@smileid/usesmileid 12.0.1 → 12.1.0

package/dist/data/repository/use_smile_id_repository.js

@@ -1,2 +1 @@
-export {};
-//# sourceMappingURL=use_smile_id_repository.js.map
+"use strict";export{};

package/dist/data/repository/use_smile_id_repository_impl.d.ts

@@ -3,6 +3,7 @@ import type { JobSubmissionResponse } from "../model/job_submission_response";
 import type { SmileIDAPI } from "../api/smile_id_api";
 import type { RetryConfig } from "../../core/models/network_config";
 import type { UseSmileIDResult } from "../../core/models/result";
+import type { SdkConfig } from "../model/sdk_config";
 /**
  * Concrete repository.
  *
@@ -15,7 +16,7 @@ export declare class UseSmileIDRepositoryImpl {
     private readonly _api;
     private readonly _retry;
     constructor(api: SmileIDAPI, retry: RetryConfig);
-    submit(request: JobRequest): Promise<UseSmileIDResult<JobSubmissionResponse>>;
+    submit(request: JobRequest, sdkConfig?: SdkConfig | undefined): Promise<UseSmileIDResult<JobSubmissionResponse>>;
     /**
      * Pre-flight payload compression entry — extracts the captured image URIs for the job type and
      * compresses the bundle under the transmission cap (metadata is measured, never modified).
@@ -32,4 +33,3 @@ export declare class UseSmileIDRepositoryImpl {
      */
     private _mapError;
 }
-//# sourceMappingURL=use_smile_id_repository_impl.d.ts.map

