@smileid/usesmileid 12.0.0-beta01

package/src/metadata/use_smile_id_metadata.ts

@@ -0,0 +1,182 @@
+/**
+ * Metadata payload submitted alongside every job request.
+ *
+ * Wire format: a JSON array of `{name, value}` entries (NOT a flat object) — the
+ * server and partner dashboards parse it positionally; `toEntries()` produces it.
+ *
+ * Omission rules: always-present (`sdk_version`, `sdk`, `device_os`,
+ * `device_model`, `app_name`, `session_id`, `proxy`, `proximity_sensor`,
+ * `security_policy_version`); conditional strings dropped when empty; conditional
+ * integers dropped when zero; booleans always included, stringified.
+ */
+
+export type MetadataEntry = {
+  readonly name: string;
+  readonly value: string;
+};
+
+export type UseSmileIDMetadataFields = {
+  readonly sdkVersion: string;
+  readonly sdk: string;
+  readonly deviceOs: string;
+  readonly deviceModel: string;
+  readonly appName: string;
+  readonly sessionId: string;
+  readonly clientIp: string;
+  readonly networkConnection: string;
+  readonly carrierInfo: string;
+  readonly proxy: boolean;
+  readonly timezone: string;
+  readonly locale: string;
+  readonly screenResolution: string;
+  readonly memoryInfoMb: number;
+  readonly deviceOrientation: string;
+  readonly systemArchitecture: string;
+  readonly numberOfCameras: number;
+  readonly hostApplication: string;
+  readonly proximitySensor: boolean;
+  readonly securityPolicyVersion: string;
+  /** Android Keystore security level (`KeyInfo.getSecurityLevel()`, `-2`…`2`) → `supports_hardware_attestation`. Undefined on iOS and before warm-up resolves. */
+  readonly hardwareAttestationSecurityLevel?: number;
+  /** base64-DER leaf-first X.509 chain → `attestation_certificate_chain` (JSON-array string). Undefined/empty when no chain was minted. */
+  readonly attestationCertificateChain?: readonly string[];
+  /** Apple App Attest support → `supports_app_attest`. Undefined on Android and before warm-up resolves. */
+  readonly supportsAppAttest?: boolean;
+  /** Capture-param provenance → `sdk_config_source`: `"sdk_config"` when a valid JWT claim was decoded, else `"default"`. */
+  readonly sdkConfigSource: string;
+  /** Resolved selfie width (px) → `image_width`: `sdk_config.selfie.width` override (when width+height > 0) or SDK default (480). Omitted when zero. */
+  readonly imageWidth: number;
+  /** Resolved selfie height (px) → `image_height`: `sdk_config.selfie.height` override (when width+height > 0) or SDK default (640). Omitted when zero. */
+  readonly imageHeight: number;
+};
+
+export class UseSmileIDMetadata {
+  private readonly _fields: UseSmileIDMetadataFields;
+  private readonly _extraEntries: readonly MetadataEntry[];
+
+  constructor(
+    fields: UseSmileIDMetadataFields,
+    extraEntries: readonly MetadataEntry[] = [],
+  ) {
+    this._fields = fields;
+    this._extraEntries = extraEntries;
+  }
+
+  /** Snapshot of the typed fields. Useful for tests and analytics hooks. */
+  toFields(): UseSmileIDMetadataFields {
+    return this._fields;
+  }
+
+  /**
+   * Returns a copy carrying additional wire entries appended after the
+   * device-metadata fields — for flow state that is not device metadata, e.g.
+   * the per-side document image origins (`DocumentFront/BackImageOrigin`).
+   */
+  withAdditionalEntries(extra: readonly MetadataEntry[]): UseSmileIDMetadata {
+    return new UseSmileIDMetadata(this._fields, [
+      ...this._extraEntries,
+      ...extra,
+    ]);
+  }
+
+  /**
+   * Canonical wire-format serialization to an array of `{name, value}` entries.
