@trustchex/react-native-sdk 1.486.0 → 1.488.0

package/lib/module/Shared/Components/EIDScanner.js

@@ -6,6 +6,7 @@ import { useSafeAreaInsets } from 'react-native-safe-area-context';
 import NFCManager from 'react-native-nfc-manager';
 import DeviceInfo from 'react-native-device-info';
 import PermissionManager from "../Libs/permissions.utils.js";
+import mrzUtils from "../Libs/mrz.utils.js";
 import { debugError } from "../Libs/debug.utils.js";
 import { eidReader } from "../EIDReader/eidReader.js";
 import NativeProgressBar from "./NativeProgressBar.js";
@@ -43,6 +44,13 @@ const EIDScanner = ({
   // Animation for pulse indicator
   const pulseAnim = useRef(new Animated.Value(1)).current;
 
+  // Strip MRZ filler (`<`) and trim; returns '' for empty/filler-only input so
+  // the UI can hide fields the chip didn't actually provide.
+  const cleanField = useCallback(value => {
+    if (!value) return '';
+    return value.replace(/</g, ' ').replace(/\s+/g, ' ').trim();
+  }, []);
+
   // Format date from YYMMDD to DD/MM/YYYY (matching Flutter SDK)
   const formatDate = useCallback(dateStr => {
     if (!dateStr) return '';
@@ -102,13 +110,20 @@ const EIDScanner = ({
   }, [i18n.language]);
   const [voiceGuidanceMessage, setVoiceGuidanceMessage] = useState();
   const [attemptNumber, setAttemptNumber] = useState(0);
-  const getFieldsFromMRZ = useCallback(mrz => {
+  const getFieldsFromMRZ = useCallback((mrz, name) => {
+    // Prefer the resolved name (DG11 printed name / transliteration) over the
+    // raw DG1 split. Some chips — notably Turkish PACE passports — return a DG1
+    // name field with no `<<` separator, so getPrimaryIdentifier() holds the
+    // FULL name and getSecondaryIdentifier() is empty ("name as surname"). The
+    // resolved name corrects that; fall back to the raw split when absent.
+    const firstName = name?.displayFirst || mrz.getSecondaryIdentifier();
+    const lastName = name?.displayLast || mrz.getPrimaryIdentifier();
     return {
-      documentCode: mrz.getDocumentCode(),
+      documentCode: mrzUtils.normalizeDocumentCode(mrz.getDocumentCode()),
       personalNumber: mrz.getPersonalNumber() || mrz.getOptionalData1(),
       documentNumber: mrz.getDocumentNumber(),
-      firstName: mrz.getSecondaryIdentifier(),
-      lastName: mrz.getPrimaryIdentifier(),
+      firstName,
+      lastName,
       birthDate: mrz.getDateOfBirth(),
       expirationDate: mrz.getDateOfExpiry(),
       issuingState: mrz.getIssuingState(),
@@ -190,7 +205,7 @@ const EIDScanner = ({
           appContext.setLastDocumentRead?.(documentReadResult);
           appContext.onDocumentRead?.(documentReadResult);
           if (appContext.skipNfcResultScreen && onScanSuccess) {
-            onScanSuccess(getFieldsFromMRZ(passportData.mrz), passportData.faceImage, passportData.mimeType);
+            onScanSuccess(getFieldsFromMRZ(passportData.mrz, builtName), passportData.faceImage, passportData.mimeType);
           } else {
             setDocumentFaceImage(passportData.faceImage);
             setDocumentMRZInfo(passportData.mrz);
@@ -227,7 +242,37 @@ const EIDScanner = ({
       // Track EID scan failure with detailed metadata
       await trackEIDScanFailed(docType, errorType, errorMessage, scanDuration, currentAttempt, DeviceInfo.getModel(), DeviceInfo.getSystemVersion()).catch(() => {});
       console.debug('NFC scan error:', error);
-      // Ignore error - let user retry
+
+      // Surface an accurate message instead of failing silently. eidReader
+      // attaches `nfcCategory` + `nfcCode`.
+      //   - User-correctable failures (wrong doc data, card moved/too slow, NFC
+      //     off) get a specific, actionable message and NO code — there's a clear
+      //     action to take, a support code would just be noise.
+      //   - Everything else is an unexpected/system error: show a generic message
+      //     plus the reportable code (e.g. NFC-READ-6A82) so the user can quote it.
+      //   - user_cancelled stays silent (the user dismissed the native NFC sheet).
+      const tagged = error;
+      const category = tagged?.nfcCategory ?? errorType;
+
+      // category -> actionable message key for the user-mistake cases.
+      const ACTIONABLE = {
+        auth_failed: 'eidScannerScreen.nfcAuthFailed',
+        tag_lost: 'eidScannerScreen.nfcTagLost',
+        timeout: 'eidScannerScreen.nfcTimeout',
+        not_enabled: 'eidScannerScreen.nfcNotEnabled'
+      };
+      if (category !== 'user_cancelled') {
+        const actionableKey = ACTIONABLE[category];
+        if (actionableKey) {
+          // Clear user action available — meaningful message, no support code.
+          Alert.alert(t('eidScannerScreen.error'), t(actionableKey));
+        } else {
+          // Unexpected/system error — generic message + reportable support code.
+          const errorCode = tagged?.nfcCode ?? 'NFC-READ';
+          const message = `${t('eidScannerScreen.nfcGenericError')}\n\n${t('eidScannerScreen.errorCode')}: ${errorCode}`;
+          Alert.alert(t('eidScannerScreen.error'), message);
+        }
+      }
     } finally {
       setIsScanning(false);
       setProgress(0);
