@trustchex/react-native-sdk 1.488.0 → 1.490.1

package/ios/ImageDecoder/ImageDecoderModule.m

@@ -0,0 +1,12 @@
+#import <React/RCTBridgeModule.h>
+
+@interface RCT_EXTERN_MODULE(ImageDecoderModule, NSObject)
+
+// Decode a JPEG2000 (JP2) base64 string and re-encode it as JPEG base64.
+// iOS's <Image> cannot render an image/jp2 data URI, but ImageIO/UIImage
+// decodes JPEG2000 natively, so we round-trip it to JPEG here.
+RCT_EXTERN_METHOD(decodeJp2ToJpeg:(NSString *)base64Jp2
+                  resolver:(RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+
+@end

package/ios/ImageDecoder/ImageDecoderModule.swift

@@ -0,0 +1,43 @@
+import Foundation
+import React
+import UIKit
+import ImageIO
+
+/// Decodes images that React Native's <Image> cannot render directly on iOS.
+///
+/// The driving case is the passport chip portrait (DG2), which is frequently
+/// stored as JPEG2000 (image/jp2). Android's image pipeline decodes JP2 data
+/// URIs natively, but iOS's <Image> does not — so the chip photo shows as a
+/// placeholder on iOS. iOS's ImageIO *can* decode JPEG2000, so we round-trip
+/// the JP2 to JPEG here and hand back base64 the JS <Image> can render.
+@objc(ImageDecoderModule)
+class ImageDecoderModule: NSObject {
+
+    @objc
+    static func requiresMainQueueSetup() -> Bool {
+        return false
+    }
+
+    @objc
+    func decodeJp2ToJpeg(_ base64Jp2: String,
+                         resolver resolve: @escaping RCTPromiseResolveBlock,
+                         rejecter reject: @escaping RCTPromiseRejectBlock) {
+        guard let jp2Data = Data(base64Encoded: base64Jp2) else {
+            reject("INVALID_BASE64", "Could not decode base64 JP2 input", nil)
+            return
+        }
+
+        // ImageIO decodes JPEG2000 on iOS even though <Image> won't render it.
+        guard let image = UIImage(data: jp2Data) else {
+            reject("DECODE_FAILED", "ImageIO could not decode the JP2 data", nil)
+            return
+        }
+
+        guard let jpegData = image.jpegData(compressionQuality: 0.95) else {
+            reject("ENCODE_FAILED", "Could not re-encode decoded image as JPEG", nil)
+            return
+        }
+
+        resolve(jpegData.base64EncodedString())
+    }
+}

package/lib/module/Screens/Static/ResultScreen.js

@@ -762,6 +762,7 @@ const ResultScreen = () => {
             },
             children: t('resultScreen.demoStartOver')
           }), /*#__PURE__*/_jsx(DiagnosticReportButton, {
+            baseUrl: appContext.baseUrl,
             sessionId: appContext.identificationInfo?.sessionId,
             scan: {
               documentType: appContext.identificationInfo?.scannedDocument?.documentType,

