@smileid/usesmileid 12.0.2 → 12.1.0

package/src/data/security/smile_id_crypto_manager.ts

@@ -1,46 +0,0 @@
-import { RequestCanonicalizer } from "./request_canonicalizer";
-import { base64Encode, SigningCrypto, utf8Bytes } from "./signing_crypto";
-
-/**
- * Signs outbound requests so the Smile ID server can prove the bytes it
- * receives were produced by a genuine SDK install.
- *
- * The request is reduced to a canonical payload ({@link RequestCanonicalizer}),
- * the signing key is PBKDF2-derived from the Arkana secret salted with the
- * payload length and request timestamp, and the payload is HMAC-SHA256'd
- * ({@link SigningCrypto}). The Base64 result is the `smileid-request-mac` value.
- *
- * Constructed by the networking factory with the Arkana signing secret
- * (obtained from the bridge) and injected into `SmileRequestMacInterceptor`.
- * Construct directly only in tests, passing a known secret.
- */
-export class SmileIDCryptoManager {
-  private readonly _signingSecret: string;
-
-  constructor(signingSecret: string) {
-    this._signingSecret = signingSecret;
-  }
-
-  /**
-   * Signs a request's `smileid-*` headers and body.
-   *
-   * @param timestamp the value of the `smileid-request-timestamp` header,
-   *   reused here so the salt matches the header the server reads.
-   * @param headers the full request headers; only those prefixed `smileid-`
-   *   (case-insensitive) are signed.
-   * @param body the request body, canonicalised before signing.
-   * @returns the Base64-encoded HMAC.
-   * @throws {SmileIDCryptoError} if key derivation or MAC computation fails.
-   */
-  async sign(
-    timestamp: string,
-    headers: Record<string, string>,
-    body: unknown,
-  ): Promise<string> {
-    const payload = await RequestCanonicalizer.canonicalize(headers, body);
-    const salt = utf8Bytes(`${payload.length}${timestamp}`);
-    const key = await SigningCrypto.deriveKey(this._signingSecret, salt);
-    const mac = await SigningCrypto.hmacSha256(key, payload);
-    return base64Encode(mac);
-  }
-}

package/src/data/smile_id_urls.ts

@@ -1,13 +0,0 @@
-/**
- * Base URLs for the Smile ID API, selected by sandbox vs production.
- *
- * Sandbox and production currently both resolve to the dev API; the split is
- * kept so the production host can diverge without touching call sites.
- */
-export const SmileIDUrls = {
-  sandbox: "https://testapi.smileidentity.com/",
-  production: "https://api.smileidentity.com/",
-  forConfig(useSandbox: boolean): string {
-    return useSandbox ? this.sandbox : this.production;
-  },
-} as const;

package/src/data/util/__tests__/retry_util.test.ts

@@ -1,182 +0,0 @@
-import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
-import { AxiosError, AxiosHeaders } from "axios";
-import { computeDelayMs, isRetryable, withRetry } from "../retry_util";
-import {
-  RetryStrategy,
-  type RetryConfig,
-} from "../../../core/models/network_config";
-
-const exponentialConfig: RetryConfig = Object.freeze({
-  maxAttempts: 3,
-  strategy: RetryStrategy.exponential,
-  initialDelay: 0.1,
-  multiplier: 2,
-  maxDelay: 10,
-  jitter: 0,
-  fixedDelay: 1,
-});
-
-const fixedConfig: RetryConfig = Object.freeze({
-  ...exponentialConfig,
-  strategy: RetryStrategy.fixed,
-});
-
-const noneConfig: RetryConfig = Object.freeze({
-  ...exponentialConfig,
-  strategy: RetryStrategy.none,
-  maxAttempts: 1,
-});
-
-function makeAxiosError(status?: number): AxiosError {
-  const err = new AxiosError(
-    "boom",
-    status ? `${status}` : undefined,
-    undefined,
-    undefined,
-    status
-      ? {
-          status,
-          statusText: "X",
-          data: undefined,
-          headers: {},
-          config: { headers: new AxiosHeaders() },
-        }
-      : undefined,
-  );
-  return err;
-}
-
-describe("isRetryable", () => {
-  it("retries no-response axios errors (timeout / DNS / connection reset)", () => {
-    expect(isRetryable(makeAxiosError())).toBe(true);
-  });
-
-  it.each([500, 502, 503, 504, 408, 429])("retries HTTP %d", (status) => {
-    expect(isRetryable(makeAxiosError(status))).toBe(true);
-  });
-
-  it.each([400, 401, 403, 404, 422])(
-    "does NOT retry HTTP %d (application error)",
-    (status) => {
-      // Concrete scenario: a 401 must fall through immediately so the
-      // auth interceptor can invalidate its cached token. If we kept
-      // retrying, the auth chain would burn `maxAttempts` calls
-      // sending the same expired token before the partner sees the
-      // failure. Pin the contract.
