@trustchex/react-native-sdk 1.487.0 → 1.489.0

package/ios/ImageDecoder/ImageDecoderModule.m

@@ -0,0 +1,12 @@
+#import <React/RCTBridgeModule.h>
+
+@interface RCT_EXTERN_MODULE(ImageDecoderModule, NSObject)
+
+// Decode a JPEG2000 (JP2) base64 string and re-encode it as JPEG base64.
+// iOS's <Image> cannot render an image/jp2 data URI, but ImageIO/UIImage
+// decodes JPEG2000 natively, so we round-trip it to JPEG here.
+RCT_EXTERN_METHOD(decodeJp2ToJpeg:(NSString *)base64Jp2
+                  resolver:(RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+
+@end

package/ios/ImageDecoder/ImageDecoderModule.swift

@@ -0,0 +1,43 @@
+import Foundation
+import React
+import UIKit
+import ImageIO
+
+/// Decodes images that React Native's <Image> cannot render directly on iOS.
+///
+/// The driving case is the passport chip portrait (DG2), which is frequently
+/// stored as JPEG2000 (image/jp2). Android's image pipeline decodes JP2 data
+/// URIs natively, but iOS's <Image> does not — so the chip photo shows as a
+/// placeholder on iOS. iOS's ImageIO *can* decode JPEG2000, so we round-trip
+/// the JP2 to JPEG here and hand back base64 the JS <Image> can render.
+@objc(ImageDecoderModule)
+class ImageDecoderModule: NSObject {
+
+    @objc
+    static func requiresMainQueueSetup() -> Bool {
+        return false
+    }
+
+    @objc
+    func decodeJp2ToJpeg(_ base64Jp2: String,
+                         resolver resolve: @escaping RCTPromiseResolveBlock,
+                         rejecter reject: @escaping RCTPromiseRejectBlock) {
+        guard let jp2Data = Data(base64Encoded: base64Jp2) else {
+            reject("INVALID_BASE64", "Could not decode base64 JP2 input", nil)
+            return
+        }
+
+        // ImageIO decodes JPEG2000 on iOS even though <Image> won't render it.
+        guard let image = UIImage(data: jp2Data) else {
+            reject("DECODE_FAILED", "ImageIO could not decode the JP2 data", nil)
+            return
+        }
+
+        guard let jpegData = image.jpegData(compressionQuality: 0.95) else {
+            reject("ENCODE_FAILED", "Could not re-encode decoded image as JPEG", nil)
+            return
+        }
+
+        resolve(jpegData.base64EncodedString())
+    }
+}

package/lib/module/Shared/Components/EIDScanner.js

@@ -44,6 +44,13 @@ const EIDScanner = ({
   // Animation for pulse indicator
   const pulseAnim = useRef(new Animated.Value(1)).current;
 