package/lib/module/Shared/Components/DiagnosticReportButton.js

@@ -4,36 +4,34 @@ import React, { useState } from 'react';
 import { Alert } from 'react-native';
 import { useTranslation } from 'react-i18next';
 import StyledButton from "./StyledButton.js";
-import { sendDiagnosticReport, isDiagnosticSharingAvailable } from "../Libs/sendDiagnosticReport.js";
+import { sendDiagnosticReport } from "../Libs/sendDiagnosticReport.js";
 import { SDK_VERSION } from "../../version.js";
 import { jsx as _jsx } from "react/jsx-runtime";
 /**
  * "Report a scanning issue" button for the result screen.
  *
- * Shows a brief notice describing what will be shared (the draft itself is the
- * user's review/consent step), then opens the OS share sheet — the user picks
- * email / WhatsApp / Drive / etc. and sends the diagnostic bundle to support.
- * Self-contained so the result screen only needs to render it with the scan
- * data + captured images.
+ * Shows a brief notice describing what will be shared (acting as the user's
+ * consent step), then uploads the diagnostic bundle (technical signals +
+ * scanned data + captured images) to the backend, encrypted in transit and at
+ * rest. Operators view and download the reports from the dashboard.
+ *
+ * Hidden when there's no session/baseUrl to upload to (e.g. before init).
  */
 const DiagnosticReportButton = ({
-  scan,
+  baseUrl,
   sessionId,
+  scan,
   images
 }) => {
   const {
     t
   } = useTranslation();
   const [sending, setSending] = useState(false);
-
-  // `react-native-share` is optional — hide the button entirely when the host
-  // app hasn't installed it, so apps that don't want diagnostics see no UI.
-  if (!isDiagnosticSharingAvailable()) {
+  if (!baseUrl || !sessionId) {
     return null;
   }
   const onPress = () => {
     if (sending) return;
-    // Brief notice — the share draft is the actual review/consent step.
     Alert.alert(t('diagnosticReport.noticeTitle'), t('diagnosticReport.noticeBody'), [{
       text: t('diagnosticReport.cancel'),
       style: 'cancel'
@@ -42,12 +40,16 @@ const DiagnosticReportButton = ({
       onPress: async () => {
         setSending(true);
         try {
-          await sendDiagnosticReport({
+          const {
+            uploaded
+          } = await sendDiagnosticReport({
+            baseUrl,
+            sessionId,
             scan,
             sdkVersion: SDK_VERSION,
-            sessionId,
             images
           });
+          Alert.alert(uploaded ? t('diagnosticReport.sentTitle') : t('diagnosticReport.failedTitle'), uploaded ? t('diagnosticReport.sentBody') : t('diagnosticReport.failedBody'));
         } finally {
           setSending(false);
         }

package/lib/module/Shared/Components/EIDScanner.js

@@ -418,7 +418,11 @@ const EIDScanner = ({
               style: styles.idCardPhotoContainer,
               children: /*#__PURE__*/_jsx(View, {
                 style: styles.idCardPhotoFrame,
-                children: documentFaceImage && (documentFaceImageMimeType === 'image/jpeg' || documentFaceImageMimeType === 'image/png') ? /*#__PURE__*/_jsx(Image, {
+                children: documentFaceImage && (documentFaceImageMimeType === 'image/jpeg' || documentFaceImageMimeType === 'image/png' ||
+                // Android's <Image> decodes a raw JP2 data URI; on iOS
+                // the chip JP2 is converted to JPEG before this point
+                // (native ImageIO), so iOS never reaches here as jp2.
+                documentFaceImageMimeType === 'image/jp2') ? /*#__PURE__*/_jsx(Image, {
                   source: {
                     uri: `data:${documentFaceImageMimeType};base64,${documentFaceImage}`
                   },

package/lib/module/Shared/Components/IdentityDocumentCamera.flows.js

@@ -261,12 +261,32 @@ export function handleIDBackFlow(mrzText, mrzFields, mrzValid, mrzStableAndValid
  *
  * PASSPORT: → COMPLETED (no back side)
  * ID CARD: → SCAN_ID_BACK
+ *
+ * Routing is PASSPORT-BIASED on purpose: a passport has no back side, so if we
+ * route it to SCAN_ID_BACK it deadlocks forever waiting for a back that will
+ * never appear. We therefore only go to SCAN_ID_BACK when there is POSITIVE
+ * evidence the document is an ID card (a parsed MRZ document code that is
+ * present and not 'P'). When the type is ambiguous — e.g. the passport MRZ was
+ * never read as 'P' so the front step locked `detectedDocumentType` as
+ * 'ID_FRONT' (the torch/tilt during hologram capture makes the MRZ unreadable),
+ * or no MRZ code survived at all — we COMPLETE rather than wait for a
+ * non-existent back side. A two-sided ID card always yields an 'I'/'A'/'C'
+ * (non-'P') MRZ code, so genuine ID cards still route to SCAN_ID_BACK.
  */
 export function getNextStepAfterHologram(detectedDocumentType, currentFrameDocType, mrzDocCode) {
-  // Check multiple sources to determine if it's a passport
+  // Any positive passport signal → done (no back side).
   const isPassport = detectedDocumentType === 'PASSPORT' || currentFrameDocType === 'PASSPORT' || mrzDocCode === 'P';
   if (isPassport) {
     return 'COMPLETED';
   }
-  return 'SCAN_ID_BACK';
+
+  // Only continue to the back side when we have POSITIVE proof it's an ID card:
+  // a real MRZ document code that is present and not a passport. Without that
+  // proof, default to COMPLETED so a misclassified passport can't hang waiting
+  // for a back side that doesn't exist.
+  const hasIdCardMrzCode = !!mrzDocCode && mrzDocCode !== 'P';
+  if (hasIdCardMrzCode) {
+    return 'SCAN_ID_BACK';
+  }
+  return 'COMPLETED';
 }