@@ -387,36 +432,51 @@ const EIDScanner = ({
                   })
                 })
               })
-            }), /*#__PURE__*/_jsxs(View, {
+            }), /*#__PURE__*/_jsx(View, {
               style: styles.idCardFields,
-              children: [/*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.surname'),
-                value: documentName?.displayLast ?? documentMRZInfo.getPrimaryIdentifier()
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.name'),
-                value: documentName?.displayFirst ?? documentMRZInfo.getSecondaryIdentifier()
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.documentNumber'),
-                value: documentMRZInfo.getDocumentNumber()
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.birthDate'),
-                value: formatDate(documentMRZInfo.getDateOfBirth())
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.expirationDate'),
-                value: formatDate(documentMRZInfo.getDateOfExpiry())
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.gender'),
-                value: formatGender(documentMRZInfo.getGender().getStrCode())
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.nationality'),
-                value: formatNationality(documentMRZInfo.getNationality())
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.issuingState'),
-                value: formatNationality(documentMRZInfo.getIssuingState())
-              }), !!(documentMRZInfo.getPersonalNumber() || documentMRZInfo.getOptionalData1()) && /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.personalNumber'),
-                value: documentMRZInfo.getPersonalNumber() || documentMRZInfo.getOptionalData1() || ''
-              })]
+              children: (() => {
+                const surname = documentName?.displayLast ?? cleanField(documentMRZInfo.getPrimaryIdentifier());
+                const givenNames = documentName?.displayFirst ?? cleanField(documentMRZInfo.getSecondaryIdentifier());
+                const docNumber = cleanField(documentMRZInfo.getDocumentNumber());
+                const birthDate = formatDate(documentMRZInfo.getDateOfBirth());
+                const expiry = formatDate(documentMRZInfo.getDateOfExpiry());
+                const gender = formatGender(documentMRZInfo.getGender().getStrCode());
+                const nationality = formatNationality(documentMRZInfo.getNationality());
+                const issuingState = formatNationality(documentMRZInfo.getIssuingState());
+                const personalNumber = cleanField(documentMRZInfo.getPersonalNumber() || documentMRZInfo.getOptionalData1());
+                const fields = [{
+                  label: t('eidScannerScreen.surname'),
+                  value: surname
+                }, {
+                  label: t('eidScannerScreen.name'),
+                  value: givenNames
+                }, {
+                  label: t('eidScannerScreen.documentNumber'),
+                  value: docNumber
+                }, {
+                  label: t('eidScannerScreen.birthDate'),
+                  value: birthDate
+                }, {
+                  label: t('eidScannerScreen.expirationDate'),
+                  value: expiry
+                }, {
+                  label: t('eidScannerScreen.gender'),
+                  value: gender
+                }, {
+                  label: t('eidScannerScreen.nationality'),
+                  value: nationality
+                }, {
+                  label: t('eidScannerScreen.issuingState'),
+                  value: issuingState
+                }, {
+                  label: t('eidScannerScreen.personalNumber'),
+                  value: personalNumber
+                }];
+                return fields.filter(f => f.value && f.value.trim().length > 0).map(f => /*#__PURE__*/_jsx(IDCardField, {
+                  label: f.label,
+                  value: f.value
+                }, f.label));
+              })()
             })]
           })]
         }), hasNfc && isEnabled && isScanned && /*#__PURE__*/_jsx(View, {
@@ -426,7 +486,7 @@ const EIDScanner = ({
             disabled: !documentFaceImage || !documentMRZInfo,
             onPress: () => {
               if (onScanSuccess && documentMRZInfo && documentFaceImage && documentFaceImageMimeType) {
-                onScanSuccess(getFieldsFromMRZ(documentMRZInfo), documentFaceImage, documentFaceImageMimeType);
+                onScanSuccess(getFieldsFromMRZ(documentMRZInfo, documentName), documentFaceImage, documentFaceImageMimeType);
               }
             },
             children: t('eidScannerScreen.approveAndContinue')
@@ -476,7 +536,7 @@ const EIDScanner = ({
           disabled: !documentFaceImage || !documentMRZInfo,
           onPress: () => {
             if (onScanSuccess && documentMRZInfo && documentFaceImage && documentFaceImageMimeType) {
-              onScanSuccess(getFieldsFromMRZ(documentMRZInfo), documentFaceImage, documentFaceImageMimeType);
+              onScanSuccess(getFieldsFromMRZ(documentMRZInfo, documentName), documentFaceImage, documentFaceImageMimeType);
             }
           },
           children: t('eidScannerScreen.approveAndContinue')

