@smileid/usesmileid 12.0.2 → 12.1.0

package/dist/core/models/result.js

@@ -1,17 +1 @@
-/** A successful outcome carrying the resulting value. */
-export function success(value) {
-    return { status: "success", value };
-}
-/** A failed outcome carrying the causing error. */
-export function failure(error) {
-    return { status: "failure", error };
-}
-/**
- * The user deliberately exited the flow without completing or failing it
- * (e.g. back-pressed out of the first screen) — distinct from a failure
- * so cancellation can be handled separately.
- */
-export function cancelled() {
-    return { status: "cancelled" };
-}
-//# sourceMappingURL=result.js.map
+"use strict";export function success(t){return{status:"success",value:t}}export function failure(t){return{status:"failure",error:t}}export function cancelled(){return{status:"cancelled"}}

package/dist/data/api/auth/token_holder.d.ts

@@ -37,4 +37,3 @@ export declare class TokenHolder {
      */
     refreshSingleFlight(previousToken: string, refreshCallback: (previousToken: string) => Promise<string | null>): Promise<string | null>;
 }
-//# sourceMappingURL=token_holder.d.ts.map

package/dist/data/api/auth/token_holder.js

@@ -1,67 +1 @@
-/**
- * Thread-safe holder for the partner-supplied `smileid-token`.
- *
- * The token is mutable at runtime so a partner-supplied refresh callback can
- * replace it on a 401 response and subsequent requests automatically pick up
- * the fresh value via `SmileAuthInterceptor` (and `SmileRequestMacInterceptor`
- * when MAC stamping is re-enabled). JavaScript's single-threaded event loop
- * provides safe publication of field writes; this class adds **single-flight**
- * refresh semantics so concurrent 401s collapse into one partner-callback
- * invocation.
- */
-export class TokenHolder {
-    _token;
-    _inflight = null;
-    constructor(initialToken) {
-        this._token = initialToken;
-    }
-    /** Current token. Returns the latest value any refresh has written. */
-    get current() {
-        return this._token;
-    }
-    /**
-     * Replace the current token. Visible for integration tests that simulate a
-     * refresh without driving a full HTTP round-trip; production refresh flows
-     * always update the holder via {@link refreshSingleFlight}.
-     */
-    update(newToken) {
-        this._token = newToken;
-    }
-    /**
-     * Single-flight refresh.
-     *
-     * If another concurrent caller already refreshed the token while this caller
-     * was awaiting, return the new token without re-invoking `refreshCallback`.
-     * If a refresh is already in flight, join it instead of starting a second
-     * one. Otherwise invoke the callback, store the result, and return it.
-     *
-     * `refreshCallback` is supplied by the caller as a non-throwing
-     * `Promise<string | null>` returning function; `TokenRefreshInterceptor`
-     * wraps the partner-facing `(previous) => Promise<string>` so any thrown
-     * exception is collapsed to `null`. A `null` return tells the caller to
-     * surface the original 401 unchanged.
-     */
-    async refreshSingleFlight(previousToken, refreshCallback) {
-        if (this._token !== previousToken) {
-            return this._token;
-        }
-        if (this._inflight) {
-            return this._inflight;
-        }
-        const promise = (async () => {
-            try {
-                const next = await refreshCallback(previousToken);
-                if (next !== null) {
-                    this._token = next;
-                }
-                return next;
-            }
-            finally {
-                this._inflight = null;
-            }
-        })();
-        this._inflight = promise;
-        return promise;
-    }
-}
-//# sourceMappingURL=token_holder.js.map
+"use strict";export class TokenHolder{_token;_inflight=null;constructor(t){this._token=t}get current(){return this._token}update(t){this._token=t}async refreshSingleFlight(t,e){if(this._token!==t)return this._token;if(this._inflight)return this._inflight;const i=(async()=>{try{const n=await e(t);return n!==null&&(this._token=n),n}finally{this._inflight=null}})();return this._inflight=i,i}}

package/dist/data/api/interceptors/gzip_interceptor.d.ts

@@ -18,4 +18,3 @@ import type { Interceptor } from "../../../core/models/network_config";
  * network stack.
  */
 export declare function createGzipInterceptor(): Interceptor;
-//# sourceMappingURL=gzip_interceptor.d.ts.map