-      expect(isRetryable(makeAxiosError(status))).toBe(false);
-    },
-  );
-
-  it("does NOT retry non-axios errors (programming bugs)", () => {
-    expect(isRetryable(new Error("typo"))).toBe(false);
-    expect(isRetryable("not an error")).toBe(false);
-    expect(isRetryable(null)).toBe(false);
-  });
-});
-
-describe("computeDelayMs", () => {
-  it('strategy="none" → 0', () => {
-    expect(computeDelayMs(noneConfig, 0)).toBe(0);
-    expect(computeDelayMs(noneConfig, 5)).toBe(0);
-  });
-
-  it('strategy="fixed" → constant fixedDelayMs', () => {
-    expect(computeDelayMs(fixedConfig, 0)).toBe(1_000);
-    expect(computeDelayMs(fixedConfig, 1)).toBe(1_000);
-    expect(computeDelayMs(fixedConfig, 5)).toBe(1_000);
-  });
-
-  it('strategy="exponential" with jitter=0 → deterministic backoff', () => {
-    // Concrete scenario: a regression that doubles `multiplier`
-    // accidentally would lengthen retry timing dramatically. Pin
-    // the formula at jitter=0 (deterministic) so timing changes
-    // surface in CI.
-    expect(computeDelayMs(exponentialConfig, 0)).toBe(100); // 100 * 2^0
-    expect(computeDelayMs(exponentialConfig, 1)).toBe(200); // 100 * 2^1
-    expect(computeDelayMs(exponentialConfig, 2)).toBe(400);
-    expect(computeDelayMs(exponentialConfig, 3)).toBe(800);
-  });
-
-  it("caps at maxDelayMs", () => {
-    expect(computeDelayMs(exponentialConfig, 10)).toBe(10_000); // would be 102_400 uncapped
-  });
-});
-
-describe("withRetry", () => {
-  beforeEach(() => {
-    vi.useFakeTimers();
-  });
-  afterEach(() => {
-    vi.useRealTimers();
-  });
-
-  it("returns immediately on first success", async () => {
-    const block = vi.fn().mockResolvedValue("ok");
-    await expect(withRetry(exponentialConfig, block)).resolves.toBe("ok");
-    expect(block).toHaveBeenCalledTimes(1);
-  });
-
-  it("retries network-class failures up to maxAttempts", async () => {
-    const block = vi
-      .fn()
-      .mockRejectedValueOnce(makeAxiosError(503))
-      .mockRejectedValueOnce(makeAxiosError(503))
-      .mockResolvedValueOnce("ok");
-    const promise = withRetry(exponentialConfig, block);
-    // Attach a no-op catch BEFORE advancing timers so vitest doesn't
-    // flag the in-flight rejection as unhandled while the retry loop
-    // is mid-cycle. The actual assertion below still sees the final
-    // resolution / rejection.
-    promise.catch(() => {});
-    await vi.runAllTimersAsync();
-    await expect(promise).resolves.toBe("ok");
-    expect(block).toHaveBeenCalledTimes(3);
-  });
-
-  it("throws application errors immediately (no retry)", async () => {
-    // Concrete scenario: 401 / 403 must not consume retry budget.
-    // The auth interceptor needs to see the 401 and clear its cache
-    // before the next "real" call comes in.