package/lib/module/Shared/Components/IdentityDocumentCamera.constants.js

@@ -17,7 +17,15 @@ export const REQUIRED_CONSISTENT_DOCTYPE_DETECTIONS = 3;
 export const SIGNATURE_REGEX = /s[gi]g?n[au]?t[u]?r|imz[a]s?/i;
 export const SIGNATURE_TEXT_REGEX = /signature|imza|İmza/i;
 export const MRZ_BLOCK_PATTERN = /[A-Z0-9<]{8,}.*</i;
-export const PASSPORT_MRZ_PATTERN = /P<[A-Z]{3}/;
+// Matches the line-1 start of ANY ICAO TD3 passport MRZ, so the camera routes
+// every passport variant into the passport flow (not the ID-card back-side
+// flow). Per ICAO 9303 Part 4: `P` + a type char (filler `<` or a subtype
+// letter — `P<`, `PP` German, `PD`/`PS`/`PO` diplomatic/service/official) +
+// the issuing state (3 letters, OR the German 1-letter `D` padded with filler,
+// e.g. `P<D<<` / `PPD<<`). Previously only `P<[A-Z]{3}` matched, so German `PP`
+// and 1-letter-issuer passports fell through to the ID-card flow and were
+// wrongly asked for a back side.
+export const PASSPORT_MRZ_PATTERN = /P[A-Z<](?:[A-Z]{3}|[A-Z]<<)[A-Z<]*<</;
 
 // BDDK Madde 7 - Security Feature Validation
 // When NFC chip reading unavailable, must verify at least 4 visual security features

