@smileid/usesmileid 12.0.1 → 12.1.0

package/src/data/repository/__tests__/network_retries.test.ts

@@ -1,117 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { AxiosError, AxiosHeaders } from "axios";
-
-import { UseSmileIDRepositoryImpl } from "../use_smile_id_repository_impl";
-import {
-  RetryStrategy,
-  type RetryConfig,
-} from "../../dsl/builder/retry_config_builder";
-import { JobType } from "../../../core/models/job_type";
-import { UseSmileIDMetadata } from "../../../metadata/use_smile_id_metadata";
-import type { EnhancedKycRequest } from "../../model/job_request";
-import type { JobSubmissionResponse } from "../../model/job_submission_response";
-import type { ConsentInformation } from "../../../core/models/params";
-
-// This file intentionally does NOT mock axios: it exercises the real retry
-// classifier (`isRetryable` → `axios.isAxiosError`) so a genuine retry happens
-// and `network_retries` can be observed on the stamped metadata.
-
-const FIXED_RETRY: RetryConfig = Object.freeze({
-  maxAttempts: 2,
-  strategy: RetryStrategy.fixed,
-  initialDelay: 0,
-  multiplier: 1,
-  maxDelay: 0,
-  jitter: 0,
-  fixedDelay: 0,
-});
-
-const CONSENT: ConsentInformation = Object.freeze({
-  granted: true,
-  grantedAt: "2026-04-30T00:00:00.000Z",
-  noticeLanguage: "EN",
-  noticePrivacyPolicyUrl: "https://example.test/p",
-});
-
-const METADATA = new UseSmileIDMetadata({
-  sdkVersion: "12.0.1",
-  sdk: "react-native-expo",
-  deviceOs: "",
-  deviceModel: "",
-  appName: "",
-  sessionId: "test-session-id",
-  clientIp: "",
-  networkConnection: "",
-  carrierInfo: "",
-  proxy: false,
-  timezone: "",
-  locale: "",
-  screenResolution: "",
-  memoryInfoMb: 0,
-  deviceOrientation: "",
-  systemArchitecture: "",
-  numberOfCameras: 0,
-  hostApplication: "",
-  proximitySensor: false,
-  securityPolicyVersion: "12.0.0",
-});
-
-function makeAxiosError(status: number): AxiosError {
-  return new AxiosError("boom", `${status}`, undefined, undefined, {
-    status,
-    statusText: "X",
-    data: undefined,
-    headers: {},
-    config: { headers: new AxiosHeaders() },
-  });
-}
-
-function networkRetriesOf(metadata: UseSmileIDMetadata): string | undefined {
-  return metadata.toEntries().find((e) => e.name === "network_retries")?.value;
-}
-
-describe("UseSmileIDRepositoryImpl — network_retries", () => {
-  it("stamps network_retries on the retried attempt and omits it on the first", async () => {
-    const response: JobSubmissionResponse = {
-      jobId: "job-1",
-      userId: "user-1",
-      status: "approved",
-      message: "ok",
-    };
-    const seenRetries: (string | undefined)[] = [];
-    const enhancedKyc = vi
-      .fn()
-      .mockImplementation((request: EnhancedKycRequest) => {
-        seenRetries.push(networkRetriesOf(request.metadata));
-        // Fail the first attempt with a retryable 500, succeed on the retry.
-        if (enhancedKyc.mock.calls.length === 1) {
-          return Promise.reject(makeAxiosError(500));
-        }
-        return Promise.resolve(response);
-      });
-    const stubApi = {
-      enhancedKyc,
-      biometricKyc: vi.fn(),
-      smartSelfieEnrollment: vi.fn(),
-      smartSelfieAuthentication: vi.fn(),
-      documentVerification: vi.fn(),
-      enhancedDocumentVerification: vi.fn(),
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any;
-    const repository = new UseSmileIDRepositoryImpl(stubApi, FIXED_RETRY);
-    const request: EnhancedKycRequest = {
-      jobType: JobType.enhancedKyc,
-      params: { idType: "NIN", idNumber: "1", country: "NG" },
-      userDetails: { givenNames: "A", lastName: "B", email: "a@b.test" },
-      consent: CONSENT,
-      metadata: METADATA,
-    };
-
-    const result = await repository.submit(request);
-
-    expect(result.status).toBe("success");
-    expect(enhancedKyc).toHaveBeenCalledTimes(2);
-    // First attempt: no retries yet. Retry attempt: one retry preceded it.
-    expect(seenRetries).toEqual([undefined, "1"]);
-  });
-});

