@trustchex/react-native-sdk 1.487.0 → 1.489.0

package/src/Shared/EIDReader/defaultFileSystem.ts

@@ -6,10 +6,12 @@ import { FileInfo } from './fileInfo';
 import { ISO7816_SW } from './smartcards/iso7816';
 import { SecureMessagingWrapper } from './secureMessagingWrapper';
 import { TripleDesSecureMessagingWrapper } from './tripleDesSecureMessagingWrapper';
+import { AESSecureMessagingWrapper } from './aesSecureMessagingWrapper';
 import type { APDUWrapper } from './smartcards/apduWrapper';
 import { TLVInputStream } from './tlv/tlvInputStream';
 import { CVCAFile } from './lds/cvcaFile';
 import { Buffer } from 'buffer';
+import { Platform } from 'react-native';
 import type { FileSystemStructured } from './smartcards/fileSystemStructured';
 
 export class DefaultFileSystem implements FileSystemStructured {
@@ -37,7 +39,37 @@ export class DefaultFileSystem implements FileSystemStructured {
     this.isSelected = false;
     this.isSFIEnabled = isSFIEnabled;
     this.fidToSFI = fidToSFI;
-    this.maxReadBinaryLength = EID_CONSTANTS.EXTENDED_MAX_TRANSCEIVE_LENGTH;
+    // iOS CoreNFC (via react-native-nfc-manager's sendCommandAPDUIOS) does not
+    // accept the EXTENDED-length APDU byte form this code emits when ne > 256
+    // (a 7-byte "00 XX XX" Le). Such a READ BINARY is rejected outright, so on
+    // iOS EVERY DG2 read failed ("Exception during READ BINARY") even though
+    // PACE — which only used short Le=256 — succeeded. Start at a short-form
+    // length on iOS (ne <= 256) so every READ BINARY stays in the short APDU
+    // form. Android's transceive() handles extended APDUs, so keep extended
+    // there for speed. JMRTD/NFCPassportReader likewise read in small blocks.
+    this.maxReadBinaryLength =
+      Platform.OS === 'ios'
+        ? EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE // 223 → short-form Le, SM-safe
+        : EID_CONSTANTS.EXTENDED_MAX_TRANSCEIVE_LENGTH;
+  }
+
+  /** Deep-copy a secure-messaging wrapper PRESERVING its cipher type (AES vs
+   *  3DES), so the SSC can be rewound for a retry without changing the MAC/enc
+   *  algorithm. Non-SM wrappers are returned as-is. */
+  private cloneWrapper(wrapper: APDUWrapper): APDUWrapper {
+    if (!(wrapper instanceof SecureMessagingWrapper)) {
+      return wrapper;
+    }
+    const args: [string, string, number, boolean, bigint] = [
+      wrapper.getEncryptionKey(),
+      wrapper.getMACKey(),
+      wrapper.getMaxTransceiveLength(),
+      wrapper.getShouldCheckMAC(),
+      wrapper.getSendSequenceCounter(),
+    ];
+    return wrapper.getType() === 'AES'
+      ? new AESSecureMessagingWrapper(...args)
+      : new TripleDesSecureMessagingWrapper(...args);
   }
 
   public setWrapper(wrapper: APDUWrapper): void {
@@ -131,19 +163,49 @@ export class DefaultFileSystem implements FileSystemStructured {
 