package/lib/module/Shared/EIDReader/cardFileInputStream.js

@@ -3,6 +3,9 @@
 import { InputStream } from "./java/inputStream.js";
 import { Buffer } from 'buffer';
 export class CardFileInputStream extends InputStream {
+  /** Max re-issues of a single block read before failing — mitigates transient
+   *  iOS NFC transceive drops during large-file reads (e.g. DG2). */
+  static MAX_BLOCK_READ_RETRIES = 5;
   constructor(maxBlockSize, fs) {
     super();
     this.fs = fs;
@@ -49,8 +52,28 @@ export class CardFileInputStream extends InputStream {
           newOffsetBufferInFile = this.offsetBufferInFile + this.bufferLength;
           let newOffsetInBuffer = 0;
           let newBufferLength = 0;
-          while (newBufferLength === 0) {
-            newBufferLength = await this.fillBufferFromFile(this.path, newOffsetBufferInFile, le);
+          // Retry a failed block read. The iOS NFC stack (react-native-nfc-manager)
+          // throws transient "READ BINARY" transceive errors during the many
+          // block reads of a large file like DG2 (face image); a single drop
+          // previously aborted the whole read with "Could not read file". Re-issue
+          // the SAME block (offset unchanged) a few times before giving up — this
+          // is idempotent (no secure-messaging state advances on a failed read).
+          let attempt = 0;
+          for (;;) {
+            try {
+              newBufferLength = 0;
+              while (newBufferLength === 0) {
+                newBufferLength = await this.fillBufferFromFile(this.path, newOffsetBufferInFile, le);
+              }
+              break;
+            } catch (blockError) {
+              if (++attempt >= CardFileInputStream.MAX_BLOCK_READ_RETRIES) {
+                throw blockError;
+              }
+              // Brief backoff: an immediate re-issue after a transient NFC drop
+              // usually fails again; a short pause lets the RF field re-stabilise.
+              await new Promise(r => setTimeout(r, 80 * attempt));
+            }
           }
           this.offsetBufferInFile = newOffsetBufferInFile;
           this.offsetInBuffer = newOffsetInBuffer;

