//# sourceMappingURL=use_smile_id_repository_impl.js.map

package/dist/data/repository/use_smile_id_repository_impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use_smile_id_repository_impl.js","sourceRoot":"","sources":["../../../src/data/repository/use_smile_id_repository_impl.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAC;AACvG,OAAO,EACL,aAAa,GAEd,MAAM,qDAAqD,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAClB,IAAI,CAAa;IACjB,MAAM,CAAc;IAErC,YAAY,GAAe,EAAE,KAAkB;QAC7C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAmB;QAEnB,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,UAAU;QACV,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YACpC,OAAO,OAAO,CACZ,IAAI,0BAA0B,CAAC;gBAC7B,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CACjD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;YACF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6DAA6D;YAC7D,iEAAiE;YACjE,oEAAoE;YACpE,uDAAuD;YACvD,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACnD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAEO,SAAS,CACf,OAA6D;QAE7D,QAAQ,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,KAAK,OAAO,CAAC,qBAAqB;gBAChC,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAClD,KAAK,OAAO,CAAC,yBAAyB;gBACpC,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YACtD,KAAK,OAAO,CAAC,WAAW;gBACtB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACxC,KAAK,OAAO,CAAC,YAAY;gBACvB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACzC,KAAK,OAAO,CAAC,oBAAoB;gBAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACjD,KAAK,OAAO,CAAC,4BAA4B;gBACvC,OAAO,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CAAC,KAAc;QAC9B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/dist/data/security/request_canonicalizer.d.ts

@@ -0,0 +1,4 @@
+export declare const RequestCanonicalizer: {
+    canonicalize(headers: Record<string, string>, body: unknown): Promise<Uint8Array>;
+};
+//# sourceMappingURL=request_canonicalizer.d.ts.map

package/dist/data/security/request_canonicalizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request_canonicalizer.d.ts","sourceRoot":"","sources":["../../../src/data/security/request_canonicalizer.ts"],"names":[],"mappings":"AAoDA,eAAO,MAAM,oBAAoB;0BAEpB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QACzB,OAAO,GACZ,OAAO,CAAC,UAAU,CAAC;CAGvB,CAAC"}

package/dist/data/security/request_canonicalizer.js

@@ -0,0 +1,120 @@
+import { base64Encode, utf8Bytes } from "./signing_crypto";
+/**
+ * Reduces a request to the canonical bytes that get signed: the signed headers
+ * as sorted-key JSON, followed by the canonicalised body. Canonicalisation
+ * reconstructs the logical request payload the server validates against, so the
+ * client and server sign the same bytes.
+ *
+ * The body reconstruction mirrors the server's form parser + payload processor:
+ *   - JSON fields (`partner_params`, `metadata`, `failure_reason`, `consent`,
+ *     `user_details`) are parsed into objects.
+ *   - File parts contribute the Base64 of their bytes; repeated names (e.g.
+ *     `liveness_images`) collapse into a list.
+ *   - Every other field contributes its string value; a top-level `"true"` /
+ *     `"false"` becomes a boolean.
+ * The result is key-sorted recursively and emitted as compact JSON, then
+ * `latitude`/`longitude` and the `device_movement_detected` metadata value are
+ * coerced from string to number to match the server.
+ */
+const SIGNED_HEADER_PREFIX = "smileid-";
+const REQUEST_MAC_HEADER = "smileid-request-mac";
+const DEVICE_NONCE_HEADER = "smileid-device-nonce";
+const JSON_FIELDS = new Set([
+    "partner_params",
+    "metadata",
+    "failure_reason",
+    "consent",
+    "user_details",
+]);
+const LATITUDE_LONGITUDE = /"(latitude|longitude)":"(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)"/g;
+const DEVICE_MOVEMENT = /("name":"device_movement_detected",.*?"value":)"(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)"/g;
+function isFormDataLike(body) {
+    return (typeof body === "object" &&
+        body !== null &&
+        typeof body.getParts === "function");
+}
+export const RequestCanonicalizer = {
+    async canonicalize(headers, body) {
+        return concat(canonicalHeaders(headers), await canonicalBody(body));
+    },
+};
+function canonicalHeaders(headers) {
+    const signed = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const name = key.toLowerCase();
+        if (name.startsWith(SIGNED_HEADER_PREFIX) &&
+            name !== REQUEST_MAC_HEADER &&
+            name !== DEVICE_NONCE_HEADER) {
+            signed[name] = value;
+        }
+    }
+    return utf8Bytes(canonicalJson(signed));
+}
+async function canonicalBody(body) {
+    if (!isFormDataLike(body))
+        return utf8Bytes("{}");
+    const payload = {};
+    for (const part of body.getParts()) {
+        merge(payload, part.fieldName, await partValue(part));
+    }
+    return utf8Bytes(coerceNumbers(canonicalJson(payload)));
+}
+/** File parts (a `uri`) → Base64 of bytes; JSON fields → parsed; else string with bool coercion. */
+async function partValue(part) {
+    if (part.uri != null) {
+        const response = await fetch(part.uri);
+        return base64Encode(new Uint8Array(await response.arrayBuffer()));
+    }
+    const value = part.string ?? "";
+    if (JSON_FIELDS.has(part.fieldName)) {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return value;
+        }
+    }
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    return value;
+}
+function merge(payload, name, value) {
+    if (!(name in payload)) {
+        payload[name] = value;
+        return;
+    }
+    const existing = payload[name];
+    payload[name] = Array.isArray(existing)
+        ? [...existing, value]
+        : [existing, value];
+}
+/** Compact JSON with recursively sorted object keys (no whitespace). */
+function canonicalJson(value) {
+    return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+    if (Array.isArray(value))
+        return value.map(sortValue);
+    if (typeof value === "object" && value !== null) {
+        const sorted = {};
+        for (const key of Object.keys(value).sort()) {
+            sorted[key] = sortValue(value[key]);
+        }
+        return sorted;
+    }
+    return value;
+}
+function coerceNumbers(json) {
+    return json
+        .replace(LATITUDE_LONGITUDE, '"$1":$2')
+        .replace(DEVICE_MOVEMENT, "$1$2");
+}
+function concat(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    return out;
+}
+//# sourceMappingURL=request_canonicalizer.js.map

