@smileid/usesmileid 12.2.0 → 12.3.0

package/dist/core/perf/capture_perf_trace.d.ts

@@ -0,0 +1,90 @@
+import type { KameraMetric } from "@smileid/kamera";
+/**
+ * The points a capture passes, in order, each timed from the capture screen
+ * appearing. The names are the log's, so a run on any platform reads the same.
+ */
+export declare const CapturePerfMark: {
+    /** The capture screen appeared: the trace's zero. */
+    readonly screenShown: "screen_shown";
+    /** The screen asked the camera to start. */
+    readonly cameraStartRequested: "camera_start_requested";
+    /** The camera's start resolved. */
+    readonly cameraRunning: "camera_running";
+    /** kamera delivered its first frame. */
+    readonly firstFrame: "first_frame";
+    /** Analysis began: as the camera runs, or on a retry's Start tap. */
+    readonly streamingStarted: "streaming_started";
+    /** The first frame analysis came back. */
+    readonly firstScanResult: "first_scan_result";
+    /** The capture reached its terminal captured state. */
+    readonly captureComplete: "capture_complete";
+    /** The captured images are ready to hand off. */
+    readonly filesReady: "files_ready";
+};
+export type CapturePerfMark = (typeof CapturePerfMark)[keyof typeof CapturePerfMark];
+/**
+ * How a capture attempt ended, as the log line names it. After `failed`, `retake` or `timeout`, the
+ * next attempt gets its own line.
+ */
+export type CapturePerfOutcome = "captured" | "gallery" | "failed" | "retake" | "timeout" | "abandoned";
+/** Whether the user can follow `outcome` with another attempt, which gets a fresh trace. */
+export declare function capturePerfOutcomeContinues(outcome: CapturePerfOutcome): boolean;
+/** Median and 95th percentile of some milliseconds, over `count` samples. */
+export type CapturePerfStat = {
+    readonly count: number;
+    readonly p50Ms: number;
+    readonly p95Ms: number;
+};
+/** What one capture measured. */
+export type CapturePerfSnapshot = {
+    /** Each mark reached, in milliseconds from `screen_shown`. */
+    readonly marks: Readonly<Partial<Record<CapturePerfMark, number>>>;
+    /** kamera's own start-to-first-frame, and whether it paid the camera stack's first start. */
+    readonly timeToFirstFrameMs?: number;
+    readonly coldStart?: boolean;
+    /** Take-to-close per analysed frame. */
+    readonly analysis?: CapturePerfStat;
+    /** How long each analysed frame waited in the frame hub before it was taken. */
+    readonly wait?: CapturePerfStat;
+    /** The last still's capture-to-result latency. */
+    readonly captureLatencyMs?: number;
+};
+/**
+ * What one capture attempt measured, as `UseSmileIDDebug.setPerfTraceListener` hands it over: the
+ * same as its log line, typed.
+ */
+export type CapturePerfReport = CapturePerfSnapshot & {
+    /** The capture timed: `selfie`, or `document` and its side (`document front`). */
+    readonly capture: string;
+    /** How the attempt ended. */
+    readonly outcome: CapturePerfOutcome;
+    /** The log line: `[UseSmileID perf] <capture> <outcome> mark=ms …`. */
+    readonly line: string;
+};
+/**
+ * Times one capture screen: the marks it passes plus kamera's metrics. Pure: the
+ * screen feeds it and reads {@link CapturePerfTrace.summaryLine} back.
+ */
+export declare class CapturePerfTrace {
+    private readonly _now;
+    private readonly _startedAt;
+    private readonly _marks;
+    private readonly _analysisMs;
+    private readonly _waitMs;
+    private _timeToFirstFrameMs;
+    private _coldStart;
+    private _captureLatencyMs;
+    constructor(now?: () => number);
+    /** Records `mark` the first time it is reached; a repeat keeps the first. */
+    mark(mark: CapturePerfMark): void;
+    /** Folds in one kamera metric. */
+    onMetric(metric: KameraMetric): void;
+    snapshot(): CapturePerfSnapshot;
+    /** The attempt's report for `capture` ending with `outcome`, its log line included. */
+    report(capture: string, outcome: CapturePerfOutcome): CapturePerfReport;
+    /**
+     * One log line: `[UseSmileID perf] <label> mark=ms … analysis=p50/p95ms(n) …`, the marks in
+     * capture order and only those reached.
+     */
+    summaryLine(label: string): string;
+}

package/dist/core/perf/capture_perf_trace.js

@@ -0,0 +1 @@
+"use strict";export const CapturePerfMark={screenShown:"screen_shown",cameraStartRequested:"camera_start_requested",cameraRunning:"camera_running",firstFrame:"first_frame",streamingStarted:"streaming_started",firstScanResult:"first_scan_result",captureComplete:"capture_complete",filesReady:"files_ready"};const u=[CapturePerfMark.screenShown,CapturePerfMark.cameraStartRequested,CapturePerfMark.cameraRunning,CapturePerfMark.firstFrame,CapturePerfMark.streamingStarted,CapturePerfMark.firstScanResult,CapturePerfMark.captureComplete,CapturePerfMark.filesReady];export function capturePerfOutcomeContinues(e){return e==="failed"||e==="retake"||e==="timeout"}export class CapturePerfTrace{_now;_startedAt;_marks={};_analysisMs=[];_waitMs=[];_timeToFirstFrameMs;_coldStart;_captureLatencyMs;constructor(t=m){this._now=t,this._startedAt=t(),this._marks[CapturePerfMark.screenShown]=0}mark(t){this._marks[t]===void 0&&(this._marks[t]=Math.max(0,Math.round(this._now()-this._startedAt)))}onMetric(t){switch(t.name){case"firstFrame":if(this._timeToFirstFrameMs!==void 0)return;this.mark(CapturePerfMark.firstFrame),this._timeToFirstFrameMs=t.timeToFirstFrameMs,this._coldStart=t.coldStart;break;case"frameAnalyzed":if(this._marks[CapturePerfMark.streamingStarted]===void 0||this._marks[CapturePerfMark.captureComplete]!==void 0)return;this._analysisMs.push(t.analysisMs),this._waitMs.push(t.waitMs);break;case"captureCompleted":this._captureLatencyMs=t.latencyMs;break}}snapshot(){return{marks:{...this._marks},...this._timeToFirstFrameMs!==void 0?{timeToFirstFrameMs:this._timeToFirstFrameMs}:{},...this._coldStart!==void 0?{coldStart:this._coldStart}:{},...this._analysisMs.length>0?{analysis:n(this._analysisMs)}:{},...this._waitMs.length>0?{wait:n(this._waitMs)}:{},...this._captureLatencyMs!==void 0?{captureLatencyMs:this._captureLatencyMs}:{}}}report(t,s){return{...this.snapshot(),capture:t,outcome:s,line:this.summaryLine(`${t} ${s}`)}}summaryLine(t){const s=this.snapshot(),a=u.filter(r=>s.marks[r]!==void 0).map(r=>`${r}=${s.marks[r]}ms`);return s.timeToFirstFrameMs!==void 0&&a.push(`kamera_first_frame=${s.timeToFirstFrameMs}ms${s.coldStart?"(cold)":""}`),s.analysis&&a.push(`analysis=${c(s.analysis)}`),s.wait&&a.push(`wait=${c(s.wait)}`),s.captureLatencyMs!==void 0&&a.push(`still=${s.captureLatencyMs}ms`),`[UseSmileID perf] ${t} ${a.join(" ")}`}}function m(){const e=globalThis.performance;return e?e.now():Date.now()}function n(e){const t=[...e].sort((s,a)=>s-a);return{count:t.length,p50Ms:i(t,.5),p95Ms:i(t,.95)}}function i(e,t){const s=Math.ceil(t*e.length);return e[Math.min(e.length,Math.max(1,s))-1]??0}function c(e){return`${Math.round(e.p50Ms)}/${Math.round(e.p95Ms)}ms(${e.count})`}

