@smileid/usesmileid 12.0.2 → 12.1.1

package/dist/data/factory/networking_factory.js

@@ -1,174 +1 @@
-import { SmileIDAPI, buildAxiosClient, SmileAuthInterceptor, attachLoggingInterceptor, } from "../api/smile_id_api";
-import { createGzipInterceptor } from "../api/interceptors/gzip_interceptor";
-import { SmileRequestMacInterceptor } from "../api/interceptors/smile_request_mac_interceptor";
-import { SmileIntegrityInterceptor } from "../api/interceptors/smile_integrity_interceptor";
-import { TokenRefreshInterceptor } from "../api/interceptors/token_refresh_interceptor";
-import { TokenHolder } from "../api/auth/token_holder";
-import { SmileIDCryptoManager } from "../security/smile_id_crypto_manager";
-import { SecurityPolicy } from "../security/security_policy";
-import { decodeSecurityPolicyBitCode } from "../util/use_smile_id_token_decoder";
-import { Attestation, SigningSecretProvider } from "@smileid/usesmileid_bridge";
-import { MissingPartnerConfigException } from "../../core/exception";
-import { UseSmileIDMetadataFactory } from "../../metadata/use_smile_id_metadata_factory";
-/**
- * Wire an axios instance + the SDK's interceptor chain and return a
- * `SmileIDAPI`.
- *
- * Canonical request-path order (outermost → wire):
- *   `partner-custom → token-refresh → auth → request-mac → integrity →
- *    logging → gzip → wire`
- *
- * - **Partner-custom interceptors** sit outermost so partners can
- *   inject debugging tools (Charles, Sentry breadcrumbs) before any
- *   SDK headers attach.
- * - **TokenRefreshInterceptor** sits next so its retry — which re-issues
- *   via `client.request(config)` — re-runs the rest of the SDK chain
- *   with the refreshed token (auth re-stamps from the same `TokenHolder`
- *   the refresh wrote into, mac/integrity re-stamp on opt-in endpoints).
- *   It only attaches a response interceptor — the 401 → refresh → retry
- *   pathway lives on the error branch.
- * - **Auth** runs before the MAC interceptor so the `smileid-*` headers it
- *   stamps (token, partner id, `smileid-request-timestamp`) are present to be
- *   signed; it also sits after partner-custom interceptors so they cannot strip
- *   the token. Reads the current token from the shared `TokenHolder`.
- * - **Request MAC** stamps `smileid-request-mac` (the canonicalised-request
- *   HMAC from `SmileIDCryptoManager`) for endpoints that opt in via
- *   `_useSmileIDRequestMac: true`. It runs before the integrity interceptor so
- *   the integrity token can bind to the freshly-computed MAC value.
- * - **Integrity** stamps `smileid-device-nonce` with the
- *   `Attestation.requestToken(macHeader)` envelope for endpoints that
- *   opt in via `_useSmileIDAttestation: true`. Reads the MAC header the
- *   previous interceptor set.
- * - **Logging** sits second-to-last so the line it prints reflects
- *   the request after auth has stamped headers but before gzip
- *   transforms the body. Sensitive headers are redacted via the
- *   [`ALWAYS_REDACT`](../api/interceptors/logging_interceptor.ts)
- *   set. On the response path the order naturally inverts.
- * - **Gzip** sits closest to the wire — it stamps `Accept-Encoding:
- *   gzip` on every request so axios auto-decompresses responses.
- *
- * axios applies **request interceptors LIFO** (last registered runs
- * first) and **response interceptors FIFO** (first registered runs
- * first). The registration order below is therefore the *reverse* of
- * the request-path order so the LIFO unwind lands on the canonical
- * order described above.
- */
-export function makeNetworkingFactory(config, 
-// The request-signing secret source; defaults to the native bridge and exists
-// so tests can supply a known secret without the native module.
-signingSecret = () => SigningSecretProvider.signingSecret()) {
-    // Reject blank credentials with a typed exception at client
-    // construction so an unauthenticated request never reaches the wire.
-    const partnerConfig = config.config?.partnerConfig;
-    if (!partnerConfig || partnerConfig.partnerId.trim() === "") {
-        throw MissingPartnerConfigException.missingPartnerId();
-    }
-    if (!config.config?.token || config.config.token.trim() === "") {
-        throw MissingPartnerConfigException.missingAuthToken();
-    }
-    const client = buildAxiosClient(config);
-    // Wire a single per-flow metadata provider — every submission
-    // endpoint requires a `metadata` part. The factory reads
-    // `expo-device` lazily when present and falls back to empty values
-    // otherwise, so this is safe to construct unconditionally. The
-    // provider is returned to the caller so the request-construction
-    // site (the flow navigation manager) can stamp a fresh snapshot
-    // onto each `JobRequest` via `metadata.make()`.
-    const metadata = new UseSmileIDMetadataFactory();
-    const api = new SmileIDAPI(client, partnerConfig);
-    // Warm up the Play Integrity / App Attest token provider off the
-    // submission path so the integrity interceptor's per-request
-    // `requestToken` doesn't pay the multi-second first-call cost (and
-    // doesn't fail `NOT_INITIALIZED`). Fire-and-forget + fail-open: on
-    // failure the interceptor stamps an `ERR_` nonce and the server decides
-    // policy.
-    void Attestation.warmUp().catch(() => {
-        /* fail-open — handled per-request by SmileIntegrityInterceptor */
-    });
-    // Shared mutable holder for the partner-supplied auth token.
-    // SmileAuthInterceptor reads from it on every request;
-    // TokenRefreshInterceptor writes a refreshed value on a 401 so the
-    // next outgoing request automatically picks up the new token.
-    const tokenHolder = new TokenHolder(config.config?.token ?? "");
-    // Server-driven security policy for this flow, decoded from the top-level `policy` claim on the
-    // JWT (a sibling of `sdk_config`). Decoding is fail-secure: a malformed token, an absent claim, or an absent
-    // bit-code all resolve to "every behaviour active", so a token without the claim keeps the
-    // pre-policy behaviour rather than dropping security.