+  // Strip MRZ filler (`<`) and trim; returns '' for empty/filler-only input so
+  // the UI can hide fields the chip didn't actually provide.
+  const cleanField = useCallback(value => {
+    if (!value) return '';
+    return value.replace(/</g, ' ').replace(/\s+/g, ' ').trim();
+  }, []);
+
   // Format date from YYMMDD to DD/MM/YYYY (matching Flutter SDK)
   const formatDate = useCallback(dateStr => {
     if (!dateStr) return '';
@@ -103,13 +110,20 @@ const EIDScanner = ({
   }, [i18n.language]);
   const [voiceGuidanceMessage, setVoiceGuidanceMessage] = useState();
   const [attemptNumber, setAttemptNumber] = useState(0);
-  const getFieldsFromMRZ = useCallback(mrz => {
+  const getFieldsFromMRZ = useCallback((mrz, name) => {
+    // Prefer the resolved name (DG11 printed name / transliteration) over the
+    // raw DG1 split. Some chips — notably Turkish PACE passports — return a DG1
+    // name field with no `<<` separator, so getPrimaryIdentifier() holds the
+    // FULL name and getSecondaryIdentifier() is empty ("name as surname"). The
+    // resolved name corrects that; fall back to the raw split when absent.
+    const firstName = name?.displayFirst || mrz.getSecondaryIdentifier();
+    const lastName = name?.displayLast || mrz.getPrimaryIdentifier();
     return {
       documentCode: mrzUtils.normalizeDocumentCode(mrz.getDocumentCode()),
       personalNumber: mrz.getPersonalNumber() || mrz.getOptionalData1(),
       documentNumber: mrz.getDocumentNumber(),
-      firstName: mrz.getSecondaryIdentifier(),
-      lastName: mrz.getPrimaryIdentifier(),
+      firstName,
+      lastName,
       birthDate: mrz.getDateOfBirth(),
       expirationDate: mrz.getDateOfExpiry(),
       issuingState: mrz.getIssuingState(),
@@ -191,7 +205,7 @@ const EIDScanner = ({
           appContext.setLastDocumentRead?.(documentReadResult);
           appContext.onDocumentRead?.(documentReadResult);
           if (appContext.skipNfcResultScreen && onScanSuccess) {
-            onScanSuccess(getFieldsFromMRZ(passportData.mrz), passportData.faceImage, passportData.mimeType);
+            onScanSuccess(getFieldsFromMRZ(passportData.mrz, builtName), passportData.faceImage, passportData.mimeType);
           } else {
             setDocumentFaceImage(passportData.faceImage);
             setDocumentMRZInfo(passportData.mrz);
@@ -228,7 +242,37 @@ const EIDScanner = ({
       // Track EID scan failure with detailed metadata
       await trackEIDScanFailed(docType, errorType, errorMessage, scanDuration, currentAttempt, DeviceInfo.getModel(), DeviceInfo.getSystemVersion()).catch(() => {});
       console.debug('NFC scan error:', error);
-      // Ignore error - let user retry
+
+      // Surface an accurate message instead of failing silently. eidReader
+      // attaches `nfcCategory` + `nfcCode`.
+      //   - User-correctable failures (wrong doc data, card moved/too slow, NFC
+      //     off) get a specific, actionable message and NO code — there's a clear
+      //     action to take, a support code would just be noise.
+      //   - Everything else is an unexpected/system error: show a generic message
+      //     plus the reportable code (e.g. NFC-READ-6A82) so the user can quote it.
+      //   - user_cancelled stays silent (the user dismissed the native NFC sheet).
+      const tagged = error;
+      const category = tagged?.nfcCategory ?? errorType;
+
+      // category -> actionable message key for the user-mistake cases.
+      const ACTIONABLE = {
+        auth_failed: 'eidScannerScreen.nfcAuthFailed',
+        tag_lost: 'eidScannerScreen.nfcTagLost',
+        timeout: 'eidScannerScreen.nfcTimeout',
+        not_enabled: 'eidScannerScreen.nfcNotEnabled'
+      };
+      if (category !== 'user_cancelled') {
+        const actionableKey = ACTIONABLE[category];
+        if (actionableKey) {
+          // Clear user action available — meaningful message, no support code.
+          Alert.alert(t('eidScannerScreen.error'), t(actionableKey));
+        } else {
+          // Unexpected/system error — generic message + reportable support code.
+          const errorCode = tagged?.nfcCode ?? 'NFC-READ';
+          const message = `${t('eidScannerScreen.nfcGenericError')}\n\n${t('eidScannerScreen.errorCode')}: ${errorCode}`;
+          Alert.alert(t('eidScannerScreen.error'), message);
+        }
+      }
     } finally {
       setIsScanning(false);
       setProgress(0);
@@ -374,7 +418,11 @@ const EIDScanner = ({
               style: styles.idCardPhotoContainer,
               children: /*#__PURE__*/_jsx(View, {
                 style: styles.idCardPhotoFrame,
-                children: documentFaceImage && (documentFaceImageMimeType === 'image/jpeg' || documentFaceImageMimeType === 'image/png') ? /*#__PURE__*/_jsx(Image, {
+                children: documentFaceImage && (documentFaceImageMimeType === 'image/jpeg' || documentFaceImageMimeType === 'image/png' ||
+                // Android's <Image> decodes a raw JP2 data URI; on iOS
+                // the chip JP2 is converted to JPEG before this point
+                // (native ImageIO), so iOS never reaches here as jp2.
+                documentFaceImageMimeType === 'image/jp2') ? /*#__PURE__*/_jsx(Image, {
                   source: {