package/dist/data/security/request_canonicalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request_canonicalizer.js","sourceRoot":"","sources":["../../../src/data/security/request_canonicalizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,oBAAoB,GAAG,UAAU,CAAC;AACxC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AACnD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,gBAAgB;IAChB,UAAU;IACV,gBAAgB;IAChB,SAAS;IACT,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,kBAAkB,GACtB,8DAA8D,CAAC;AACjE,MAAM,eAAe,GACnB,sFAAsF,CAAC;AAUzF,SAAS,cAAc,CAAC,IAAa;IACnC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,OAAQ,IAA+B,CAAC,QAAQ,KAAK,UAAU,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,KAAK,CAAC,YAAY,CAChB,OAA+B,EAC/B,IAAa;QAEb,OAAO,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;CACF,CAAC;AAEF,SAAS,gBAAgB,CAAC,OAA+B;IACvD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC/B,IACE,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;YACrC,IAAI,KAAK,kBAAkB;YAC3B,IAAI,KAAK,mBAAmB,EAC5B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAa;IACxC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,SAAS,CAAC,IAAkB;IACzC,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,YAAY,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CACZ,OAAgC,EAChC,IAAY,EACZ,KAAc;IAEd,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACtB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI;SACR,OAAO,CAAC,kBAAkB,EAAE,SAAS,CAAC;SACtC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,MAAM,CAAC,CAAa,EAAE,CAAa;IAC1C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/data/security/request_timestamp.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The request timestamp used for request signing: epoch milliseconds rendered
+ * as a string.
+ *
+ * Stamped as the `smileid-request-timestamp` header and reused as the
+ * request-MAC salt, so producing it in one place keeps the clock read and the
+ * wire format consistent between the header and the signature. The server
+ * validates the value against its accepted clock-skew window.
+ */
+export declare function currentRequestTimestamp(): string;
+//# sourceMappingURL=request_timestamp.d.ts.map

package/dist/data/security/request_timestamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request_timestamp.d.ts","sourceRoot":"","sources":["../../../src/data/security/request_timestamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD"}

package/dist/data/security/request_timestamp.js

@@ -0,0 +1,13 @@
+/**
+ * The request timestamp used for request signing: epoch milliseconds rendered
+ * as a string.
+ *
+ * Stamped as the `smileid-request-timestamp` header and reused as the
+ * request-MAC salt, so producing it in one place keeps the clock read and the
+ * wire format consistent between the header and the signature. The server
+ * validates the value against its accepted clock-skew window.
+ */
+export function currentRequestTimestamp() {
+    return Date.now().toString();
+}
+//# sourceMappingURL=request_timestamp.js.map