-    const securityPolicy = SecurityPolicy.fromBitCode(decodeSecurityPolicyBitCode(config.config?.token ?? ""));
-    // 1. Gzip is registered FIRST so it runs LAST on the request path
-    //    (innermost / closest to the wire). It stamps `Accept-Encoding:
-    //    gzip` so the server can compress responses (axios
-    //    transparently decompresses).
-    const gzip = createGzipInterceptor();
-    gzip.attach(client);
-    // 2. Logging is registered SECOND so it runs SECOND-TO-LAST on the
-    //    request path — the printed body and headers reflect the
-    //    request after auth has stamped headers but before gzip
-    //    transforms the wire bytes. Lives at `config.config.logging`
-    //    under the `network → config → logging` nesting.
-    const logging = config.config?.logging;
-    if (logging) {
-        attachLoggingInterceptor(client, logging);
-    }
-    // 3. Integrity is registered THIRD so it runs after MAC stamping on the
-    //    request path — it reads the `smileid-request-mac` header the MAC
-    //    interceptor sets and binds the per-request token to it. Per-request
-    //    opt-in via `config._useSmileIDAttestation`; pass-through otherwise.
-    const integrityInterceptor = new SmileIntegrityInterceptor({
-        securityPolicy,
-    });
-    integrityInterceptor.attach(client);
-    // 4. Request MAC runs after auth (so the `smileid-*` headers + timestamp it
-    //    signs are present) and before integrity (which binds to the MAC). The
-    //    signing key is PBKDF2-derived from the native Arkana secret. Per-request
-    //    opt-in via `config._useSmileIDRequestMac`; pass-through otherwise.
-    const cryptoManager = new SmileIDCryptoManager(signingSecret());
-    const requestMacInterceptor = new SmileRequestMacInterceptor({
-        cryptoManager,
-        securityPolicy,
-    });
-    requestMacInterceptor.attach(client);
-    // 5. Auth is registered LAST of these three so it runs FIRST on the request
-    //    path — after partner-custom interceptors (which therefore cannot strip
-    //    the token), before logging. It stamps the token + partner id +
-    //    `smileid-request-timestamp` before the MAC interceptor signs them, and
-    //    reads from the shared `TokenHolder` so a refreshed value is picked up on
-    //    the next outbound request.
-    const authInterceptor = new SmileAuthInterceptor({
-        partnerConfig,
-        tokenHolder,
-    });
-    authInterceptor.attach(client);
-    // 6. TokenRefreshInterceptor only attaches a response interceptor —
-    //    its 401 → refresh → retry pathway lives on the error branch.
-    //    Registered after the SDK request-side interceptors so its
-    //    response error handler sees the 401 BEFORE bubbling up to
-    //    partner-custom handlers downstream; the retry re-issues via
-    //    `client.request(config)` and re-runs all request interceptors
-    //    above (auth re-reads the now-refreshed `TokenHolder`).
-    const tokenRefreshInterceptor = new TokenRefreshInterceptor({
-        tokenHolder,
-        onTokenExpired: config.config?.onTokenExpired,
-    });
-    tokenRefreshInterceptor.attach(client);
-    // 7. Partner-custom interceptors are registered LAST so they run
-    //    FIRST on the request path (outermost) — ideal for Charles,
-    //    Sentry breadcrumbs, etc. that should observe the request
-    //    before any SDK headers attach.
-    if (config.interceptors) {
-        for (const interceptor of config.interceptors) {
-            // Partner contracts: `interceptor` may be `(client) => void` or
-            // an object with `attach(client)`. We support both shapes.
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const handler = interceptor;
-            if (typeof handler === "function") {
-                handler(client);
-            }
-            else if (typeof handler?.attach === "function") {
-                handler.attach(client);
-            }
-        }
-    }
-    return { api, client, metadata };
-}
-//# sourceMappingURL=networking_factory.js.map
+"use strict";import{SmileIDAPI as I,buildAxiosClient as l,SmileAuthInterceptor as u,attachLoggingInterceptor as d}from"../api/smile_id_api";import{createGzipInterceptor as k}from"../api/interceptors/gzip_interceptor";import{SmileRequestMacInterceptor as y}from"../api/interceptors/smile_request_mac_interceptor";import{SmileIntegrityInterceptor as w}from"../api/interceptors/smile_integrity_interceptor";import{TokenRefreshInterceptor as S}from"../api/interceptors/token_refresh_interceptor";import{TokenHolder as C}from"../api/auth/token_holder";import{SmileIDCryptoManager as P}from"../security/smile_id_crypto_manager";import{SecurityPolicy as M}from"../security/security_policy";import{decodeSecurityPolicyBitCode as A}from"../util/use_smile_id_token_decoder";import{Attestation as T}from"@smileid/usesmileid_bridge";import{SigningSecretProvider as x}from"@smileid/usesmileid_bridge/internal";import{MissingPartnerConfigException as n}from"../../core/exception";import{UseSmileIDMetadataFactory as F}from"../../metadata/use_smile_id_metadata_factory";export function makeNetworkingFactory(t,m=()=>x.signingSecret()){const r=t.config?.partnerConfig;if(!r||r.partnerId.trim()==="")throw n.missingPartnerId();if(!t.config?.token||t.config.token.trim()==="")throw n.missingAuthToken();const i=/[\u0000-\u001F\u007F-\u009F]/;if(i.test(r.partnerId))throw n.controlCharacterPartnerId();if(i.test(t.config.token))throw n.controlCharacterAuthToken();const e=l(t),s=new F,f=new I(e,r);T.warmUp().catch(()=>{});const c=new C(t.config?.token??""),a=M.fromBitCode(A(t.config?.token??""));k().attach(e);const p=t.config?.logging;p&&d(e,p),new w({securityPolicy:a}).attach(e);const g=new P(m());if(new y({cryptoManager:g,securityPolicy:a}).attach(e),new u({partnerConfig:r,tokenHolder:c}).attach(e),new S({tokenHolder:c,onTokenExpired:t.config?.onTokenExpired}).attach(e),t.interceptors)for(const h of t.interceptors){const o=h;typeof o=="function"?o(e):typeof o?.attach=="function"&&o.attach(e)}return{api:f,client:e,metadata:s}}