                     uri: `data:${documentFaceImageMimeType};base64,${documentFaceImage}`
                   },
@@ -388,36 +436,51 @@ const EIDScanner = ({
                   })
                 })
               })
-            }), /*#__PURE__*/_jsxs(View, {
+            }), /*#__PURE__*/_jsx(View, {
               style: styles.idCardFields,
-              children: [/*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.surname'),
-                value: documentName?.displayLast ?? documentMRZInfo.getPrimaryIdentifier()
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.name'),
-                value: documentName?.displayFirst ?? documentMRZInfo.getSecondaryIdentifier()
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.documentNumber'),
-                value: documentMRZInfo.getDocumentNumber()
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.birthDate'),
-                value: formatDate(documentMRZInfo.getDateOfBirth())
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.expirationDate'),
-                value: formatDate(documentMRZInfo.getDateOfExpiry())
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.gender'),
-                value: formatGender(documentMRZInfo.getGender().getStrCode())
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.nationality'),
-                value: formatNationality(documentMRZInfo.getNationality())
-              }), /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.issuingState'),
-                value: formatNationality(documentMRZInfo.getIssuingState())
-              }), !!(documentMRZInfo.getPersonalNumber() || documentMRZInfo.getOptionalData1()) && /*#__PURE__*/_jsx(IDCardField, {
-                label: t('eidScannerScreen.personalNumber'),
-                value: documentMRZInfo.getPersonalNumber() || documentMRZInfo.getOptionalData1() || ''
-              })]
+              children: (() => {
+                const surname = documentName?.displayLast ?? cleanField(documentMRZInfo.getPrimaryIdentifier());
+                const givenNames = documentName?.displayFirst ?? cleanField(documentMRZInfo.getSecondaryIdentifier());
+                const docNumber = cleanField(documentMRZInfo.getDocumentNumber());
+                const birthDate = formatDate(documentMRZInfo.getDateOfBirth());
+                const expiry = formatDate(documentMRZInfo.getDateOfExpiry());
+                const gender = formatGender(documentMRZInfo.getGender().getStrCode());
+                const nationality = formatNationality(documentMRZInfo.getNationality());
+                const issuingState = formatNationality(documentMRZInfo.getIssuingState());
+                const personalNumber = cleanField(documentMRZInfo.getPersonalNumber() || documentMRZInfo.getOptionalData1());
+                const fields = [{
+                  label: t('eidScannerScreen.surname'),
+                  value: surname
+                }, {
+                  label: t('eidScannerScreen.name'),
+                  value: givenNames
+                }, {
+                  label: t('eidScannerScreen.documentNumber'),
+                  value: docNumber
+                }, {
+                  label: t('eidScannerScreen.birthDate'),
+                  value: birthDate
+                }, {
+                  label: t('eidScannerScreen.expirationDate'),
+                  value: expiry
+                }, {
+                  label: t('eidScannerScreen.gender'),
+                  value: gender
+                }, {
+                  label: t('eidScannerScreen.nationality'),
+                  value: nationality
+                }, {
+                  label: t('eidScannerScreen.issuingState'),
+                  value: issuingState
+                }, {
+                  label: t('eidScannerScreen.personalNumber'),
+                  value: personalNumber
+                }];
+                return fields.filter(f => f.value && f.value.trim().length > 0).map(f => /*#__PURE__*/_jsx(IDCardField, {
+                  label: f.label,
+                  value: f.value
+                }, f.label));
+              })()
             })]
           })]
         }), hasNfc && isEnabled && isScanned && /*#__PURE__*/_jsx(View, {
@@ -427,7 +490,7 @@ const EIDScanner = ({
             disabled: !documentFaceImage || !documentMRZInfo,
             onPress: () => {
               if (onScanSuccess && documentMRZInfo && documentFaceImage && documentFaceImageMimeType) {
-                onScanSuccess(getFieldsFromMRZ(documentMRZInfo), documentFaceImage, documentFaceImageMimeType);
+                onScanSuccess(getFieldsFromMRZ(documentMRZInfo, documentName), documentFaceImage, documentFaceImageMimeType);
               }
             },
             children: t('eidScannerScreen.approveAndContinue')
@@ -477,7 +540,7 @@ const EIDScanner = ({
           disabled: !documentFaceImage || !documentMRZInfo,
           onPress: () => {
             if (onScanSuccess && documentMRZInfo && documentFaceImage && documentFaceImageMimeType) {
-              onScanSuccess(getFieldsFromMRZ(documentMRZInfo), documentFaceImage, documentFaceImageMimeType);
+              onScanSuccess(getFieldsFromMRZ(documentMRZInfo, documentName), documentFaceImage, documentFaceImageMimeType);
             }
           },
           children: t('eidScannerScreen.approveAndContinue')