       return result;
     } catch (error) {
-      const sw = (error as any).getSW();
+      // Only APDU-level errors expose getSW(); a transient native NFC transceive
+      // error does NOT, so calling it unguarded threw a TypeError and masked the
+      // real failure. Guard it before testing for the WRONG_LENGTH downgrade.
+      const sw =
+        typeof (error as { getSW?: () => number }).getSW === 'function'
+          ? (error as { getSW: () => number }).getSW()
+          : undefined;
+      const isWrongLength =
+        sw != null &&
+        (sw & ISO7816_SW.WRONG_LENGTH) === ISO7816_SW.WRONG_LENGTH;
+
+      // Downgrade the read size and signal a retry (empty result) when EITHER:
+      //  - the chip returned 6Cxx WRONG_LENGTH (the standard JMRTD path), OR
+      //  - the read failed transiently with NO status word while we were still
+      //    at extended length. iOS CoreNFC (via react-native-nfc-manager) drops
+      //    the connection on too-large extended-length READ BINARY on some chips
+      //    (e.g. German passport DG2) instead of returning 6Cxx, so the chip
+      //    never gets to ask for a smaller length. Dropping to the conservative
+      //    223-byte block makes the next read succeed. Reference readers
+      //    (JMRTD, NFCPassportReader) read large files in small blocks (~0xA0).
+      // Restore the pre-send secure-messaging wrapper. A failed wrapped READ
+      // BINARY still advanced the send-sequence-counter, so a retry MUST reset
+      // it or every subsequent read fails the MAC. (This is why the read
+      // previously stalled partway through DG2: each retry reused a desynced
+      // SSC.) JMRTD does the same reset on its downgrade path.
+      this.wrapper = this.oldWrapper;
+
       if (
-        (sw & ISO7816_SW.WRONG_LENGTH) === ISO7816_SW.WRONG_LENGTH &&
+        (isWrongLength || sw == null) &&
         this.maxReadBinaryLength > EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE
       ) {
-        this.wrapper = this.oldWrapper;
         this.maxReadBinaryLength = EID_CONSTANTS.DEFAULT_MAX_BLOCKSIZE;
         return new Uint8Array(0);
       }
 
-      throw new Error(
-        `Read binary failed on file ${fileInfo == null ? this.selectedFID.toString(16) : fileInfo}`
-      );
+      // Preserve the original error (a transient transceive failure at an
+      // already-small block size) so the retry layer above can recognise and
+      // re-issue it, instead of flattening every cause into one opaque string.
+      throw error instanceof Error
+        ? error
+        : new Error(
+            `Read binary failed on file ${fileInfo == null ? this.selectedFID.toString(16) : fileInfo}`
+          );
     }
   }
 
@@ -216,16 +278,12 @@ export class DefaultFileSystem implements FileSystemStructured {
     le: number,
     isTLVEncodedOffsetNeeded: boolean
   ) {
-    this.oldWrapper =
-      this.wrapper instanceof SecureMessagingWrapper
-        ? new TripleDesSecureMessagingWrapper(
-            this.wrapper.getEncryptionKey(),
-            this.wrapper.getMACKey(),
-            this.wrapper.getMaxTransceiveLength(),
-            this.wrapper.getShouldCheckMAC(),
-            this.wrapper.getSendSequenceCounter()
-          )
-        : this.wrapper;
+    // Snapshot the wrapper BEFORE the send so a failed read can rewind the SSC.
+    // The copy MUST preserve the actual wrapper type — PACE sessions are AES
+    // (the German passport uses AES-CMAC). Previously this always built a 3DES
+    // wrapper, so an AES session's retry used a 3DES wrapper with AES keys and
+    // every subsequent read failed the MAC — the cause of the DG2 stall.
+    this.oldWrapper = this.cloneWrapper(this.wrapper);
     return this.service.sendReadBinary(
       this.wrapper,
       DefaultFileSystem.NO_SFI,

package/src/Shared/EIDReader/eidReader.ts

@@ -2,6 +2,7 @@ import { BACKey } from './bacKey';
 import { PACEKeySpec } from './paceKeySpec';
 import { NFCManagerCardService } from './nfcManagerCardService';
 import { EIDService } from './eidService';
+import { isPACEUnsupportedError } from './protocol/paceErrors';
 import { DG1File } from './lds/icao/dg1File';
 import { DG2File } from './lds/icao/dg2File';
 import { DG11File } from './lds/icao/dg11File';
@@ -11,6 +12,7 @@ import { MRZInfo } from './lds/icao/mrzInfo';
 import { InputStream } from './java/inputStream';
 import { debugLog } from '../Libs/debug.utils';
 import { diagnostics } from '../Libs/diagnostics';
+import { decodeJp2ToJpeg } from '../Libs/jp2Decode';
 