package/dist/data/model/image_dimensions.d.ts

@@ -13,4 +13,3 @@ export type ImageDimensions = {
     readonly width: number;
     readonly height: number;
 };
-//# sourceMappingURL=image_dimensions.d.ts.map

package/dist/data/model/image_dimensions.js

@@ -1,2 +1 @@
-export {};
-//# sourceMappingURL=image_dimensions.js.map
+"use strict";export{};

package/dist/data/model/job_request.d.ts

@@ -83,11 +83,10 @@ export type EnhancedKycRequest = BaseJobRequest & {
     readonly userDetails?: UserDetailsPayload;
 };
 /**
- * BVN submission stub. The variant exists in the discriminated union
- * so `JobType.bvn` can dispatch to a dedicated request rather than
- * piggy-backing on `enhancedKyc`. The repository rejects it with the
- * canonical `"BVN submission is not yet supported"` message until the
- * dedicated endpoint lands.
+ * BVN submission stub for the dedicated endpoint that has not landed. The
+ * flow fails fast before assembling one; the repository rejects any
+ * directly-constructed instance with the canonical
+ * `"BVN submission is not yet supported"` message.
  */
 export type BvnRequest = BaseJobRequest & {
     readonly jobType: typeof JobType.bvn;
@@ -143,4 +142,3 @@ export type EnhancedDocumentVerificationRequest = BaseJobRequest & {
     readonly expectedLivenessImageCount: number;
 };
 export type JobRequest = SmartSelfieEnrollmentRequest | SmartSelfieAuthenticationRequest | EnhancedKycRequest | BvnRequest | BiometricKycRequest | DocumentVerificationRequest | EnhancedDocumentVerificationRequest;
-//# sourceMappingURL=job_request.d.ts.map