package/dist/data/api/interceptors/gzip_interceptor.js

@@ -1,29 +1 @@
-/**
- * Interceptor that stamps `Accept-Encoding: gzip` on every outbound
- * request so the server is invited to gzip its response. This is the
- * same hint-only strategy iOS's `GzipRequestInterceptor` uses.
- *
- * Why hint-only on RN:
- * - axios in React Native does not natively compress outbound bodies.
- * - The SDK avoids pulling in a JS gzip dependency (`pako` etc.)
- *   because every additional bundle byte ships to every partner app.
- * - Stamping `Content-Encoding: gzip` without actually gzipping the
- *   body — the prior behavior of this interceptor — was wrong: the
- *   header told the server the body was gzipped when it was not.
- *   Servers strict-parsing the header would reject the request.
- *
- * Partners whose backends require true request-body compression
- * should add their own compressing interceptor in front of the SDK's
- * network stack.
- */
-export function createGzipInterceptor() {
-    return {
-        attach(client) {
-            client.interceptors.request.use((requestConfig) => {
-                requestConfig.headers.set("Accept-Encoding", "gzip");
-                return requestConfig;
-            });
-        },
-    };
-}
-//# sourceMappingURL=gzip_interceptor.js.map
+"use strict";export function createGzipInterceptor(){return{attach(t){t.interceptors.request.use(e=>(e.headers.set("Accept-Encoding","gzip"),e))}}}

package/dist/data/api/interceptors/logging_interceptor.d.ts

@@ -23,4 +23,3 @@ export declare function attachLoggingInterceptor(client: AxiosInstance, config:
     request: number;
     response: number;
 };
-//# sourceMappingURL=logging_interceptor.d.ts.map