package/dist/data/api/interceptors/logging_interceptor.js

@@ -1 +1 @@
-"use strict";import{LogLevel as u}from"../../../core/models/network_config";import{ALWAYS_REDACT as i,ALWAYS_REDACT_BODY_KEYS as p}from"./sensitive_headers";export function attachLoggingInterceptor(e,t){if(!t.enabled||t.level===u.none){const o=e.interceptors.request.use(l=>l),a=e.interceptors.response.use(l=>l);return{request:o,response:a}}const s=new Set(t.redactHeaders.map(o=>o.toLowerCase())),r=e.interceptors.request.use(o=>(m(o,t.level,s),o)),n=e.interceptors.response.use(o=>(b(o,t.level),o),o=>(y(o,t.level),Promise.reject(o)));return{request:r,response:n}}const d=/^([a-z][a-z\d+\-.]*:)?\/\//i;function f(e){const t=e.baseURL??"",s=e.url??"";return!t||d.test(s)?s:s?`${t.replace(/\/+$/,"")}/${s.replace(/^\/+/,"")}`:t}function m(e,t,s){const r=(e.method??"GET").toUpperCase(),n=f(e);if(console.log(`[UseSmileID] \u2192 ${r} ${n}`),t===u.headers||t===u.body){const o=D(e.headers,s);console.log("[UseSmileID]   headers:",o)}}function b(e,t){console.log(`[UseSmileID] \u2190 ${e.status} ${e.statusText} ${e.config.url??""}`),t===u.body&&console.log("[UseSmileID]   body:",c(e.data))}function y(e,t){const s=e.response?.status??"no-response";console.warn(`[UseSmileID] \u2717 ${s} ${e.config?.url??""} \u2014 ${e.message}`),t===u.body&&e.response&&console.warn("[UseSmileID]   body:",c(e.response.data))}const A=6;function c(e,t=0){if(t>=A)return"<depth-limit>";if(Array.isArray(e))return e.map(s=>c(s,t+1));if(e!==null&&typeof e=="object"){const s={};for(const[r,n]of Object.entries(e))s[r]=p.has(r.toLowerCase())?"<redacted>":c(n,t+1);return s}return e}function D(e,t){const s={};for(const[r,n]of Object.entries(e??{})){const o=r.toLowerCase();i.has(o)||t.has(o)?s[r]="<redacted>":s[r]=n}return s}
+"use strict";import{LogLevel as u}from"../../../core/models/network_config";import{ALWAYS_REDACT as d,ALWAYS_REDACT_BODY_KEYS as p}from"./sensitive_headers";import{isDevelopmentBuild as f}from"../../../core/is_development_build";export function attachLoggingInterceptor(e,t){if(!t.enabled||t.level===u.none){const r=e.interceptors.request.use(a=>a),i=e.interceptors.response.use(a=>a);return{request:r,response:i}}const s=new Set(t.redactHeaders.map(r=>r.toLowerCase())),o=t.level===u.body&&!f()?u.headers:t.level,n=e.interceptors.request.use(r=>(y(r,o,s),r)),c=e.interceptors.response.use(r=>(D(r,o),r),r=>(A(r,o),Promise.reject(r)));return{request:n,response:c}}const m=/^([a-z][a-z\d+\-.]*:)?\/\//i;function b(e){const t=e.baseURL??"",s=e.url??"";return!t||m.test(s)?s:s?`${t.replace(/\/+$/,"")}/${s.replace(/^\/+/,"")}`:t}function y(e,t,s){const o=(e.method??"GET").toUpperCase(),n=b(e);if(console.log(`[UseSmileID] \u2192 ${o} ${n}`),t===u.headers||t===u.body){const c=S(e.headers,s);console.log("[UseSmileID]   headers:",c)}}function D(e,t){console.log(`[UseSmileID] \u2190 ${e.status} ${e.statusText} ${e.config.url??""}`),t===u.body&&console.log("[UseSmileID]   body:",l(e.data))}function A(e,t){const s=e.response?.status??"no-response";console.warn(`[UseSmileID] \u2717 ${s} ${e.config?.url??""} \u2014 ${e.message}`),t===u.body&&e.response&&console.warn("[UseSmileID]   body:",l(e.response.data))}const L=6;function l(e,t=0){if(t>=L)return"<depth-limit>";if(Array.isArray(e))return e.map(s=>l(s,t+1));if(e!==null&&typeof e=="object"){const s={};for(const[o,n]of Object.entries(e))s[o]=p.has(o.toLowerCase())?"<redacted>":l(n,t+1);return s}return e}function S(e,t){const s={};for(const[o,n]of Object.entries(e??{})){const c=o.toLowerCase();d.has(c)||t.has(c)?s[o]="<redacted>":s[o]=n}return s}

package/dist/data/api/interceptors/smile_auth_interceptor.js

@@ -1 +1 @@
-"use strict";import{sourceSdkIdentifier as t}from"@smileid/usesmileid_bridge";import{currentRequestTimestamp as s}from"../../security/request_timestamp";const n="12.2.0";export class SmileAuthInterceptor{_partnerConfig;_tokenHolder;constructor(e){this._partnerConfig=e.partnerConfig,this._tokenHolder=e.tokenHolder}attach(e){return{request:e.interceptors.request.use(async r=>this._onRequest(r))}}async _onRequest(e){return e.headers.set("smileid-token",this._tokenHolder.current),e.headers.set("smileid-source-sdk",t()),e.headers.set("smileid-source-sdk-version",n),e.headers.set("smileid-partner-id",this._partnerConfig.partnerId),e.headers.set("smileid-request-timestamp",s()),e}}
+"use strict";import{sourceSdkIdentifier as t}from"@smileid/usesmileid_bridge";import{currentRequestTimestamp as s}from"../../security/request_timestamp";const n="12.3.0";export class SmileAuthInterceptor{_partnerConfig;_tokenHolder;constructor(e){this._partnerConfig=e.partnerConfig,this._tokenHolder=e.tokenHolder}attach(e){return{request:e.interceptors.request.use(async r=>this._onRequest(r))}}async _onRequest(e){return e.headers.set("smileid-token",this._tokenHolder.current),e.headers.set("smileid-source-sdk",t()),e.headers.set("smileid-source-sdk-version",n),e.headers.set("smileid-partner-id",this._partnerConfig.partnerId),e.headers.set("smileid-request-timestamp",s()),e}}

package/dist/data/api/request_capture.d.ts

@@ -0,0 +1,16 @@
+import type { AxiosAdapter, InternalAxiosRequestConfig } from "axios";
+/**
+ * The request the capture client stopped: its config as it would have gone to
+ * the wire, after every request interceptor (auth, request-MAC, integrity) ran.
+ */
+export declare class CapturedRequest extends Error {
+    readonly config: InternalAxiosRequestConfig;
+    constructor(config: InternalAxiosRequestConfig);
+}
+/**
+ * The capture client's adapter: axios calls it once the request interceptors
+ * have run, so it rejects with the signed request instead of sending it. A
+ * skipped submission seals its request through this client, so the request it
+ * seals is signed exactly as a submission is and never leaves the device.
+ */
+export declare const captureAdapter: AxiosAdapter;

package/dist/data/api/request_capture.js

@@ -0,0 +1 @@
+"use strict";export class CapturedRequest extends Error{config;constructor(t){super("The request was captured for sealing, not sent"),this.name="CapturedRequest",this.config=t}}export const captureAdapter=e=>Promise.reject(new CapturedRequest(e));

package/dist/data/api/smile_id_api.d.ts

@@ -66,7 +66,7 @@ export declare class SmileIDAPI {
      *
      * `expectedLivenessCount` is the expected number of liveness frames
      * for this submission — derived from the decoded `sdk_config` claim
-     * when present, otherwise the `ScanPerformanceProfile` default (7).
+     * when present, otherwise the native default (7).
      */
     private _buildSelfieFormData;
     /**