package/src/data/repository/__tests__/use_smile_id_repository.test.ts

@@ -1,118 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-
-/**
- * Repository-level dispatch tests.
- *
- * Covers the BVN unsupported-submission path: the repository
- * short-circuits a `BvnRequest` and returns a typed
- * `InvalidFieldValueException` carrying the canonical
- * "BVN submission is not yet supported" message, without ever
- * reaching the API layer.
- */
-
-vi.mock("axios", () => ({
-  __esModule: true,
-  default: {
-    create: vi.fn(),
-    isAxiosError: () => false,
-  },
-  isAxiosError: () => false,
-}));
-
-import { UseSmileIDRepositoryImpl } from "../use_smile_id_repository_impl";
-import { InvalidFieldValueException } from "../../../core/exception/job_validation_exceptions";
-import {
-  RetryStrategy,
-  type RetryConfig,
-} from "../../../core/models/network_config";
-import type { BvnRequest } from "../../model/job_request";
-import { JobType } from "../../../core/models/job_type";
-import type { ConsentInformation } from "../../../core/models/params";
-import { UseSmileIDMetadata } from "../../../metadata/use_smile_id_metadata";
-
-const NO_RETRY: RetryConfig = Object.freeze({
-  maxAttempts: 1,
-  strategy: RetryStrategy.none,
-  initialDelay: 0,
-  multiplier: 1,
-  maxDelay: 0,
-  jitter: 0,
-  fixedDelay: 0,
-});
-
-const CONSENT: ConsentInformation = Object.freeze({
-  granted: true,
-  grantedAt: "2026-04-30T00:00:00.000Z",
-  noticeLanguage: "EN",
-  noticePrivacyPolicyUrl: "https://example.test/p",
-});
-
-// Per-submission metadata snapshot carried on every `JobRequest`. The
-// BVN path short-circuits before the API serializes it, but the field
-// is required on `BaseJobRequest` so the fixture must supply one.
-const METADATA = new UseSmileIDMetadata({
-  sdkVersion: "12.0.1",
-  sdk: "react-native-expo",
-  deviceOs: "",
-  deviceModel: "",
-  appName: "",
-  sessionId: "test-session-id",
-  clientIp: "",
-  networkConnection: "",
-  carrierInfo: "",
-  proxy: false,
-  timezone: "",
-  locale: "",
-  screenResolution: "",
-  memoryInfoMb: 0,
-  deviceOrientation: "",
-  systemArchitecture: "",
-  numberOfCameras: 0,
-  hostApplication: "",
-  proximitySensor: false,
-  securityPolicyVersion: "12.0.0",
-});
-
-describe("UseSmileIDRepositoryImpl — BVN submission", () => {
-  it("rejects BvnRequest with `BVN submission is not yet supported` without calling the API", async () => {
-    // Concrete scenario: partner configures `JobType.bvn` and the
-    // flow manager dispatches a `bvn` request to the repository.
-    // The repository must short-circuit before hitting the API.
-    const stubApi = {
-      enhancedKyc: vi.fn(),
-      biometricKyc: vi.fn(),
-      smartSelfieEnrollment: vi.fn(),
-      smartSelfieAuthentication: vi.fn(),
-      documentVerification: vi.fn(),
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any;
-    const repository = new UseSmileIDRepositoryImpl(stubApi, NO_RETRY);
-    const request: BvnRequest = {
-      jobType: JobType.bvn,
-      params: {
-        idType: "BVN",
-        idNumber: "12345678901",
-        country: "NG",
-      },
-      userDetails: {
-        givenNames: "John",
-        lastName: "Doe",
-        email: "john@example.test",
-      },
-      consent: CONSENT,
-      metadata: METADATA,
-    };
-
-    const result = await repository.submit(request);
-
-    expect(result.status).toBe("failure");
-    if (result.status === "failure") {
-      expect(result.error).toBeInstanceOf(InvalidFieldValueException);
-      const err = result.error as InvalidFieldValueException;
-      expect(err.message).toMatch(/BVN submission is not yet supported/);
-      expect(err.errorDetails?.["fieldName"]).toBe("jobType");
-    }
-    expect(stubApi.enhancedKyc).not.toHaveBeenCalled();
-    expect(stubApi.biometricKyc).not.toHaveBeenCalled();
-  });
-});