package/dist/data/api/interceptors/logging_interceptor.js

@@ -1,108 +1 @@
-import { LogLevel, } from "../../../core/models/network_config";
-import { ALWAYS_REDACT, ALWAYS_REDACT_BODY_KEYS } from "./sensitive_headers";
-/**
- * Logging interceptor.
- *
- * Levels:
- *   - `none`:    silent
- *   - `basic`:   request line + response status line
- *   - `headers`: basic + request/response headers (with redaction)
- *   - `body`:    headers + response body / error body (request body
- *                is large — multipart binaries — and not logged)
- *
- * Header redaction: the auth interceptor adds sensitive headers
- * (`SmileID-Token`, `smileid-partner-id`) and partners can extend
- * the redaction list via
- * `n.logging((l) => { l.redactHeaders = ['x-proxy-secret']; })`.
- *
- * One concrete security guard: redact list is case-insensitive —
- * partners pass `'x-Partner-Token'` and we redact `'x-partner-token'`
- * too.
- */
-// Canonical redact set lives in a dedicated module so a new sensitive
-// header can be added in one place and picked up by every logging path.
-export function attachLoggingInterceptor(client, config) {
-    if (!config.enabled || config.level === LogLevel.none) {
-        // Attach no-op interceptors so `eject(...)` calls match.
-        const noopReq = client.interceptors.request.use((c) => c);
-        const noopRes = client.interceptors.response.use((r) => r);
-        return { request: noopReq, response: noopRes };
-    }
-    const partnerRedact = new Set(config.redactHeaders.map((h) => h.toLowerCase()));
-    const requestId = client.interceptors.request.use((c) => {
-        logRequest(c, config.level, partnerRedact);
-        return c;
-    });
-    const responseId = client.interceptors.response.use((response) => {
-        logResponse(response, config.level);
-        return response;
-    }, (error) => {
-        logError(error, config.level);
-        return Promise.reject(error);
-    });
-    return { request: requestId, response: responseId };
-}
-function logRequest(config, level, partnerRedact) {
-    const method = (config.method ?? "GET").toUpperCase();
-    const url = `${config.baseURL ?? ""}${config.url ?? ""}`;
-    // eslint-disable-next-line no-console
-    console.log(`[UseSmileID] → ${method} ${url}`);
-    if (level === LogLevel.headers || level === LogLevel.body) {
-        const redacted = redactHeaders(config.headers, partnerRedact);
-        // eslint-disable-next-line no-console
-        console.log("[UseSmileID]   headers:", redacted);
-    }
-}
-function logResponse(response, level) {
-    // eslint-disable-next-line no-console
-    console.log(`[UseSmileID] ← ${response.status} ${response.statusText} ${response.config.url ?? ""}`);
-    if (level === LogLevel.body) {
-        // eslint-disable-next-line no-console
-        console.log("[UseSmileID]   body:", redactBody(response.data));
-    }
-}
-function logError(error, level) {
-    const status = error.response?.status ?? "no-response";
-    // eslint-disable-next-line no-console
-    console.warn(`[UseSmileID] ✗ ${status} ${error.config?.url ?? ""} — ${error.message}`);
-    if (level === LogLevel.body && error.response) {
-        // eslint-disable-next-line no-console
-        console.warn("[UseSmileID]   body:", redactBody(error.response.data));
-    }
-}
-const MAX_REDACT_DEPTH = 6;
-/**
- * Copy of `data` safe to log — sensitive keys masked, recursion capped
- * at {@link MAX_REDACT_DEPTH}. Never mutates the input.
- */
-function redactBody(data, depth = 0) {
-    if (depth >= MAX_REDACT_DEPTH)
-        return "<depth-limit>";
-    if (Array.isArray(data)) {
-        return data.map((item) => redactBody(item, depth + 1));
-    }
-    if (data !== null && typeof data === "object") {
-        const out = {};
-        for (const [key, value] of Object.entries(data)) {
-            out[key] = ALWAYS_REDACT_BODY_KEYS.has(key.toLowerCase())
-                ? "<redacted>"
-                : redactBody(value, depth + 1);
-        }
-        return out;
-    }
-    return data;
-}
-function redactHeaders(headers, partnerRedact) {
-    const out = {};
-    for (const [key, value] of Object.entries(headers ?? {})) {
-        const lower = key.toLowerCase();
-        if (ALWAYS_REDACT.has(lower) || partnerRedact.has(lower)) {
-            out[key] = "<redacted>";
-        }
-        else {
-            out[key] = value;
-        }
-    }
-    return out;
-}
-//# sourceMappingURL=logging_interceptor.js.map
+"use strict";import{LogLevel as u}from"../../../core/models/network_config";import{ALWAYS_REDACT as i,ALWAYS_REDACT_BODY_KEYS as p}from"./sensitive_headers";export function attachLoggingInterceptor(e,t){if(!t.enabled||t.level===u.none){const o=e.interceptors.request.use(l=>l),a=e.interceptors.response.use(l=>l);return{request:o,response:a}}const s=new Set(t.redactHeaders.map(o=>o.toLowerCase())),r=e.interceptors.request.use(o=>(m(o,t.level,s),o)),n=e.interceptors.response.use(o=>(b(o,t.level),o),o=>(y(o,t.level),Promise.reject(o)));return{request:r,response:n}}const d=/^([a-z][a-z\d+\-.]*:)?\/\//i;function f(e){const t=e.baseURL??"",s=e.url??"";return!t||d.test(s)?s:s?`${t.replace(/\/+$/,"")}/${s.replace(/^\/+/,"")}`:t}function m(e,t,s){const r=(e.method??"GET").toUpperCase(),n=f(e);if(console.log(`[UseSmileID] \u2192 ${r} ${n}`),t===u.headers||t===u.body){const o=D(e.headers,s);console.log("[UseSmileID]   headers:",o)}}function b(e,t){console.log(`[UseSmileID] \u2190 ${e.status} ${e.statusText} ${e.config.url??""}`),t===u.body&&console.log("[UseSmileID]   body:",c(e.data))}function y(e,t){const s=e.response?.status??"no-response";console.warn(`[UseSmileID] \u2717 ${s} ${e.config?.url??""} \u2014 ${e.message}`),t===u.body&&e.response&&console.warn("[UseSmileID]   body:",c(e.response.data))}const A=6;function c(e,t=0){if(t>=A)return"<depth-limit>";if(Array.isArray(e))return e.map(s=>c(s,t+1));if(e!==null&&typeof e=="object"){const s={};for(const[r,n]of Object.entries(e))s[r]=p.has(r.toLowerCase())?"<redacted>":c(n,t+1);return s}return e}function D(e,t){const s={};for(const[r,n]of Object.entries(e??{})){const o=r.toLowerCase();i.has(o)||t.has(o)?s[r]="<redacted>":s[r]=n}return s}