package/dist/data/api/smile_id_api.js

@@ -1 +1 @@
-"use strict";import u from"axios";import{SmileIDUrls as d}from"../smile_id_urls";import{userDetailsPayloadToWire as g}from"../model/user_details_payload";import{SmileAuthInterceptor as h}from"./interceptors/smile_auth_interceptor";import{attachLoggingInterceptor as y}from"./interceptors/logging_interceptor";import{REQUEST_MAC_OPT_IN_KEY as b}from"./interceptors/smile_request_mac_interceptor";import{ATTESTATION_OPT_IN_KEY as D}from"./interceptors/smile_integrity_interceptor";import{NetworkResponseParseException as m}from"../../core/exception";import{LivenessFrameCountException as S}from"../../core/exception";const l=d.production,_=d.sandbox,C={[b]:!0,[D]:!0};export class SmileIDAPI{_client;_partnerConfig;constructor(t,n){this._client=t,this._partnerConfig=n}async smartSelfieEnrollment(t){const n=this._buildSelfieFormData(t);return r(n,t),this._appendPartnerConfigParts(n),this._appendConsentAndMetadata(n,t.consent,t.metadata),this._postMultipart("/v3/registration",n)}async smartSelfieAuthentication(t){const n=this._buildSelfieFormData(t);return i(n,"user_id",t.userId),r(n,t),this._appendPartnerConfigParts(n),this._appendConsentAndMetadata(n,t.consent,t.metadata),this._postMultipart("/v3/authentication",n)}async enhancedKyc(t){const n=new FormData;return this._appendIdFields(n,t.params),r(n,t),t.params.bankCode&&i(n,"bank_code",t.params.bankCode),t.params.mobileOperator&&i(n,"operator",t.params.mobileOperator),this._appendPartnerConfigParts(n),this._appendConsentAndMetadata(n,t.consent,t.metadata),this._postMultipart("/v3/enhanced_kyc",n)}async biometricKyc(t){const n=t.params.useEnrolledImage,e=this._buildSelfieFormData(t);return this._appendIdFields(e,t.params),r(e,t),n&&i(e,"use_enrolled_image","true"),this._appendPartnerConfigParts(e),this._appendConsentAndMetadata(e,t.consent,t.metadata),this._postMultipart("/v3/biometric_kyc",e)}async documentVerification(t){return this._postDocumentVerification(t,"/v3/document_verification")}async enhancedDocumentVerification(t){return this._postDocumentVerification(t,"/v3/enhanced_document_verification")}async residencyDocumentVerification(t){return this._postDocumentVerification(t,"/v3/residency_document_verification")}async _postDocumentVerification(t,n){const e=this._buildSelfieFormData(t);return s(e,"document",t.frontDocument),"backDocument"in t&&t.backDocument&&s(e,"document_back",t.backDocument),"visaDocument"in t&&s(e,"visa",t.visaDocument),t.country&&i(e,"country",t.country),t.idType&&i(e,"id_type",t.idType),r(e,t),this._appendPartnerConfigParts(e),this._appendConsentAndMetadata(e,t.consent,t.metadata),this._postMultipart(n,e)}_buildSelfieFormData(t){SmileIDAPI._validateLivenessCount(t.livenessImages,t.expectedLivenessImageCount);const n=new FormData;s(n,"selfie_image",t.selfieImage);for(const e of t.livenessImages)s(n,"liveness_images",e);return n}static _validateLivenessCount(t,n){if(t.length!==n)throw new S({expected:n,actual:t.length})}_appendIdFields(t,n){n.idType&&i(t,"id_type",n.idType),n.idNumber&&i(t,"id_number",n.idNumber),n.country&&i(t,"country",n.country)}_appendPartnerConfigParts(t){const n=this._partnerConfig.callbackUrl;n&&i(t,"callback_url",n);const e=this._partnerConfig.partnerParams;e&&Object.keys(e).length>0&&c(t,"partner_params",e)}_appendConsentAndMetadata(t,n,e){n!==void 0&&c(t,"consent",{granted:n.granted,granted_at:n.grantedAt,notice_language:n.noticeLanguage,notice_privacy_policy_url:n.noticePrivacyPolicyUrl}),c(t,"metadata",e.toEntries())}async _postMultipart(t,n){const e=await this._client.post(t,n,{headers:{"Content-Type":"multipart/form-data"},...C});return P(e.data)}}function P(a){if(a==null||typeof a!="object"||Array.isArray(a))throw new m({message:"SmileIDAPI: server returned an empty or non-object response body."});const t=a,n=(p,f)=>{if(typeof p!="string")throw new m({message:`SmileIDAPI: response is missing the required string field '${f}'.`});return p},e={jobId:n(t.job_id??t.jobId,"job_id"),userId:n(t.user_id??t.userId,"user_id"),status:n(t.status,"status"),message:n(t.message,"message")},o=t.created_at??t.createdAt;return typeof o=="string"&&o.length>0?{...e,createdAt:o}:e}function r(a,t){const n=t.userDetails;if(n===void 0)return;const e=g(n);Object.keys(e).length!==0&&c(a,"user_details",e)}function i(a,t,n){a.append(t,n)}function c(a,t,n){const e=JSON.stringify(n);a.append(t,e)}function s(a,t,n){const e=n.split("/").pop()??`${t}.jpg`;a.append(t,{uri:n,name:e,type:"image/jpeg"})}export function buildAxiosClient(a){const e=a.config?.partnerConfig?.useSandbox??!0?_:l,o=a.timeouts?.call??120;return u.create({baseURL:e,timeout:o*1e3})}export{h as SmileAuthInterceptor,y as attachLoggingInterceptor,l as PROD_BASE_URL,_ as SANDBOX_BASE_URL};
+"use strict";import u from"axios";import{SmileIDUrls as d}from"../smile_id_urls";import{userDetailsPayloadToWire as g}from"../model/user_details_payload";import{SmileAuthInterceptor as h}from"./interceptors/smile_auth_interceptor";import{attachLoggingInterceptor as y}from"./interceptors/logging_interceptor";import{REQUEST_MAC_OPT_IN_KEY as b}from"./interceptors/smile_request_mac_interceptor";import{ATTESTATION_OPT_IN_KEY as D}from"./interceptors/smile_integrity_interceptor";import{NetworkResponseParseException as m}from"../../core/exception";import{LivenessFrameCountException as S}from"../../core/exception";const l=d.production,_=d.sandbox,C={[b]:!0,[D]:!0};export class SmileIDAPI{_client;_partnerConfig;constructor(t,n){this._client=t,this._partnerConfig=n}async smartSelfieEnrollment(t){const n=this._buildSelfieFormData(t);return r(n,t),this._appendPartnerConfigParts(n),this._appendConsentAndMetadata(n,t.consent,t.metadata),this._postMultipart("/v3/registration",n)}async smartSelfieAuthentication(t){const n=this._buildSelfieFormData(t);return i(n,"user_id",t.userId),r(n,t),this._appendPartnerConfigParts(n),this._appendConsentAndMetadata(n,t.consent,t.metadata),this._postMultipart("/v3/authentication",n)}async enhancedKyc(t){const n=new FormData;return this._appendIdFields(n,t.params),r(n,t),t.params.bankCode&&i(n,"bank_code",t.params.bankCode),t.params.mobileOperator&&i(n,"operator",t.params.mobileOperator),this._appendPartnerConfigParts(n),this._appendConsentAndMetadata(n,t.consent,t.metadata),this._postMultipart("/v3/enhanced_kyc",n)}async biometricKyc(t){const n=t.params.useEnrolledImage,e=this._buildSelfieFormData(t);return this._appendIdFields(e,t.params),r(e,t),n&&i(e,"use_enrolled_image","true"),this._appendPartnerConfigParts(e),this._appendConsentAndMetadata(e,t.consent,t.metadata),this._postMultipart("/v3/biometric_kyc",e)}async documentVerification(t){return this._postDocumentVerification(t,"/v3/document_verification")}async enhancedDocumentVerification(t){return this._postDocumentVerification(t,"/v3/enhanced_document_verification")}async residencyDocumentVerification(t){return this._postDocumentVerification(t,"/v3/residency_document_verification")}async _postDocumentVerification(t,n){const e=this._buildSelfieFormData(t);return s(e,"document",t.frontDocument),"backDocument"in t&&t.backDocument&&s(e,"document_back",t.backDocument),"visaDocument"in t&&s(e,"visa",t.visaDocument),t.country&&i(e,"country",t.country),t.idType&&i(e,"id_type",t.idType),r(e,t),this._appendPartnerConfigParts(e),this._appendConsentAndMetadata(e,t.consent,t.metadata),this._postMultipart(n,e)}_buildSelfieFormData(t){SmileIDAPI._validateLivenessCount(t.livenessImages,t.expectedLivenessImageCount);const n=new FormData;s(n,"selfie_image",t.selfieImage);for(const e of t.livenessImages)s(n,"liveness_images",e);return n}static _validateLivenessCount(t,n){if(t.length!==n)throw new S({expected:n,actual:t.length})}_appendIdFields(t,n){n.idType&&i(t,"id_type",n.idType),n.idNumber&&i(t,"id_number",n.idNumber),n.country&&i(t,"country",n.country)}_appendPartnerConfigParts(t){const n=this._partnerConfig.callbackUrl;n&&i(t,"callback_url",n);const e=this._partnerConfig.partnerParams;e&&Object.keys(e).length>0&&c(t,"partner_params",e)}_appendConsentAndMetadata(t,n,e){n!==void 0&&c(t,"consent",{granted:n.granted,granted_at:n.grantedAt,notice_language:n.noticeLanguage,notice_privacy_policy_url:n.noticePrivacyPolicyUrl}),c(t,"metadata",e.toEntries())}async _postMultipart(t,n){const e=await this._client.post(t,n,{headers:{"Content-Type":"multipart/form-data"},...C});return P(e.data)}}function P(a){if(a==null||typeof a!="object"||Array.isArray(a))throw new m({message:"SmileIDAPI: server returned an empty or non-object response body."});const t=a,n=(p,f)=>{if(typeof p!="string")throw new m({message:`SmileIDAPI: response is missing the required string field '${f}'.`});return p},e={jobId:n(t.job_id??t.jobId,"job_id"),userId:n(t.user_id??t.userId,"user_id"),status:n(t.status,"status"),message:n(t.message,"message")},o=t.created_at??t.createdAt;return typeof o=="string"&&o.length>0?{...e,createdAt:o}:e}function r(a,t){const n=t.userDetails;n!==void 0&&c(a,"user_details",g(n))}function i(a,t,n){a.append(t,n)}function c(a,t,n){const e=JSON.stringify(n);a.append(t,e)}function s(a,t,n){const e=n.split("/").pop()??`${t}.jpg`;a.append(t,{uri:n,name:e,type:"image/jpeg"})}export function buildAxiosClient(a){const e=a.config?.partnerConfig?.useSandbox??!0?_:l,o=a.timeouts?.call??120;return u.create({baseURL:e,timeout:o*1e3})}export{h as SmileAuthInterceptor,y as attachLoggingInterceptor,l as PROD_BASE_URL,_ as SANDBOX_BASE_URL};