package/dist/data/repository/use_smile_id_repository_impl.js

@@ -1,149 +1 @@
-import { failure, success } from "../../core/models/result";
-import { JobType } from "../../core/models/job_type";
-import { withRetry } from "../util/retry_util";
-import { InvalidFieldValueException } from "../../core/exception/job_validation_exceptions";
-import { UseSmileIDValidationException } from "../../core/exception/use_smile_id_validation_exception";
-import { mapAxiosError, } from "../../core/exception/use_smile_id_network_exception";
-import { PayloadCompressionRunner, } from "../compression/payload_compression_runner";
-/** Builds the per-image original/final compressed size wire entries, omitting absent/zero sizes. */
-function compressionSizeEntries(sizes) {
-    const entries = [];
-    const push = (name, value) => {
-        if (value !== undefined && value > 0)
-            entries.push({ name, value: String(value) });
-    };
-    push("selfie_original_size", sizes.selfieOriginalMb);
-    push("selfie_final_compressed_size", sizes.selfieFinalMb);
-    push("document_front_original_size", sizes.frontOriginalMb);
-    push("document_front_final_compressed_size", sizes.frontFinalMb);
-    push("document_back_original_size", sizes.backOriginalMb);
-    push("document_back_final_compressed_size", sizes.backFinalMb);
-    return entries;
-}
-/**
- * Concrete repository.
- *
- * Exhaustive-switch dispatch over the `JobRequest` discriminated
- * union — adding a new variant fails to compile here until the new
- * dispatch case lands, so partner orchestrator code never silently
- * skips a request type.
- */
-export class UseSmileIDRepositoryImpl {
-    _api;
-    _retry;
-    constructor(api, retry) {
-        this._api = api;
-        this._retry = retry;
-    }
-    async submit(request) {
-        // BVN is not yet supported. Fail fast at the repository boundary
-        // with the canonical typed exception so partner `onResult` sees a
-        // structured error rather than a wire-level failure from the
-        // server.
-        if (request.jobType === JobType.bvn) {
-            return failure(new InvalidFieldValueException({
-                fieldName: "jobType",
-                reason: "BVN submission is not yet supported",
-            }));
-        }
-        // Pre-flight payload compression — best effort: shrink the captured JPEGs under the Lambda
-        // cap before transmission (runs once, outside the retry loop), but never block submission, so
-        // any compression failure ships the captured images as-is and lets the server validate. The
-        // per-image original + final compressed sizes are stamped onto the metadata for telemetry.
-        let submitted = request;
-        try {
-            const sizes = await this._compressPayload(request);
-            const sizeEntries = sizes ? compressionSizeEntries(sizes) : [];
-            if (sizeEntries.length > 0) {
-                submitted = {
-                    ...request,
-                    metadata: request.metadata.withAdditionalEntries(sizeEntries),
-                };
-            }
-        }
-        catch {
-            // Best-effort: compression is an optimization; submit the captured images as-is on failure.
-        }
-        try {
-            const response = await withRetry(this._retry, (attempt) => this._dispatch(submitted, attempt));
-            return success(response);
-        }
-        catch (error) {
-            // A validation failure (e.g. a liveness-count mismatch) is a
-            // pre-network constraint violation — surface the typed exception
-            // directly rather than collapsing it into the network hierarchy, so
-            // partners can catch it as the validation error it is.
-            if (error instanceof UseSmileIDValidationException) {
-                return failure(error);
-            }
-            return failure(this._mapError(error));
-        }
-    }
-    /**
-     * Pre-flight payload compression entry — extracts the captured image URIs for the job type and
-     * compresses the bundle under the transmission cap (metadata is measured, never modified).
-     * No-op for job types that carry no captured images (Enhanced KYC / BVN).
-     */
-    async _compressPayload(request) {
-        const metadataBytes = JSON.stringify(request.metadata.toEntries()).length;
-        switch (request.jobType) {
-            case JobType.smartSelfieEnrollment:
-            case JobType.smartSelfieAuthentication:
-            case JobType.biometricKyc:
-                return PayloadCompressionRunner.compress({
-                    selfieImage: request.selfieImage,
-                    livenessImages: request.livenessImages,
-                    metadataBytes,
-                });