package/dist/data/api/interceptors/sensitive_headers.d.ts

@@ -23,4 +23,3 @@ export declare const ALWAYS_REDACT: ReadonlySet<string>;
  * signed-response envelopes). Matched case-insensitively by full key.
  */
 export declare const ALWAYS_REDACT_BODY_KEYS: ReadonlySet<string>;
-//# sourceMappingURL=sensitive_headers.d.ts.map

package/dist/data/api/interceptors/sensitive_headers.js

@@ -1,42 +1 @@
-/**
- * Canonical list of HTTP headers the SDK redacts unconditionally from
- * any partner-visible log line, regardless of whether the partner
- * remembered to populate `redactHeaders` themselves.
- *
- * These headers carry credentials, session tokens, or partner-id signals
- * that would let a bystander reading the console output impersonate the
- * partner's backend. The logging interceptor replaces the value with
- * `██` while preserving the header name, so the audit trail still
- * shows the header was present.
- *
- * Partners can extend this set via
- * `n.logging((l) => { l.redactHeaders = ['x-partner-proxy-secret']; })` —
- * the auto-applied + partner-supplied lists are unioned before logging.
- *
- * Names are stored lowercase; the logging interceptor matches
- * case-insensitively.
- */
-export const ALWAYS_REDACT = new Set([
-    "smileid-token",
-    "smileid-partner-id",
-    "smileid-api-key",
-    "smileid-device-nonce",
-    "authorization",
-    "cookie",
-    "set-cookie",
-].map((h) => h.toLowerCase()));
-/**
- * JSON body fields redacted unconditionally from `LogLevel.body` log
- * lines — credentials the server may echo back (token exchange,
- * signed-response envelopes). Matched case-insensitively by full key.
- */
-export const ALWAYS_REDACT_BODY_KEYS = new Set([
-    "token",
-    "api_key",
-    "apikey",
-    "signature",
-    "secret",
-    "authorization",
-    "session_id",
-].map((k) => k.toLowerCase()));
-//# sourceMappingURL=sensitive_headers.js.map
+"use strict";export const ALWAYS_REDACT=new Set(["smileid-token","smileid-partner-id","smileid-api-key","smileid-device-nonce","authorization","cookie","set-cookie"].map(e=>e.toLowerCase())),ALWAYS_REDACT_BODY_KEYS=new Set(["token","api_key","apikey","signature","secret","authorization","session_id"].map(e=>e.toLowerCase()));

package/dist/data/api/interceptors/smile_auth_interceptor.d.ts

@@ -19,4 +19,3 @@ export declare class SmileAuthInterceptor {
     };
     private _onRequest;
 }
-//# sourceMappingURL=smile_auth_interceptor.d.ts.map