package/dist/data/factory/networking_factory.d.ts

@@ -45,7 +45,9 @@ import type { MetadataProvider } from "../../metadata/use_smile_id_metadata_fact
  * the request-path order so the LIFO unwind lands on the canonical
  * order described above.
  */
-export declare function makeNetworkingFactory(config: NetworkConfig, signingSecret?: () => string): {
+export declare function makeNetworkingFactory(config: NetworkConfig, signingSecret?: () => string, options?: {
+    readonly capturing?: boolean;
+}): {
     readonly api: SmileIDAPI;
     readonly client: AxiosInstance;
     readonly metadata: MetadataProvider;

package/dist/data/factory/networking_factory.js

@@ -1 +1 @@
-"use strict";import{SmileIDAPI as u,buildAxiosClient as g,SmileAuthInterceptor as I,attachLoggingInterceptor as k}from"../api/smile_id_api";import{createGzipInterceptor as d}from"../api/interceptors/gzip_interceptor";import{SmileRequestMacInterceptor as y}from"../api/interceptors/smile_request_mac_interceptor";import{SmileIntegrityInterceptor as w}from"../api/interceptors/smile_integrity_interceptor";import{TokenRefreshInterceptor as C}from"../api/interceptors/token_refresh_interceptor";import{TokenHolder as S}from"../api/auth/token_holder";import{SmileIDCryptoManager as A}from"../security/smile_id_crypto_manager";import{SecurityPolicy as P}from"../security/security_policy";import{decodeSecurityPolicyBitCode as F}from"../util/use_smile_id_token_decoder";import{Attestation as T}from"@smileid/usesmileid_bridge";import{SigningSecretProvider as b}from"@smileid/usesmileid_bridge/internal";import{MissingPartnerConfigException as n}from"../../core/exception";import{UseSmileIDMetadataFactory as x}from"../../metadata/use_smile_id_metadata_factory";export function makeNetworkingFactory(t,o=()=>b.signingSecret()){const r=t.config?.partnerConfig;if(!r||r.partnerId.trim()==="")throw n.missingPartnerId();if(!t.config?.token||t.config.token.trim()==="")throw n.missingAuthToken();const c=/[\u0000-\u001F\u007F-\u009F]/;if(c.test(r.partnerId))throw n.controlCharacterPartnerId();if(c.test(t.config.token))throw n.controlCharacterAuthToken();if(!isResolvableCallbackUrl(r.callbackUrl??""))throw n.unresolvableCallbackUrl();const e=g(t),m=new x,f=new u(e,r);T.warmUp().catch(()=>{});const a=new S(t.config?.token??""),s=P.fromBitCode(F(t.config?.token??""));d().attach(e);const p=t.config?.logging;p&&k(e,p),new w({securityPolicy:s}).attach(e);const l=new A(o());if(new y({cryptoManager:l,securityPolicy:s}).attach(e),new I({partnerConfig:r,tokenHolder:a}).attach(e),new C({tokenHolder:a,onTokenExpired:t.config?.onTokenExpired}).attach(e),t.interceptors)for(const h of t.interceptors){const i=h;typeof i=="function"?i(e):typeof i?.attach=="function"&&i.attach(e)}return{api:f,client:e,metadata:m}}const M=/^callback_[0-9a-hjkmnp-tv-z]{26}$/;export function isResolvableCallbackUrl(t){if(t===""||M.test(t))return!0;const o=t.indexOf("://");if(o<=0)return!1;const r=t.slice(0,o).toLowerCase();if(r!=="http"&&r!=="https")return!1;const e=((t.slice(o+3).split(/[/?#]/)[0]??"").split("@").pop()??"").split(":")[0]??"";return e!==""&&!/[\s\u0000-\u001F\u007F-\u009F]/.test(e)}
+"use strict";import{SmileIDAPI as I,buildAxiosClient as d,SmileAuthInterceptor as k,attachLoggingInterceptor as y}from"../api/smile_id_api";import{createGzipInterceptor as w}from"../api/interceptors/gzip_interceptor";import{captureAdapter as C}from"../api/request_capture";import{SmileRequestMacInterceptor as S}from"../api/interceptors/smile_request_mac_interceptor";import{SmileIntegrityInterceptor as A}from"../api/interceptors/smile_integrity_interceptor";import{TokenRefreshInterceptor as P}from"../api/interceptors/token_refresh_interceptor";import{TokenHolder as F}from"../api/auth/token_holder";import{SmileIDCryptoManager as T}from"../security/smile_id_crypto_manager";import{SecurityPolicy as b}from"../security/security_policy";import{decodeSecurityPolicyBitCode as x}from"../util/use_smile_id_token_decoder";import{Attestation as M}from"@smileid/usesmileid_bridge";import{SigningSecretProvider as R}from"@smileid/usesmileid_bridge/internal";import{MissingPartnerConfigException as c}from"../../core/exception";import{UseSmileIDMetadataFactory as E}from"../../metadata/use_smile_id_metadata_factory";export function makeNetworkingFactory(t,o=()=>R.signingSecret(),a={}){const e=t.config?.partnerConfig;if(!e||e.partnerId.trim()==="")throw c.missingPartnerId();if(!t.config?.token||t.config.token.trim()==="")throw c.missingAuthToken();const n=/[\u0000-\u001F\u007F-\u009F]/;if(n.test(e.partnerId))throw c.controlCharacterPartnerId();if(n.test(t.config.token))throw c.controlCharacterAuthToken();if(!isResolvableCallbackUrl(e.callbackUrl??""))throw c.unresolvableCallbackUrl();const i=a.capturing===!0,r=d(t);i&&(r.defaults.adapter=C);const u=new E,h=new I(r,e);i||M.warmUp().catch(()=>{});const p=new F(t.config?.token??""),f=b.fromBitCode(x(t.config?.token??""));i||w().attach(r);const m=t.config?.logging;m&&!i&&y(r,m),new A({securityPolicy:f}).attach(r);const g=new T(o());if(new S({cryptoManager:g,securityPolicy:f}).attach(r),new k({partnerConfig:e,tokenHolder:p}).attach(r),new P({tokenHolder:p,onTokenExpired:t.config?.onTokenExpired}).attach(r),t.interceptors&&!i)for(const l of t.interceptors){const s=l;typeof s=="function"?s(r):typeof s?.attach=="function"&&s.attach(r)}return{api:h,client:r,metadata:u}}const U=/^callback_[0-9a-hjkmnp-tv-z]{26}$/;export function isResolvableCallbackUrl(t){if(t===""||U.test(t))return!0;const o=t.indexOf("://");if(o<=0)return!1;const a=t.slice(0,o).toLowerCase();if(a!=="http"&&a!=="https")return!1;const n=((t.slice(o+3).split(/[/?#]/)[0]??"").split("@").pop()??"").split(":")[0]??"";return n!==""&&!/[\s\u0000-\u001F\u007F-\u009F]/.test(n)}

package/dist/data/model/captured_job.d.ts

@@ -0,0 +1,49 @@
+import type { JobRequest } from "./job_request";
+import type { SealedJobRequest } from "./sealed_job_request";
+/**
+ * Everything the flow captured for a job that was handed back instead of
+ * submitted (`c.skipApiSubmission = true`). Forward it to Smile ID from your
+ * own backend: send the job type's `/v3` request with `headers` as request
+ * headers, the images as their usual form parts, and `encryptedPackage`,
+ * `packageNonce` and `packageTag` as the `encrypted_package`, `package_nonce`
+ * and `package_tag` form fields.
+ *
+ * Everything else the SDK would have sent (the consent record, the metadata,
+ * the signature and the other `smileid-*` headers) travels inside
+ * `encryptedPackage`, encrypted for Smile ID: forward it as is, since the
+ * server rejects a package that was changed. The image files must
+ * reach the server byte-for-byte too, since they carry an integrity seal that
+ * a re-encode invalidates. The SDK deletes neither the files nor
+ * `sessionDirectory` in this mode: once the job has been forwarded, delete
+ * every file it lists, then `sessionDirectory` and everything left in it.
+ * `sessionDirectory` is the SDK's session folder holding every listed file,
+ * and absent when they don't share one (the capture sessions can store them
+ * apart), the folder isn't one of the SDK's own, or the job captured no files
+ * (Enhanced KYC). A document imported from the gallery or taken with the manual
+ * shutter lives in the app's cache, which the OS may clear under storage
+ * pressure, so forward such a job promptly.
+ */
+export type CapturedJob = {
+    readonly jobType: JobRequest["jobType"];
+    readonly sessionId: string;
+    readonly sessionDirectory?: string;
+    readonly selfieImage?: string;
+    readonly livenessImages: readonly string[];
+    readonly frontDocument?: string;
+    readonly backDocument?: string;
+    /** The visa page of a Residency Document Verification job, sent as the `visa` part. */
+    readonly visaDocument?: string;
+    /** `smileid-token`, `smileid-source-sdk` and `smileid-source-sdk-version`, to send as they are. */
+    readonly headers: Readonly<Record<string, string>>;
+    /** The sealed request, hex-encoded; the `encrypted_package` form field. */
+    readonly encryptedPackage: string;
+    /** The package's AES-GCM nonce, hex-encoded; the `package_nonce` form field. */
+    readonly packageNonce: string;
+    /** The package's AES-GCM authentication tag, hex-encoded; the `package_tag` form field. */
+    readonly packageTag: string;
+};
+/**
+ * The partner-facing hand-over of `request`: the files its legs produced and
+ * the `sealed` request, with nothing the partner supplied echoed back.
+ */
+export declare function capturedJobFrom(request: JobRequest, sessionId: string, sealed: SealedJobRequest): CapturedJob;