-            case JobType.documentVerification:
-            case JobType.enhancedDocumentVerification:
-                return PayloadCompressionRunner.compress({
-                    selfieImage: request.selfieImage,
-                    livenessImages: request.livenessImages,
-                    frontDocument: request.frontDocument,
-                    backDocument: request.backDocument,
-                    metadataBytes,
-                });
-            default:
-                return undefined;
-        }
-    }
-    _dispatch(request, attempt) {
-        // Stamp how many network retries preceded this attempt onto the metadata
-        // (re-evaluated per attempt inside the retry loop). Appended as a flow-state
-        // entry so the already-appended document / config entries are preserved.
-        const stamped = attempt > 0
-            ? {
-                ...request,
-                metadata: request.metadata.withAdditionalEntries([
-                    { name: "network_retries", value: String(attempt) },
-                ]),
-            }
-            : request;
-        switch (stamped.jobType) {
-            case JobType.smartSelfieEnrollment:
-                return this._api.smartSelfieEnrollment(stamped);
-            case JobType.smartSelfieAuthentication:
-                return this._api.smartSelfieAuthentication(stamped);
-            case JobType.enhancedKyc:
-                return this._api.enhancedKyc(stamped);
-            case JobType.biometricKyc:
-                return this._api.biometricKyc(stamped);
-            case JobType.documentVerification:
-                return this._api.documentVerification(stamped);
-            case JobType.enhancedDocumentVerification:
-                return this._api.enhancedDocumentVerification(stamped);
-        }
-    }
-    /**
-     * Translate any caught error into the typed
-     * [UseSmileIDNetworkException] hierarchy. Delegates to the canonical
-     * [mapAxiosError] so a single mapper implementation covers both the
-     * repository layer and any future call sites (interceptors,
-     * partner-supplied error wrappers).
-     */
-    _mapError(error) {
-        return mapAxiosError(error);
-    }
-}
-//# sourceMappingURL=use_smile_id_repository_impl.js.map
+"use strict";import{failure as s,success as m}from"../../core/models/result";import{JobType as a}from"../../core/models/job_type";import{withRetry as l}from"../util/retry_util";import{InvalidFieldValueException as f}from"../../core/exception/job_validation_exceptions";import{UseSmileIDValidationException as p}from"../../core/exception/use_smile_id_validation_exception";import{mapAxiosError as d}from"../../core/exception/use_smile_id_network_exception";import{PayloadCompressionRunner as c}from"../compression/payload_compression_runner";function _(r){const e=[],i=(t,n)=>{n!==void 0&&n>0&&e.push({name:t,value:String(n)})};return i("selfie_original_size",r.selfieOriginalMb),i("selfie_final_compressed_size",r.selfieFinalMb),i("document_front_original_size",r.frontOriginalMb),i("document_front_final_compressed_size",r.frontFinalMb),i("document_back_original_size",r.backOriginalMb),i("document_back_final_compressed_size",r.backFinalMb),e}export class UseSmileIDRepositoryImpl{_api;_retry;constructor(e,i){this._api=e,this._retry=i}async submit(e,i){if(e.jobType===a.bvn)return s(new f({fieldName:"jobType",reason:"BVN submission is not yet supported"}));let t=e;try{const n=await this._compressPayload(e,i),o=n?_(n):[];o.length>0&&(t={...e,metadata:e.metadata.withAdditionalEntries(o)})}catch{}try{const n=await l(this._retry,o=>this._dispatch(t,o));return m(n)}catch(n){return n instanceof p?s(n):s(this._mapError(n))}}async _compressPayload(e,i){const t=JSON.stringify(e.metadata.toEntries()).length;switch(e.jobType){case a.smartSelfieEnrollment:case a.smartSelfieAuthentication:case a.biometricKyc:return c.compress({selfieImage:e.selfieImage,livenessImages:e.livenessImages,metadataBytes:t,sdkConfig:i});case a.documentVerification:case a.enhancedDocumentVerification:return c.compress({selfieImage:e.selfieImage,livenessImages:e.livenessImages,frontDocument:e.frontDocument,backDocument:e.backDocument,metadataBytes:t,sdkConfig:i});default:return}}_dispatch(e,i){const t=i>0?{...e,metadata:e.metadata.withAdditionalEntries([{name:"network_retries",value:String(i)}])}:e;switch(t.jobType){case a.smartSelfieEnrollment:return this._api.smartSelfieEnrollment(t);case a.smartSelfieAuthentication:return this._api.smartSelfieAuthentication(t);case a.enhancedKyc:return this._api.enhancedKyc(t);case a.biometricKyc:return this._api.biometricKyc(t);case a.documentVerification:return this._api.documentVerification(t);case a.enhancedDocumentVerification:return this._api.enhancedDocumentVerification(t)}}_mapError(e){return d(e)}}