-    const block = vi.fn().mockRejectedValue(makeAxiosError(401));
-    await expect(withRetry(exponentialConfig, block)).rejects.toMatchObject({
-      response: { status: 401 },
-    });
-    expect(block).toHaveBeenCalledTimes(1);
-  });
-
-  it("throws after exhausting maxAttempts on persistent failure", async () => {
-    const block = vi.fn().mockRejectedValue(makeAxiosError(503));
-    const promise = withRetry(exponentialConfig, block);
-    promise.catch(() => {}); // see comment in prior test
-    await vi.runAllTimersAsync();
-    await expect(promise).rejects.toMatchObject({
-      response: { status: 503 },
-    });
-    expect(block).toHaveBeenCalledTimes(3); // maxAttempts
-  });
-
-  it('strategy="none" never retries, even with an attempt budget', async () => {
-    // A config can carry both; the strategy wins.
-    const block = vi.fn().mockRejectedValue(makeAxiosError(503));
-    const config: RetryConfig = {
-      ...exponentialConfig,
-      strategy: RetryStrategy.none,
-    };
-
-    await expect(withRetry(config, block)).rejects.toMatchObject({
-      response: { status: 503 },
-    });
-    expect(block).toHaveBeenCalledTimes(1);
-  });
-
-  it("makes one attempt and surfaces the real error when maxAttempts is 0", async () => {
-    // `attempt < 0` never ran the body, so the old code rejected with `undefined`.
-    const block = vi.fn().mockRejectedValue(makeAxiosError(503));
-    const config: RetryConfig = { ...exponentialConfig, maxAttempts: 0 };
-
-    await expect(withRetry(config, block)).rejects.toMatchObject({
-      response: { status: 503 },
-    });
-    expect(block).toHaveBeenCalledTimes(1);
-  });
-});

package/src/data/util/__tests__/use_smile_id_token_decoder.test.ts

@@ -1,430 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  decodeSmileIDToken,
-  decodeSecurityPolicyBitCode,
-} from "../use_smile_id_token_decoder";
-import {
-  isTokenConsentComplete,
-  bindsRequiredUserDetails,
-} from "../../model/token_payload";
-
-// ---------------------------------------------------------------------------
-// Helper — mint a structurally valid JWT with a caller-supplied payload.
-// The header and signature fields are arbitrary tokens; only the
-// base64url-encoded middle segment is decoded.
-// ---------------------------------------------------------------------------
-function makeJwt(payload: Record<string, unknown>): string {
-  const json = JSON.stringify(payload);
-  // Node.js Buffer.from + base64url covers the full UTF-8 range and is
-  // available in the Hermes-compatible vitest Node environment.
-  const payloadSegment = Buffer.from(json).toString("base64url");
-  return `eyJhbGciOiJub25lIn0.${payloadSegment}.stub-sig`;
-}
-
-// ---------------------------------------------------------------------------
-// Security policy bit-code extraction
-// ---------------------------------------------------------------------------
-describe("decodeSecurityPolicyBitCode", () => {
-  it("parses the top-level policy bit-code alongside sdk_config", () => {
-    const token = makeJwt({
-      policy: 9,
-      sdk_config: { selfie: { quality: 85 } },
-    });
-    expect(decodeSecurityPolicyBitCode(token)).toBe(9);
-  });
-
-  it("parses the top-level policy bit-code when sdk_config is absent", () => {
-    const token = makeJwt({ policy: 0 });
-    expect(decodeSecurityPolicyBitCode(token)).toBe(0);
-  });
-
-  it("returns undefined when the token omits policy", () => {
-    const token = makeJwt({ sdk_config: { selfie: { quality: 85 } } });
-    expect(decodeSecurityPolicyBitCode(token)).toBeUndefined();
-  });
-
-  it("returns undefined for a structurally invalid token", () => {
-    expect(decodeSecurityPolicyBitCode("not-a-jwt")).toBeUndefined();
-  });
-
-  it("returns undefined when policy is not a number", () => {
-    const token = makeJwt({ policy: "9" });
-    expect(decodeSecurityPolicyBitCode(token)).toBeUndefined();
-  });
-});
-
-describe("decodeSmileIDToken — partner_id claim (stamped onto the EXIF tag)", () => {
-  it("parses the canonical top-level partner_id claim", () => {
-    // The EXIF tagger keys on this, so it must be the server-canonical form (e.g. "002").