package/dist/data/model/captured_job.js

@@ -0,0 +1 @@
+"use strict";import{JobType as t}from"../../core/models/job_type";export function capturedJobFrom(e,a,c){const n=m(e),i=r([n.selfieImage,...n.livenessImages,n.frontDocument,n.backDocument,n.visaDocument]);return Object.freeze({jobType:e.jobType,sessionId:a,...i!==void 0?{sessionDirectory:i}:{},...n.selfieImage!==void 0?{selfieImage:n.selfieImage}:{},livenessImages:Object.freeze([...n.livenessImages]),...n.frontDocument!==void 0?{frontDocument:n.frontDocument}:{},...n.backDocument!==void 0?{backDocument:n.backDocument}:{},...n.visaDocument!==void 0?{visaDocument:n.visaDocument}:{},headers:c.headers,encryptedPackage:c.encryptedPackage,packageNonce:c.packageNonce,packageTag:c.packageTag})}function m(e){switch(e.jobType){case t.smartSelfieEnrollment:case t.smartSelfieAuthentication:case t.biometricKyc:return{selfieImage:e.selfieImage,livenessImages:e.livenessImages};case t.documentVerification:case t.enhancedDocumentVerification:return{selfieImage:e.selfieImage,livenessImages:e.livenessImages,frontDocument:e.frontDocument,...e.backDocument!==void 0?{backDocument:e.backDocument}:{}};case t.residencyDocumentVerification:return{selfieImage:e.selfieImage,livenessImages:e.livenessImages,frontDocument:e.frontDocument,visaDocument:e.visaDocument};case t.enhancedKyc:case t.bvn:return{livenessImages:[]}}}function o(e){const a=e.lastIndexOf("/");if(a<=0)return;const c=e.slice(0,a);return/^[a-z][a-z0-9+.-]*:\/*$/i.test(c)?void 0:c}const f="UseSmileID";function r(e){const a=new Set(e.filter(s=>s!==void 0).map(o));if(a.size!==1)return;const[c]=a;if(c===void 0)return;const n=o(c);return n?.slice(n.lastIndexOf("/")+1)===f?c:void 0}

package/dist/data/model/job_request.d.ts

@@ -48,7 +48,7 @@ export type SmartSelfieEnrollmentRequest = BaseJobRequest & {
      * from the `sdk_config` JWT claim's `livenessImageCount` when
      * present (`livenessImageCount` maps to `numSamples = count + 1`,
      * so `expectedLivenessImageCount = count`); otherwise the
-     * `ScanPerformanceProfile` default minus one (`numSamples - 1`).
+     * native default (`FaceCaptureDefaults.numSamples`) minus one (`numSamples - 1`).
      * For Enhanced Smart Selfie this is always
      * `EnhancedSmartSelfieConfig.EXPECTED_LIVENESS_IMAGE_COUNT` (7).
      *

package/dist/data/model/sealed_job_request.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A job request signed and sealed for the partner to forward
+ * (`c.skipApiSubmission = true`), produced by `JobPackageSealer`. The images
+ * travel beside it, unencrypted.
+ *
+ * `headers` go on the forwarded request as they are; `encryptedPackage`,
+ * `packageNonce` and `packageTag` are hex strings sent as the
+ * `encrypted_package`, `package_nonce` and `package_tag` form fields.
+ */
+export type SealedJobRequest = {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly encryptedPackage: string;
+    readonly packageNonce: string;
+    readonly packageTag: string;
+};

package/dist/data/model/sealed_job_request.js

@@ -0,0 +1 @@
+"use strict";export{};

package/dist/data/model/token_payload.d.ts

@@ -69,6 +69,11 @@ export type TokenBoundIdField = "country" | "idType" | "idNumber";
  * (a bound field is never sent) read, so the two cannot disagree.
  */
 export declare function isIdFieldBoundByToken(payload: TokenPayload | undefined, field: TokenBoundIdField): boolean;
+/**
+ * Whether the token binds any user detail, which the server then injects
+ * into `user_details`.
+ */
+export declare function bindsUserDetails(payload: TokenPayload | undefined): boolean;
 /**
  * Token consent is COMPLETE when `granted` is `true` and every other
  * subfield is non-blank. A complete binding — granted with every
@@ -84,10 +89,3 @@ export declare function isTokenConsentComplete(consent: TokenConsent | undefined
  * what the token must add.
  */
 export declare function tokenConsentMissingSubfields(consent: TokenConsent): readonly string[];
-/**
- * Whether the token binds every user-detail field the SDK would
- * otherwise require from the builder: `given_names` AND `last_name`
- * AND at least one of `email` / `phone_number`. Only then may
- * `builder.userDetails` be omitted entirely.
- */
-export declare function bindsRequiredUserDetails(payload: TokenPayload | undefined): boolean;

package/dist/data/model/token_payload.js

@@ -1 +1 @@
-"use strict";import{z as t}from"zod";const a=t.object({granted:t.literal(!0).optional().catch(void 0),granted_at:t.string().optional().catch(void 0),notice_language:t.string().optional().catch(void 0),notice_privacy_policy_url:t.string().optional().catch(void 0)});export const tokenPayloadSchema=t.object({given_names:t.string().optional().catch(void 0),last_name:t.string().optional().catch(void 0),email:t.string().optional().catch(void 0),phone_number:t.string().optional().catch(void 0),country:t.string().optional().catch(void 0),id_type:t.string().optional().catch(void 0),id_number:t.string().optional().catch(void 0),consent:a.optional().catch(void 0)});export function parseTokenPayload(n){if(n===null||typeof n!="object"||Array.isArray(n))return;const e=tokenPayloadSchema.safeParse(n);if(!e.success)return;const i=e.data,u=s(i.consent);return{hasGivenNames:r(i.given_names),hasLastName:r(i.last_name),hasEmail:r(i.email),hasPhoneNumber:r(i.phone_number),...u!==void 0?{consent:u}:{},hasCountry:r(i.country),hasIdType:r(i.id_type),hasIdNumber:r(i.id_number)}}export function isIdFieldBoundByToken(n,e){switch(e){case"country":return n?.hasCountry===!0;case"idType":return n?.hasIdType===!0;case"idNumber":return n?.hasIdNumber===!0}}export function isTokenConsentComplete(n){return n!==void 0&&tokenConsentMissingSubfields(n).length===0}export function tokenConsentMissingSubfields(n){const e=[];return n.granted!==!0&&e.push("granted"),o(n.grantedAt)||e.push("granted_at"),o(n.noticeLanguage)||e.push("notice_language"),o(n.noticePrivacyPolicyUrl)||e.push("notice_privacy_policy_url"),e}export function bindsRequiredUserDetails(n){return n===void 0?!1:n.hasGivenNames&&n.hasLastName&&(n.hasEmail||n.hasPhoneNumber)}function s(n){if(n===void 0)return;const e={...n.granted===!0?{granted:!0}:{},...n.granted_at!==void 0?{grantedAt:n.granted_at}:{},...n.notice_language!==void 0?{noticeLanguage:n.notice_language}:{},...n.notice_privacy_policy_url!==void 0?{noticePrivacyPolicyUrl:n.notice_privacy_policy_url}:{}};return Object.keys(e).length>0?e:void 0}function r(n){return n!==void 0&&n.length>0}function o(n){return n!==void 0&&n.trim().length>0}
+"use strict";import{z as t}from"zod";const a=t.object({granted:t.literal(!0).optional().catch(void 0),granted_at:t.string().optional().catch(void 0),notice_language:t.string().optional().catch(void 0),notice_privacy_policy_url:t.string().optional().catch(void 0)});export const tokenPayloadSchema=t.object({given_names:t.string().optional().catch(void 0),last_name:t.string().optional().catch(void 0),email:t.string().optional().catch(void 0),phone_number:t.string().optional().catch(void 0),country:t.string().optional().catch(void 0),id_type:t.string().optional().catch(void 0),id_number:t.string().optional().catch(void 0),consent:a.optional().catch(void 0)});export function parseTokenPayload(n){if(n===null||typeof n!="object"||Array.isArray(n))return;const e=tokenPayloadSchema.safeParse(n);if(!e.success)return;const i=e.data,u=s(i.consent);return{hasGivenNames:r(i.given_names),hasLastName:r(i.last_name),hasEmail:r(i.email),hasPhoneNumber:r(i.phone_number),...u!==void 0?{consent:u}:{},hasCountry:r(i.country),hasIdType:r(i.id_type),hasIdNumber:r(i.id_number)}}export function isIdFieldBoundByToken(n,e){switch(e){case"country":return n?.hasCountry===!0;case"idType":return n?.hasIdType===!0;case"idNumber":return n?.hasIdNumber===!0}}export function bindsUserDetails(n){return n?.hasGivenNames===!0||n?.hasLastName===!0||n?.hasEmail===!0||n?.hasPhoneNumber===!0}export function isTokenConsentComplete(n){return n!==void 0&&tokenConsentMissingSubfields(n).length===0}export function tokenConsentMissingSubfields(n){const e=[];return n.granted!==!0&&e.push("granted"),o(n.grantedAt)||e.push("granted_at"),o(n.noticeLanguage)||e.push("notice_language"),o(n.noticePrivacyPolicyUrl)||e.push("notice_privacy_policy_url"),e}function s(n){if(n===void 0)return;const e={...n.granted===!0?{granted:!0}:{},...n.granted_at!==void 0?{grantedAt:n.granted_at}:{},...n.notice_language!==void 0?{noticeLanguage:n.notice_language}:{},...n.notice_privacy_policy_url!==void 0?{noticePrivacyPolicyUrl:n.notice_privacy_policy_url}:{}};return Object.keys(e).length>0?e:void 0}function r(n){return n!==void 0&&n.length>0}function o(n){return n!==void 0&&n.trim().length>0}