package/dist/data/model/job_request.js

@@ -1,2 +1 @@
-export {};
-//# sourceMappingURL=job_request.js.map
+"use strict";export{};

package/dist/data/model/job_submission_response.d.ts

@@ -15,4 +15,3 @@ export type JobSubmissionResponse = {
      */
     readonly createdAt?: string;
 };
-//# sourceMappingURL=job_submission_response.d.ts.map

package/dist/data/model/job_submission_response.js

@@ -1,2 +1 @@
-export {};
-//# sourceMappingURL=job_submission_response.js.map
+"use strict";export{};

package/dist/data/model/sdk_config.d.ts

@@ -51,4 +51,3 @@ export type SdkConfig = z.infer<typeof sdkConfigSchema>;
  * A count of `0` or below is treated as absent (returns `undefined`).
  */
 export declare function numSamplesOverride(config: SdkConfig | undefined): number | undefined;
-//# sourceMappingURL=sdk_config.d.ts.map

package/dist/data/model/sdk_config.js

@@ -1,68 +1 @@
-import { z } from "zod";
-import { sdkConfigCaptureSchema } from "./sdk_config_capture";
-/**
- * Capture-parameter settings delivered via the JWT auth token.
- *
- * The backend embeds this object under the `sdk_config` claim (JWT
- * payload, base64url-decoded middle segment). All fields are optional;
- * an absent or invalid field falls back to the SDK default — values are
- * never clamped.
- *
- * Expected claim shape:
- * ```jsonc
- * {
- *   "sdk_config": {
- *     "selfie":   { "width": 640, "height": 480, "quality": 90 },
- *     "liveness": { "width": 640, "height": 480, "quality": 80 },
- *     "document": { "quality": 70 },
- *     "livenessImageCount": 7
- *   }
- * }
- * ```
- *
- * Field names are a deliberate cross-SDK shared contract that
- * intentionally omits the `UseSmileID` prefix.
- */
-export const sdkConfigSchema = z.object({
-    /** Selfie capture settings: pixel dimensions and JPEG quality. */
-    selfie: sdkConfigCaptureSchema.optional(),
-    /** Liveness capture settings: pixel dimensions and JPEG quality. */
-    liveness: sdkConfigCaptureSchema.optional(),
-    /**
-     * Document capture settings. Only `quality` is applied — document
-     * frames stay sensor-native with their longest side bounded at
-     * 1 600 px by the native resampler. `width` / `height` are accepted
-     * by the schema but deliberately ignored.
-     */
-    document: sdkConfigCaptureSchema.optional(),
-    /**
-     * Number of liveness images the native session should capture.
-     * Maps to the internal `numSamples` parameter as
-     * `numSamples = livenessImageCount + 1` (the `+1` accounts for the
-     * reference selfie still).
-     *
-     * A value of `0` or below is treated as absent; the caller falls back
-     * to the `ScanPerformanceProfile` default (`numSamples = 8`).
-     *
-     * This override is suppressed when Enhanced Smart Selfie liveness is
-     * active — the head-turn flow manages its own capture count.
-     */
-    livenessImageCount: z.number().int().optional(),
-});
-/**
- * Convert `livenessImageCount` to the internal `numSamples` override,
- * or `undefined` when the value is absent or invalid.
- *
- * Formula: `numSamples = livenessImageCount + 1`.
- * The `+1` accounts for the reference selfie still that the native
- * session captures in addition to the liveness frames.
- * A count of `0` or below is treated as absent (returns `undefined`).
- */
-export function numSamplesOverride(config) {
-    const count = config?.livenessImageCount;
-    if (count !== undefined && count > 0) {
-        return count + 1;
-    }
-    return undefined;
-}
-//# sourceMappingURL=sdk_config.js.map
+"use strict";import{z as o}from"zod";import{sdkConfigCaptureSchema as n}from"./sdk_config_capture";export const sdkConfigSchema=o.object({selfie:n.optional(),liveness:n.optional(),document:n.optional(),livenessImageCount:o.number().int().optional()});export function numSamplesOverride(t){const e=t?.livenessImageCount;if(e!==void 0&&e>0)return e+1}