package/lib/module/Shared/Components/IdentityDocumentCamera.constants.js

@@ -17,7 +17,15 @@ export const REQUIRED_CONSISTENT_DOCTYPE_DETECTIONS = 3;
 export const SIGNATURE_REGEX = /s[gi]g?n[au]?t[u]?r|imz[a]s?/i;
 export const SIGNATURE_TEXT_REGEX = /signature|imza|İmza/i;
 export const MRZ_BLOCK_PATTERN = /[A-Z0-9<]{8,}.*</i;
-export const PASSPORT_MRZ_PATTERN = /P<[A-Z]{3}/;
+// Matches the line-1 start of ANY ICAO TD3 passport MRZ, so the camera routes
+// every passport variant into the passport flow (not the ID-card back-side
+// flow). Per ICAO 9303 Part 4: `P` + a type char (filler `<` or a subtype
+// letter — `P<`, `PP` German, `PD`/`PS`/`PO` diplomatic/service/official) +
+// the issuing state (3 letters, OR the German 1-letter `D` padded with filler,
+// e.g. `P<D<<` / `PPD<<`). Previously only `P<[A-Z]{3}` matched, so German `PP`
+// and 1-letter-issuer passports fell through to the ID-card flow and were
+// wrongly asked for a back side.
+export const PASSPORT_MRZ_PATTERN = /P[A-Z<](?:[A-Z]{3}|[A-Z]<<)[A-Z<]*<</;
 
 // BDDK Madde 7 - Security Feature Validation
 // When NFC chip reading unavailable, must verify at least 4 visual security features

package/lib/module/Shared/Components/IdentityDocumentCamera.flows.js

@@ -261,12 +261,32 @@ export function handleIDBackFlow(mrzText, mrzFields, mrzValid, mrzStableAndValid
  *
  * PASSPORT: → COMPLETED (no back side)
  * ID CARD: → SCAN_ID_BACK
+ *
+ * Routing is PASSPORT-BIASED on purpose: a passport has no back side, so if we
+ * route it to SCAN_ID_BACK it deadlocks forever waiting for a back that will
+ * never appear. We therefore only go to SCAN_ID_BACK when there is POSITIVE
+ * evidence the document is an ID card (a parsed MRZ document code that is
+ * present and not 'P'). When the type is ambiguous — e.g. the passport MRZ was
+ * never read as 'P' so the front step locked `detectedDocumentType` as
+ * 'ID_FRONT' (the torch/tilt during hologram capture makes the MRZ unreadable),
+ * or no MRZ code survived at all — we COMPLETE rather than wait for a
+ * non-existent back side. A two-sided ID card always yields an 'I'/'A'/'C'
+ * (non-'P') MRZ code, so genuine ID cards still route to SCAN_ID_BACK.
  */
 export function getNextStepAfterHologram(detectedDocumentType, currentFrameDocType, mrzDocCode) {
-  // Check multiple sources to determine if it's a passport
+  // Any positive passport signal → done (no back side).
   const isPassport = detectedDocumentType === 'PASSPORT' || currentFrameDocType === 'PASSPORT' || mrzDocCode === 'P';
   if (isPassport) {
     return 'COMPLETED';
   }
-  return 'SCAN_ID_BACK';
+
+  // Only continue to the back side when we have POSITIVE proof it's an ID card:
+  // a real MRZ document code that is present and not a passport. Without that
+  // proof, default to COMPLETED so a misclassified passport can't hang waiting
+  // for a back side that doesn't exist.
+  const hasIdCardMrzCode = !!mrzDocCode && mrzDocCode !== 'P';
+  if (hasIdCardMrzCode) {
+    return 'SCAN_ID_BACK';
+  }
+  return 'COMPLETED';
 }