package/dist/data/api/interceptors/smile_auth_interceptor.js

@@ -1,57 +1 @@
-import { sourceSdkIdentifier } from "@smileid/usesmileid_bridge";
-import { currentRequestTimestamp } from "../../security/request_timestamp";
-/**
- * Auth interceptor.
- *
- * Responsibilities:
- *   1. Stamp the partner-supplied auth token onto every outbound
- *      request as the `smileid-token` header.
- *   2. Add the canonical SDK identification headers
- *      (`smileid-source-sdk`, `smileid-source-sdk-version`,
- *      `smileid-partner-id`, `callback-url`).
- *   3. Stamp `smileid-request-timestamp` (epoch ms) before the request-MAC
- *      interceptor runs, so it is part of the signed `smileid-*` set and the
- *      MAC reuses it as the salt.
- *
- * Token exchange is the partner application's responsibility — it
- * fetches a short-lived v3 token from its own backend and supplies the
- * result via the network DSL's `config.token`. The interceptor reads
- * the current value from the shared {@link TokenHolder} so a refreshed
- * value written by `TokenRefreshInterceptor` is observed automatically
- * by the next outgoing request.
- */
-const SDK_VERSION = "12.0.2"; // x-release-please-version
-export class SmileAuthInterceptor {
-    _partnerConfig;
-    _tokenHolder;
-    constructor(options) {
-        this._partnerConfig = options.partnerConfig;
-        this._tokenHolder = options.tokenHolder;
-    }
-    /**
-     * Attach to an axios instance. Returns the interceptor ID so the
-     * caller can detach later if needed (typically just on instance
-     * disposal — the interceptor's lifetime tracks the instance).
-     */
-    attach(client) {
-        const requestId = client.interceptors.request.use(async (config) => {
-            return this._onRequest(config);
-        });
-        return { request: requestId };
-    }
-    async _onRequest(config) {
-        config.headers.set("smileid-token", this._tokenHolder.current);
-        config.headers.set("smileid-source-sdk", sourceSdkIdentifier());
-        config.headers.set("smileid-source-sdk-version", SDK_VERSION);
-        config.headers.set("smileid-partner-id", this._partnerConfig.partnerId);
-        if (this._partnerConfig.callbackUrl) {
-            config.headers.set("callback-url", this._partnerConfig.callbackUrl);
-        }
-        // Generated at request time and stamped before the request-MAC interceptor
-        // runs, so it is part of the signed `smileid-*` header set and the MAC
-        // reuses the same value as its salt rather than reading the clock again.
-        config.headers.set("smileid-request-timestamp", currentRequestTimestamp());
-        return config;
-    }
-}
-//# sourceMappingURL=smile_auth_interceptor.js.map
+"use strict";import{sourceSdkIdentifier as t}from"@smileid/usesmileid_bridge";import{currentRequestTimestamp as s}from"../../security/request_timestamp";const n="12.1.0";export class SmileAuthInterceptor{_partnerConfig;_tokenHolder;constructor(e){this._partnerConfig=e.partnerConfig,this._tokenHolder=e.tokenHolder}attach(e){return{request:e.interceptors.request.use(async r=>this._onRequest(r))}}async _onRequest(e){return e.headers.set("smileid-token",this._tokenHolder.current),e.headers.set("smileid-source-sdk",t()),e.headers.set("smileid-source-sdk-version",n),e.headers.set("smileid-partner-id",this._partnerConfig.partnerId),this._partnerConfig.callbackUrl&&e.headers.set("callback-url",this._partnerConfig.callbackUrl),e.headers.set("smileid-request-timestamp",s()),e}}

package/dist/data/api/interceptors/smile_integrity_interceptor.d.ts

@@ -47,4 +47,3 @@ export declare class SmileIntegrityInterceptor {
     };
     private _onRequest;
 }
-//# sourceMappingURL=smile_integrity_interceptor.d.ts.map