+   * Empty strings and zero integers are dropped so the payload stays compact
+   * (e.g. an emulator with no carrier info omits `carrier_info` entirely).
+   */
+  toEntries(): readonly MetadataEntry[] {
+    const fields = this._fields;
+    const entries: MetadataEntry[] = [];
+
+    // Always-present: SDK constants, booleans, sessionId (UUID), and
+    // device_os/device_model/app_name (emitted even when empty). The rest
+    // below use the drop-when-empty rule.
+    entries.push({ name: "sdk_version", value: fields.sdkVersion });
+    entries.push({ name: "sdk", value: fields.sdk });
+    entries.push({ name: "device_os", value: fields.deviceOs });
+    entries.push({ name: "device_model", value: fields.deviceModel });
+    entries.push({ name: "app_name", value: fields.appName });
+    entries.push({ name: "session_id", value: fields.sessionId });
+
+    // Always-present booleans (stringified, never empty by construction)
+    entries.push({ name: "proxy", value: String(fields.proxy) });
+    entries.push({
+      name: "proximity_sensor",
+      value: String(fields.proximitySensor),
+    });
+
+    // Conditional strings — omitted when empty
+    pushIfNonEmpty(entries, "client_ip", fields.clientIp);
+    pushIfNonEmpty(entries, "network_connection", fields.networkConnection);
+    pushIfNonEmpty(entries, "carrier_info", fields.carrierInfo);
+    pushIfNonEmpty(entries, "timezone", fields.timezone);
+    pushIfNonEmpty(entries, "locale", fields.locale);
+    pushIfNonEmpty(entries, "screen_resolution", fields.screenResolution);
+    pushIfNonEmpty(entries, "device_orientation", fields.deviceOrientation);
+    pushIfNonEmpty(entries, "system_architecture", fields.systemArchitecture);
+    pushIfNonEmpty(entries, "host_application", fields.hostApplication);
+
+    // Conditional integers — omitted when zero
+    pushIfNonZero(entries, "memory_info", fields.memoryInfoMb);
+    pushIfNonZero(entries, "number_of_cameras", fields.numberOfCameras);
+
+    // Always-present trailer
+    entries.push({
+      name: "security_policy_version",
+      value: fields.securityPolicyVersion,
+    });
+
+    // Device-integrity capability — omitted until per-session warm-up resolves.
+    // Android: Keystore security-level integer + cert chain; iOS: App Attest flag.
+    if (fields.hardwareAttestationSecurityLevel !== undefined) {
+      entries.push({
+        name: "supports_hardware_attestation",
+        value: String(fields.hardwareAttestationSecurityLevel),
+      });
+      const chain = fields.attestationCertificateChain;
+      if (chain && chain.length > 0) {
+        entries.push({
+          name: "attestation_certificate_chain",
+          value: JSON.stringify(chain),
+        });
+      }
+    }
+    if (fields.supportsAppAttest !== undefined) {
+      entries.push({
+        name: "supports_app_attest",
+        value: String(fields.supportsAppAttest),
+      });
+    }
+
+    // sdk_config provenance — always-present string, never empty.
+    entries.push({ name: "sdk_config_source", value: fields.sdkConfigSource });
+    // Resolved selfie dimensions — omitted when zero.
+    pushIfNonZero(entries, "image_width", fields.imageWidth);
+    pushIfNonZero(entries, "image_height", fields.imageHeight);
+
+    // Flow-state entries appended after the device-metadata fields.