package/dist/data/model/sdk_config_capture.d.ts

@@ -36,4 +36,3 @@ export declare function resolveDimensions(capture: SdkConfigCapture | undefined)
  * clamped — the caller uses the SDK default instead.
  */
 export declare function resolveJpegQuality(capture: SdkConfigCapture | undefined): number | undefined;
-//# sourceMappingURL=sdk_config_capture.d.ts.map

package/dist/data/model/sdk_config_capture.js

@@ -1,69 +1 @@
-import { z } from "zod";
-/**
- * Per-capture-type block inside an `sdk_config` JWT claim.
- *
- * Three instances appear under the `selfie`, `liveness`, and `document`
- * keys of the top-level claim. Each field is optional — any absent or
- * out-of-range value falls back to the SDK default at the point of use.
- *
- * Field names are a deliberate cross-SDK shared contract that
- * intentionally omits the `UseSmileID` prefix.
- */
-export const sdkConfigCaptureSchema = z.object({
-    /**
-     * Target capture width in pixels.
-     * Applied only for selfie and liveness — document frames stay
-     * sensor-native with their longest side bounded by the native
-     * resampler at 1 600 px.
-     */
-    width: z.number().int().optional(),
-    /**
-     * Target capture height in pixels.
-     * Resolved as a pair with `width` — both must be present and
-     * greater than zero, otherwise the pair falls back to the SDK
-     * default in full (never mix a server width with a default height).
-     */
-    height: z.number().int().optional(),
-    /**
-     * JPEG compression quality hint in the range `1..100`.
-     * Values outside that range are treated as absent — the caller uses
-     * the SDK default. Values are never clamped; the backend owns
-     * enforcement.
-     */
-    quality: z.number().int().optional(),
-});
-/**
- * Resolve a capture block to an `ImageDimensions` pair, or `undefined`
- * when the pair rule is not satisfied.
- *
- * Rule (port of Flutter / iOS / Android cross-SDK contract):
- *   - Both `width` and `height` must be present and `> 0`.
- *   - If either is absent or invalid, return `undefined`; the caller
- *     falls back to the SDK default pair in full. Mixing a server width
- *     with a default height is explicitly forbidden to avoid
- *     aspect-ratio mismatches.
- */
-export function resolveDimensions(capture) {
-    if (!capture)
-        return undefined;
-    const { width, height } = capture;
-    if (width !== undefined && height !== undefined && width > 0 && height > 0) {
-        return { width, height };
-    }
-    return undefined;
-}
-/**
- * Resolve the JPEG quality from a capture block, or `undefined` when
- * the value is outside the valid range.
- *
- * Range: integer `1..100` inclusive. Out-of-range values are not
- * clamped — the caller uses the SDK default instead.
- */
-export function resolveJpegQuality(capture) {
-    const quality = capture?.quality;
-    if (quality !== undefined && quality >= 1 && quality <= 100) {
-        return quality;
-    }
-    return undefined;
-}
-//# sourceMappingURL=sdk_config_capture.js.map
+"use strict";import{z as i}from"zod";export const sdkConfigCaptureSchema=i.object({width:i.number().int().optional(),height:i.number().int().optional(),quality:i.number().int().optional()});export function resolveDimensions(e){if(!e)return;const{width:n,height:t}=e;if(n!==void 0&&t!==void 0&&n>0&&t>0)return{width:n,height:t}}export function resolveJpegQuality(e){const n=e?.quality;if(n!==void 0&&n>=1&&n<=100)return n}

package/dist/data/model/sdk_config_source.d.ts

@@ -22,4 +22,3 @@ export declare const SdkConfigSource: {
     readonly defaultSource: "default";
 };
 export type SdkConfigSourceValue = (typeof SdkConfigSource)[keyof typeof SdkConfigSource];
-//# sourceMappingURL=sdk_config_source.d.ts.map