package/dist/data/api/interceptors/smile_integrity_interceptor.js

@@ -1,79 +1 @@
-import { Attestation, AttestationException } from "@smileid/usesmileid_bridge";
-import { REQUEST_MAC_HEADER } from "./smile_request_mac_interceptor";
-/**
- * Stamps the `smileid-device-nonce` header on every outbound request
- * whose axios config declares `_useSmileIDAttestation: true`. The
- * header carries the base64-encoded envelope from
- * `Attestation.requestToken`, bound to the `smileid-request-mac`
- * value set upstream by `SmileRequestMacInterceptor`.
- *
- * Native side (Play Integrity on Android, App Attest on iOS) is
- * already wired through `usesmileid_bridge`'s Expo module; this
- * interceptor is a thin TS-side coordinator that:
- *
- *   1. Skips requests that don't opt in via `_useSmileIDAttestation`.
- *   2. Reads the upstream `smileid-request-mac` header. If missing
- *      (e.g. the endpoint opted into attestation but not MAC), ships
- *      unattested — the integrity guarantee is the body binding, so
- *      a stamped nonce without a MAC adds noise rather than security.
- *   3. Calls `Attestation.requestToken(macHeader)`.
- *   4. On success → stamp `smileid-device-nonce: <token>`.
- *   5. On `AttestationException` → stamp
- *      `smileid-device-nonce: ERR_<urlEncoded>`. **Fail-open by
- *      design**: failing closed on the client means an outage at
- *      Google / Apple takes the SDK offline; the server logs the
- *      failure mode and decides policy.
- *
- * Warm-up lives outside the interceptor. Call `Attestation.warmUp()`
- * once at flow mount so the per-request `requestToken` call doesn't
- * pay the multi-second warm-up cost on every submission.
- *
- * Attestation is additionally gated by the server-driven {@link SecurityPolicy}:
- * when the session's policy disables the device-attestation check, an opted-in
- * request ships without a device nonce. The policy is fail-secure, so a token
- * that omits the claim attests as before.
- */
-export const DEVICE_NONCE_HEADER = "smileid-device-nonce";
-/** Axios config key that opts a request into attestation stamping. */
-export const ATTESTATION_OPT_IN_KEY = "_useSmileIDAttestation";
-export class SmileIntegrityInterceptor {
-    _securityPolicy;
-    constructor(options) {
-        this._securityPolicy = options.securityPolicy;
-    }
-    attach(client) {
-        const requestId = client.interceptors.request.use(async (config) => {
-            return this._onRequest(config);
-        });
-        return { request: requestId };
-    }
-    async _onRequest(config) {
-        const optedIn = config[ATTESTATION_OPT_IN_KEY] === true;
-        if (!optedIn)
-            return config;
-        // Server-driven policy can switch device attestation off for this session; when it is off,
-        // ship the opted-in request without requesting a token.
-        if (!this._securityPolicy.isPlayIntegrityCheckActive())
-            return config;
-        const macHeader = config.headers.get(REQUEST_MAC_HEADER);
-        if (typeof macHeader !== "string")
-            return config;
-        try {
-            const token = await Attestation.requestToken(macHeader);
-            config.headers.set(DEVICE_NONCE_HEADER, token);
-        }
-        catch (error) {
-            const message = errorMessage(error);
-            config.headers.set(DEVICE_NONCE_HEADER, `ERR_${encodeURIComponent(message)}`);
-        }
-        return config;
-    }
-}
-function errorMessage(error) {
-    if (error instanceof AttestationException)
-        return error.message;
-    if (error instanceof Error)
-        return error.message;
-    return String(error);
-}
-//# sourceMappingURL=smile_integrity_interceptor.js.map
+"use strict";import{Attestation as i,AttestationException as c}from"@smileid/usesmileid_bridge";import{REQUEST_MAC_HEADER as u}from"./smile_request_mac_interceptor";export const DEVICE_NONCE_HEADER="smileid-device-nonce",ATTESTATION_OPT_IN_KEY="_useSmileIDAttestation";export class SmileIntegrityInterceptor{_securityPolicy;constructor(e){this._securityPolicy=e.securityPolicy}attach(e){return{request:e.interceptors.request.use(async s=>this._onRequest(s))}}async _onRequest(e){if(!(e[ATTESTATION_OPT_IN_KEY]===!0)||!this._securityPolicy.isPlayIntegrityCheckActive())return e;const s=e.headers.get(u);if(typeof s!="string")return e;try{const r=await i.requestToken(s);e.headers.set(DEVICE_NONCE_HEADER,r)}catch(r){const o=a(r);e.headers.set(DEVICE_NONCE_HEADER,`ERR_${encodeURIComponent(o)}`)}return e}}function a(t){return t instanceof c||t instanceof Error?t.message:String(t)}

package/dist/data/api/interceptors/smile_request_mac_interceptor.d.ts

@@ -39,4 +39,3 @@ export declare class SmileRequestMacInterceptor {
     };
     private _onRequest;
 }
-//# sourceMappingURL=smile_request_mac_interceptor.d.ts.map