+    entries.push(...this._extraEntries);
+
+    return Object.freeze(entries);
+  }
+}
+
+function pushIfNonEmpty(
+  entries: MetadataEntry[],
+  name: string,
+  value: string,
+): void {
+  if (value && value.length > 0) {
+    entries.push({ name, value });
+  }
+}
+
+function pushIfNonZero(
+  entries: MetadataEntry[],
+  name: string,
+  value: number,
+): void {
+  if (value !== 0) {
+    entries.push({ name, value: String(value) });
+  }
+}

package/src/metadata/use_smile_id_metadata_factory.ts

@@ -0,0 +1,385 @@
+import { Dimensions, Platform } from "react-native";
+import {
+  Attestation,
+  type HardwareAttestation,
+} from "@smileid/usesmileid_bridge";
+import {
+  UseSmileIDMetadata,
+  type UseSmileIDMetadataFields,
+} from "./use_smile_id_metadata";
+import { loadExpoDevice, loadExpoNetwork } from "./optional_native_modules";
+import type { SdkConfig } from "../data/model/sdk_config";
+import { resolveDimensions } from "../data/model/sdk_config_capture";
+import { SdkConfigSource } from "../data/model/sdk_config_source";
+import { CameraDefaults } from "../camera/camera_defaults";
+
+/**
+ * Metadata factory.
+ *
+ * **Lifecycle:**
+ *   - **One factory per SDK session.** Construct once at flow start
+ *     (the orchestrator owns it) — `sessionId` is generated here and
+ *     reused across every submission within the flow.
+ *   - **One `make()` per API request.** Static fields (device OS,
+ *     model, system architecture, screen resolution, …) are resolved
+ *     once at construction and cached. Dynamic fields (timezone,
+ *     locale, device orientation) are re-resolved on every `make()`
+ *     so a mid-flow rotation or locale change is captured.
+ *
+ * **What's resolved here today:**
+ *   - Resolved synchronously from `react-native` core APIs at
+ *     construction: `device_os`, `screen_resolution`,
+ *     `device_orientation`, `timezone`, `locale`, `session_id`,
+ *     `sdk_version`, `sdk`, `security_policy_version`.
+ *   - Resolved synchronously from `expo-device` when present:
+ *     `device_model`, `system_architecture`, `memory_info`.
+ *   - Resolved asynchronously via fire-and-forget [warmup] from
+ *     `expo-network` when present: `client_ip`, `network_connection`.
+ *     The first [make] after construction may see empty defaults if
+ *     warmup hasn't settled; every subsequent [make] sees the
+ *     resolved values. Capture flows always take several seconds
+ *     before the first submission so the race is benign in practice.
+ *   - Partner-supplied via [MetadataFactoryOptions]: `app_name`,
+ *     `host_application`.
+ *   - Empty / zero by default until a richer native bridge lands:
+ *     `carrier_info`, `number_of_cameras`, `proximity_sensor`,
+ *     `proxy`. Partners who want these pass a custom
+ *     `MetadataProvider` to the repository.
+ */
+
+// Beta release version reported to the backend as `sdk_version`. Keep in sync
+// with the `version` field across the published package.json files.
+const SDK_VERSION = "12.0.0-beta01";
+// The security-policy axis is versioned independently of the SDK release tag,
+// so it stays at the base `12.0.0` (not the prerelease tag).
+const SECURITY_POLICY_VERSION = "12.0.0";
+const SDK_IDENTIFIER = "react-native-expo";
+
+export interface MetadataProvider {
+  /**
+   * Build a metadata snapshot for a single submission.
+   *
+   * When `sdkConfig` is provided (the decoded `sdk_config` JWT claim),
+   * the snapshot includes:
+   *   - `sdk_config_source: "sdk_config"` — the backend gates its
+   *     dimension-consistency check on this value.
+   *   - `image_width` / `image_height` — the resolved selfie capture
+   *     dimensions (server override or SDK default of 480 × 640).
+   *
+   * When `sdkConfig` is absent, `sdk_config_source` is `"default"` and
+   * `image_width` / `image_height` reflect the SDK defaults.
+   */
+  make(sdkConfig?: SdkConfig): UseSmileIDMetadata;
+
+  /**
+   * Stable per-flow session identifier — used as the analytics
+   * events' `session_id` value and the storage session directory name.