package/dist/data/security/request_timestamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request_timestamp.js","sourceRoot":"","sources":["../../../src/data/security/request_timestamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC"}

package/dist/data/security/signing_crypto.d.ts

@@ -0,0 +1,25 @@
+/** UTF-8 encodes a string to bytes. */
+export declare function utf8Bytes(input: string): Uint8Array;
+/** Standard-alphabet Base64 of [bytes] (no line wrap). */
+export declare function base64Encode(bytes: Uint8Array): string;
+/**
+ * Low-level signing primitives: PBKDF2 key derivation and HMAC-SHA256. Stateless
+ * and deterministic, so the server reproduces the same key and MAC from the same
+ * inputs. Backed by the native Web Crypto provider resolved above.
+ */
+export declare const SigningCrypto: {
+    /**
+     * Derives a 32-byte key from [secret] and [salt] with PBKDF2-HMAC-SHA256.
+     *
+     * @throws {SmileIDCryptoError} if no provider is available or derivation fails.
+     */
+    deriveKey(secret: string, salt: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Computes HMAC-SHA256 of [data] under [key].
+     *
+     * @throws {SmileIDCryptoError} if no provider is available or the MAC cannot
+     *   be computed.
+     */
+    hmacSha256(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+};
+//# sourceMappingURL=signing_crypto.d.ts.map

package/dist/data/security/signing_crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing_crypto.d.ts","sourceRoot":"","sources":["../../../src/data/security/signing_crypto.ts"],"names":[],"mappings":"AAiBA,uCAAuC;AACvC,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAEnD;AAKD,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAetD;AAoHD;;;;GAIG;AACH,eAAO,MAAM,aAAa;IACxB;;;;OAIG;sBACqB,MAAM,QAAQ,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IA2BtE;;;;;OAKG;oBACmB,UAAU,QAAQ,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAiBzE,CAAC"}