package/dist/data/api/interceptors/smile_request_mac_interceptor.js

@@ -1,77 +1 @@
-import { SmileIDCryptoError } from "../../security/smile_id_crypto_error";
-/**
- * Stamps the `smileid-request-mac` header on every outbound request whose axios
- * config declares `_useSmileIDRequestMac: true`. The value is computed by
- * {@link SmileIDCryptoManager}: an HMAC-SHA256 over the canonicalised
- * `smileid-*` headers and request body, keyed by a PBKDF2-derived key from the
- * Arkana signing secret, Base64-encoded.
- *
- * The MAC is salted with the request timestamp, which is stamped upstream by
- * `SmileAuthInterceptor` and carried as the signed `smileid-request-timestamp`
- * header. This interceptor reuses that value as the single source of truth for
- * the salt; if it is absent (a MAC endpoint that is not auth-annotated — a
- * misconfiguration), the request is left unsigned for the server to reject
- * rather than signed against an invented timestamp.
- *
- * Requests without the opt-in flag pass through unchanged.
- *
- * Signing is additionally gated by the server-driven {@link SecurityPolicy}: when the session's
- * policy disables payload signing, an opted-in request still ships, just unsigned — the same wire
- * shape as an opt-out request. The policy is fail-secure, so a token that omits the claim signs as
- * before.
- */
-export const REQUEST_MAC_HEADER = "smileid-request-mac";
-export const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
-/** Axios config key that opts a request into MAC stamping. */
-export const REQUEST_MAC_OPT_IN_KEY = "_useSmileIDRequestMac";
-export class SmileRequestMacInterceptor {
-    _cryptoManager;
-    _securityPolicy;
-    constructor(options) {
-        this._cryptoManager = options.cryptoManager;
-        this._securityPolicy = options.securityPolicy;
-    }
-    attach(client) {
-        const requestId = client.interceptors.request.use(async (config) => {
-            return this._onRequest(config);
-        });
-        return { request: requestId };
-    }
-    async _onRequest(config) {
-        const optedIn = config[REQUEST_MAC_OPT_IN_KEY] === true;
-        if (!optedIn)
-            return config;
-        // Server-driven policy can switch payload signing off for this session; when it is off, ship
-        // the opted-in request unsigned and let the server apply its policy.
-        if (!this._securityPolicy.isPayloadSigningActive())
-            return config;
-        const timestamp = config.headers.get(REQUEST_TIMESTAMP_HEADER);
-        if (typeof timestamp !== "string")
-            return config;
-        try {
-            const mac = await this._cryptoManager.sign(timestamp, headersToRecord(config.headers), config.data);
-            config.headers.set(REQUEST_MAC_HEADER, mac);
-        }
-        catch (error) {
-            if (!(error instanceof SmileIDCryptoError))
-                throw error;
-            // Signing failed (e.g. the signing secret is unavailable). Proceed
-            // without the MAC header rather than breaking the request; the server
-            // rejects the unsigned request with a clear error.
-        }
-        return config;
-    }
-}
-/** Flattens axios `AxiosHeaders` (or a plain object) to a string record. */
-function headersToRecord(headers) {
-    const source = typeof headers.toJSON === "function"
-        ? headers.toJSON()
-        : headers;
-    const out = {};
-    for (const [key, value] of Object.entries(source)) {
-        if (value != null)
-            out[key] = String(value);
-    }
-    return out;
-}
-//# sourceMappingURL=smile_request_mac_interceptor.js.map
+"use strict";import{SmileIDCryptoError as c}from"../../security/smile_id_crypto_error";export const REQUEST_MAC_HEADER="smileid-request-mac",REQUEST_TIMESTAMP_HEADER="smileid-request-timestamp",REQUEST_MAC_OPT_IN_KEY="_useSmileIDRequestMac";export class SmileRequestMacInterceptor{_cryptoManager;_securityPolicy;constructor(t){this._cryptoManager=t.cryptoManager,this._securityPolicy=t.securityPolicy}attach(t){return{request:t.interceptors.request.use(async r=>this._onRequest(r))}}async _onRequest(t){if(!(t[REQUEST_MAC_OPT_IN_KEY]===!0)||!this._securityPolicy.isPayloadSigningActive())return t;const r=t.headers.get(REQUEST_TIMESTAMP_HEADER);if(typeof r!="string")return t;try{const e=await this._cryptoManager.sign(r,n(t.headers),t.data);t.headers.set(REQUEST_MAC_HEADER,e)}catch(e){if(!(e instanceof c))throw e}return t}}function n(s){const t=typeof s.toJSON=="function"?s.toJSON():s,o={};for(const[r,e]of Object.entries(t))e!=null&&(o[r]=String(e));return o}