 /**
  * Extract an APDU status word (hex, e.g. "6982") from an error message if the
@@ -38,6 +40,54 @@ const categorizeNfcError = (msg: string): string => {
   return 'reading_error';
 };
 
+/** Short, stable code per category for the user-facing reportable error code. */
+const NFC_CATEGORY_CODE: Record<string, string> = {
+  user_cancelled: 'CANCEL',
+  tag_lost: 'TAGLOST',
+  timeout: 'TIMEOUT',
+  unsupported: 'UNSUPPORTED',
+  not_enabled: 'DISABLED',
+  auth_failed: 'AUTH',
+  reading_error: 'READ',
+};
+
+/** Short, stable token per read step, so the error code names WHERE it failed.
+ *  A generic NFC-READ is not actionable; NFC-READ-DG2-6982 tells support the
+ *  read failed reading the face image (DG2) with APDU status 6982. */
+const NFC_STEP_CODE: Record<string, string> = {
+  open: 'OPEN',
+  selectApplet: 'SELAPP',
+  selectMF: 'SELMF',
+  readCardAccess: 'CARDACCESS',
+  paceAuth: 'PACE',
+  bacAuth: 'BAC',
+  readDG1: 'DG1',
+  readDG2: 'DG2',
+  readDG11: 'DG11',
+};
+
+/**
+ * Build a stable, reportable error code from a categorised NFC failure that
+ * names the failing STEP, e.g. `NFC-READ-DG2-6982` (reading the face image
+ * failed, APDU status 6982) or `NFC-AUTH-PACE-6300` (PACE auth rejected). Falls
+ * back to `NFC-<category>` when neither step nor status word is known.
+ * Non-PII by construction: only the bucket + step name + the chip's 4-hex
+ * status word. A user can quote it to pinpoint exactly where the read failed.
+ */
+const buildNfcErrorCode = (
+  category: string,
+  msg: string,
+  step?: string,
+  stepSw?: string
+): string => {
+  const part = NFC_CATEGORY_CODE[category] ?? 'READ';
+  const stepTok = step ? NFC_STEP_CODE[step] : undefined;
+  // Prefer the status word recorded against the failing step; fall back to one
+  // parsed from the error message.
+  const sw = stepSw ?? extractStatusWord(msg);
+  return [`NFC-${part}`, stepTok, sw].filter(Boolean).join('-');
+};
+
 // --- Minimal PNG encoder (pure JS, no native deps) ---
 // Uses deflate stored (uncompressed) blocks for O(n) encoding speed.
 // A naive DCT-based JPEG encoder would be O(n²) and freeze the JS thread
@@ -182,14 +232,48 @@ function pixelsToPng(
  * If the image is JPEG 2000, decode and convert to PNG so React Native can display it.
  * Returns { base64, mimeType } with the converted image, or the original if not JP2.
  */
-function convertJP2IfNeeded(
+// Largest JP2 face image we will attempt to decode in pure JS on the UI thread.
+// The `jpeg2000` decoder's parse() is SYNCHRONOUS and roughly quadratic, so a
+// large image (some passports store 20–30 KB+ JPEG2000 portraits) blocks the JS
+// thread for many seconds or indefinitely — the German-passport "stuck at face
+// conversion" hang. A JS timeout cannot interrupt a synchronous call, so we must
+// gate BEFORE decoding. ~12 KB decodes fast; beyond that we keep the raw JP2.
+const MAX_JP2_DECODE_BYTES = 12 * 1024;
+
+async function convertJP2IfNeeded(
   imageBuffer: Buffer,
   mimeType: string
-): { base64: string; mimeType: string } {
+): Promise<{ base64: string; mimeType: string }> {
   if (mimeType !== 'image/jp2') {
     return { base64: imageBuffer.toString('base64'), mimeType };
   }
 