package/lib/module/Shared/Components/IdentityDocumentCamera.js

@@ -1799,7 +1799,7 @@ const IdentityDocumentCamera = ({
           status === 'SCANNING' && allElementsDetected && elementsOutsideScanArea.length === 0 && !isBrightnessLow && !isFrameBlurry && styles.topZoneTextScanning
           // 5. Default (white) - aligning (not all detected OR elements outside scan area)
           ],
-          children: getStatusMessage(nextStep, status, detectedDocumentType, isBrightnessLow, isFrameBlurry, allElementsDetected, elementsOutsideScanArea, t, mrzReliable)
+          children: getStatusMessage(nextStep, status, detectedDocumentType, isBrightnessLow, isFrameBlurry, allElementsDetected, elementsOutsideScanArea, t)
         })]
       }), /*#__PURE__*/_jsx(View, {
         style: styles.leftZone

package/lib/module/Shared/Components/IdentityDocumentCamera.utils.js

@@ -78,17 +78,17 @@ export function transformBoundsToScreen(bounds, scale, offsetX, offsetY) {
  * Unified status message logic used by both voice guidance and render text.
  * Returns the appropriate i18n key arguments for the current scan state.
  */
-export function getStatusMessage(nextStep, status, detectedDocumentType, isBrightnessLow, isFrameBlurry, allElementsDetected, elementsOutsideScanArea, t, mrzReliable = false) {
+export function getStatusMessage(nextStep, status, detectedDocumentType, isBrightnessLow, isFrameBlurry, allElementsDetected, elementsOutsideScanArea, t) {
   if (nextStep === 'COMPLETED') {
     return t('identityDocumentCamera.scanCompleted');
   }
 
-  // MRZ reliably detected (stable consensus) — the green "GO" message. Ranks
-  // above the in-progress states so the user gets a clear positive signal the
-  // moment the reading has settled, but never on an early/transient valid read.
-  if (mrzReliable) {
-    return t('identityDocumentCamera.mrzDetected');
-  }
+  // NOTE: the "MRZ detected — hold steady" message was intentionally removed
+  // (along with its former `mrzReliable` parameter). User-facing guidance
+  // should only describe the SCAN STEP (front side, back side, hologram, etc.),
+  // not low-level MRZ-detection state. We fall through to the step-specific
+  // messages below.
+
   if (status === 'INCORRECT') {
     if (nextStep === 'SCAN_ID_FRONT_OR_PASSPORT') {
       return t('identityDocumentCamera.alignIDFront');