package/lib/module/Shared/EIDReader/defaultFileSystem.js

@@ -6,9 +6,11 @@ import { DefaultFileInfo } from "./defaultFileInfo.js";
 import { ISO7816_SW } from "./smartcards/iso7816.js";
 import { SecureMessagingWrapper } from "./secureMessagingWrapper.js";
 import { TripleDesSecureMessagingWrapper } from "./tripleDesSecureMessagingWrapper.js";
+import { AESSecureMessagingWrapper } from "./aesSecureMessagingWrapper.js";
 import { TLVInputStream } from "./tlv/tlvInputStream.js";
 import { CVCAFile } from "./lds/cvcaFile.js";
 import { Buffer } from 'buffer';
+import { Platform } from 'react-native';
 export class DefaultFileSystem {
   static NO_SFI = -1;
   static READ_AHEAD_LENGTH = 8;
@@ -19,7 +21,27 @@ export class DefaultFileSystem {
     this.isSelected = false;
     this.isSFIEnabled = isSFIEnabled;
     this.fidToSFI = fidToSFI;
-    this.maxReadBinaryLength = EID_CONSTANTS.EXTENDED_MAX_TRANSCEIVE_LENGTH;
+    // iOS CoreNFC (via react-native-nfc-manager's sendCommandAPDUIOS) does not
+    // accept the EXTENDED-length APDU byte form this code emits when ne > 256
+    // (a 7-byte "00 XX XX" Le). Such a READ BINARY is rejected outright, so on
+    // iOS EVERY DG2 read failed ("Exception during READ BINARY") even though
+    // PACE — which only used short Le=256 — succeeded. Start at a short-form
+    // length on iOS (ne <= 256) so every READ BINARY stays in the short APDU
+    // form. Android's transceive() handles extended APDUs, so keep extended
+    // there for speed. JMRTD/NFCPassportReader likewise read in small blocks.
+    this.maxReadBinaryLength = Platform.OS === 'ios' ? EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE // 223 → short-form Le, SM-safe
+    : EID_CONSTANTS.EXTENDED_MAX_TRANSCEIVE_LENGTH;
+  }
+
+  /** Deep-copy a secure-messaging wrapper PRESERVING its cipher type (AES vs
+   *  3DES), so the SSC can be rewound for a retry without changing the MAC/enc
+   *  algorithm. Non-SM wrappers are returned as-is. */
+  cloneWrapper(wrapper) {
+    if (!(wrapper instanceof SecureMessagingWrapper)) {
+      return wrapper;
+    }
+    const args = [wrapper.getEncryptionKey(), wrapper.getMACKey(), wrapper.getMaxTransceiveLength(), wrapper.getShouldCheckMAC(), wrapper.getSendSequenceCounter()];
+    return wrapper.getType() === 'AES' ? new AESSecureMessagingWrapper(...args) : new TripleDesSecureMessagingWrapper(...args);
   }
   setWrapper(wrapper) {
     this.oldWrapper = this.wrapper;
@@ -89,13 +111,36 @@ export class DefaultFileSystem {
       const result = buffer.slice(offset, offset + responseLength);
       return result;
     } catch (error) {
-      const sw = error.getSW();
-      if ((sw & ISO7816_SW.WRONG_LENGTH) === ISO7816_SW.WRONG_LENGTH && this.maxReadBinaryLength > EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE) {
-        this.wrapper = this.oldWrapper;
+      // Only APDU-level errors expose getSW(); a transient native NFC transceive
+      // error does NOT, so calling it unguarded threw a TypeError and masked the
+      // real failure. Guard it before testing for the WRONG_LENGTH downgrade.
+      const sw = typeof error.getSW === 'function' ? error.getSW() : undefined;
+      const isWrongLength = sw != null && (sw & ISO7816_SW.WRONG_LENGTH) === ISO7816_SW.WRONG_LENGTH;
+
+      // Downgrade the read size and signal a retry (empty result) when EITHER:
+      //  - the chip returned 6Cxx WRONG_LENGTH (the standard JMRTD path), OR