package/dist/data/api/interceptors/token_refresh_interceptor.d.ts

@@ -42,4 +42,3 @@ export declare class TokenRefreshInterceptor {
     };
     private _onError;
 }
-//# sourceMappingURL=token_refresh_interceptor.d.ts.map

package/dist/data/api/interceptors/token_refresh_interceptor.js

@@ -1,58 +1 @@
-/** Marker on `RequestOptions.config` so a second 401 stops here instead of looping. */
-const RETRIED_FLAG = "__smileid_token_refresh_retried";
-export class TokenRefreshInterceptor {
-    _tokenHolder;
-    _onTokenExpired;
-    constructor(options) {
-        this._tokenHolder = options.tokenHolder;
-        this._onTokenExpired = options.onTokenExpired;
-    }
-    /** Attach a response interceptor that intercepts 401s and retries once. */
-    attach(client) {
-        const responseId = client.interceptors.response.use((response) => response, (error) => this._onError(client, error));
-        return { response: responseId };
-    }
-    async _onError(client, error) {
-        const refresh = this._onTokenExpired;
-        if (!refresh)
-            throw error;
-        if (!isAxiosErrorLike(error))
-            throw error;
-        const response = error.response;
-        if (!response || response.status !== 401)
-            throw error;
-        const config = error.config;
-        if (!config)
-            throw error;
-        if (config[RETRIED_FLAG] === true)
-            throw error;
-        const previousToken = this._tokenHolder.current;
-        const newToken = await this._tokenHolder.refreshSingleFlight(previousToken, async (previous) => {
-            try {
-                return await refresh(previous);
-            }
-            catch {
-                // Partner-supplied callback: opaque error surface. Any failure →
-                // null, caller surfaces the original 401 unchanged.
-                return null;
-            }
-        });
-        if (newToken === null || newToken === previousToken) {
-            throw error;
-        }
-        config[RETRIED_FLAG] = true;
-        return client.request(config);
-    }
-}
-/**
- * Narrow `unknown` to the shape `TokenRefreshInterceptor` needs to read
- * (`response.status`, `config`). Avoids relying on `axios.isAxiosError`
- * which requires the package's named export at runtime.
- */
-function isAxiosErrorLike(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "isAxiosError" in error &&
-        error.isAxiosError === true);
-}
-//# sourceMappingURL=token_refresh_interceptor.js.map
+"use strict";const h="__smileid_token_refresh_retried";export class TokenRefreshInterceptor{_tokenHolder;_onTokenExpired;constructor(t){this._tokenHolder=t.tokenHolder,this._onTokenExpired=t.onTokenExpired}attach(t){return{response:t.interceptors.response.use(n=>n,n=>this._onError(t,n))}}async _onError(t,e){const n=this._onTokenExpired;if(!n||!_(e))throw e;const r=e.response;if(!r||r.status!==401)throw e;const s=e.config;if(!s||s[h]===!0)throw e;const i=this._tokenHolder.current,c=await this._tokenHolder.refreshSingleFlight(i,async u=>{try{return await n(u)}catch{return null}});if(c===null||c===i)throw e;return s[h]=!0,t.request(s)}}function _(o){return typeof o=="object"&&o!==null&&"isAxiosError"in o&&o.isAxiosError===!0}

package/dist/data/api/smile_id_api.d.ts

@@ -125,4 +125,3 @@ export declare class SmileIDAPI {
  */
 export declare function buildAxiosClient(config: NetworkConfig): AxiosInstance;
 export { SmileAuthInterceptor, attachLoggingInterceptor, PROD_BASE_URL, SANDBOX_BASE_URL, };
-//# sourceMappingURL=smile_id_api.d.ts.map