package/dist/data/security/signing_crypto.js

@@ -0,0 +1,145 @@
+import { SmileIDCryptoError } from "./smile_id_crypto_error";
+const KEY_LENGTH_BYTES = 32;
+const ITERATIONS = 200000;
+/** UTF-8 encodes a string to bytes. */
+export function utf8Bytes(input) {
+    return new TextEncoder().encode(input);
+}
+const BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+/** Standard-alphabet Base64 of [bytes] (no line wrap). */
+export function base64Encode(bytes) {
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 3) {
+        const b0 = bytes[i];
+        const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+        const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+        out += BASE64_ALPHABET[b0 >> 2];
+        out += BASE64_ALPHABET[((b0 & 0x03) << 4) | (b1 >> 4)];
+        out +=
+            i + 1 < bytes.length
+                ? BASE64_ALPHABET[((b1 & 0x0f) << 2) | (b2 >> 6)]
+                : "=";
+        out += i + 2 < bytes.length ? BASE64_ALPHABET[b2 & 0x3f] : "=";
+    }
+    return out;
+}
+// Cached only once a provider is found. A not-found result is never cached, so a
+// provider that appears later (e.g. a partner that polyfills `globalThis.crypto`
+// or calls `react-native-quick-crypto`'s `install()` after the first signing
+// attempt) is picked up on the next call instead of being stuck throwing.
+let cachedSubtle;
+/**
+ * Resolve the Web Crypto provider for request signing:
+ *
+ *   1. An existing global `crypto.subtle` — Node (vitest) provides it, and a
+ *      runtime that already polyfills Web Crypto (e.g. a partner app that calls
+ *      `react-native-quick-crypto`'s `install()`) exposes it here.
+ *   2. `react-native-quick-crypto` — the native (OpenSSL) provider bundled on
+ *      device. Hermes ships no `crypto.subtle`, so this is the on-device path;
+ *      PBKDF2/HMAC then run in compiled native code (~ms) rather than the JS
+ *      engine. Its `subtle` is read across the export shapes the package exposes
+ *      (`subtle`, `webcrypto.subtle`, and the same under `default`).
+ *
+ * Preferring the global first means tests transparently use Node's crypto and
+ * the lazy `require` is only reached on device (where Hermes has no global
+ * subtle and Metro has bundled the native module) — no runtime sniffing needed.
+ *
+ * Returns `null` (uncached) when neither resolves; callers throw
+ * {@link SmileIDCryptoError}. There is intentionally **no pure-JS PBKDF2/HMAC
+ * fallback**: a pure-JS 200_000-iteration PBKDF2 takes 40–80 s on device and,
+ * being silent, presents as "slow network".
+ */
+function resolveSubtle() {
+    if (cachedSubtle)
+        return cachedSubtle;
+    const globalSubtle = globalThis
+        .crypto?.subtle;
+    if (globalSubtle) {
+        cachedSubtle = globalSubtle;
+        return cachedSubtle;
+    }
+    try {
+        const moduleExports = require("react-native-quick-crypto");
+        const nativeSubtle = moduleExports.subtle ??
+            moduleExports.webcrypto?.subtle ??
+            moduleExports.default?.subtle ??
+            moduleExports.default?.webcrypto?.subtle;
+        if (nativeSubtle) {
+            cachedSubtle = nativeSubtle;
+            return cachedSubtle;
+        }
+    }
+    catch {
+        // Module not installed / not linked.
+    }
+    // Not found — intentionally uncached so a later polyfill / install() resolves.
+    return null;
+}
+function requireSubtle() {
+    const subtle = resolveSubtle();
+    if (!subtle) {
+        throw new SmileIDCryptoError("No Web Crypto provider available for request signing. Install the " +
+            "`react-native-quick-crypto` peer dependency (with its peers " +
+            "`react-native-nitro-modules` and `react-native-quick-base64`), or " +
+            "expose a global `crypto.subtle`.");
+    }
+    return subtle;
+}
+/**
+ * The exact bytes of [bytes] as a standalone `ArrayBuffer`. Reading `.buffer`
+ * directly is wrong when the view covers only part of a larger buffer (a
+ * `subarray` / `slice`), which would feed the surrounding bytes into PBKDF2/HMAC.
+ */
+function exactBuffer(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+/**
+ * Low-level signing primitives: PBKDF2 key derivation and HMAC-SHA256. Stateless
+ * and deterministic, so the server reproduces the same key and MAC from the same
+ * inputs. Backed by the native Web Crypto provider resolved above.
+ */
+export const SigningCrypto = {
+    /**
+     * Derives a 32-byte key from [secret] and [salt] with PBKDF2-HMAC-SHA256.
+     *
+     * @throws {SmileIDCryptoError} if no provider is available or derivation fails.
+     */
+    async deriveKey(secret, salt) {
+        const subtle = requireSubtle();
+        try {
+            const keyMaterial = await subtle.importKey("raw", exactBuffer(utf8Bytes(secret)), "PBKDF2", false, ["deriveBits"]);
+            const bits = await subtle.deriveBits({
+                name: "PBKDF2",
+                salt: exactBuffer(salt),
+                iterations: ITERATIONS,
+                hash: "SHA-256",
+            }, keyMaterial, KEY_LENGTH_BYTES * 8);
+            return new Uint8Array(bits);
+        }
+        catch (cause) {
+            if (cause instanceof SmileIDCryptoError)
+                throw cause;
+            throw new SmileIDCryptoError(`Key derivation failed: ${String(cause)}`);
+        }
+    },
+    /**
+     * Computes HMAC-SHA256 of [data] under [key].
+     *
+     * @throws {SmileIDCryptoError} if no provider is available or the MAC cannot
+     *   be computed.
+     */
+    async hmacSha256(key, data) {
+        const subtle = requireSubtle();
+        try {
+            const cryptoKey = await subtle.importKey("raw", exactBuffer(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+            const digest = await subtle.sign("HMAC", cryptoKey, exactBuffer(data));
+            return new Uint8Array(digest);
+        }
+        catch (cause) {
+            if (cause instanceof SmileIDCryptoError)
+                throw cause;
+            throw new SmileIDCryptoError(`MAC computation failed: ${String(cause)}`);
+        }
+    },
+};
+//# sourceMappingURL=signing_crypto.js.map