package/dist/data/model/user_details_payload.d.ts

@@ -8,7 +8,9 @@ import type { TokenPayload } from "./token_payload";
  * fields the token does **not** already bind. Token-bound fields are dropped
  * at assembly (`userDetailsPayloadFrom`): the server injects the bound values
  * and they take precedence over anything the client sends. When nothing
- * remains, assembly omits the part entirely (`isUserDetailsPayloadEmpty`).
+ * remains, assembly omits the part under a token that binds user details,
+ * and otherwise sends `{}` so the API can name the field a job needs
+ * (`isUserDetailsPayloadEmpty`).
  *
  * Type and helper names are a deliberate cross-SDK shared contract and
  * intentionally omit the `UseSmileID` prefix (like `TokenPayload`).
@@ -26,9 +28,9 @@ export type UserDetailsPayload = {
  */
 export declare function userDetailsPayloadFrom(userDetails: UserDetails, droppingFieldsBoundBy: TokenPayload | undefined): UserDetailsPayload;
 /**
- * True when `userDetailsPayloadToWire` would produce an empty object — the
- * caller omits the part instead of sending `{}`. Blank contacts count as
- * empty, mirroring the wire encoding that trims and drops them.
+ * True when `userDetailsPayloadToWire` would produce an empty object. Blank
+ * fields count as empty, mirroring the wire encoding that trims and drops
+ * them.
  */
 export declare function isUserDetailsPayloadEmpty(payload: UserDetailsPayload): boolean;
 /**

package/dist/data/repository/use_smile_id_repository.d.ts

@@ -1,6 +1,7 @@
 import type { SdkConfig } from "../model/sdk_config";
 import type { JobRequest } from "../model/job_request";
 import type { JobSubmissionResponse } from "../model/job_submission_response";
+import type { SealedJobRequest } from "../model/sealed_job_request";
 import type { UseSmileIDResult } from "../../core/models/result";
 /**
  * Repository abstraction over `SmileIDAPI` + retry policy.
@@ -16,4 +17,10 @@ export interface UseSmileIDRepository {
      * discriminator drives dispatch to the matching API method.
      */
     submit(request: JobRequest, sdkConfig?: SdkConfig | undefined): Promise<UseSmileIDResult<JobSubmissionResponse>>;
+    /**
+     * Build and sign the request `submit` would send for `request` without
+     * sending it, and seal it into the package a skipped submission hands the
+     * partner to forward (`c.skipApiSubmission`).
+     */
+    seal(request: JobRequest, sdkConfig?: SdkConfig | undefined): Promise<UseSmileIDResult<SealedJobRequest>>;
 }

package/dist/data/repository/use_smile_id_repository_impl.d.ts

@@ -4,6 +4,13 @@ import type { SmileIDAPI } from "../api/smile_id_api";
 import type { RetryConfig } from "../../core/models/network_config";
 import type { UseSmileIDResult } from "../../core/models/result";
 import type { SdkConfig } from "../model/sdk_config";
+import type { SealedJobRequest } from "../model/sealed_job_request";
+import type { JobPackageSealer } from "../security/job_package_sealer";
+/** What a skipped submission seals its request with. */
+export type CaptureDependencies = {
+    readonly api: SmileIDAPI;
+    readonly sealer: JobPackageSealer;
+};
 /**
  * Concrete repository.
  *
@@ -15,15 +22,35 @@ import type { SdkConfig } from "../model/sdk_config";
 export declare class UseSmileIDRepositoryImpl {
     private readonly _api;
     private readonly _retry;
-    constructor(api: SmileIDAPI, retry: RetryConfig);
+    private readonly _capture;
+    /**
+     * `capture` is what a skipped submission seals its request with: the capture
+     * client (`makeNetworkingFactory(config, secret, { capturing: true })`, the
+     * same interceptors stopped before the network) and the sealer.
+     */
+    constructor(api: SmileIDAPI, retry: RetryConfig, capture?: CaptureDependencies);
+    /**
+     * Sends `request` through the capture client, which runs the same
+     * interceptors as a submission and then stops the request
+     * (`CapturedRequest`) instead of sending it, so the sealed request is
+     * compressed and signed exactly as `submit`'s first attempt would be.
+     */
+    seal(request: JobRequest, sdkConfig?: SdkConfig | undefined): Promise<UseSmileIDResult<SealedJobRequest>>;
     submit(request: JobRequest, sdkConfig?: SdkConfig | undefined): Promise<UseSmileIDResult<JobSubmissionResponse>>;
+    /**
+     * Pre-flight payload compression — best effort: shrink the captured JPEGs under the Lambda
+     * cap before transmission (runs once, outside the retry loop), but never block submission, so
+     * any compression failure ships the captured images as-is and lets the server validate. The
+     * per-image original + final compressed sizes are stamped onto the metadata for telemetry.
+     */
+    private _compressed;
     /**
      * Pre-flight payload compression entry — extracts the captured image URIs for the job type and
      * compresses the bundle under the transmission cap (metadata is measured, never modified).
      * No-op for job types that carry no captured images (Enhanced KYC / BVN).
      */
     private _compressPayload;
-    private _dispatch;
+    private static _send;
     /**
      * Translate any caught error into the typed
      * [UseSmileIDNetworkException] hierarchy. Delegates to the canonical