+  // Prefer the native decoder (iOS ImageIO). It decodes JPEG2000 of any size
+  // without blocking the JS thread, so it both fixes the iOS preview (RN's
+  // <Image> can't render a raw image/jp2 data URI) and avoids the slow pure-JS
+  // decoder entirely. Returns null on Android / when unavailable → fall through.
+  const native = await decodeJp2ToJpeg(imageBuffer);
+  if (native) {
+    debugLog(
+      'EID',
+      `[EID] JP2 decoded natively → ${native.mimeType} (${native.base64.length} base64 chars)`
+    );
+    return native;
+  }
+
+  // Too large to decode synchronously without freezing the UI — keep the raw
+  // JP2. The face image is still captured (the verification backend / face-match
+  // accept JPEG2000); only the on-screen preview can't render it. This lets the
+  // NFC read COMPLETE instead of hanging. (On Android the raw JP2 still renders
+  // in <Image>; on iOS the native path above normally handles it.)
+  if (imageBuffer.length > MAX_JP2_DECODE_BYTES) {
+    debugLog(
+      'EID',
+      `[EID] JP2 face image is ${imageBuffer.length} bytes (> ${MAX_JP2_DECODE_BYTES}); skipping in-JS decode to avoid blocking, keeping raw JP2`
+    );
+    return { base64: imageBuffer.toString('base64'), mimeType };
+  }
+
   debugLog('EID', '[EID] Face image is JP2, attempting conversion…');
   try {
     // Lazy-load jpeg2000 to avoid crashing if it fails to import
@@ -349,7 +433,12 @@ const eidReader = async (
   const stepTimer = () => {
     const t0 = Date.now();
     return (step: string, ok: boolean, error?: unknown) => {
-      const msg = error instanceof Error ? error.message : error ? String(error) : undefined;
+      const msg =
+        error instanceof Error
+          ? error.message
+          : error
+            ? String(error)
+            : undefined;
       // Store only the APDU status word and a COARSE category — never the raw
       // error text, which could in theory embed field/PII values. The SW + step
       // name + category carry all the actionable signal.
@@ -472,12 +561,38 @@ const eidReader = async (
 
           const done = stepTimer();
           try {
-            await passportService.doPACE(
-              paceKey,
-              paceInfo.oid,
-              paceInfo.parameterId,
-              progressCallback
-            );
+            // PACE runs many APDU round-trips; on iOS the CoreNFC tag connection
+            // can drop mid-handshake (empty/lost-tag error). A restart can't
+            // resume PACE (the on-chip state is gone), so on a CONNECTION-DROP
+            // (not a crypto/capability failure) restart the session and retry
+            // the WHOLE PACE handshake from scratch a few times. A real failure
+            // (wrong key, unsupported variant) is rethrown immediately.
+            const MAX_PACE_ATTEMPTS = 3;
+            for (let paceAttempt = 1; ; paceAttempt++) {
+              try {
+                await passportService.doPACE(
+                  paceKey,
+                  paceInfo.oid,
+                  paceInfo.parameterId,
+                  progressCallback
+                );
+                break;
+              } catch (attemptErr) {
+                const lost = nfcManagerCardService.isTagLost(attemptErr);
+                if (!lost || paceAttempt >= MAX_PACE_ATTEMPTS) {
+                  throw attemptErr;
+                }
+                debugLog(
+                  'EID',
+                  `[EID] PACE attempt ${paceAttempt} lost the tag; restarting session and retrying`
+                );
+                await nfcManagerCardService.restartSession();
+                await new Promise((r) => setTimeout(r, 200 * paceAttempt));
+                // Re-select MF + re-read EF.CardAccess so the next PACE starts
+                // from the same clean state as the first attempt.
+                await passportService.sendSelectMF();
+              }
+            }
             hasPACESucceeded = true;
             done('paceAuth', true);
             debugLog('EID', '[EID] PACE succeeded');
@@ -493,13 +608,19 @@ const eidReader = async (
           );
         }
       } catch (paceError) {
-        // PACE protocol exchange failed — fall back to BAC
-        diagnostics.nfcPaceFellBackToBac('pace_failed');
+        // PACE could not complete — fall back to BAC. Distinguish a CAPABILITY
+        // gap (this build can't run the variant the chip advertises) from a
+        // RUNTIME failure (wrong key, tag lost, APDU error) so diagnostics show
+        // exactly why, e.g. pace_unsupported_curve vs pace_failed.
+        const reason = isPACEUnsupportedError(paceError)
+          ? `pace_unsupported_${paceError.reason}`
+          : 'pace_failed';
+        diagnostics.nfcPaceFellBackToBac(reason);
         const msg =
           paceError instanceof Error ? paceError.message : String(paceError);
         debugLog(
           'EID',
-          `[EID] PACE protocol failed (${msg}), falling back to BAC`
+          `[EID] PACE could not complete (${reason}: ${msg}), falling back to BAC`
         );
         if (paceError instanceof Error && paceError.stack) {
           debugLog('EID', '[EID] PACE error stack:', paceError.stack);
@@ -555,6 +676,13 @@ const eidReader = async (
       progressCallback(progress);
     }
 