package/dist/data/security/signing_crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing_crypto.js","sourceRoot":"","sources":["../../../src/data/security/signing_crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAc7D,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,uCAAuC;AACvC,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,eAAe,GACnB,kEAAkE,CAAC;AAErE,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAChC,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,GAAG;YACD,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM;gBAClB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjD,CAAC,CAAC,GAAG,CAAC;QACV,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA+BD,iFAAiF;AACjF,iFAAiF;AACjF,6EAA6E;AAC7E,0EAA0E;AAC1E,IAAI,YAAoC,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,aAAa;IACpB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,YAAY,GAAI,UAAmD;SACtE,MAAM,EAAE,MAAM,CAAC;IAClB,IAAI,YAAY,EAAE,CAAC;QACjB,YAAY,GAAG,YAAY,CAAC;QAC5B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,2BAA2B,CAIxD,CAAC;QACF,MAAM,YAAY,GAChB,aAAa,CAAC,MAAM;YACpB,aAAa,CAAC,SAAS,EAAE,MAAM;YAC/B,aAAa,CAAC,OAAO,EAAE,MAAM;YAC7B,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;QAC3C,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,GAAG,YAAY,CAAC;YAC5B,OAAO,YAAY,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,+EAA+E;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,kBAAkB,CAC1B,oEAAoE;YAClE,8DAA8D;YAC9D,oEAAoE;YACpE,kCAAkC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CACvB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACrB,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,IAAgB;QAC9C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAC9B,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAClC;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;gBACvB,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,SAAS;aAChB,EACD,WAAW,EACX,gBAAgB,GAAG,CAAC,CACrB,CAAC;YACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB;gBAAE,MAAM,KAAK,CAAC;YACrD,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAe,EAAE,IAAgB;QAChD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,WAAW,CAAC,GAAG,CAAC,EAChB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YACvE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB;gBAAE,MAAM,KAAK,CAAC;YACrD,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/data/security/smile_id_crypto_error.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Error thrown by {@link SmileIDCryptoManager} and its supporting crypto
+ * routines.
+ *
+ * Typed so call sites can catch a key-derivation / MAC-computation failure
+ * (environment problem) intentionally rather than catching everything.
+ */
+export declare class SmileIDCryptoError extends Error {
+    constructor(message?: string);
+}
+//# sourceMappingURL=smile_id_crypto_error.d.ts.map

package/dist/data/security/smile_id_crypto_error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_id_crypto_error.d.ts","sourceRoot":"","sources":["../../../src/data/security/smile_id_crypto_error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAAmC;CAIvD"}

package/dist/data/security/smile_id_crypto_error.js

@@ -0,0 +1,14 @@
+/**
+ * Error thrown by {@link SmileIDCryptoManager} and its supporting crypto
+ * routines.
+ *
+ * Typed so call sites can catch a key-derivation / MAC-computation failure
+ * (environment problem) intentionally rather than catching everything.
+ */
+export class SmileIDCryptoError extends Error {
+    constructor(message = "SmileID request signing failed") {
+        super(message);
+        this.name = "SmileIDCryptoError";
+    }
+}
+//# sourceMappingURL=smile_id_crypto_error.js.map

package/dist/data/security/smile_id_crypto_error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_id_crypto_error.js","sourceRoot":"","sources":["../../../src/data/security/smile_id_crypto_error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,GAAG,gCAAgC;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/data/security/smile_id_crypto_manager.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Signs outbound requests so the Smile ID server can prove the bytes it
+ * receives were produced by a genuine SDK install.
+ *
+ * The request is reduced to a canonical payload ({@link RequestCanonicalizer}),
+ * the signing key is PBKDF2-derived from the Arkana secret salted with the
+ * payload length and request timestamp, and the payload is HMAC-SHA256'd
+ * ({@link SigningCrypto}). The Base64 result is the `smileid-request-mac` value.
+ *
+ * Constructed by the networking factory with the Arkana signing secret
+ * (obtained from the bridge) and injected into `SmileRequestMacInterceptor`.
+ * Construct directly only in tests, passing a known secret.
+ */
+export declare class SmileIDCryptoManager {
+    private readonly _signingSecret;
+    constructor(signingSecret: string);
+    /**
+     * Signs a request's `smileid-*` headers and body.
+     *
+     * @param timestamp the value of the `smileid-request-timestamp` header,
+     *   reused here so the salt matches the header the server reads.
+     * @param headers the full request headers; only those prefixed `smileid-`
+     *   (case-insensitive) are signed.
+     * @param body the request body, canonicalised before signing.
+     * @returns the Base64-encoded HMAC.
+     * @throws {SmileIDCryptoError} if key derivation or MAC computation fails.
+     */
+    sign(timestamp: string, headers: Record<string, string>, body: unknown): Promise<string>;
+}
+//# sourceMappingURL=smile_id_crypto_manager.d.ts.map

package/dist/data/security/smile_id_crypto_manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_id_crypto_manager.d.ts","sourceRoot":"","sources":["../../../src/data/security/smile_id_crypto_manager.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,aAAa,EAAE,MAAM;IAIjC;;;;;;;;;;OAUG;IACG,IAAI,CACR,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC;CAOnB"}