package/dist/data/security/request_canonicalizer.d.ts

@@ -1,4 +1,3 @@
 export declare const RequestCanonicalizer: {
     canonicalize(headers: Record<string, string>, body: unknown): Promise<Uint8Array>;
 };
-//# sourceMappingURL=request_canonicalizer.d.ts.map

package/dist/data/security/request_canonicalizer.js

@@ -1,132 +1 @@
-import { base64Encode, utf8Bytes } from "./signing_crypto";
-import { SmileIDCryptoError } from "./smile_id_crypto_error";
-/**
- * Reduces a request to the canonical bytes that get signed: the signed headers
- * as sorted-key JSON, followed by the canonicalised body. Canonicalisation
- * reconstructs the logical request payload the server validates against, so the
- * client and server sign the same bytes.
- *
- * The body reconstruction mirrors the server's form parser + payload processor:
- *   - JSON fields (`partner_params`, `metadata`, `failure_reason`, `consent`,
- *     `user_details`) are parsed into objects.
- *   - File parts contribute the Base64 of their bytes; repeated names (e.g.
- *     `liveness_images`) collapse into a list.
- *   - Every other field contributes its string value; a top-level `"true"` /
- *     `"false"` becomes a boolean.
- * The result is key-sorted recursively and emitted as compact JSON, then
- * `latitude`/`longitude` and the `device_movement_detected` metadata value are
- * coerced from string to number to match the server.
- */
-const SIGNED_HEADER_PREFIX = "smileid-";
-const REQUEST_MAC_HEADER = "smileid-request-mac";
-const DEVICE_NONCE_HEADER = "smileid-device-nonce";
-const JSON_FIELDS = new Set([
-    "partner_params",
-    "metadata",
-    "failure_reason",
-    "consent",
-    "user_details",
-]);
-const LATITUDE_LONGITUDE = /"(latitude|longitude)":"(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)"/g;
-const DEVICE_MOVEMENT = /("name":"device_movement_detected",.*?"value":)"(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)"/g;
-function isFormDataLike(body) {
-    return (typeof body === "object" &&
-        body !== null &&
-        typeof body.getParts === "function");
-}
-export const RequestCanonicalizer = {
-    async canonicalize(headers, body) {
-        return concat(canonicalHeaders(headers), await canonicalBody(body));
-    },
-};
-function canonicalHeaders(headers) {
-    const signed = {};
-    for (const [key, value] of Object.entries(headers)) {
-        const name = key.toLowerCase();
-        if (name.startsWith(SIGNED_HEADER_PREFIX) &&
-            name !== REQUEST_MAC_HEADER &&
-            name !== DEVICE_NONCE_HEADER) {
-            signed[name] = value;
-        }
-    }
-    return utf8Bytes(canonicalJson(signed));
-}
-async function canonicalBody(body) {
-    if (!isFormDataLike(body))
-        return utf8Bytes("{}");
-    const payload = {};
-    for (const part of body.getParts()) {
-        merge(payload, part.fieldName, await partValue(part));
-    }
-    return utf8Bytes(coerceNumbers(canonicalJson(payload)));
-}
-/** File parts (a `uri`) → Base64 of bytes; JSON fields → parsed; else string with bool coercion. */
-async function partValue(part) {
-    if (part.uri != null) {
-        // Reading a file part can reject — e.g. the captured-image `file://` URI is
-        // unreadable, or the RN runtime rejects a local-file `fetch` when the device
-        // is offline (behaviour differs between the Expo and bare-RN runtimes).
-        // Surface it as a SmileIDCryptoError so the signing interceptor's narrow
-        // catch fails open (ships the request unsigned) instead of letting the
-        // rejection escape and crash the submission flow.
-        try {
-            const response = await fetch(part.uri);
-            return base64Encode(new Uint8Array(await response.arrayBuffer()));
-        }
-        catch (cause) {
-            throw new SmileIDCryptoError(`Failed to read request part "${part.fieldName}" for signing: ${String(cause)}`);
-        }
-    }
-    const value = part.string ?? "";
-    if (JSON_FIELDS.has(part.fieldName)) {
-        try {
-            return JSON.parse(value);
-        }
-        catch {
-            return value;
-        }
-    }
-    if (value === "true")
-        return true;
-    if (value === "false")
-        return false;
-    return value;
-}
-function merge(payload, name, value) {
-    if (!(name in payload)) {
-        payload[name] = value;
-        return;
-    }
-    const existing = payload[name];
-    payload[name] = Array.isArray(existing)
-        ? [...existing, value]
-        : [existing, value];
-}
-/** Compact JSON with recursively sorted object keys (no whitespace). */
-function canonicalJson(value) {
-    return JSON.stringify(sortValue(value));
-}
-function sortValue(value) {
-    if (Array.isArray(value))
-        return value.map(sortValue);
-    if (typeof value === "object" && value !== null) {
-        const sorted = {};
-        for (const key of Object.keys(value).sort()) {
-            sorted[key] = sortValue(value[key]);
-        }
-        return sorted;
-    }
-    return value;
-}
-function coerceNumbers(json) {
-    return json
-        .replace(LATITUDE_LONGITUDE, '"$1":$2')
-        .replace(DEVICE_MOVEMENT, "$1$2");
-}
-function concat(a, b) {
-    const out = new Uint8Array(a.length + b.length);
-    out.set(a, 0);
-    out.set(b, a.length);
-    return out;
-}
-//# sourceMappingURL=request_canonicalizer.js.map
+"use strict";import{base64Encode as a,utf8Bytes as o}from"./signing_crypto";import{SmileIDCryptoError as u}from"./smile_id_crypto_error";const f="smileid-",l="smileid-request-mac",E="smileid-device-nonce",d=new Set(["partner_params","metadata","failure_reason","consent","user_details"]),m=/"(latitude|longitude)":"(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)"/g,y=/("name":"device_movement_detected",.*?"value":)"(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)"/g;function g(t){return typeof t=="object"&&t!==null&&typeof t.getParts=="function"}export const RequestCanonicalizer={async canonicalize(t,e){return w(_(t),await N(e))}};function _(t){const e={};for(const[n,r]of Object.entries(t)){const i=n.toLowerCase();i.startsWith(f)&&i!==l&&i!==E&&(e[i]=r)}return o(c(e))}async function N(t){if(!g(t))return o("{}");const e={};for(const n of t.getParts())A(e,n.fieldName,await p(n));return o(D(c(e)))}async function p(t){if(t.uri!=null)try{const n=await fetch(t.uri);return a(new Uint8Array(await n.arrayBuffer()))}catch(n){throw new u(`Failed to read request part "${t.fieldName}" for signing: ${String(n)}`)}const e=t.string??"";if(d.has(t.fieldName))try{return JSON.parse(e)}catch{return e}return e==="true"?!0:e==="false"?!1:e}function A(t,e,n){if(!(e in t)){t[e]=n;return}const r=t[e];t[e]=Array.isArray(r)?[...r,n]:[r,n]}function c(t){return JSON.stringify(s(t))}function s(t){if(Array.isArray(t))return t.map(s);if(typeof t=="object"&&t!==null){const e={};for(const n of Object.keys(t).sort())e[n]=s(t[n]);return e}return t}function D(t){return t.replace(m,'"$1":$2').replace(y,"$1$2")}function w(t,e){const n=new Uint8Array(t.length+e.length);return n.set(t,0),n.set(e,t.length),n}

package/dist/data/security/request_timestamp.d.ts

@@ -8,4 +8,3 @@
  * validates the value against its accepted clock-skew window.
  */
 export declare function currentRequestTimestamp(): string;
-//# sourceMappingURL=request_timestamp.d.ts.map