+   */
+  readonly sessionId: string;
+}
+
+export type MetadataFactoryOptions = {
+  /**
+   * Override the partner's app name. Default is empty string — RN
+   * does not expose the host-app name without `expo-application` as
+   * a peer dep. Partners using `expo-application` typically pass
+   * `Application.applicationName` here.
+   */
+  readonly appName?: string;
+  /**
+   * Override the host-app version string (e.g. `'PartnerApp v1.2.3'`).
+   * Default empty.
+   */
+  readonly hostApplication?: string;
+};
+
+export class UseSmileIDMetadataFactory implements MetadataProvider {
+  // Cached static fields (resolved once at construction).
+  private readonly _sessionId: string;
+  private readonly _deviceOs: string;
+  private readonly _deviceModel: string;
+  private readonly _appName: string;
+  private readonly _hostApplication: string;
+  private readonly _systemArchitecture: string;
+  private readonly _memoryInfoMb: number;
+  // Mutated by [warmup] once the async expo-network calls settle.
+  // Mutable on purpose — the constructor cannot block on the
+  // async API, and reading stale `""` is preferable to forcing the
+  // orchestrator to await before mounting the camera.
+  private _clientIp = "";
+  private _networkConnection = "";
+  // Per-session device-integrity snapshot, set once the fire-and-forget
+  // hardware-attestation warm-up settles. Undefined until then — make()
+  // omits the attestation metadata fields.
+  private _hardwareAttestation?: HardwareAttestation;
+
+  constructor(options: MetadataFactoryOptions = {}) {
+    this._sessionId = generateSessionId();
+    this._deviceOs = resolveDeviceOs();
+    this._appName = options.appName ?? "";
+    this._hostApplication = options.hostApplication ?? "";
+
+    // `expo-device` is an optional peer dep — populate the richer
+    // fields when it's installed, fall back to empty / zero
+    // otherwise. The check happens ONCE at construction so the
+    // require-attempt is cached for the factory's lifetime; concrete
+    // scenario this prevents: a partner without `expo-device` would
+    // otherwise pay a fresh require-failure throw on every flow
+    // mount. The optional-modules helper caches `null` distinctly
+    // from `undefined` so re-attempts are skipped.
+    const device = loadExpoDevice();
+    if (device) {
+      const brand = device.brand?.trim() ?? "";
+      const model = device.modelName?.trim() ?? "";
+      // `<brand> <model>` shape (e.g. `"Apple iPhone 15"`) — the
+      // wire format the analytics pipeline expects.
+      this._deviceModel = [brand, model].filter(Boolean).join(" ");
+      this._systemArchitecture =
+        device.supportedCpuArchitectures?.[0]?.trim() ?? "";
+      // expo-device returns `totalMemory` in BYTES; the wire format
+      // expects MB.
+      this._memoryInfoMb =
+        typeof device.totalMemory === "number" && device.totalMemory > 0
+          ? Math.round(device.totalMemory / (1024 * 1024))
+          : 0;
+    } else {
+      this._deviceModel = "";
+      this._systemArchitecture = "";
+      this._memoryInfoMb = 0;
+    }
+
+    // Fire-and-forget warmup of the async network fields. The
+    // promise is intentionally unawaited — capture flows take
+    // several seconds before the first `make()`, by which time
+    // `getNetworkStateAsync()` (typically ~10–50 ms on device) has
+    // long since settled. Any rejection is swallowed: partners
+    // without `expo-network` get empty defaults, never a thrown
+    // error.
+    void this._warmupAsync();
+
+    // Fire-and-forget hardware-attestation probe, bound to this
+    // session id. Unawaited for the same reason as the network warmup;
+    // make() omits the attestation fields until it settles.
+    void this._warmUpHardwareAttestation();
+  }
+
+  /**
+   * Stable per-flow session identifier. Used as the storage session
+   * directory name, the analytics events' `session_id` value, and the
+   * Sentry user-id for crash-report correlation (see
+   * `UseSmileIDCrashReporting.setUserId`).