package/dist/data/model/sdk_config_source.js

@@ -1,24 +1 @@
-/**
- * Provenance of the capture parameters used for a given submission.
- *
- * Emitted as the `sdk_config_source` metadata entry on every job
- * submission. The backend gates its dimension-consistency check on this
- * value — reporting the wrong source causes server-side validation
- * failures, so these wire strings are parity-critical.
- *
- * Wire values are intentionally lowercase snake_case to match the
- * backend's expected strings.
- */
-export const SdkConfigSource = {
-    /**
-     * Capture parameters were overridden by a valid `sdk_config` claim
-     * decoded from the JWT auth token.
-     */
-    sdkConfig: "sdk_config",
-    /**
-     * No `sdk_config` claim was present (or it was structurally invalid);
-     * the SDK applied its built-in defaults throughout the flow.
-     */
-    defaultSource: "default",
-};
-//# sourceMappingURL=sdk_config_source.js.map
+"use strict";export const SdkConfigSource={sdkConfig:"sdk_config",defaultSource:"default"};

package/dist/data/model/token_payload.d.ts

@@ -75,4 +75,3 @@ export declare function tokenConsentMissingSubfields(consent: TokenConsent): rea
  * `builder.userDetails` be omitted entirely.
  */
 export declare function bindsRequiredUserDetails(payload: TokenPayload | undefined): boolean;
-//# sourceMappingURL=token_payload.d.ts.map