package/dist/data/security/request_timestamp.js

@@ -1,13 +1 @@
-/**
- * The request timestamp used for request signing: epoch milliseconds rendered
- * as a string.
- *
- * Stamped as the `smileid-request-timestamp` header and reused as the
- * request-MAC salt, so producing it in one place keeps the clock read and the
- * wire format consistent between the header and the signature. The server
- * validates the value against its accepted clock-skew window.
- */
-export function currentRequestTimestamp() {
-    return Date.now().toString();
-}
-//# sourceMappingURL=request_timestamp.js.map
+"use strict";export function currentRequestTimestamp(){return Date.now().toString()}

package/dist/data/security/security_policy.d.ts

@@ -40,4 +40,3 @@ export declare class SecurityPolicy {
     isPlayIntegrityCheckActive(): boolean;
     private _isSet;
 }
-//# sourceMappingURL=security_policy.d.ts.map

package/dist/data/security/security_policy.js

@@ -1,61 +1 @@
-/**
- * Server-driven security policy decoded from the integer `policy` bit-code carried as a top-level
- * claim on the SmileID JWT — a sibling of the `sdk_config` claim, not nested inside it (see
- * `decodeSecurityPolicyBitCode` and `docs/Policy.md`).
- *
- * Each bit toggles one SDK security behaviour, so the backend can dial protection up or down per
- * session without shipping a new SDK build. The bit-code contract — which bit means what — is
- * documented in `docs/Policy.md`, not here, so the four SDKs share one source of truth.
- *
- * **Fail-secure:** an absent (`undefined`) bit-code enables every behaviour, so a token that omits
- * the claim — or a malformed token that fails to decode — runs with full protection rather than
- * silently dropping security. This matches the value `undefined` produces in
- * {@link SecurityPolicy.fromBitCode}.
- *
- * **Internal by design:** this class is not exported from the package entrypoint (`src/index.ts`),
- * so it never becomes part of the partner-facing API; it exists only so the SDK can gate its own
- * request signing and device attestation.
- */
-export class SecurityPolicy {
-    static _BIT_PAYLOAD_SIGNING = 0;
-    static _BIT_PAYLOAD_ENCRYPTION = 1;
-    static _BIT_ROOTED_DEVICE_CHECK = 2;
-    static _BIT_PLAY_INTEGRITY_CHECK = 3;
-    // Fail-secure default for an absent bit-code: every known behaviour active.
-    static _ALL_ACTIVE = (1 << SecurityPolicy._BIT_PAYLOAD_SIGNING) |
-        (1 << SecurityPolicy._BIT_PAYLOAD_ENCRYPTION) |
-        (1 << SecurityPolicy._BIT_ROOTED_DEVICE_CHECK) |
-        (1 << SecurityPolicy._BIT_PLAY_INTEGRITY_CHECK);
-    _bitCode;
-    constructor(bitCode) {
-        this._bitCode = bitCode;
-    }
-    /**
-     * Decode a `bitCode` into a typed policy. An `undefined` code is fail-secure — every behaviour
-     * is active. For a defined code, behaviour `b` is active when bit `b` is set, least-significant
-     * bit first.
-     */
-    static fromBitCode(bitCode) {
-        return new SecurityPolicy(bitCode ?? SecurityPolicy._ALL_ACTIVE);
-    }
-    /** True when the server enabled request-payload HMAC signing for this session. */
-    isPayloadSigningActive() {
-        return this._isSet(SecurityPolicy._BIT_PAYLOAD_SIGNING);
-    }
-    /** True when the server enabled request-payload encryption for this session. */
-    isPayloadEncryptionActive() {
-        return this._isSet(SecurityPolicy._BIT_PAYLOAD_ENCRYPTION);
-    }
-    /** True when the server enabled the rooted / jailbroken device check for this session. */
-    isRootedDeviceCheckActive() {
-        return this._isSet(SecurityPolicy._BIT_ROOTED_DEVICE_CHECK);
-    }
-    /** True when the server enabled device attestation for this session. */
-    isPlayIntegrityCheckActive() {
-        return this._isSet(SecurityPolicy._BIT_PLAY_INTEGRITY_CHECK);
-    }
-    _isSet(bit) {
-        return ((this._bitCode >> bit) & 1) === 1;
-    }
-}
-//# sourceMappingURL=security_policy.js.map
+"use strict";export class SecurityPolicy{static _BIT_PAYLOAD_SIGNING=0;static _BIT_PAYLOAD_ENCRYPTION=1;static _BIT_ROOTED_DEVICE_CHECK=2;static _BIT_PLAY_INTEGRITY_CHECK=3;static _ALL_ACTIVE=1<<SecurityPolicy._BIT_PAYLOAD_SIGNING|1<<SecurityPolicy._BIT_PAYLOAD_ENCRYPTION|1<<SecurityPolicy._BIT_ROOTED_DEVICE_CHECK|1<<SecurityPolicy._BIT_PLAY_INTEGRITY_CHECK;_bitCode;constructor(_){this._bitCode=_}static fromBitCode(_){return new SecurityPolicy(_??SecurityPolicy._ALL_ACTIVE)}isPayloadSigningActive(){return this._isSet(SecurityPolicy._BIT_PAYLOAD_SIGNING)}isPayloadEncryptionActive(){return this._isSet(SecurityPolicy._BIT_PAYLOAD_ENCRYPTION)}isRootedDeviceCheckActive(){return this._isSet(SecurityPolicy._BIT_ROOTED_DEVICE_CHECK)}isPlayIntegrityCheckActive(){return this._isSet(SecurityPolicy._BIT_PLAY_INTEGRITY_CHECK)}_isSet(_){return(this._bitCode>>_&1)===1}}