package/dist/data/repository/use_smile_id_repository_impl.js

@@ -1 +1 @@
-"use strict";import{failure as s,success as m}from"../../core/models/result";import{JobType as t}from"../../core/models/job_type";import{withRetry as l}from"../util/retry_util";import{InvalidFieldValueException as f}from"../../core/exception/job_validation_exceptions";import{UseSmileIDValidationException as p}from"../../core/exception/use_smile_id_validation_exception";import{mapAxiosError as d}from"../../core/exception/use_smile_id_network_exception";import{PayloadCompressionRunner as c}from"../compression/payload_compression_runner";function _(r){const e=[],i=(n,a)=>{a!==void 0&&a>0&&e.push({name:n,value:String(a)})};return i("selfie_original_size",r.selfieOriginalMb),i("selfie_final_compressed_size",r.selfieFinalMb),i("document_front_original_size",r.frontOriginalMb),i("document_front_final_compressed_size",r.frontFinalMb),i("document_back_original_size",r.backOriginalMb),i("document_back_final_compressed_size",r.backFinalMb),i("document_visa_original_size",r.visaOriginalMb),i("document_visa_final_compressed_size",r.visaFinalMb),e}export class UseSmileIDRepositoryImpl{_api;_retry;constructor(e,i){this._api=e,this._retry=i}async submit(e,i){if(e.jobType===t.bvn)return s(new f({fieldName:"jobType",reason:"BVN submission is not yet supported"}));let n=e;try{const a=await this._compressPayload(e,i),o=a?_(a):[];o.length>0&&(n={...e,metadata:e.metadata.withAdditionalEntries(o)})}catch{}try{const a=await l(this._retry,o=>this._dispatch(n,o));return m(a)}catch(a){return a instanceof p?s(a):s(this._mapError(a))}}async _compressPayload(e,i){const n=JSON.stringify(e.metadata.toEntries()).length;switch(e.jobType){case t.smartSelfieEnrollment:case t.smartSelfieAuthentication:case t.biometricKyc:return c.compress({selfieImage:e.selfieImage,livenessImages:e.livenessImages,metadataBytes:n,sdkConfig:i});case t.documentVerification:case t.enhancedDocumentVerification:return c.compress({selfieImage:e.selfieImage,livenessImages:e.livenessImages,frontDocument:e.frontDocument,backDocument:e.backDocument,metadataBytes:n,sdkConfig:i});case t.residencyDocumentVerification:return c.compress({selfieImage:e.selfieImage,livenessImages:e.livenessImages,frontDocument:e.frontDocument,visaDocument:e.visaDocument,metadataBytes:n,sdkConfig:i});default:return}}_dispatch(e,i){const n=i>0?{...e,metadata:e.metadata.withAdditionalEntries([{name:"network_retries",value:String(i)}])}:e;switch(n.jobType){case t.smartSelfieEnrollment:return this._api.smartSelfieEnrollment(n);case t.smartSelfieAuthentication:return this._api.smartSelfieAuthentication(n);case t.enhancedKyc:return this._api.enhancedKyc(n);case t.biometricKyc:return this._api.biometricKyc(n);case t.documentVerification:return this._api.documentVerification(n);case t.enhancedDocumentVerification:return this._api.enhancedDocumentVerification(n);case t.residencyDocumentVerification:return this._api.residencyDocumentVerification(n)}}_mapError(e){return d(e)}}
+"use strict";import{failure as a,success as m}from"../../core/models/result";import{JobType as r}from"../../core/models/job_type";import{withRetry as d}from"../util/retry_util";import{InvalidFieldValueException as l}from"../../core/exception/job_validation_exceptions";import{UseSmileIDValidationException as f}from"../../core/exception/use_smile_id_validation_exception";import{mapAxiosError as p}from"../../core/exception/use_smile_id_network_exception";import{PayloadCompressionRunner as c}from"../compression/payload_compression_runner";import{CapturedRequest as _}from"../api/request_capture";function h(s){const e=[],t=(i,n)=>{n!==void 0&&n>0&&e.push({name:i,value:String(n)})};return t("selfie_original_size",s.selfieOriginalMb),t("selfie_final_compressed_size",s.selfieFinalMb),t("document_front_original_size",s.frontOriginalMb),t("document_front_final_compressed_size",s.frontFinalMb),t("document_back_original_size",s.backOriginalMb),t("document_back_final_compressed_size",s.backFinalMb),t("document_visa_original_size",s.visaOriginalMb),t("document_visa_final_compressed_size",s.visaFinalMb),e}export class UseSmileIDRepositoryImpl{_api;_retry;_capture;constructor(e,t,i){this._api=e,this._retry=t,this._capture=i}async seal(e,t){if(e.jobType===r.bvn)return a(new l({fieldName:"jobType",reason:"BVN submission is not yet supported"}));const i=this._capture;if(!i)return a(new Error("No capture client to seal the request through"));const n=await this._compressed(e,t);try{return await UseSmileIDRepositoryImpl._send(i.api,n,0),a(new Error("The capture client sent the request instead of stopping it"))}catch(o){if(o instanceof _)try{return m(await i.sealer.seal(o.config))}catch(u){return a(u)}return o instanceof f?a(o):a(this._mapError(o))}}async submit(e,t){if(e.jobType===r.bvn)return a(new l({fieldName:"jobType",reason:"BVN submission is not yet supported"}));const i=await this._compressed(e,t);try{const n=await d(this._retry,o=>UseSmileIDRepositoryImpl._send(this._api,i,o));return m(n)}catch(n){return n instanceof f?a(n):a(this._mapError(n))}}async _compressed(e,t){try{const i=await this._compressPayload(e,t),n=i?h(i):[];if(n.length>0)return{...e,metadata:e.metadata.withAdditionalEntries(n)}}catch{}return e}async _compressPayload(e,t){const i=JSON.stringify(e.metadata.toEntries()).length;switch(e.jobType){case r.smartSelfieEnrollment:case r.smartSelfieAuthentication:case r.biometricKyc:return c.compress({selfieImage:e.selfieImage,livenessImages:e.livenessImages,metadataBytes:i,sdkConfig:t});case r.documentVerification:case r.enhancedDocumentVerification:return c.compress({selfieImage:e.selfieImage,livenessImages:e.livenessImages,frontDocument:e.frontDocument,backDocument:e.backDocument,metadataBytes:i,sdkConfig:t});case r.residencyDocumentVerification:return c.compress({selfieImage:e.selfieImage,livenessImages:e.livenessImages,frontDocument:e.frontDocument,visaDocument:e.visaDocument,metadataBytes:i,sdkConfig:t});default:return}}static _send(e,t,i){const n=i>0?{...t,metadata:t.metadata.withAdditionalEntries([{name:"network_retries",value:String(i)}])}:t;switch(n.jobType){case r.smartSelfieEnrollment:return e.smartSelfieEnrollment(n);case r.smartSelfieAuthentication:return e.smartSelfieAuthentication(n);case r.enhancedKyc:return e.enhancedKyc(n);case r.biometricKyc:return e.biometricKyc(n);case r.documentVerification:return e.documentVerification(n);case r.enhancedDocumentVerification:return e.enhancedDocumentVerification(n);case r.residencyDocumentVerification:return e.residencyDocumentVerification(n)}}_mapError(e){return p(e)}}

package/dist/data/security/job_package_crypto.d.ts

@@ -0,0 +1,41 @@
+/** GCM's standard 96-bit nonce, fresh for every package. */
+export declare const JOB_PACKAGE_NONCE_BYTES = 12;
+/** GCM's full 128-bit authentication tag. */
+export declare const JOB_PACKAGE_TAG_BYTES = 16;
+/** AES-256's key length, which the secret's UTF-8 bytes must have. */
+export declare const JOB_PACKAGE_KEY_BYTES = 32;
+/** The encrypted bytes, and the nonce and tag the server needs to open them. */
+export type SealedBytes = {
+    readonly ciphertext: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly tag: Uint8Array;
+};
+/**
+ * AES-256-GCM sealing for the job package a skipped submission hands the
+ * partner (`c.skipApiSubmission = true`). The server opens it with the same SDK
+ * encryption secret, and GCM's tag fails on any changed byte, so the partner
+ * forwards the package as is. The secret ships in the app, so this keeps the
+ * package from casual reading, not from someone who extracts it.
+ *
+ * The secret is the secret rotator's `sdk_encryption` for this SDK version:
+ * 32 characters since secret-rotator #27, whose UTF-8 bytes are the AES-256 key
+ * as they are. The server keys the cipher the same way
+ * (`Buffer.from(secret, 'utf8')` in lambda's `decrypt.ts`). Runs on the Web
+ * Crypto provider the request signing uses.
+ */
+export declare const JobPackageCrypto: {
+    /**
+     * The AES key for `secret`: its UTF-8 bytes. Throws `SmileIDCryptoError`
+     * unless they are `JOB_PACKAGE_KEY_BYTES` long, as a secret bundled before
+     * secret-rotator #27 is not.
+     */
+    key(secret: string): Uint8Array;
+    /**
+     * Encrypts `plaintext` under `key` with `nonce`, a fresh random one unless a
+     * test pins it. Web Crypto appends the tag to the ciphertext; it is split off
+     * so the two travel separately.
+     */
+    seal(plaintext: Uint8Array, key: Uint8Array, nonce?: Uint8Array): Promise<SealedBytes>;
+};
+/** Lowercase hex, the encoding every field of the job package travels in. */
+export declare function toHex(bytes: Uint8Array): string;

package/dist/data/security/job_package_crypto.js

@@ -0,0 +1 @@
+"use strict";import{SmileIDCryptoError as a}from"./smile_id_crypto_error";import{exactBuffer as c,requireSubtle as l,utf8Bytes as u}from"./signing_crypto";export const JOB_PACKAGE_NONCE_BYTES=12,JOB_PACKAGE_TAG_BYTES=16,JOB_PACKAGE_KEY_BYTES=32;function p(){try{const t=require("react-native-quick-crypto"),r=t.getRandomValues??t.default?.getRandomValues;if(r)return r}catch{}const e=globalThis.crypto;if(e?.getRandomValues)return e.getRandomValues.bind(e);throw new a("No secure random source available to seal the job package. Install the `react-native-quick-crypto` peer dependency, or expose a global `crypto`.")}export const JobPackageCrypto={key(e){const t=u(e);if(t.length!==JOB_PACKAGE_KEY_BYTES)throw new a("The SDK encryption secret is not the 32 characters AES-256 takes");return t},async seal(e,t,r=p()(new Uint8Array(JOB_PACKAGE_NONCE_BYTES))){const s=l();try{const o=await s.importKey("raw",c(t),"AES-GCM",!1,["encrypt"]),n=new Uint8Array(await s.encrypt({name:"AES-GCM",iv:c(r),tagLength:JOB_PACKAGE_TAG_BYTES*8},o,c(e))),i=n.length-JOB_PACKAGE_TAG_BYTES;return{ciphertext:n.slice(0,i),nonce:r.slice(),tag:n.slice(i)}}catch(o){throw o instanceof a?o:new a(`Sealing the job package failed: ${String(o)}`)}}};export function toHex(e){let t="";for(const r of e)t+=r.toString(16).padStart(2,"0");return t}