+      //  - the read failed transiently with NO status word while we were still
+      //    at extended length. iOS CoreNFC (via react-native-nfc-manager) drops
+      //    the connection on too-large extended-length READ BINARY on some chips
+      //    (e.g. German passport DG2) instead of returning 6Cxx, so the chip
+      //    never gets to ask for a smaller length. Dropping to the conservative
+      //    223-byte block makes the next read succeed. Reference readers
+      //    (JMRTD, NFCPassportReader) read large files in small blocks (~0xA0).
+      // Restore the pre-send secure-messaging wrapper. A failed wrapped READ
+      // BINARY still advanced the send-sequence-counter, so a retry MUST reset
+      // it or every subsequent read fails the MAC. (This is why the read
+      // previously stalled partway through DG2: each retry reused a desynced
+      // SSC.) JMRTD does the same reset on its downgrade path.
+      this.wrapper = this.oldWrapper;
+      if ((isWrongLength || sw == null) && this.maxReadBinaryLength > EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE) {
         this.maxReadBinaryLength = EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE;
         return new Uint8Array(0);
       }
-      throw new Error(`Read binary failed on file ${fileInfo == null ? this.selectedFID.toString(16) : fileInfo}`);
+
+      // Preserve the original error (a transient transceive failure at an
+      // already-small block size) so the retry layer above can recognise and
+      // re-issue it, instead of flattening every cause into one opaque string.
+      throw error instanceof Error ? error : new Error(`Read binary failed on file ${fileInfo == null ? this.selectedFID.toString(16) : fileInfo}`);
     }
   }
   async getFileInfo() {
@@ -139,7 +184,12 @@ export class DefaultFileSystem {
     await this.service.sendSelectFile(this.wrapper, fid);
   }
   sendReadBinaryNoSFI(offset, le, isTLVEncodedOffsetNeeded) {
-    this.oldWrapper = this.wrapper instanceof SecureMessagingWrapper ? new TripleDesSecureMessagingWrapper(this.wrapper.getEncryptionKey(), this.wrapper.getMACKey(), this.wrapper.getMaxTransceiveLength(), this.wrapper.getShouldCheckMAC(), this.wrapper.getSendSequenceCounter()) : this.wrapper;
+    // Snapshot the wrapper BEFORE the send so a failed read can rewind the SSC.
+    // The copy MUST preserve the actual wrapper type — PACE sessions are AES
+    // (the German passport uses AES-CMAC). Previously this always built a 3DES
+    // wrapper, so an AES session's retry used a 3DES wrapper with AES keys and
+    // every subsequent read failed the MAC — the cause of the DG2 stall.
+    this.oldWrapper = this.cloneWrapper(this.wrapper);
     return this.service.sendReadBinary(this.wrapper, DefaultFileSystem.NO_SFI, offset, le, false, isTLVEncodedOffsetNeeded);
   }
   sendReadBinary(sfi, offset, le, isTLVEncodedOffsetNeeded) {

package/lib/module/Shared/EIDReader/eidReader.js

@@ -4,6 +4,7 @@ import { BACKey } from "./bacKey.js";
 import { PACEKeySpec } from "./paceKeySpec.js";
 import { NFCManagerCardService } from "./nfcManagerCardService.js";
 import { EIDService } from "./eidService.js";
+import { isPACEUnsupportedError } from "./protocol/paceErrors.js";
 import { DG1File } from "./lds/icao/dg1File.js";
 import { DG2File } from "./lds/icao/dg2File.js";
 import { DG11File } from "./lds/icao/dg11File.js";
@@ -38,6 +39,49 @@ const categorizeNfcError = msg => {
   return 'reading_error';
 };
 