package/dist/data/model/token_payload.js

@@ -1,132 +1 @@
-import { z } from "zod";
-/**
- * User-detail and consent bindings delivered via the JWT auth token.
- *
- * The backend embeds this object under the top-level `payload` claim
- * (JWT payload, base64url-decoded middle segment) when the partner
- * binds user details and/or consent into the token on their backend.
- * User-detail values in the claim are opaque vault references — only
- * key PRESENCE is meaningful client-side. Consent subfields are
- * plaintext. `country` / `id_type` / `id_number` / `callback_url` may
- * also appear in the claim but are deliberately ignored.
- *
- * Every field is optional and every field tolerates a wrong wire type
- * by degrading to absent — a malformed claim never rejects the token.
- *
- * Field names are a deliberate cross-SDK shared contract that
- * intentionally omits the `UseSmileID` prefix. Internal — not
- * re-exported from the package entrypoint (`src/index.ts`).
- */
-const tokenConsentClaimSchema = z.object({
-    /** Only a literal `true` counts — `false` or a non-boolean is never trusted as a binding. */
-    granted: z.literal(true).optional().catch(undefined),
-    granted_at: z.string().optional().catch(undefined),
-    notice_language: z.string().optional().catch(undefined),
-    notice_privacy_policy_url: z.string().optional().catch(undefined),
-});
-/**
- * Tolerant wire schema for the `payload` claim. Unknown keys are
- * stripped; a wrong-typed field degrades to `undefined` (per-field
- * `.catch`) instead of failing the whole claim.
- */
-export const tokenPayloadSchema = z.object({
-    given_names: z.string().optional().catch(undefined),
-    last_name: z.string().optional().catch(undefined),
-    email: z.string().optional().catch(undefined),
-    phone_number: z.string().optional().catch(undefined),
-    /** Non-object / array consent values degrade to absent. */
-    consent: tokenConsentClaimSchema.optional().catch(undefined),
-});
-/**
- * Parse a raw `payload` claim value into a `TokenPayload`, or
- * `undefined` when the claim is absent or not a JSON object. Mirrors
- * the `sdk_config` degradation semantics: never throws, tolerates
- * unknown keys, and degrades wrong-typed fields to absent.
- */
-export function parseTokenPayload(rawClaim) {
-    if (rawClaim === null ||
-        typeof rawClaim !== "object" ||
-        Array.isArray(rawClaim)) {
-        return undefined;
-    }
-    const parseResult = tokenPayloadSchema.safeParse(rawClaim);
-    if (!parseResult.success) {
-        // Unreachable in practice (every field carries a `.catch`), but
-        // degrade gracefully to preserve the never-throws contract.
-        return undefined;
-    }
-    const claim = parseResult.data;
-    const consent = tokenConsentFromClaim(claim.consent);
-    return {
-        hasGivenNames: isPresent(claim.given_names),
-        hasLastName: isPresent(claim.last_name),
-        hasEmail: isPresent(claim.email),
-        hasPhoneNumber: isPresent(claim.phone_number),
-        ...(consent !== undefined ? { consent } : {}),
-    };
-}
-/**
- * Token consent is COMPLETE when `granted` is `true` and every other
- * subfield is non-blank. A complete binding — granted with every
- * notice subfield non-blank — satisfies the consent requirement
- * without a local source. Token consent always wins, so a partial
- * binding is a build-time validation error.
- */
-export function isTokenConsentComplete(consent) {
-    return (consent !== undefined && tokenConsentMissingSubfields(consent).length === 0);
-}
-/**
- * Wire-key names of the consent subfields the binding is missing. A
- * token that carries a consent object must carry all four subfields —
- * a non-empty list is a build-time validation error naming exactly
- * what the token must add.
- */
-export function tokenConsentMissingSubfields(consent) {
-    const missing = [];
-    if (consent.granted !== true)
-        missing.push("granted");
-    if (!isNonBlank(consent.grantedAt))
-        missing.push("granted_at");
-    if (!isNonBlank(consent.noticeLanguage))
-        missing.push("notice_language");
-    if (!isNonBlank(consent.noticePrivacyPolicyUrl)) {
-        missing.push("notice_privacy_policy_url");
-    }
-    return missing;
-}
-/**
- * Whether the token binds every user-detail field the SDK would
- * otherwise require from the builder: `given_names` AND `last_name`
- * AND at least one of `email` / `phone_number`. Only then may
- * `builder.userDetails` be omitted entirely.
- */
-export function bindsRequiredUserDetails(payload) {
-    if (payload === undefined)
-        return false;
-    return (payload.hasGivenNames &&
-        payload.hasLastName &&
-        (payload.hasEmail || payload.hasPhoneNumber));
-}
-function tokenConsentFromClaim(claim) {
-    if (claim === undefined)
-        return undefined;
-    const consent = {
-        ...(claim.granted === true ? { granted: true } : {}),
-        ...(claim.granted_at !== undefined ? { grantedAt: claim.granted_at } : {}),
-        ...(claim.notice_language !== undefined
-            ? { noticeLanguage: claim.notice_language }
-            : {}),
-        ...(claim.notice_privacy_policy_url !== undefined
-            ? { noticePrivacyPolicyUrl: claim.notice_privacy_policy_url }
-            : {}),
-    };
-    // An empty consent object binds nothing — treat it as absent.
-    return Object.keys(consent).length > 0 ? consent : undefined;
-}
-function isPresent(value) {
-    return value !== undefined && value.length > 0;
-}
-function isNonBlank(value) {
-    return value !== undefined && value.trim().length > 0;
-}
-//# sourceMappingURL=token_payload.js.map
+"use strict";import{z as t}from"zod";const u=t.object({granted:t.literal(!0).optional().catch(void 0),granted_at:t.string().optional().catch(void 0),notice_language:t.string().optional().catch(void 0),notice_privacy_policy_url:t.string().optional().catch(void 0)});export const tokenPayloadSchema=t.object({given_names:t.string().optional().catch(void 0),last_name:t.string().optional().catch(void 0),email:t.string().optional().catch(void 0),phone_number:t.string().optional().catch(void 0),consent:u.optional().catch(void 0)});export function parseTokenPayload(n){if(n===null||typeof n!="object"||Array.isArray(n))return;const e=tokenPayloadSchema.safeParse(n);if(!e.success)return;const i=e.data,a=s(i.consent);return{hasGivenNames:r(i.given_names),hasLastName:r(i.last_name),hasEmail:r(i.email),hasPhoneNumber:r(i.phone_number),...a!==void 0?{consent:a}:{}}}export function isTokenConsentComplete(n){return n!==void 0&&tokenConsentMissingSubfields(n).length===0}export function tokenConsentMissingSubfields(n){const e=[];return n.granted!==!0&&e.push("granted"),o(n.grantedAt)||e.push("granted_at"),o(n.noticeLanguage)||e.push("notice_language"),o(n.noticePrivacyPolicyUrl)||e.push("notice_privacy_policy_url"),e}export function bindsRequiredUserDetails(n){return n===void 0?!1:n.hasGivenNames&&n.hasLastName&&(n.hasEmail||n.hasPhoneNumber)}function s(n){if(n===void 0)return;const e={...n.granted===!0?{granted:!0}:{},...n.granted_at!==void 0?{grantedAt:n.granted_at}:{},...n.notice_language!==void 0?{noticeLanguage:n.notice_language}:{},...n.notice_privacy_policy_url!==void 0?{noticePrivacyPolicyUrl:n.notice_privacy_policy_url}:{}};return Object.keys(e).length>0?e:void 0}function r(n){return n!==void 0&&n.length>0}function o(n){return n!==void 0&&n.trim().length>0}