package/dist/data/security/job_package_sealer.d.ts

@@ -0,0 +1,35 @@
+import type { InternalAxiosRequestConfig } from "axios";
+import type { SealedJobRequest } from "../model/sealed_job_request";
+/**
+ * Seals a signed job request into the package a skipped submission hands the
+ * partner.
+ *
+ * `seal` takes the request exactly as the SDK would have sent it, after the
+ * auth, request-MAC and integrity interceptors ran, so the signing is the same
+ * as for a submission. Everything but the images is encrypted together as
+ *
+ * ```
+ * { "headers": { every smileid-* header, lowercase }, "params": { every non-file form field } }
+ * ```
+ *
+ * and the partner forwards the ciphertext, nonce and tag as the
+ * `encrypted_package`, `package_nonce` and `package_tag` form fields alongside
+ * the images. The server opens the package and merges it back into the request
+ * before anything downstream reads it, so `params` carries each field the way
+ * the server's form parser produces it: the JSON fields parsed, every other
+ * field its string.
+ *
+ * The partner sends the token and source SDK headers
+ * (`SealedJobRequest.headers`) in the clear: the server authorises the request
+ * with the token and picks the secret to open the package with by the source
+ * SDK and its version.
+ */
+export declare class JobPackageSealer {
+    private readonly _encryptionSecret;
+    constructor(encryptionSecret: () => string);
+    /**
+     * Seals `config`. Throws `SmileIDCryptoError` in a build without the secret,
+     * or with one that is not 32 characters.
+     */
+    seal(config: InternalAxiosRequestConfig): Promise<SealedJobRequest>;
+}

package/dist/data/security/job_package_sealer.js

@@ -0,0 +1 @@
+"use strict";import{JobPackageCrypto as f,toHex as o}from"./job_package_crypto";import{utf8Bytes as d}from"./signing_crypto";import{SmileIDCryptoError as u}from"./smile_id_crypto_error";const m="smileid-",S=new Set(["smileid-token","smileid-source-sdk","smileid-source-sdk-version"]),h=new Set(["partner_params","metadata","failure_reason","consent","user_details","payload","countries","aliases","id_types"]);function y(e){return typeof e=="object"&&e!==null&&typeof e.getParts=="function"}export class JobPackageSealer{_encryptionSecret;constructor(t){this._encryptionSecret=t}async seal(t){const r=this._encryptionSecret();if(r.trim()==="")throw new u("The build carries no SDK encryption secret; run ./secrets.sh");const i={};for(const[s,n]of Object.entries(t.headers?.toJSON?.()??t.headers??{})){const l=s.toLowerCase();l.startsWith(m)&&n!=null&&(i[l]=String(n))}const c=Object.fromEntries(Object.entries(i).sort(([s],[n])=>s.localeCompare(n))),p=JSON.stringify({headers:c,params:g(t.data)}),a=await f.seal(d(p),f.key(r));return Object.freeze({headers:Object.freeze(Object.fromEntries(Object.entries(c).filter(([s])=>S.has(s)))),encryptedPackage:o(a.ciphertext),packageNonce:o(a.nonce),packageTag:o(a.tag)})}}function g(e){const t={};if(!y(e))return t;for(const r of e.getParts())r.uri!=null||r.string===void 0||(t[r.fieldName]=h.has(r.fieldName)?O(r.string):r.string);return t}function O(e){try{return JSON.parse(e)}catch{return e}}

package/dist/data/security/signing_crypto.d.ts

@@ -2,6 +2,40 @@
 export declare function utf8Bytes(input: string): Uint8Array;
 /** Standard-alphabet Base64 of [bytes] (no line wrap). */
 export declare function base64Encode(bytes: Uint8Array): string;
+/**
+ * Minimal structural type for the Web Crypto `SubtleCrypto` surface this module
+ * uses. Declared locally because the workspace tsconfig omits the DOM lib.
+ */
+export interface SubtleLike {
+    importKey(format: "raw", keyData: ArrayBuffer, algorithm: {
+        name: "HMAC";
+        hash: "SHA-256";
+    } | "PBKDF2" | "AES-GCM", extractable: boolean, keyUsages: readonly ("sign" | "deriveBits" | "encrypt")[]): Promise<unknown>;
+    encrypt(algorithm: {
+        name: "AES-GCM";
+        iv: ArrayBuffer;
+        tagLength: number;
+    }, key: unknown, data: ArrayBuffer): Promise<ArrayBuffer>;
+    sign(algorithm: "HMAC", key: unknown, data: ArrayBuffer): Promise<ArrayBuffer>;
+    deriveBits(algorithm: {
+        name: "PBKDF2";
+        salt: ArrayBuffer;
+        iterations: number;
+        hash: "SHA-256";
+    }, key: unknown, length: number): Promise<ArrayBuffer>;
+}
+/**
+ * The resolved Web Crypto provider, shared with the job-package sealing.
+ *
+ * @throws {SmileIDCryptoError} when no provider is available.
+ */
+export declare function requireSubtle(): SubtleLike;
+/**
+ * The exact bytes of [bytes] as a standalone `ArrayBuffer`. Reading `.buffer`
+ * directly is wrong when the view covers only part of a larger buffer (a
+ * `subarray` / `slice`), which would feed the surrounding bytes into PBKDF2/HMAC.
+ */
+export declare function exactBuffer(bytes: Uint8Array): ArrayBuffer;
 /**
  * Low-level signing primitives: PBKDF2 key derivation and HMAC-SHA256. Stateless
  * and deterministic, so the server reproduces the same key and MAC from the same

package/dist/data/security/signing_crypto.js

@@ -1 +1 @@
-"use strict";import{SmileIDCryptoError as a}from"./smile_id_crypto_error";const f=32,h=2e5;export function utf8Bytes(t){return new TextEncoder().encode(t)}const c="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";export function base64Encode(t){let n="";for(let e=0;e<t.length;e+=3){const r=t[e],o=e+1<t.length?t[e+1]:0,l=e+2<t.length?t[e+2]:0;n+=c[r>>2],n+=c[(r&3)<<4|o>>4],n+=e+1<t.length?c[(o&15)<<2|l>>6]:"=",n+=e+2<t.length?c[l&63]:"="}return n}let i;function p(){if(i)return i;const t=globalThis.crypto?.subtle;if(t)return i=t,i;try{const n=require("react-native-quick-crypto"),e=n.subtle??n.webcrypto?.subtle??n.default?.subtle??n.default?.webcrypto?.subtle;if(e)return i=e,i}catch{}return null}function u(){const t=p();if(!t)throw new a("No Web Crypto provider available for request signing. Install the `react-native-quick-crypto` peer dependency (with its peers `react-native-nitro-modules` and `react-native-quick-base64`), or expose a global `crypto.subtle`.");return t}function s(t){return t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength)}export const SigningCrypto={async deriveKey(t,n){const e=u();try{const r=await e.importKey("raw",s(utf8Bytes(t)),"PBKDF2",!1,["deriveBits"]),o=await e.deriveBits({name:"PBKDF2",salt:s(n),iterations:h,hash:"SHA-256"},r,f*8);return new Uint8Array(o)}catch(r){throw r instanceof a?r:new a(`Key derivation failed: ${String(r)}`)}},async hmacSha256(t,n){const e=u();try{const r=await e.importKey("raw",s(t),{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await e.sign("HMAC",r,s(n));return new Uint8Array(o)}catch(r){throw r instanceof a?r:new a(`MAC computation failed: ${String(r)}`)}}};
+"use strict";import{SmileIDCryptoError as a}from"./smile_id_crypto_error";const l=32,u=2e5;export function utf8Bytes(t){return new TextEncoder().encode(t)}const c="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";export function base64Encode(t){let r="";for(let e=0;e<t.length;e+=3){const n=t[e],o=e+1<t.length?t[e+1]:0,s=e+2<t.length?t[e+2]:0;r+=c[n>>2],r+=c[(n&3)<<4|o>>4],r+=e+1<t.length?c[(o&15)<<2|s>>6]:"=",r+=e+2<t.length?c[s&63]:"="}return r}let i;function f(){if(i)return i;const t=globalThis.crypto?.subtle;if(t)return i=t,i;try{const r=require("react-native-quick-crypto"),e=r.subtle??r.webcrypto?.subtle??r.default?.subtle??r.default?.webcrypto?.subtle;if(e)return i=e,i}catch{}return null}export function requireSubtle(){const t=f();if(!t)throw new a("No Web Crypto provider available for request signing. Install the `react-native-quick-crypto` peer dependency (with its peers `react-native-nitro-modules` and `react-native-quick-base64`), or expose a global `crypto.subtle`.");return t}export function exactBuffer(t){return t.buffer.slice(t.byteOffset,t.byteOffset+t.byteLength)}export const SigningCrypto={async deriveKey(t,r){const e=requireSubtle();try{const n=await e.importKey("raw",exactBuffer(utf8Bytes(t)),"PBKDF2",!1,["deriveBits"]),o=await e.deriveBits({name:"PBKDF2",salt:exactBuffer(r),iterations:u,hash:"SHA-256"},n,l*8);return new Uint8Array(o)}catch(n){throw n instanceof a?n:new a(`Key derivation failed: ${String(n)}`)}},async hmacSha256(t,r){const e=requireSubtle();try{const n=await e.importKey("raw",exactBuffer(t),{name:"HMAC",hash:"SHA-256"},!1,["sign"]),o=await e.sign("HMAC",n,exactBuffer(r));return new Uint8Array(o)}catch(n){throw n instanceof a?n:new a(`MAC computation failed: ${String(n)}`)}}};