package/lib/module/Shared/EIDReader/cardFileInputStream.js

@@ -3,6 +3,9 @@
 import { InputStream } from "./java/inputStream.js";
 import { Buffer } from 'buffer';
 export class CardFileInputStream extends InputStream {
+  /** Max re-issues of a single block read before failing — mitigates transient
+   *  iOS NFC transceive drops during large-file reads (e.g. DG2). */
+  static MAX_BLOCK_READ_RETRIES = 5;
   constructor(maxBlockSize, fs) {
     super();
     this.fs = fs;
@@ -49,8 +52,28 @@ export class CardFileInputStream extends InputStream {
           newOffsetBufferInFile = this.offsetBufferInFile + this.bufferLength;
           let newOffsetInBuffer = 0;
           let newBufferLength = 0;
-          while (newBufferLength === 0) {
-            newBufferLength = await this.fillBufferFromFile(this.path, newOffsetBufferInFile, le);
+          // Retry a failed block read. The iOS NFC stack (react-native-nfc-manager)
+          // throws transient "READ BINARY" transceive errors during the many
+          // block reads of a large file like DG2 (face image); a single drop
+          // previously aborted the whole read with "Could not read file". Re-issue
+          // the SAME block (offset unchanged) a few times before giving up — this
+          // is idempotent (no secure-messaging state advances on a failed read).
+          let attempt = 0;
+          for (;;) {
+            try {
+              newBufferLength = 0;
+              while (newBufferLength === 0) {
+                newBufferLength = await this.fillBufferFromFile(this.path, newOffsetBufferInFile, le);
+              }
+              break;
+            } catch (blockError) {
+              if (++attempt >= CardFileInputStream.MAX_BLOCK_READ_RETRIES) {
+                throw blockError;
+              }
+              // Brief backoff: an immediate re-issue after a transient NFC drop
+              // usually fails again; a short pause lets the RF field re-stabilise.
+              await new Promise(r => setTimeout(r, 80 * attempt));
+            }
           }
           this.offsetBufferInFile = newOffsetBufferInFile;
           this.offsetInBuffer = newOffsetInBuffer;