+/** Short, stable code per category for the user-facing reportable error code. */
+const NFC_CATEGORY_CODE = {
+  user_cancelled: 'CANCEL',
+  tag_lost: 'TAGLOST',
+  timeout: 'TIMEOUT',
+  unsupported: 'UNSUPPORTED',
+  not_enabled: 'DISABLED',
+  auth_failed: 'AUTH',
+  reading_error: 'READ'
+};
+
+/** Short, stable token per read step, so the error code names WHERE it failed.
+ *  A generic NFC-READ is not actionable; NFC-READ-DG2-6982 tells support the
+ *  read failed reading the face image (DG2) with APDU status 6982. */
+const NFC_STEP_CODE = {
+  open: 'OPEN',
+  selectApplet: 'SELAPP',
+  selectMF: 'SELMF',
+  readCardAccess: 'CARDACCESS',
+  paceAuth: 'PACE',
+  bacAuth: 'BAC',
+  readDG1: 'DG1',
+  readDG2: 'DG2',
+  readDG11: 'DG11'
+};
+
+/**
+ * Build a stable, reportable error code from a categorised NFC failure that
+ * names the failing STEP, e.g. `NFC-READ-DG2-6982` (reading the face image
+ * failed, APDU status 6982) or `NFC-AUTH-PACE-6300` (PACE auth rejected). Falls
+ * back to `NFC-<category>` when neither step nor status word is known.
+ * Non-PII by construction: only the bucket + step name + the chip's 4-hex
+ * status word. A user can quote it to pinpoint exactly where the read failed.
+ */
+const buildNfcErrorCode = (category, msg, step, stepSw) => {
+  const part = NFC_CATEGORY_CODE[category] ?? 'READ';
+  const stepTok = step ? NFC_STEP_CODE[step] : undefined;
+  // Prefer the status word recorded against the failing step; fall back to one
+  // parsed from the error message.
+  const sw = stepSw ?? extractStatusWord(msg);
+  return [`NFC-${part}`, stepTok, sw].filter(Boolean).join('-');
+};
+
 // --- Minimal PNG encoder (pure JS, no native deps) ---
 // Uses deflate stored (uncompressed) blocks for O(n) encoding speed.
 // A naive DCT-based JPEG encoder would be O(n²) and freeze the JS thread
@@ -169,6 +213,13 @@ function pixelsToPng(pixels, width, height, channels) {
  * If the image is JPEG 2000, decode and convert to PNG so React Native can display it.
  * Returns { base64, mimeType } with the converted image, or the original if not JP2.
  */
+// Largest JP2 face image we will attempt to decode in pure JS on the UI thread.
+// The `jpeg2000` decoder's parse() is SYNCHRONOUS and roughly quadratic, so a
+// large image (some passports store 20–30 KB+ JPEG2000 portraits) blocks the JS
+// thread for many seconds or indefinitely — the German-passport "stuck at face
+// conversion" hang. A JS timeout cannot interrupt a synchronous call, so we must
+// gate BEFORE decoding. ~12 KB decodes fast; beyond that we keep the raw JP2.
+const MAX_JP2_DECODE_BYTES = 12 * 1024;
 function convertJP2IfNeeded(imageBuffer, mimeType) {
   if (mimeType !== 'image/jp2') {
     return {
@@ -176,6 +227,18 @@ function convertJP2IfNeeded(imageBuffer, mimeType) {
       mimeType
     };
   }
+
+  // Too large to decode synchronously without freezing the UI — keep the raw
+  // JP2. The face image is still captured (the verification backend / face-match
+  // accept JPEG2000); only the on-screen preview can't render it. This lets the
+  // NFC read COMPLETE instead of hanging.
+  if (imageBuffer.length > MAX_JP2_DECODE_BYTES) {
+    debugLog('EID', `[EID] JP2 face image is ${imageBuffer.length} bytes (> ${MAX_JP2_DECODE_BYTES}); skipping in-JS decode to avoid blocking, keeping raw JP2`);
+    return {
+      base64: imageBuffer.toString('base64'),
+      mimeType
+    };
+  }
   debugLog('EID', '[EID] Face image is JP2, attempting conversion…');
   try {
     // Lazy-load jpeg2000 to avoid crashing if it fails to import
@@ -411,7 +474,30 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
           }
           const done = stepTimer();
           try {
-            await passportService.doPACE(paceKey, paceInfo.oid, paceInfo.parameterId, progressCallback);
+            // PACE runs many APDU round-trips; on iOS the CoreNFC tag connection
+            // can drop mid-handshake (empty/lost-tag error). A restart can't
+            // resume PACE (the on-chip state is gone), so on a CONNECTION-DROP
+            // (not a crypto/capability failure) restart the session and retry
+            // the WHOLE PACE handshake from scratch a few times. A real failure
+            // (wrong key, unsupported variant) is rethrown immediately.
+            const MAX_PACE_ATTEMPTS = 3;
+            for (let paceAttempt = 1;; paceAttempt++) {
+              try {
+                await passportService.doPACE(paceKey, paceInfo.oid, paceInfo.parameterId, progressCallback);
+                break;
+              } catch (attemptErr) {
+                const lost = nfcManagerCardService.isTagLost(attemptErr);
+                if (!lost || paceAttempt >= MAX_PACE_ATTEMPTS) {
+                  throw attemptErr;
+                }
+                debugLog('EID', `[EID] PACE attempt ${paceAttempt} lost the tag; restarting session and retrying`);
+                await nfcManagerCardService.restartSession();
+                await new Promise(r => setTimeout(r, 200 * paceAttempt));
+                // Re-select MF + re-read EF.CardAccess so the next PACE starts
+                // from the same clean state as the first attempt.
+                await passportService.sendSelectMF();
+              }
+            }
             hasPACESucceeded = true;
             done('paceAuth', true);
             debugLog('EID', '[EID] PACE succeeded');
@@ -424,10 +510,14 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
           debugLog('EID', '[EID] EF.CardAccess read OK but no PACE SecurityInfo found — document does not support PACE, falling back to BAC');
         }
       } catch (paceError) {
-        // PACE protocol exchange failed — fall back to BAC
-        diagnostics.nfcPaceFellBackToBac('pace_failed');
+        // PACE could not complete — fall back to BAC. Distinguish a CAPABILITY
+        // gap (this build can't run the variant the chip advertises) from a
+        // RUNTIME failure (wrong key, tag lost, APDU error) so diagnostics show
+        // exactly why, e.g. pace_unsupported_curve vs pace_failed.
+        const reason = isPACEUnsupportedError(paceError) ? `pace_unsupported_${paceError.reason}` : 'pace_failed';
+        diagnostics.nfcPaceFellBackToBac(reason);
         const msg = paceError instanceof Error ? paceError.message : String(paceError);
-        debugLog('EID', `[EID] PACE protocol failed (${msg}), falling back to BAC`);
+        debugLog('EID', `[EID] PACE could not complete (${reason}: ${msg}), falling back to BAC`);
         if (paceError instanceof Error && paceError.stack) {
           debugLog('EID', '[EID] PACE error stack:', paceError.stack);
         }
@@ -478,6 +568,13 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
       progressCallback(progress);
     }
 