package/dist/data/security/signing_crypto.d.ts

@@ -22,4 +22,3 @@ export declare const SigningCrypto: {
      */
     hmacSha256(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
 };
-//# sourceMappingURL=signing_crypto.d.ts.map

package/dist/data/security/signing_crypto.js

@@ -1,145 +1 @@
-import { SmileIDCryptoError } from "./smile_id_crypto_error";
-const KEY_LENGTH_BYTES = 32;
-const ITERATIONS = 200000;
-/** UTF-8 encodes a string to bytes. */
-export function utf8Bytes(input) {
-    return new TextEncoder().encode(input);
-}
-const BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-/** Standard-alphabet Base64 of [bytes] (no line wrap). */
-export function base64Encode(bytes) {
-    let out = "";
-    for (let i = 0; i < bytes.length; i += 3) {
-        const b0 = bytes[i];
-        const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
-        const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
-        out += BASE64_ALPHABET[b0 >> 2];
-        out += BASE64_ALPHABET[((b0 & 0x03) << 4) | (b1 >> 4)];
-        out +=
-            i + 1 < bytes.length
-                ? BASE64_ALPHABET[((b1 & 0x0f) << 2) | (b2 >> 6)]
-                : "=";
-        out += i + 2 < bytes.length ? BASE64_ALPHABET[b2 & 0x3f] : "=";
-    }
-    return out;
-}
-// Cached only once a provider is found. A not-found result is never cached, so a
-// provider that appears later (e.g. a partner that polyfills `globalThis.crypto`
-// or calls `react-native-quick-crypto`'s `install()` after the first signing
-// attempt) is picked up on the next call instead of being stuck throwing.
-let cachedSubtle;
-/**
- * Resolve the Web Crypto provider for request signing:
- *
- *   1. An existing global `crypto.subtle` — Node (vitest) provides it, and a
- *      runtime that already polyfills Web Crypto (e.g. a partner app that calls
- *      `react-native-quick-crypto`'s `install()`) exposes it here.
- *   2. `react-native-quick-crypto` — the native (OpenSSL) provider bundled on
- *      device. Hermes ships no `crypto.subtle`, so this is the on-device path;
- *      PBKDF2/HMAC then run in compiled native code (~ms) rather than the JS
- *      engine. Its `subtle` is read across the export shapes the package exposes
- *      (`subtle`, `webcrypto.subtle`, and the same under `default`).
- *
- * Preferring the global first means tests transparently use Node's crypto and
- * the lazy `require` is only reached on device (where Hermes has no global
- * subtle and Metro has bundled the native module) — no runtime sniffing needed.
- *
- * Returns `null` (uncached) when neither resolves; callers throw
- * {@link SmileIDCryptoError}. There is intentionally **no pure-JS PBKDF2/HMAC
- * fallback**: a pure-JS 200_000-iteration PBKDF2 takes 40–80 s on device and,
- * being silent, presents as "slow network".
- */
-function resolveSubtle() {
-    if (cachedSubtle)
-        return cachedSubtle;
-    const globalSubtle = globalThis
-        .crypto?.subtle;
-    if (globalSubtle) {
-        cachedSubtle = globalSubtle;
-        return cachedSubtle;
-    }
-    try {
-        const moduleExports = require("react-native-quick-crypto");
-        const nativeSubtle = moduleExports.subtle ??
-            moduleExports.webcrypto?.subtle ??
-            moduleExports.default?.subtle ??
-            moduleExports.default?.webcrypto?.subtle;
-        if (nativeSubtle) {
-            cachedSubtle = nativeSubtle;
-            return cachedSubtle;
-        }
-    }
-    catch {
-        // Module not installed / not linked.
-    }
-    // Not found — intentionally uncached so a later polyfill / install() resolves.
-    return null;
-}
-function requireSubtle() {
-    const subtle = resolveSubtle();
-    if (!subtle) {
-        throw new SmileIDCryptoError("No Web Crypto provider available for request signing. Install the " +
-            "`react-native-quick-crypto` peer dependency (with its peers " +
-            "`react-native-nitro-modules` and `react-native-quick-base64`), or " +
-            "expose a global `crypto.subtle`.");