+    // Authentication is complete — enable iOS CoreNFC session-restart recovery
+    // for the data-group reads. It must stay OFF during PACE/BAC (the auth state
+    // lives on the chip; a mid-handshake restart destroys it). Reads are
+    // idempotent and their secure-messaging state lives in our JS wrapper, so a
+    // session restart between blocks is safe here.
+    nfcManagerCardService.setSessionRestartEnabled(true);
+
     // Read DG1 (MRZ Info)
     const dg1Done = stepTimer();
     let mrzInfo: MRZInfo;
@@ -592,21 +720,23 @@ const eidReader = async (
 
     // Read DG2 (Face Image)
     const dg2Done = stepTimer();
-    const dg2InputStream = passportService.getInputStream(EIDService.EF_DG2);
-    await dg2InputStream.init();
-    InputStream.onRead((totalBytesRead, fileLength) => {
-      progress = 30 + (totalBytesRead / fileLength) * 70;
-      if (progressCallback) {
-        progressCallback(progress);
-      }
-    });
-    const dg2File = new DG2File([], dg2InputStream);
     let imageAsBase64 = '';
     let mimeType = '';
-
     const allFaceImageInfos: FaceImageInfo[] = [];
     let faceInfos;
     try {
+      // init() selects EF.DG2 and reads its header over secure messaging; keep
+      // it INSIDE the try so a failure here is still recorded as the readDG2
+      // step (it was previously outside, so an early DG2 failure went unlabelled).
+      const dg2InputStream = passportService.getInputStream(EIDService.EF_DG2);
+      await dg2InputStream.init();
+      InputStream.onRead((totalBytesRead, fileLength) => {
+        progress = 30 + (totalBytesRead / fileLength) * 70;
+        if (progressCallback) {
+          progressCallback(progress);
+        }
+      });
+      const dg2File = new DG2File([], dg2InputStream);
       faceInfos = await dg2File.getFaceInfos();
       dg2Done('readDG2', true);
     } catch (e) {
@@ -624,7 +754,7 @@ const eidReader = async (
       const buffer = Buffer.alloc(imageLength);
       await imageInputStream.readBytesWithOffset(buffer, 0, imageLength);
       const rawMimeType = faceImageInfo.getMimeType();
-      const converted = convertJP2IfNeeded(buffer, rawMimeType);
+      const converted = await convertJP2IfNeeded(buffer, rawMimeType);
       imageAsBase64 = converted.base64;
       mimeType = converted.mimeType;
     }
@@ -644,8 +774,26 @@ const eidReader = async (
     };
   } catch (error) {
     const msg = error instanceof Error ? error.message : String(error);
-    diagnostics.nfcResult(false, categorizeNfcError(msg));
+    const category = categorizeNfcError(msg);
+    diagnostics.nfcResult(false, category);
     debugLog('EID', 'Error reading passport data', error);
+    // Rethrow so the caller can surface an accurate, actionable message. Swallowing
+    // here returned `undefined`, which the UI mis-reported as "invalid MRZ fields"
+    // (e.g. a German passport whose BAC/PACE auth or chip read actually failed).
+    // The category is attached for the UI to map to a specific message.
+    const rethrown = error instanceof Error ? error : new Error(msg);
+    const tagged = rethrown as Error & {
+      nfcCategory?: string;
+      nfcCode?: string;
+    };
+    tagged.nfcCategory = category;
+    tagged.nfcCode = buildNfcErrorCode(
+      category,
+      msg,
+      diagnostics.getFailureStep(),
+      diagnostics.getFailureStatusWord()
+    );
+    throw tagged;
   } finally {
     await passportService.close();
   }