+    // Authentication is complete — enable iOS CoreNFC session-restart recovery
+    // for the data-group reads. It must stay OFF during PACE/BAC (the auth state
+    // lives on the chip; a mid-handshake restart destroys it). Reads are
+    // idempotent and their secure-messaging state lives in our JS wrapper, so a
+    // session restart between blocks is safe here.
+    nfcManagerCardService.setSessionRestartEnabled(true);
+
     // Read DG1 (MRZ Info)
     const dg1Done = stepTimer();
     let mrzInfo;
@@ -512,20 +609,23 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
 
     // Read DG2 (Face Image)
     const dg2Done = stepTimer();
-    const dg2InputStream = passportService.getInputStream(EIDService.EF_DG2);
-    await dg2InputStream.init();
-    InputStream.onRead((totalBytesRead, fileLength) => {
-      progress = 30 + totalBytesRead / fileLength * 70;
-      if (progressCallback) {
-        progressCallback(progress);
-      }
-    });
-    const dg2File = new DG2File([], dg2InputStream);
     let imageAsBase64 = '';
     let mimeType = '';
     const allFaceImageInfos = [];
     let faceInfos;
     try {
+      // init() selects EF.DG2 and reads its header over secure messaging; keep
+      // it INSIDE the try so a failure here is still recorded as the readDG2
+      // step (it was previously outside, so an early DG2 failure went unlabelled).
+      const dg2InputStream = passportService.getInputStream(EIDService.EF_DG2);
+      await dg2InputStream.init();
+      InputStream.onRead((totalBytesRead, fileLength) => {
+        progress = 30 + totalBytesRead / fileLength * 70;
+        if (progressCallback) {
+          progressCallback(progress);
+        }
+      });
+      const dg2File = new DG2File([], dg2InputStream);
       faceInfos = await dg2File.getFaceInfos();
       dg2Done('readDG2', true);
     } catch (e) {
@@ -560,8 +660,18 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
     };
   } catch (error) {
     const msg = error instanceof Error ? error.message : String(error);
-    diagnostics.nfcResult(false, categorizeNfcError(msg));
+    const category = categorizeNfcError(msg);
+    diagnostics.nfcResult(false, category);
     debugLog('EID', 'Error reading passport data', error);
+    // Rethrow so the caller can surface an accurate, actionable message. Swallowing
+    // here returned `undefined`, which the UI mis-reported as "invalid MRZ fields"
+    // (e.g. a German passport whose BAC/PACE auth or chip read actually failed).
+    // The category is attached for the UI to map to a specific message.
+    const rethrown = error instanceof Error ? error : new Error(msg);
+    const tagged = rethrown;
+    tagged.nfcCategory = category;
+    tagged.nfcCode = buildNfcErrorCode(category, msg, diagnostics.getFailureStep(), diagnostics.getFailureStatusWord());
+    throw tagged;
   } finally {
     await passportService.close();
   }

package/lib/module/Shared/EIDReader/lds/icao/dg11File.js

@@ -65,13 +65,30 @@ export class DG11File extends DataGroup {
    * Strips trailing filler `<` within each segment.
    */
   parseName(nameString) {
-    const delimIndex = nameString.indexOf('<<');
-    if (delimIndex < 0) {
-      this.lastName = nameString.replace(/<+$/, '').trim();
-      this.firstName = '';
+    const fillerToSpace = s => s.replace(/<+$/, '') // drop trailing filler
+    .replace(/</g, ' ') // internal filler = word separator
+    .replace(/\s+/g, ' ').trim();
+    const dblIndex = nameString.indexOf('<<');
+    if (dblIndex >= 0) {
+      // Standard ICAO layout: PRIMARY<<SECONDARY.
+      this.lastName = fillerToSpace(nameString.substring(0, dblIndex));
+      this.firstName = fillerToSpace(nameString.substring(dblIndex + 2));
       return;
     }
-    this.lastName = nameString.substring(0, delimIndex).replace(/<+$/, '').trim();
-    this.firstName = nameString.substring(delimIndex + 2).replace(/<$/, ' ').replace(/<+$/, '').trim();
+
+    // No `<<` separator. Some chips (e.g. certain Turkish PACE passports) store
+    // DG11 0x5F0E as SURNAME<GIVEN1<GIVEN2 with single fillers. Split on the
+    // FIRST single filler: surname = first token, given names = the rest. With
+    // no filler at all the field is a single token we cannot reliably split into
+    // surname/given, so leave firstName empty and let the caller decide (the MRZ
+    // split is then more trustworthy than a guess).
+    const singleIndex = nameString.replace(/<+$/, '').indexOf('<');
+    if (singleIndex >= 0) {
+      this.lastName = fillerToSpace(nameString.substring(0, singleIndex));
+      this.firstName = fillerToSpace(nameString.substring(singleIndex + 1));
+      return;
+    }
+    this.lastName = fillerToSpace(nameString);
+    this.firstName = '';
   }
 }