-    const token = makeJwt({
-      partner_id: "002",
-      sdk_config: { selfie: { width: 640 } },
-    });
-    expect(decodeSmileIDToken(token)?.partnerId).toBe("002");
-  });
-
-  it("leaves partnerId undefined when the claim is absent", () => {
-    const token = makeJwt({ sdk_config: { selfie: { quality: 85 } } });
-    expect(decodeSmileIDToken(token)?.partnerId).toBeUndefined();
-  });
-
-  it("leaves partnerId undefined when the claim is not a string", () => {
-    const token = makeJwt({ partner_id: 2 });
-    expect(decodeSmileIDToken(token)?.partnerId).toBeUndefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Structural failure paths → undefined
-// ---------------------------------------------------------------------------
-describe("decodeSmileIDToken — structural failures return undefined", () => {
-  it("returns undefined for an empty string", () => {
-    expect(decodeSmileIDToken("")).toBeUndefined();
-  });
-
-  it("returns undefined for a single-segment string", () => {
-    expect(decodeSmileIDToken("notajwt")).toBeUndefined();
-  });
-
-  it("returns undefined for two segments", () => {
-    expect(decodeSmileIDToken("a.b")).toBeUndefined();
-  });
-
-  it("returns undefined for four segments", () => {
-    expect(decodeSmileIDToken("a.b.c.d")).toBeUndefined();
-  });
-
-  it("returns undefined for non-base64 payload", () => {
-    // The second segment cannot be decoded by atob — structurally invalid.
-    expect(
-      decodeSmileIDToken("header.!!!invalid-base64!!!.sig"),
-    ).toBeUndefined();
-  });
-
-  it("returns undefined when the payload decodes to non-JSON", () => {
-    const nonJson = Buffer.from("not-json").toString("base64url");
-    expect(decodeSmileIDToken(`header.${nonJson}.sig`)).toBeUndefined();
-  });
-
-  it("returns undefined when the payload is a JSON array (RFC 7519 §3 violation)", () => {
-    const arrayPayload = Buffer.from(JSON.stringify([1, 2, 3])).toString(
-      "base64url",
-    );
-    expect(decodeSmileIDToken(`header.${arrayPayload}.sig`)).toBeUndefined();
-  });
-
-  it("returns undefined when the payload is a JSON null", () => {
-    const nullPayload = Buffer.from("null").toString("base64url");
-    expect(decodeSmileIDToken(`header.${nullPayload}.sig`)).toBeUndefined();
-  });
-
-  it("returns undefined when the payload is a JSON string", () => {
-    const strPayload = Buffer.from('"just-a-string"').toString("base64url");
-    expect(decodeSmileIDToken(`header.${strPayload}.sig`)).toBeUndefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Valid token, absent or non-object claim → defined DecodedToken with
-// sdkConfig unset.
-// ---------------------------------------------------------------------------
-describe("decodeSmileIDToken — valid token with no usable sdk_config", () => {
-  it("returns an empty DecodedToken when sdk_config is absent", () => {
-    const token = makeJwt({ sub: "partner-1", iat: 1_700_000_000 });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    expect(result?.sdkConfig).toBeUndefined();
-  });
-
-  it("returns an empty DecodedToken when sdk_config is null", () => {
-    const token = makeJwt({ sdk_config: null });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    expect(result?.sdkConfig).toBeUndefined();
-  });
-
-  it("returns an empty DecodedToken when sdk_config is a number", () => {
-    const token = makeJwt({ sdk_config: 42 });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    expect(result?.sdkConfig).toBeUndefined();
-  });
-
-  it("returns an empty DecodedToken when sdk_config is a string", () => {
-    const token = makeJwt({ sdk_config: "some-string" });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    expect(result?.sdkConfig).toBeUndefined();
-  });
-
-  it("returns an empty DecodedToken when sdk_config is an array", () => {
-    const token = makeJwt({ sdk_config: [{ width: 640 }] });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    expect(result?.sdkConfig).toBeUndefined();
-  });
-
-  it("returns an empty DecodedToken when sdk_config fails Zod parsing (float width)", () => {
-    // Non-integer floats are rejected by .int() in sdkConfigCaptureSchema.