+   */
+  get sessionId(): string {
+    return this._sessionId;
+  }
+
+  /**
+   * Resolve the async `expo-network` fields into the cache. Called
+   * from the constructor as fire-and-forget; partners can also
+   * `await` it explicitly when they want to guarantee populated
+   * network fields on the first submission.
+   */
+  async warmup(): Promise<void> {
+    return this._warmupAsync();
+  }
+
+  private async _warmupAsync(): Promise<void> {
+    const network = loadExpoNetwork();
+    if (!network) return;
+    // Run both calls concurrently — they're independent and the
+    // factory does not need either's result to handle the other.
+    const stateResult = network
+      .getNetworkStateAsync()
+      .then((state) => {
+        this._networkConnection = (state.type ?? "").toString();
+      })
+      .catch(() => {
+        /* leave the cached empty string */
+      });
+    const ipResult = network.getIpAddressAsync
+      ? network
+          .getIpAddressAsync()
+          .then((ip) => {
+            this._clientIp = ip ?? "";
+          })
+          .catch(() => {
+            /* leave the cached empty string */
+          })
+      : Promise.resolve();
+    await Promise.all([stateResult, ipResult]);
+  }
+
+  /**
+   * Resolve the per-session hardware-attestation snapshot. Called from the
+   * constructor as fire-and-forget. Android mints a Keystore-backed key
+   * (challenge `SHA-256(sessionId)`); iOS reports App Attest support.
+   */
+  private async _warmUpHardwareAttestation(): Promise<void> {
+    try {
+      this._hardwareAttestation = await Attestation.generateHardwareAttestation(
+        this._sessionId,
+      );
+    } catch {
+      // Fail-open: the native module may be absent (pure-JS test) or the
+      // probe may fail; leave the snapshot unset so make() omits the fields.
+    }
+  }
+
+  /** Build a metadata snapshot for a single submission. */
+  make(sdkConfig?: SdkConfig): UseSmileIDMetadata {
+    // Android carries the Keystore security level + cert chain; iOS carries
+    // the App Attest capability. The shared snapshot encodes both; pick the
+    // platform-appropriate fields so an iOS job never ships the Android
+    // Keystore field (which the server parses as a numeric security level).
+    // `exactOptionalPropertyTypes` — spread the optional fields in only when
+    // present rather than assigning `undefined`.
+    const hardware = this._hardwareAttestation;
+    const androidAttestation =
+      Platform.OS === "android" && hardware
+        ? {
+            hardwareAttestationSecurityLevel: hardware.securityLevel,
+            ...(hardware.certificateChain &&
+            hardware.certificateChain.length > 0
+              ? { attestationCertificateChain: hardware.certificateChain }
+              : {}),
+          }
+        : {};
+    const iosAttestation =
+      Platform.OS === "ios" && hardware
+        ? { supportsAppAttest: hardware.supportsAppAttest }
+        : {};
+
+    // Resolve sdk_config provenance and selfie dimensions for metadata.
+    // The backend gates its dimension-consistency check on sdk_config_source,
+    // so this value must match whether a claim was actually applied.
+    const selfieDims = resolveDimensions(sdkConfig?.selfie);
+    const sdkConfigSource =
+      sdkConfig !== undefined
+        ? SdkConfigSource.sdkConfig
+        : SdkConfigSource.defaultSource;
+    const imageWidth =
+      selfieDims?.width ?? CameraDefaults.selfieJpegTargetWidth;
+    const imageHeight =
+      selfieDims?.height ?? CameraDefaults.selfieJpegTargetHeight;
+
+    const fields: UseSmileIDMetadataFields = {
+      sdkVersion: SDK_VERSION,
+      sdk: SDK_IDENTIFIER,
+      deviceOs: this._deviceOs,
+      deviceModel: this._deviceModel,
+      appName: this._appName,
+      sessionId: this._sessionId,
+      clientIp: this._clientIp,
+      networkConnection: this._networkConnection,
+      // No expo API exposes carrier info; leave empty until a
+      // dedicated native module lands.