package/src/data/repository/use_smile_id_repository.ts

@@ -1,19 +0,0 @@
-import type { JobRequest } from "../model/job_request";
-import type { JobSubmissionResponse } from "../model/job_submission_response";
-import type { UseSmileIDResult } from "../../core/models/result";
-
-/**
- * Repository abstraction over `SmileIDAPI` + retry policy.
- *
- * The orchestrator depends on this interface, not the concrete
- * `UseSmileIDRepositoryImpl`, so tests can substitute an in-memory
- * repository without spinning up a real axios chain.
- */
-export interface UseSmileIDRepository {
-  /**
-   * Submit a `JobRequest`, transparently retrying network-class
-   * failures per the configured retry policy. The `request.jobType`
-   * discriminator drives dispatch to the matching API method.
-   */
-  submit(request: JobRequest): Promise<UseSmileIDResult<JobSubmissionResponse>>;
-}

package/src/data/repository/use_smile_id_repository_impl.ts

@@ -1,181 +0,0 @@
-import type { JobRequest } from "../model/job_request";
-import type { JobSubmissionResponse } from "../model/job_submission_response";
-import type { SmileIDAPI } from "../api/smile_id_api";
-import type { RetryConfig } from "../../core/models/network_config";
-import type { UseSmileIDResult } from "../../core/models/result";
-import { failure, success } from "../../core/models/result";
-import { JobType } from "../../core/models/job_type";
-import { withRetry } from "../util/retry_util";
-import { InvalidFieldValueException } from "../../core/exception/job_validation_exceptions";
-import { UseSmileIDValidationException } from "../../core/exception/use_smile_id_validation_exception";
-import {
-  mapAxiosError,
-  type UseSmileIDNetworkException,
-} from "../../core/exception/use_smile_id_network_exception";
-import {
-  PayloadCompressionRunner,
-  type PayloadCompressionSizes,
-} from "../compression/payload_compression_runner";
-import type { MetadataEntry } from "../../metadata/use_smile_id_metadata";
-
-/** Builds the per-image original/final compressed size wire entries, omitting absent/zero sizes. */
-function compressionSizeEntries(
-  sizes: PayloadCompressionSizes,
-): MetadataEntry[] {
-  const entries: MetadataEntry[] = [];
-  const push = (name: string, value: number | undefined) => {
-    if (value !== undefined && value > 0)
-      entries.push({ name, value: String(value) });
-  };
-  push("selfie_original_size", sizes.selfieOriginalMb);
-  push("selfie_final_compressed_size", sizes.selfieFinalMb);
-  push("document_front_original_size", sizes.frontOriginalMb);
-  push("document_front_final_compressed_size", sizes.frontFinalMb);
-  push("document_back_original_size", sizes.backOriginalMb);
-  push("document_back_final_compressed_size", sizes.backFinalMb);
-  return entries;
-}
-
-/**
- * Concrete repository.
- *
- * Exhaustive-switch dispatch over the `JobRequest` discriminated
- * union — adding a new variant fails to compile here until the new
- * dispatch case lands, so partner orchestrator code never silently
- * skips a request type.
- */
-export class UseSmileIDRepositoryImpl {
-  private readonly _api: SmileIDAPI;
-  private readonly _retry: RetryConfig;
-
-  constructor(api: SmileIDAPI, retry: RetryConfig) {
-    this._api = api;
-    this._retry = retry;
-  }
-
-  async submit(
-    request: JobRequest,
-  ): Promise<UseSmileIDResult<JobSubmissionResponse>> {
-    // BVN is not yet supported. Fail fast at the repository boundary
-    // with the canonical typed exception so partner `onResult` sees a
-    // structured error rather than a wire-level failure from the
-    // server.
-    if (request.jobType === JobType.bvn) {
-      return failure(
-        new InvalidFieldValueException({
-          fieldName: "jobType",
-          reason: "BVN submission is not yet supported",
-        }),
-      );
-    }
-
-    // Pre-flight payload compression — best effort: shrink the captured JPEGs under the Lambda
-    // cap before transmission (runs once, outside the retry loop), but never block submission, so
-    // any compression failure ships the captured images as-is and lets the server validate. The