-    const token = makeJwt({ sdk_config: { selfie: { width: 640.5 } } });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    expect(result?.sdkConfig).toBeUndefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Valid token with a parseable sdk_config — full round-trip
-// ---------------------------------------------------------------------------
-describe("decodeSmileIDToken — parses a valid sdk_config claim", () => {
-  it("parses the canonical backend fixture (selfie, liveness, document, livenessImageCount)", () => {
-    // Matches the lambda authentication test fixture exactly.
-    const token = makeJwt({
-      sdk_config: {
-        selfie: { width: 640, height: 480, quality: 90 },
-        liveness: { width: 640, height: 480, quality: 80 },
-        document: { quality: 70 },
-        livenessImageCount: 7,
-      },
-    });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    expect(result?.sdkConfig?.selfie?.width).toBe(640);
-    expect(result?.sdkConfig?.selfie?.height).toBe(480);
-    expect(result?.sdkConfig?.selfie?.quality).toBe(90);
-    expect(result?.sdkConfig?.liveness?.quality).toBe(80);
-    expect(result?.sdkConfig?.document?.quality).toBe(70);
-    expect(result?.sdkConfig?.livenessImageCount).toBe(7);
-  });
-
-  it("parses a minimal claim (only livenessImageCount)", () => {
-    const token = makeJwt({ sdk_config: { livenessImageCount: 5 } });
-    const result = decodeSmileIDToken(token);
-    expect(result?.sdkConfig?.livenessImageCount).toBe(5);
-    expect(result?.sdkConfig?.selfie).toBeUndefined();
-  });
-
-  it("parses a claim with only quality settings (no dimensions)", () => {
-    const token = makeJwt({
-      sdk_config: { selfie: { quality: 85 }, liveness: { quality: 70 } },
-    });
-    const result = decodeSmileIDToken(token);
-    expect(result?.sdkConfig?.selfie?.quality).toBe(85);
-    expect(result?.sdkConfig?.selfie?.width).toBeUndefined();
-    expect(result?.sdkConfig?.liveness?.quality).toBe(70);
-  });
-
-  it("strips extra unknown fields at the top level of sdk_config (Zod strip)", () => {
-    const token = makeJwt({ sdk_config: { unknownTopLevel: "ignored" } });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    // sdkConfig is defined (valid empty object), not undefined
-    expect(result?.sdkConfig).toBeDefined();
-    expect(
-      (result?.sdkConfig as Record<string, unknown>)?.["unknownTopLevel"],
-    ).toBeUndefined();
-  });
-
-  it("handles a token with other standard JWT claims alongside sdk_config", () => {
-    const token = makeJwt({
-      sub: "partner-123",
-      iat: 1_700_000_000,
-      exp: 1_700_086_400,
-      sdk_config: { liveness: { quality: 60 } },
-    });
-    const result = decodeSmileIDToken(token);
-    expect(result?.sdkConfig?.liveness?.quality).toBe(60);
-  });
-
-  it("never throws — returns a value for any input string", () => {
-    // Smoke-test: a large variety of malformed inputs must never throw.
-    const inputs = [
-      "",
-      "a",
-      "a.b",
-      "a.b.c.d",
-      "a.!!!.c",
-      makeJwt({}),
-      makeJwt({ sdk_config: {} }),
-      makeJwt({ sdk_config: { selfie: { quality: 90 } } }),
-      makeJwt({ payload: "not-an-object" }),
-      makeJwt({ payload: { consent: { granted: "yes" } } }),
-    ];
-    for (const input of inputs) {
-      expect(() => decodeSmileIDToken(input)).not.toThrow();
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Token-bound user details & consent — the top-level `payload` claim
-// (a sibling of `sdk_config`). Values are opaque vault references; only
-// key presence is meaningful. Consent subfields are plaintext.