+      carrierInfo: "",
+      proxy: false,
+      // Dynamic — re-resolved per submission so mid-flow changes
+      // (rotation, locale switch) are captured.
+      timezone: resolveTimezone(),
+      locale: resolveLocale(),
+      screenResolution: resolveScreenResolution(),
+      memoryInfoMb: this._memoryInfoMb,
+      deviceOrientation: resolveDeviceOrientation(),
+      systemArchitecture: this._systemArchitecture,
+      numberOfCameras: 0,
+      hostApplication: this._hostApplication,
+      proximitySensor: false,
+      securityPolicyVersion: SECURITY_POLICY_VERSION,
+      ...androidAttestation,
+      ...iosAttestation,
+      sdkConfigSource,
+      imageWidth,
+      imageHeight,
+    };
+    return new UseSmileIDMetadata(fields);
+  }
+}
+
+// --- field resolvers --------------------------------------------------------
+
+function resolveDeviceOs(): string {
+  // Human-readable string with platform name + version. Examples:
+  //   "iOS 17.4"
+  //   "Android 14"
+  const platform =
+    Platform.OS === "ios"
+      ? "iOS"
+      : Platform.OS === "android"
+        ? "Android"
+        : Platform.OS;
+  const version =
+    typeof Platform.Version !== "undefined" ? String(Platform.Version) : "";
+  return version ? `${platform} ${version}` : platform;
+}
+
+function resolveTimezone(): string {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone ?? "";
+  } catch {
+    return "";
+  }
+}
+
+function resolveLocale(): string {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().locale ?? "";
+  } catch {
+    return "";
+  }
+}
+
+function resolveScreenResolution(): string {
+  try {
+    const { width, height, scale } = Dimensions.get("screen");
+    if (!width || !height) return "";
+    // Physical pixels (dp × scale), formatted as `<width> × <height>`
+    // with the U+00D7 multiplication sign.
+    const pixelWidth = Math.round(width * (scale || 1));
+    const pixelHeight = Math.round(height * (scale || 1));
+    return `${pixelWidth} × ${pixelHeight}`;
+  } catch {
+    return "";
+  }
+}
+
+function resolveDeviceOrientation(): string {
+  try {
+    const { width, height } = Dimensions.get("window");
+    if (!width || !height) return "";
+    return height >= width ? "Portrait" : "Landscape";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Generate a session-stable identifier. Prefers `crypto.randomUUID`
+ * (Hermes 0.79+ / RN 0.76+) and falls back to a Math.random-based
+ * UUID-like for older runtimes. The fallback is NOT
+ * cryptographically random — that's acceptable here because the
+ * session ID's purpose is correlation, not security.
+ */
+export function generateSessionId(): string {
+  const cryptoApi = (globalThis as { crypto?: { randomUUID?: () => string } })
+    .crypto;
+  if (cryptoApi && typeof cryptoApi.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  // Fallback: standard UUID v4 generated from Math.random.
+  // Matches the canonical 8-4-4-4-12 layout.
+  const hex = (n: number) => n.toString(16);
+  const rand = () => Math.floor(Math.random() * 0x10000);
+  return [
+    hex(rand()) + hex(rand()),
+    hex(rand()),
+    // Set the version nibble to 4 (UUID v4)
+    "4" + hex(rand()).slice(-3),
+    // Set the variant bits to 10xx
+    hex((rand() & 0x3fff) | 0x8000),
+    hex(rand()) + hex(rand()) + hex(rand()),
+  ]
+    .map((s) => s.padStart(s.length === 4 ? 4 : s.length === 12 ? 12 : 4, "0"))
+    .join("-");
+}

package/src/presentation/assets/fonts/OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2014 The DM Sans Project Authors (https://github.com/googlefonts/dm-fonts)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.