-    // per-image original + final compressed sizes are stamped onto the metadata for telemetry.
-    let submitted = request;
-    try {
-      const sizes = await this._compressPayload(request);
-      const sizeEntries = sizes ? compressionSizeEntries(sizes) : [];
-      if (sizeEntries.length > 0) {
-        submitted = {
-          ...request,
-          metadata: request.metadata.withAdditionalEntries(sizeEntries),
-        };
-      }
-    } catch {
-      // Best-effort: compression is an optimization; submit the captured images as-is on failure.
-    }
-
-    try {
-      const response = await withRetry(this._retry, (attempt) =>
-        this._dispatch(submitted, attempt),
-      );
-      return success(response);
-    } catch (error) {
-      // A validation failure (e.g. a liveness-count mismatch) is a
-      // pre-network constraint violation — surface the typed exception
-      // directly rather than collapsing it into the network hierarchy, so
-      // partners can catch it as the validation error it is.
-      if (error instanceof UseSmileIDValidationException) {
-        return failure(error);
-      }
-      return failure(this._mapError(error));
-    }
-  }
-
-  /**
-   * Pre-flight payload compression entry — extracts the captured image URIs for the job type and
-   * compresses the bundle under the transmission cap (metadata is measured, never modified).
-   * No-op for job types that carry no captured images (Enhanced KYC / BVN).
-   */
-  private async _compressPayload(
-    request: JobRequest,
-  ): Promise<PayloadCompressionSizes | undefined> {
-    const metadataBytes = JSON.stringify(request.metadata.toEntries()).length;
-    switch (request.jobType) {
-      case JobType.smartSelfieEnrollment:
-      case JobType.smartSelfieAuthentication:
-      case JobType.biometricKyc:
-        return PayloadCompressionRunner.compress({
-          selfieImage: request.selfieImage,
-          livenessImages: request.livenessImages,
-          metadataBytes,
-        });
-      case JobType.documentVerification:
-      case JobType.enhancedDocumentVerification:
-        return PayloadCompressionRunner.compress({
-          selfieImage: request.selfieImage,
-          livenessImages: request.livenessImages,
-          frontDocument: request.frontDocument,
-          backDocument: request.backDocument,
-          metadataBytes,
-        });
-      default:
-        return undefined;
-    }
-  }
-
-  private _dispatch(
-    request: Exclude<JobRequest, { jobType: typeof JobType.bvn }>,
-    attempt: number,
-  ): Promise<JobSubmissionResponse> {
-    // Stamp how many network retries preceded this attempt onto the metadata
-    // (re-evaluated per attempt inside the retry loop). Appended as a flow-state
-    // entry so the already-appended document / config entries are preserved.
-    const stamped: typeof request =
-      attempt > 0
-        ? {
-            ...request,
-            metadata: request.metadata.withAdditionalEntries([
-              { name: "network_retries", value: String(attempt) },
-            ]),
-          }
-        : request;
-    switch (stamped.jobType) {
-      case JobType.smartSelfieEnrollment:
-        return this._api.smartSelfieEnrollment(stamped);
-      case JobType.smartSelfieAuthentication:
-        return this._api.smartSelfieAuthentication(stamped);
-      case JobType.enhancedKyc:
-        return this._api.enhancedKyc(stamped);
-      case JobType.biometricKyc:
-        return this._api.biometricKyc(stamped);
-      case JobType.documentVerification:
-        return this._api.documentVerification(stamped);
-      case JobType.enhancedDocumentVerification:
-        return this._api.enhancedDocumentVerification(stamped);
-    }
-  }
-
-  /**
-   * Translate any caught error into the typed
-   * [UseSmileIDNetworkException] hierarchy. Delegates to the canonical
-   * [mapAxiosError] so a single mapper implementation covers both the
-   * repository layer and any future call sites (interceptors,
-   * partner-supplied error wrappers).
-   */
-  private _mapError(error: unknown): UseSmileIDNetworkException {
-    return mapAxiosError(error);
-  }
-}