-// ---------------------------------------------------------------------------
-describe("decodeSmileIDToken — payload claim (token-bound user details & consent)", () => {
-  it("parses a full payload claim into all four presence flags plus complete consent", () => {
-    const token = makeJwt({
-      payload: {
-        given_names: "pii_abc",
-        last_name: "pii_def",
-        email: "pii_ghi",
-        phone_number: "pii_jkl",
-        consent: {
-          granted: true,
-          granted_at: "2026-01-01T09:00:00.000Z",
-          notice_language: "EN",
-          notice_privacy_policy_url: "https://partner.test/privacy",
-        },
-      },
-    });
-    const tokenPayload = decodeSmileIDToken(token)?.tokenPayload;
-    expect(tokenPayload?.hasGivenNames).toBe(true);
-    expect(tokenPayload?.hasLastName).toBe(true);
-    expect(tokenPayload?.hasEmail).toBe(true);
-    expect(tokenPayload?.hasPhoneNumber).toBe(true);
-    expect(isTokenConsentComplete(tokenPayload?.consent)).toBe(true);
-  });
-
-  it("parses a subset claim — exact flags plus a partial (incomplete) consent", () => {
-    const token = makeJwt({
-      payload: {
-        email: "pii_ghi",
-        consent: {
-          granted: true,
-          granted_at: "2026-01-01T09:00:00.000Z",
-        },
-      },
-    });
-    const tokenPayload = decodeSmileIDToken(token)?.tokenPayload;
-    expect(tokenPayload?.hasGivenNames).toBe(false);
-    expect(tokenPayload?.hasLastName).toBe(false);
-    expect(tokenPayload?.hasEmail).toBe(true);
-    expect(tokenPayload?.hasPhoneNumber).toBe(false);
-    expect(tokenPayload?.consent).toEqual({
-      granted: true,
-      grantedAt: "2026-01-01T09:00:00.000Z",
-    });
-    expect(isTokenConsentComplete(tokenPayload?.consent)).toBe(false);
-  });
-
-  it("leaves tokenPayload undefined when the payload claim is absent", () => {
-    const token = makeJwt({ sub: "partner-1", iat: 1_700_000_000 });
-    const result = decodeSmileIDToken(token);
-    expect(result).toBeDefined();
-    expect(result?.tokenPayload).toBeUndefined();
-  });
-
-  it("leaves tokenPayload undefined when the payload claim is not an object", () => {
-    for (const claim of ["a-string", ["an", "array"], 42, null]) {
-      const result = decodeSmileIDToken(makeJwt({ payload: claim }));
-      expect(result).toBeDefined();
-      expect(result?.tokenPayload).toBeUndefined();
-    }
-  });
-
-  it("tolerates malformed consent and unknown keys inside the claim", () => {
-    const stringConsent = decodeSmileIDToken(
-      makeJwt({ payload: { consent: "granted", last_name: "pii_x" } }),
-    )?.tokenPayload;
-    expect(stringConsent?.consent).toBeUndefined();
-    expect(stringConsent?.hasLastName).toBe(true);
-
-    const arrayConsent = decodeSmileIDToken(
-      makeJwt({ payload: { consent: [true] } }),
-    )?.tokenPayload;
-    expect(arrayConsent?.consent).toBeUndefined();
-
-    const emptyConsent = decodeSmileIDToken(
-      makeJwt({ payload: { consent: {} } }),
-    )?.tokenPayload;
-    expect(emptyConsent?.consent).toBeUndefined();
-
-    const untrustedGranted = decodeSmileIDToken(
-      makeJwt({
-        payload: {
-          consent: { granted: "yes", notice_language: "EN" },
-          unknown_key: "ignored",
-        },
-      }),
-    )?.tokenPayload;
-    expect(untrustedGranted?.consent?.granted).toBeUndefined();