package/src/Shared/EIDReader/lds/icao/dg11File.ts

@@ -75,20 +75,35 @@ export class DG11File extends DataGroup {
    * Strips trailing filler `<` within each segment.
    */
   private parseName(nameString: string): void {
-    const delimIndex = nameString.indexOf('<<');
-    if (delimIndex < 0) {
-      this.lastName = nameString.replace(/<+$/, '').trim();
-      this.firstName = '';
+    const fillerToSpace = (s: string): string =>
+      s
+        .replace(/<+$/, '') // drop trailing filler
+        .replace(/</g, ' ') // internal filler = word separator
+        .replace(/\s+/g, ' ')
+        .trim();
+
+    const dblIndex = nameString.indexOf('<<');
+    if (dblIndex >= 0) {
+      // Standard ICAO layout: PRIMARY<<SECONDARY.
+      this.lastName = fillerToSpace(nameString.substring(0, dblIndex));
+      this.firstName = fillerToSpace(nameString.substring(dblIndex + 2));
       return;
     }
-    this.lastName = nameString
-      .substring(0, delimIndex)
-      .replace(/<+$/, '')
-      .trim();
-    this.firstName = nameString
-      .substring(delimIndex + 2)
-      .replace(/<$/, ' ')
-      .replace(/<+$/, '')
-      .trim();
+
+    // No `<<` separator. Some chips (e.g. certain Turkish PACE passports) store
+    // DG11 0x5F0E as SURNAME<GIVEN1<GIVEN2 with single fillers. Split on the
+    // FIRST single filler: surname = first token, given names = the rest. With
+    // no filler at all the field is a single token we cannot reliably split into
+    // surname/given, so leave firstName empty and let the caller decide (the MRZ
+    // split is then more trustworthy than a guess).
+    const singleIndex = nameString.replace(/<+$/, '').indexOf('<');
+    if (singleIndex >= 0) {
+      this.lastName = fillerToSpace(nameString.substring(0, singleIndex));
+      this.firstName = fillerToSpace(nameString.substring(singleIndex + 1));
+      return;
+    }
+
+    this.lastName = fillerToSpace(nameString);
+    this.firstName = '';
   }
 }

package/src/Shared/EIDReader/nfcManagerCardService.ts

@@ -4,6 +4,36 @@ import { CommandAPDU } from './smartcards/commandAPDU';
 import { ResponseAPDU } from './smartcards/responseAPDU';
 import { Platform } from 'react-native';
 
+// iOS CoreNFC "Tag connection lost" (NFCError 100) is a well-known issue whose
+// likelihood scales with the number of APDU round-trips in a session — a large
+// file like DG2 (face image) needs dozens, so the tag is regularly lost
+// mid-read. The session itself can be re-established with
+// restartTechnologyRequestIOS() WITHOUT losing our PACE/BAC secure-messaging
+// state (keys + send-sequence-counter live in our JS wrapper), so a lost-tag
+// transmit can recover by restarting the session and re-issuing the SAME APDU
+// (idempotent — a failed read advances no SM state, and the caller rewinds the
+// SSC). See react-native-nfc-manager#358.
+const IOS_MAX_RECONNECTS = 3;
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+const isTagLostError = (e: unknown): boolean => {
+  const msg = (
+    e instanceof Error ? e.message : typeof e === 'string' ? e : ''
+  ).toLowerCase();
+  // The native bridge surfaces these for a dropped/timed-out CoreNFC session;
+  // an empty message is also treated as a lost tag (the observed DG2 failure).
+  return (
+    msg === '' ||
+    msg.includes('lost') ||
+    msg.includes('not connected') ||
+    msg.includes('tag was') ||
+    msg.includes('session') ||
+    msg.includes('invalidated') ||
+    msg.includes('timeout') ||
+    msg.includes('100')
+  );
+};
+
 export class NFCManagerCardService extends CardService {
   private isOpened = false;
   public async open(): Promise<void> {
@@ -24,29 +54,77 @@ export class NFCManagerCardService extends CardService {
     return this.isOpened;
   }
 