-    }
-    return subtle;
-}
-/**
- * The exact bytes of [bytes] as a standalone `ArrayBuffer`. Reading `.buffer`
- * directly is wrong when the view covers only part of a larger buffer (a
- * `subarray` / `slice`), which would feed the surrounding bytes into PBKDF2/HMAC.
- */
-function exactBuffer(bytes) {
-    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-}
-/**
- * Low-level signing primitives: PBKDF2 key derivation and HMAC-SHA256. Stateless
- * and deterministic, so the server reproduces the same key and MAC from the same
- * inputs. Backed by the native Web Crypto provider resolved above.
- */
-export const SigningCrypto = {
-    /**
-     * Derives a 32-byte key from [secret] and [salt] with PBKDF2-HMAC-SHA256.
-     *
-     * @throws {SmileIDCryptoError} if no provider is available or derivation fails.
-     */
-    async deriveKey(secret, salt) {
-        const subtle = requireSubtle();
-        try {
-            const keyMaterial = await subtle.importKey("raw", exactBuffer(utf8Bytes(secret)), "PBKDF2", false, ["deriveBits"]);
-            const bits = await subtle.deriveBits({
-                name: "PBKDF2",
-                salt: exactBuffer(salt),
-                iterations: ITERATIONS,
-                hash: "SHA-256",
-            }, keyMaterial, KEY_LENGTH_BYTES * 8);
-            return new Uint8Array(bits);
-        }
-        catch (cause) {
-            if (cause instanceof SmileIDCryptoError)
-                throw cause;
-            throw new SmileIDCryptoError(`Key derivation failed: ${String(cause)}`);
-        }
-    },
-    /**
-     * Computes HMAC-SHA256 of [data] under [key].
-     *
-     * @throws {SmileIDCryptoError} if no provider is available or the MAC cannot
-     *   be computed.
-     */
-    async hmacSha256(key, data) {
-        const subtle = requireSubtle();
-        try {
-            const cryptoKey = await subtle.importKey("raw", exactBuffer(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-            const digest = await subtle.sign("HMAC", cryptoKey, exactBuffer(data));
-            return new Uint8Array(digest);
-        }
-        catch (cause) {
-            if (cause instanceof SmileIDCryptoError)
-                throw cause;
-            throw new SmileIDCryptoError(`MAC computation failed: ${String(cause)}`);
-        }
-    },
-};
-//# sourceMappingURL=signing_crypto.js.map
+"use strict";import{SmileIDCryptoError as a}from"./smile_id_crypto_error";const f=32,h=2e5;export function utf8Bytes(t){return new TextEncoder().encode(t)}const c="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";export function base64Encode(t){let n="";for(let e=0;e<t.length;e+=3){const r=t[e],o=e+1<t.length?t[e+1]:0,l=e+2<t.length?t[e+2]:0;n+=c[r>>2],n+=c[(r&3)<<4|o>>4],n+=e+1<t.length?c[(o&15)<<2|l>>6]:"=",n+=e+2<t.length?c[l&63]:"="}return n}let i;function p(){if(i)return i;const t=globalThis.crypto?.subtle;if(t)return i=t,i;try{const n=require("react-native-quick-crypto"),e=n.subtle??n.webcrypto?.subtle??n.default?.subtle??n.default?.webcrypto?.subtle;if(e)return i=e,i}catch{}return null}function u(){const t=p();if(!t)throw new a("No Web Crypto provider available for request signing. Install the `react-native-quick-crypto` peer dependency (with its peers `react-native-nitro-modules` and `react-native-quick-base64`), or expose a global `crypto.subtle`.");return t}function s(t){return t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength)}export const SigningCrypto={async deriveKey(t,n){const e=u();try{const r=await e.importKey("raw",s(utf8Bytes(t)),"PBKDF2",!1,["deriveBits"]),o=await e.deriveBits({name:"PBKDF2",salt:s(n),iterations:h,hash:"SHA-256"},r,f*8);return new Uint8Array(o)}catch(r){throw r instanceof a?r:new a(`Key derivation failed: ${String(r)}`)}},async hmacSha256(t,n){const e=u();try{const r=await e.importKey("raw",s(t),{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await e.sign("HMAC",r,s(n));return new Uint8Array(o)}catch(r){throw r instanceof a?r:new a(`MAC computation failed: ${String(r)}`)}}};