package/lib/module/Shared/EIDReader/defaultFileSystem.js

@@ -6,9 +6,11 @@ import { DefaultFileInfo } from "./defaultFileInfo.js";
 import { ISO7816_SW } from "./smartcards/iso7816.js";
 import { SecureMessagingWrapper } from "./secureMessagingWrapper.js";
 import { TripleDesSecureMessagingWrapper } from "./tripleDesSecureMessagingWrapper.js";
+import { AESSecureMessagingWrapper } from "./aesSecureMessagingWrapper.js";
 import { TLVInputStream } from "./tlv/tlvInputStream.js";
 import { CVCAFile } from "./lds/cvcaFile.js";
 import { Buffer } from 'buffer';
+import { Platform } from 'react-native';
 export class DefaultFileSystem {
   static NO_SFI = -1;
   static READ_AHEAD_LENGTH = 8;
@@ -19,7 +21,27 @@ export class DefaultFileSystem {
     this.isSelected = false;
     this.isSFIEnabled = isSFIEnabled;
     this.fidToSFI = fidToSFI;
-    this.maxReadBinaryLength = EID_CONSTANTS.EXTENDED_MAX_TRANSCEIVE_LENGTH;
+    // iOS CoreNFC (via react-native-nfc-manager's sendCommandAPDUIOS) does not
+    // accept the EXTENDED-length APDU byte form this code emits when ne > 256
+    // (a 7-byte "00 XX XX" Le). Such a READ BINARY is rejected outright, so on
+    // iOS EVERY DG2 read failed ("Exception during READ BINARY") even though
+    // PACE — which only used short Le=256 — succeeded. Start at a short-form
+    // length on iOS (ne <= 256) so every READ BINARY stays in the short APDU
+    // form. Android's transceive() handles extended APDUs, so keep extended
+    // there for speed. JMRTD/NFCPassportReader likewise read in small blocks.
+    this.maxReadBinaryLength = Platform.OS === 'ios' ? EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE // 223 → short-form Le, SM-safe
+    : EID_CONSTANTS.EXTENDED_MAX_TRANSCEIVE_LENGTH;
+  }
+
+  /** Deep-copy a secure-messaging wrapper PRESERVING its cipher type (AES vs
+   *  3DES), so the SSC can be rewound for a retry without changing the MAC/enc
+   *  algorithm. Non-SM wrappers are returned as-is. */
+  cloneWrapper(wrapper) {
+    if (!(wrapper instanceof SecureMessagingWrapper)) {
+      return wrapper;
+    }
+    const args = [wrapper.getEncryptionKey(), wrapper.getMACKey(), wrapper.getMaxTransceiveLength(), wrapper.getShouldCheckMAC(), wrapper.getSendSequenceCounter()];
+    return wrapper.getType() === 'AES' ? new AESSecureMessagingWrapper(...args) : new TripleDesSecureMessagingWrapper(...args);
   }
   setWrapper(wrapper) {
     this.oldWrapper = this.wrapper;
@@ -89,13 +111,36 @@ export class DefaultFileSystem {
       const result = buffer.slice(offset, offset + responseLength);
       return result;
     } catch (error) {
-      const sw = error.getSW();
-      if ((sw & ISO7816_SW.WRONG_LENGTH) === ISO7816_SW.WRONG_LENGTH && this.maxReadBinaryLength > EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE) {
-        this.wrapper = this.oldWrapper;
+      // Only APDU-level errors expose getSW(); a transient native NFC transceive
+      // error does NOT, so calling it unguarded threw a TypeError and masked the
+      // real failure. Guard it before testing for the WRONG_LENGTH downgrade.
+      const sw = typeof error.getSW === 'function' ? error.getSW() : undefined;
+      const isWrongLength = sw != null && (sw & ISO7816_SW.WRONG_LENGTH) === ISO7816_SW.WRONG_LENGTH;
+
+      // Downgrade the read size and signal a retry (empty result) when EITHER:
+      //  - the chip returned 6Cxx WRONG_LENGTH (the standard JMRTD path), OR
+      //  - the read failed transiently with NO status word while we were still
+      //    at extended length. iOS CoreNFC (via react-native-nfc-manager) drops
+      //    the connection on too-large extended-length READ BINARY on some chips
+      //    (e.g. German passport DG2) instead of returning 6Cxx, so the chip
+      //    never gets to ask for a smaller length. Dropping to the conservative
+      //    223-byte block makes the next read succeed. Reference readers
+      //    (JMRTD, NFCPassportReader) read large files in small blocks (~0xA0).
+      // Restore the pre-send secure-messaging wrapper. A failed wrapped READ
+      // BINARY still advanced the send-sequence-counter, so a retry MUST reset
+      // it or every subsequent read fails the MAC. (This is why the read
+      // previously stalled partway through DG2: each retry reused a desynced
+      // SSC.) JMRTD does the same reset on its downgrade path.
+      this.wrapper = this.oldWrapper;
+      if ((isWrongLength || sw == null) && this.maxReadBinaryLength > EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE) {
         this.maxReadBinaryLength = EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE;
         return new Uint8Array(0);
       }
-      throw new Error(`Read binary failed on file ${fileInfo == null ? this.selectedFID.toString(16) : fileInfo}`);
+
+      // Preserve the original error (a transient transceive failure at an
+      // already-small block size) so the retry layer above can recognise and
+      // re-issue it, instead of flattening every cause into one opaque string.
+      throw error instanceof Error ? error : new Error(`Read binary failed on file ${fileInfo == null ? this.selectedFID.toString(16) : fileInfo}`);
     }
   }
   async getFileInfo() {
@@ -139,7 +184,12 @@ export class DefaultFileSystem {
     await this.service.sendSelectFile(this.wrapper, fid);
   }
   sendReadBinaryNoSFI(offset, le, isTLVEncodedOffsetNeeded) {
-    this.oldWrapper = this.wrapper instanceof SecureMessagingWrapper ? new TripleDesSecureMessagingWrapper(this.wrapper.getEncryptionKey(), this.wrapper.getMACKey(), this.wrapper.getMaxTransceiveLength(), this.wrapper.getShouldCheckMAC(), this.wrapper.getSendSequenceCounter()) : this.wrapper;
+    // Snapshot the wrapper BEFORE the send so a failed read can rewind the SSC.
+    // The copy MUST preserve the actual wrapper type — PACE sessions are AES
+    // (the German passport uses AES-CMAC). Previously this always built a 3DES
+    // wrapper, so an AES session's retry used a 3DES wrapper with AES keys and
+    // every subsequent read failed the MAC — the cause of the DG2 stall.
+    this.oldWrapper = this.cloneWrapper(this.wrapper);
     return this.service.sendReadBinary(this.wrapper, DefaultFileSystem.NO_SFI, offset, le, false, isTLVEncodedOffsetNeeded);
   }
   sendReadBinary(sfi, offset, le, isTLVEncodedOffsetNeeded) {