+  // Session-restart recovery is SAFE only for idempotent data-group reads, NOT
+  // during PACE/BAC: the authentication state machine lives on the chip, so
+  // restarting the CoreNFC session mid-handshake destroys it ("Not even
+  // registered"). The reader turns this on AFTER authentication succeeds.
+  private sessionRestartEnabled = false;
+
+  public setSessionRestartEnabled(enabled: boolean): void {
+    this.sessionRestartEnabled = enabled;
+  }
+
   public async transmit(commandAPDU: CommandAPDU): Promise<ResponseAPDU> {
-    let response: number[];
+    const bytes = Array.from(commandAPDU.getBytes());
 
-    if (Platform.OS === 'ios') {
-      const iosResponse = await NFCManager.sendCommandAPDUIOS(
-        Array.from(commandAPDU.getBytes())
-      );
-      response = [...iosResponse.response, iosResponse.sw1, iosResponse.sw2];
-    } else {
-      response = await NFCManager.transceive(
-        Array.from(commandAPDU.getBytes())
-      );
+    if (Platform.OS !== 'ios') {
+      return new ResponseAPDU(await NFCManager.transceive(bytes));
+    }
+
+    // During auth (restart disabled) just send once — never restart mid-PACE.
+    if (!this.sessionRestartEnabled) {
+      const r = await NFCManager.sendCommandAPDUIOS(bytes);
+      return new ResponseAPDU([...r.response, r.sw1, r.sw2]);
     }
 
-    return new ResponseAPDU(response);
+    // Post-auth data reads: on a lost-tag error restart the CoreNFC session and
+    // retry the same command (secure-messaging state is preserved by the caller).
+    let lastError: unknown;
+    for (let attempt = 0; attempt <= IOS_MAX_RECONNECTS; attempt++) {
+      try {
+        const r = await NFCManager.sendCommandAPDUIOS(bytes);
+        return new ResponseAPDU([...r.response, r.sw1, r.sw2]);
+      } catch (e) {
+        lastError = e;
+        if (attempt >= IOS_MAX_RECONNECTS || !isTagLostError(e)) {
+          throw e;
+        }
+        // Re-establish the session, then pause briefly so the RF field settles
+        // before re-issuing (immediate re-send after a drop usually fails again).
+        try {
+          await NFCManager.restartTechnologyRequestIOS();
+        } catch {
+          // If restart itself fails the session is unrecoverable for now —
+          // surface the original lost-tag error to the caller.
+          throw e;
+        }
+        await sleep(150 * (attempt + 1));
+      }
+    }
+    throw lastError;
   }
 
   public getATR(): Uint8Array {
     throw new Error('Method not implemented.');
   }
 
-  public getIsConnectionLost(_error: Error): boolean {
-    return !this.isOpened;
+  public getIsConnectionLost(error: Error): boolean {
+    // Lost if the session was closed, or the error looks like a dropped tag.
+    return !this.isOpened || isTagLostError(error);
+  }
+
+  /** True if the error looks like a dropped/timed-out CoreNFC tag connection
+   *  (as opposed to a real APDU/crypto failure). */
+  public isTagLost(error: unknown): boolean {
+    return isTagLostError(error);
+  }
+
+  /** Re-establish the CoreNFC session (iOS) so a fresh handshake can be retried
+   *  after a tag drop. No-op on Android. Best-effort. */
+  public async restartSession(): Promise<void> {
+    if (Platform.OS === 'ios') {
+      await NFCManager.restartTechnologyRequestIOS();
+    }
   }
 
   public async close(): Promise<void> {