package/dist/data/security/smile_id_crypto_error.d.ts

@@ -8,4 +8,3 @@
 export declare class SmileIDCryptoError extends Error {
     constructor(message?: string);
 }
-//# sourceMappingURL=smile_id_crypto_error.d.ts.map

package/dist/data/security/smile_id_crypto_error.js

@@ -1,14 +1 @@
-/**
- * Error thrown by {@link SmileIDCryptoManager} and its supporting crypto
- * routines.
- *
- * Typed so call sites can catch a key-derivation / MAC-computation failure
- * (environment problem) intentionally rather than catching everything.
- */
-export class SmileIDCryptoError extends Error {
-    constructor(message = "SmileID request signing failed") {
-        super(message);
-        this.name = "SmileIDCryptoError";
-    }
-}
-//# sourceMappingURL=smile_id_crypto_error.js.map
+"use strict";export class SmileIDCryptoError extends Error{constructor(r="SmileID request signing failed"){super(r),this.name="SmileIDCryptoError"}}

package/dist/data/security/smile_id_crypto_manager.d.ts

@@ -27,4 +27,3 @@ export declare class SmileIDCryptoManager {
      */
     sign(timestamp: string, headers: Record<string, string>, body: unknown): Promise<string>;
 }
-//# sourceMappingURL=smile_id_crypto_manager.d.ts.map

package/dist/data/security/smile_id_crypto_manager.js

@@ -1,40 +1 @@
-import { RequestCanonicalizer } from "./request_canonicalizer";
-import { base64Encode, SigningCrypto, utf8Bytes } from "./signing_crypto";
-/**
- * Signs outbound requests so the Smile ID server can prove the bytes it
- * receives were produced by a genuine SDK install.
- *
- * The request is reduced to a canonical payload ({@link RequestCanonicalizer}),
- * the signing key is PBKDF2-derived from the Arkana secret salted with the
- * payload length and request timestamp, and the payload is HMAC-SHA256'd
- * ({@link SigningCrypto}). The Base64 result is the `smileid-request-mac` value.
- *
- * Constructed by the networking factory with the Arkana signing secret
- * (obtained from the bridge) and injected into `SmileRequestMacInterceptor`.
- * Construct directly only in tests, passing a known secret.
- */
-export class SmileIDCryptoManager {
-    _signingSecret;
-    constructor(signingSecret) {
-        this._signingSecret = signingSecret;
-    }
-    /**
-     * Signs a request's `smileid-*` headers and body.
-     *
-     * @param timestamp the value of the `smileid-request-timestamp` header,
-     *   reused here so the salt matches the header the server reads.
-     * @param headers the full request headers; only those prefixed `smileid-`
-     *   (case-insensitive) are signed.
-     * @param body the request body, canonicalised before signing.
-     * @returns the Base64-encoded HMAC.
-     * @throws {SmileIDCryptoError} if key derivation or MAC computation fails.
-     */
-    async sign(timestamp, headers, body) {
-        const payload = await RequestCanonicalizer.canonicalize(headers, body);
-        const salt = utf8Bytes(`${payload.length}${timestamp}`);
-        const key = await SigningCrypto.deriveKey(this._signingSecret, salt);
-        const mac = await SigningCrypto.hmacSha256(key, payload);
-        return base64Encode(mac);
-    }
-}
-//# sourceMappingURL=smile_id_crypto_manager.js.map
+"use strict";import{RequestCanonicalizer as r}from"./request_canonicalizer";import{base64Encode as g,SigningCrypto as e,utf8Bytes as l}from"./signing_crypto";export class SmileIDCryptoManager{_signingSecret;constructor(t){this._signingSecret=t}async sign(t,i,a){const n=await r.canonicalize(i,a),s=l(`${n.length}${t}`),c=await e.deriveKey(this._signingSecret,s),o=await e.hmacSha256(c,n);return g(o)}}

package/dist/data/smile_id_urls.d.ts

@@ -9,4 +9,3 @@ export declare const SmileIDUrls: {
     readonly production: "https://api.smileidentity.com/";
     readonly forConfig: (useSandbox: boolean) => string;
 };
-//# sourceMappingURL=smile_id_urls.d.ts.map