package/dist/data/model/user_details_payload.d.ts

@@ -36,4 +36,3 @@ export declare function isUserDetailsPayloadEmpty(payload: UserDetailsPayload):
  * contact fields are trimmed and omitted when blank.
  */
 export declare function userDetailsPayloadToWire(payload: UserDetailsPayload): Record<string, string>;
-//# sourceMappingURL=user_details_payload.d.ts.map

package/dist/data/model/user_details_payload.js

@@ -1,53 +1 @@
-/**
- * Build the payload from builder-supplied details, dropping every field the
- * token binds. With no token binding this reproduces `UserDetails`' wire
- * encoding unchanged.
- */
-export function userDetailsPayloadFrom(userDetails, droppingFieldsBoundBy) {
-    return {
-        ...(droppingFieldsBoundBy?.hasGivenNames
-            ? {}
-            : { givenNames: userDetails.givenNames }),
-        ...(droppingFieldsBoundBy?.hasLastName
-            ? {}
-            : { lastName: userDetails.lastName }),
-        ...(droppingFieldsBoundBy?.hasEmail || userDetails.email === undefined
-            ? {}
-            : { email: userDetails.email }),
-        ...(droppingFieldsBoundBy?.hasPhoneNumber ||
-            userDetails.phoneNumber === undefined
-            ? {}
-            : { phoneNumber: userDetails.phoneNumber }),
-    };
-}
-/**
- * True when `userDetailsPayloadToWire` would produce an empty object — the
- * caller omits the part instead of sending `{}`. Blank contacts count as
- * empty, mirroring the wire encoding that trims and drops them.
- */
-export function isUserDetailsPayloadEmpty(payload) {
-    return Object.keys(userDetailsPayloadToWire(payload)).length === 0;
-}
-/**
- * Wire shape: snake_case keys. Names are emitted as supplied when non-blank;
- * contact fields are trimmed and omitted when blank.
- */
-export function userDetailsPayloadToWire(payload) {
-    const wire = {};
-    if (payload.givenNames !== undefined && payload.givenNames.trim() !== "") {
-        wire["given_names"] = payload.givenNames;
-    }
-    if (payload.lastName !== undefined && payload.lastName.trim() !== "") {
-        wire["last_name"] = payload.lastName;
-    }
-    const trimmedEmail = payload.email?.trim();
-    if (trimmedEmail) {
-        wire["email"] = trimmedEmail;
-    }
-    const trimmedPhone = payload.phoneNumber?.trim();
-    if (trimmedPhone) {
-        wire["phone_number"] = trimmedPhone;
-    }
-    return wire;
-}
-//# sourceMappingURL=user_details_payload.js.map
+"use strict";export function userDetailsPayloadFrom(e,m){return{...m?.hasGivenNames?{}:{givenNames:e.givenNames},...m?.hasLastName?{}:{lastName:e.lastName},...m?.hasEmail||e.email===void 0?{}:{email:e.email},...m?.hasPhoneNumber||e.phoneNumber===void 0?{}:{phoneNumber:e.phoneNumber}}}export function isUserDetailsPayloadEmpty(e){return Object.keys(userDetailsPayloadToWire(e)).length===0}export function userDetailsPayloadToWire(e){const m={};e.givenNames!==void 0&&e.givenNames.trim()!==""&&(m.given_names=e.givenNames),e.lastName!==void 0&&e.lastName.trim()!==""&&(m.last_name=e.lastName);const n=e.email?.trim();n&&(m.email=n);const i=e.phoneNumber?.trim();return i&&(m.phone_number=i),m}

package/dist/data/repository/use_smile_id_repository.d.ts

@@ -1,3 +1,4 @@
+import type { SdkConfig } from "../model/sdk_config";
 import type { JobRequest } from "../model/job_request";
 import type { JobSubmissionResponse } from "../model/job_submission_response";
 import type { UseSmileIDResult } from "../../core/models/result";
@@ -14,6 +15,5 @@ export interface UseSmileIDRepository {
      * failures per the configured retry policy. The `request.jobType`
      * discriminator drives dispatch to the matching API method.
      */
-    submit(request: JobRequest): Promise<UseSmileIDResult<JobSubmissionResponse>>;
+    submit(request: JobRequest, sdkConfig?: SdkConfig | undefined): Promise<UseSmileIDResult<JobSubmissionResponse>>;
 }
-//# sourceMappingURL=use_smile_id_repository.d.ts.map

package/dist/data/repository/use_smile_id_repository.js

@@ -1,2 +1 @@
-export {};
-//# sourceMappingURL=use_smile_id_repository.js.map
+"use strict";export{};