-    expect(untrustedGranted?.consent?.noticeLanguage).toBe("EN");
-    expect(isTokenConsentComplete(untrustedGranted?.consent)).toBe(false);
-
-    const deniedGranted = decodeSmileIDToken(
-      makeJwt({ payload: { consent: { granted: false } } }),
-    )?.tokenPayload;
-    expect(deniedGranted?.consent).toBeUndefined();
-  });
-
-  it("regression: a legacy token (sdk_config only) still parses sdkConfig with tokenPayload unset", () => {
-    const token = makeJwt({
-      partner_id: "002",
-      sdk_config: { selfie: { width: 640, height: 480, quality: 90 } },
-    });
-    const result = decodeSmileIDToken(token);
-    expect(result?.sdkConfig?.selfie?.width).toBe(640);
-    expect(result?.partnerId).toBe("002");
-    expect(result?.tokenPayload).toBeUndefined();
-  });
-
-  it("parses payload and sdk_config claims side by side", () => {
-    const token = makeJwt({
-      sdk_config: { livenessImageCount: 5 },
-      payload: { given_names: "pii_abc" },
-    });
-    const result = decodeSmileIDToken(token);
-    expect(result?.sdkConfig?.livenessImageCount).toBe(5);
-    expect(result?.tokenPayload?.hasGivenNames).toBe(true);
-  });
-
-  it("decodes a minted token that binds names and email but not phone_number", () => {
-    // Same deployment, partial binding: given_names, last_name and email
-    // only. The contact requirement is satisfied by the bound email alone.
-    const mintedToken =
-      "eyJhbGciOiJFUzI1NiIsImtpZCI6ImtleV8wMWtibWd6bXczZXloOW5jdjlqcG1kNDlqZiIsInR5cCI6IkpXVCJ9." +
-      "eyJhcGlfdXJsIjoiaHR0cHM6Ly92My10b2tlbi1jb25zZW50LXBheWxvYWQuYXBpLnNtaWxlaWQuY28vdjMiLCJrZXlfaWQiOiIyY2NjOWMyMy01Y2U3LTRkMGUtYWRkYy1lN2I1NGQ4YjkxZGQiLCJwYXlsb2FkIjp7ImNvbnNlbnQiOnsiZ3JhbnRlZCI6dHJ1ZSwiZ3JhbnRlZF9hdCI6IjIwMjYtMDEtMDFUMDk6MDA6MDAuMDAwWiIsIm5vdGljZV9sYW5ndWFnZSI6IkVOIiwibm90aWNlX3ByaXZhY3lfcG9saWN5X3VybCI6Imh0dHBzOi8vanVtYS5wcml2YWN5LXBvbGljeS5jb20ifSwiZW1haWwiOiJwaWlfMDFrcDNzOXQ3OGZleDkxcWg0NnlwODdyanEiLCJnaXZlbl9uYW1lcyI6InBpaV8wMWt6cm0xNzB0ZjY5cnE5NTM4cnpnZXR5eiIsImxhc3RfbmFtZSI6InBpaV8wMWtwM3M5dDdyZThocjZkZXI5cTNucHo3YyJ9LCJwYXJ0bmVyX2lkIjoiMTQ4MyIsInBvbGljeSI6MTUsImF1ZCI6InNtaWxlaWQtYXBpIiwiZXhwIjoxNzg2NDU5ODcxLCJpYXQiOjE3ODY0NTg5NzEsImlzcyI6InNtaWxlaWQtYXV0aCJ9." +
-      "s5BFthU2B1aKxYDYyyWYDmRpLoHibH34r2Lk4OS-wZQC8pmYROjWBiORx6n2_0srmxz_SA2eZo_FHyAr-ew_Zg";
-
-    const tokenPayload = decodeSmileIDToken(mintedToken)?.tokenPayload;
-
-    expect(tokenPayload?.hasGivenNames).toBe(true);
-    expect(tokenPayload?.hasLastName).toBe(true);
-    expect(tokenPayload?.hasEmail).toBe(true);
-    expect(tokenPayload?.hasPhoneNumber).toBe(false);
-    expect(bindsRequiredUserDetails(tokenPayload)).toBe(true);
-    expect(isTokenConsentComplete(tokenPayload?.consent)).toBe(true);
-  });
-
-  it("decodes the payload claim from a token minted by the v3 token endpoint", () => {
-    // Captured from the /v3/token deployment: ES256-signed, extra top-level
-    // claims (api_url, key_id, aud, iss), every user-detail field bound as an
-    // opaque pii_ reference, a complete consent object, and in-claim identity
-    // fields (country, id_type, id_number, callback_url) the SDK deliberately
-    // ignores. The token expired minutes after minting and carries no raw
-    // PII — the decoder never checks exp (the server enforces token
-    // validity).