package/src/data/security/__tests__/request_canonicalizer.test.ts

@@ -1,132 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { RequestCanonicalizer } from "../request_canonicalizer";
-import { SmileIDCryptoManager } from "../smile_id_crypto_manager";
-
-/**
- * Golden-vector suite for `RequestCanonicalizer`: pins the exact canonical bytes and the resulting
- * `smileid-request-mac` for a fixed key across the shapes `canonicalize()` distinguishes. This
- * SDK's own contract with the server, not a cross-SDK guarantee.
- */
-const TIMESTAMP = "1700000000000";
-const SIGNING_SECRET = "golden-vector-secret";
-const cryptoManager = new SmileIDCryptoManager(SIGNING_SECRET);
-
-const BASE_HEADERS = {
-  "smileid-token": "golden-token",
-  "smileid-request-timestamp": TIMESTAMP,
-};
-
-type FormDataPart = { fieldName: string; string?: string; uri?: string };
-
-/** Minimal stand-in for React Native's `FormData` (only `getParts` is read). */
-function formData(parts: readonly FormDataPart[]) {
-  return { getParts: () => parts };
-}
-
-function decode(bytes: Uint8Array): string {
-  return Buffer.from(bytes).toString("utf-8");
-}
-
-const MULTIPART_BODY = formData([
-  { fieldName: "country", string: "NG" },
-  { fieldName: "allow_new_enroll", string: "true" },
-  { fieldName: "partner_params", string: '{"job_id":"j1"}' },
-  {
-    fieldName: "selfie_image",
-    uri: "data:application/octet-stream;base64,c2VsZmll",
-  },
-]);
-
-// Same logical fields as MULTIPART_BODY, in reverse part order.
-const MULTIPART_BODY_REORDERED = formData([
-  {
-    fieldName: "selfie_image",
-    uri: "data:application/octet-stream;base64,c2VsZmll",
-  },
-  { fieldName: "partner_params", string: '{"job_id":"j1"}' },
-  { fieldName: "allow_new_enroll", string: "true" },
-  { fieldName: "country", string: "NG" },
-]);
-
-const MIXED_CASE_HEADERS = {
-  "Smileid-Token": "golden-token",
-  "SMILEID-REQUEST-TIMESTAMP": TIMESTAMP,
-};
-
-describe("RequestCanonicalizer golden vectors", () => {
-  it("(a) canonicalizes a bodyless request to the signed headers + `{}`", async () => {
-    const bytes = await RequestCanonicalizer.canonicalize(
-      BASE_HEADERS,
-      undefined,
-    );
-    expect(decode(bytes)).toBe(
-      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
-    );
-    expect(await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, undefined)).toBe(
-      "qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=",
-    );
-  });
-
-  it("(b) canonicalizes a raw JSON-string body the same as a bodyless request — only FormData-shaped bodies are reconstructed", async () => {
-    const bytes = await RequestCanonicalizer.canonicalize(
-      BASE_HEADERS,
-      '{"hello":"world"}',
-    );
-    // Same canonical bytes as case (a): a JSON string isn't FormData-like,
-    // so canonicalBody() falls through to the same `{}` as no body at all.
-    expect(decode(bytes)).toBe(
-      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
-    );
-    expect(
-      await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, '{"hello":"world"}'),
-    ).toBe("qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=");
-  });
-
-  it("(c) canonicalizes a multipart FormData body: scalar, boolean-coerced, JSON, and file parts", async () => {
-    const bytes = await RequestCanonicalizer.canonicalize(
-      BASE_HEADERS,
-      MULTIPART_BODY,
-    );
-    expect(decode(bytes)).toBe(
-      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}' +
-        '{"allow_new_enroll":true,"country":"NG","partner_params":{"job_id":"j1"},"selfie_image":"c2VsZmll"}',
-    );
-    expect(
-      await cryptoManager.sign(TIMESTAMP, BASE_HEADERS, MULTIPART_BODY),
-    ).toBe("eNJqKR45aNiou4JM0yVRNYrTdhfg1VblWvsbrRndoLQ=");
-  });
-
-  it("(d) part ordering does not change the canonical bytes or the MAC", async () => {
-    const bytes = await RequestCanonicalizer.canonicalize(
-      BASE_HEADERS,
-      MULTIPART_BODY_REORDERED,
-    );
-    expect(decode(bytes)).toBe(
-      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}' +
-        '{"allow_new_enroll":true,"country":"NG","partner_params":{"job_id":"j1"},"selfie_image":"c2VsZmll"}',
-    );
-    expect(
-      await cryptoManager.sign(
-        TIMESTAMP,
-        BASE_HEADERS,
-        MULTIPART_BODY_REORDERED,
-      ),
-    ).toBe("eNJqKR45aNiou4JM0yVRNYrTdhfg1VblWvsbrRndoLQ=");
-  });
-
-  it("(e) header key casing does not change the canonical bytes or the MAC", async () => {
-    const bytes = await RequestCanonicalizer.canonicalize(
-      MIXED_CASE_HEADERS,
-      undefined,
-    );
-    // Identical to case (a): canonicalHeaders() lower-cases every header
-    // name before signing, so casing at the call site is not observable.
-    expect(decode(bytes)).toBe(
-      '{"smileid-request-timestamp":"1700000000000","smileid-token":"golden-token"}{}',
-    );
-    expect(
-      await cryptoManager.sign(TIMESTAMP, MIXED_CASE_HEADERS, undefined),
-    ).toBe("qikeRL0jNa7bZKUZdoN7tY30VvVy4ol/hcMdyg4PU4w=");
-  });
-});