-    const mintedToken =
-      "eyJhbGciOiJFUzI1NiIsImtpZCI6ImtleV8wMWtibWd6bXczZXloOW5jdjlqcG1kNDlqZiIsInR5cCI6IkpXVCJ9." +
-      "eyJhcGlfdXJsIjoiaHR0cHM6Ly92My10b2tlbi1jb25zZW50LXBheWxvYWQuYXBpLnNtaWxlaWQuY28vdjMiLCJrZXlfaWQiOiIyY2NjOWMyMy01Y2U3LTRkMGUtYWRkYy1lN2I1NGQ4YjkxZGQiLCJwYXlsb2FkIjp7ImNvbnNlbnQiOnsiZ3JhbnRlZCI6dHJ1ZSwiZ3JhbnRlZF9hdCI6IjIwMjYtMDEtMDFUMDk6MDA6MDAuMDAwWiIsIm5vdGljZV9sYW5ndWFnZSI6IkVOIiwibm90aWNlX3ByaXZhY3lfcG9saWN5X3VybCI6Imh0dHBzOi8vanVtYS5wcml2YWN5LXBvbGljeS5jb20ifSwiY291bnRyeSI6Ik5HIiwiaWRfdHlwZSI6Ik5JTl9WMiIsImVtYWlsIjoicGlpXzAxa3Azczl0NzhmZXg5MXFoNDZ5cDg3cmpxIiwiZ2l2ZW5fbmFtZXMiOiJwaWlfMDFrenJtMTcwdGY2OXJxOTUzOHJ6Z2V0eXoiLCJpZF9udW1iZXIiOiJwaWlfMDFra2dhYTliNWZ2Z2EyMnllZXM1ZjRyNnQiLCJsYXN0X25hbWUiOiJwaWlfMDFrcDNzOXQ3cmU4aHI2ZGVyOXEzbnB6N2MiLCJwaG9uZV9udW1iZXIiOiJwaWlfMDFrenJtdHdkeGZlenJ0dGRmOXQzc3Rzem4iLCJjYWxsYmFja191cmwiOiJjYWxsYmFja18wMWt6cm10d2VmZTV5YWgzbmR2NW03MDc3ZyJ9LCJwYXJ0bmVyX2lkIjoiMTQ4MyIsInBvbGljeSI6MTUsImF1ZCI6InNtaWxlaWQtYXBpIiwiZXhwIjoxNzg2NDYwNzEyLCJpYXQiOjE3ODY0NTk4MTIsImlzcyI6InNtaWxlaWQtYXV0aCJ9." +
-      "cuZgo64eEt5vNvND_RvCVpJyTv4rqax9ebkLV4i4uI4raz6fBhazxspbaoErYC0wxwRmn5EhPAdAdDnNKI6tEQ";
-
-    const result = decodeSmileIDToken(mintedToken);
-
-    expect(result?.partnerId).toBe("1483");
-    expect(result?.tokenPayload).toEqual({
-      hasGivenNames: true,
-      hasLastName: true,
-      hasEmail: true,
-      hasPhoneNumber: true,
-      consent: {
-        granted: true,
-        grantedAt: "2026-01-01T09:00:00.000Z",
-        noticeLanguage: "EN",
-        noticePrivacyPolicyUrl: "https://juma.privacy-policy.com",
-      },
-    });
-    expect(bindsRequiredUserDetails(result?.tokenPayload)).toBe(true);
-    expect(isTokenConsentComplete(result?.tokenPayload?.consent)).toBe(true);
-  });
-});