package/src/data/security/__tests__/security_policy.test.ts

@@ -1,96 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { SecurityPolicy } from "../security_policy";
-
-/**
- * Pins down the server-driven security policy bit-code mapping (the contract lives in
- * `docs/Policy.md`):
- *   - `undefined` is fail-secure (every behaviour active).
- *   - bit 0 -> payload signing, bit 1 -> payload encryption, bit 2 -> rooted-device check,
- *     bit 3 -> device attestation (least-significant bit first).
- *   - Unrelated bits never cross-activate a behaviour.
- */
-describe("SecurityPolicy", () => {
-  it("undefined bit-code is fail-secure and enables every behaviour", () => {
-    const policy = SecurityPolicy.fromBitCode(undefined);
-
-    expect(policy.isPayloadSigningActive()).toBe(true);
-    expect(policy.isPayloadEncryptionActive()).toBe(true);
-    expect(policy.isRootedDeviceCheckActive()).toBe(true);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(true);
-  });
-
-  it("zero bit-code disables every behaviour", () => {
-    const policy = SecurityPolicy.fromBitCode(0);
-
-    expect(policy.isPayloadSigningActive()).toBe(false);
-    expect(policy.isPayloadEncryptionActive()).toBe(false);
-    expect(policy.isRootedDeviceCheckActive()).toBe(false);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
-  });
-
-  it("bit 0 maps to payload signing only", () => {
-    const policy = SecurityPolicy.fromBitCode(0b0001);
-
-    expect(policy.isPayloadSigningActive()).toBe(true);
-    expect(policy.isPayloadEncryptionActive()).toBe(false);
-    expect(policy.isRootedDeviceCheckActive()).toBe(false);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
-  });
-
-  it("bit 1 maps to payload encryption only", () => {
-    const policy = SecurityPolicy.fromBitCode(0b0010);
-
-    expect(policy.isPayloadSigningActive()).toBe(false);
-    expect(policy.isPayloadEncryptionActive()).toBe(true);
-    expect(policy.isRootedDeviceCheckActive()).toBe(false);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
-  });
-
-  it("bit 2 maps to rooted-device check only", () => {
-    const policy = SecurityPolicy.fromBitCode(0b0100);
-
-    expect(policy.isPayloadSigningActive()).toBe(false);
-    expect(policy.isPayloadEncryptionActive()).toBe(false);
-    expect(policy.isRootedDeviceCheckActive()).toBe(true);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
-  });
-
-  it("bit 3 maps to play integrity check only", () => {
-    const policy = SecurityPolicy.fromBitCode(0b1000);
-
-    expect(policy.isPayloadSigningActive()).toBe(false);
-    expect(policy.isPayloadEncryptionActive()).toBe(false);
-    expect(policy.isRootedDeviceCheckActive()).toBe(false);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(true);
-  });
-
-  it("combined bit-code activates exactly the set behaviours", () => {
-    // 0b1001 = payload signing (bit 0) + device attestation (bit 3).
-    const policy = SecurityPolicy.fromBitCode(0b1001);
-
-    expect(policy.isPayloadSigningActive()).toBe(true);
-    expect(policy.isPayloadEncryptionActive()).toBe(false);
-    expect(policy.isRootedDeviceCheckActive()).toBe(false);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(true);
-  });
-
-  it("all four bits set activates every behaviour", () => {
-    const policy = SecurityPolicy.fromBitCode(0b1111);
-
-    expect(policy.isPayloadSigningActive()).toBe(true);
-    expect(policy.isPayloadEncryptionActive()).toBe(true);
-    expect(policy.isRootedDeviceCheckActive()).toBe(true);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(true);
-  });
-
-  it("higher unmapped bits do not affect the known behaviours", () => {
-    // bit 4 (0b10000) is beyond the defined mapping; the four known behaviours stay off.
-    const policy = SecurityPolicy.fromBitCode(0b10000);
-
-    expect(policy.isPayloadSigningActive()).toBe(false);
-    expect(policy.isPayloadEncryptionActive()).toBe(false);
-    expect(policy.isRootedDeviceCheckActive()).toBe(false);
-    expect(policy.isPlayIntegrityCheckActive()).toBe(false);
-  });
-});