package/lib/module/Shared/Components/IdentityDocumentCamera.js

@@ -1799,7 +1799,7 @@ const IdentityDocumentCamera = ({
           status === 'SCANNING' && allElementsDetected && elementsOutsideScanArea.length === 0 && !isBrightnessLow && !isFrameBlurry && styles.topZoneTextScanning
           // 5. Default (white) - aligning (not all detected OR elements outside scan area)
           ],
-          children: getStatusMessage(nextStep, status, detectedDocumentType, isBrightnessLow, isFrameBlurry, allElementsDetected, elementsOutsideScanArea, t, mrzReliable)
+          children: getStatusMessage(nextStep, status, detectedDocumentType, isBrightnessLow, isFrameBlurry, allElementsDetected, elementsOutsideScanArea, t)
         })]
       }), /*#__PURE__*/_jsx(View, {
         style: styles.leftZone

package/lib/module/Shared/Components/IdentityDocumentCamera.utils.js

@@ -78,17 +78,17 @@ export function transformBoundsToScreen(bounds, scale, offsetX, offsetY) {
  * Unified status message logic used by both voice guidance and render text.
  * Returns the appropriate i18n key arguments for the current scan state.
  */
-export function getStatusMessage(nextStep, status, detectedDocumentType, isBrightnessLow, isFrameBlurry, allElementsDetected, elementsOutsideScanArea, t, mrzReliable = false) {
+export function getStatusMessage(nextStep, status, detectedDocumentType, isBrightnessLow, isFrameBlurry, allElementsDetected, elementsOutsideScanArea, t) {
   if (nextStep === 'COMPLETED') {
     return t('identityDocumentCamera.scanCompleted');
   }
 
-  // MRZ reliably detected (stable consensus) — the green "GO" message. Ranks
-  // above the in-progress states so the user gets a clear positive signal the
-  // moment the reading has settled, but never on an early/transient valid read.
-  if (mrzReliable) {
-    return t('identityDocumentCamera.mrzDetected');
-  }
+  // NOTE: the "MRZ detected — hold steady" message was intentionally removed
+  // (along with its former `mrzReliable` parameter). User-facing guidance
+  // should only describe the SCAN STEP (front side, back side, hologram, etc.),
+  // not low-level MRZ-detection state. We fall through to the step-specific
+  // messages below.
+
   if (status === 'INCORRECT') {
     if (nextStep === 'SCAN_ID_FRONT_OR_PASSPORT') {
       return t('identityDocumentCamera.alignIDFront');

package/lib/module/Shared/EIDReader/eidReader.js

@@ -12,6 +12,7 @@ import { Buffer } from 'buffer';
 import { InputStream } from "./java/inputStream.js";
 import { debugLog } from "../Libs/debug.utils.js";
 import { diagnostics } from "../Libs/diagnostics.js";
+import { decodeJp2ToJpeg } from "../Libs/jp2Decode.js";
 
 /**
  * Extract an APDU status word (hex, e.g. "6982") from an error message if the
@@ -220,7 +221,7 @@ function pixelsToPng(pixels, width, height, channels) {
 // conversion" hang. A JS timeout cannot interrupt a synchronous call, so we must
 // gate BEFORE decoding. ~12 KB decodes fast; beyond that we keep the raw JP2.
 const MAX_JP2_DECODE_BYTES = 12 * 1024;
-function convertJP2IfNeeded(imageBuffer, mimeType) {
+async function convertJP2IfNeeded(imageBuffer, mimeType) {
   if (mimeType !== 'image/jp2') {
     return {
       base64: imageBuffer.toString('base64'),
@@ -228,10 +229,21 @@ function convertJP2IfNeeded(imageBuffer, mimeType) {
     };
   }
 
+  // Prefer the native decoder (iOS ImageIO). It decodes JPEG2000 of any size
+  // without blocking the JS thread, so it both fixes the iOS preview (RN's
+  // <Image> can't render a raw image/jp2 data URI) and avoids the slow pure-JS
+  // decoder entirely. Returns null on Android / when unavailable → fall through.
+  const native = await decodeJp2ToJpeg(imageBuffer);
+  if (native) {
+    debugLog('EID', `[EID] JP2 decoded natively → ${native.mimeType} (${native.base64.length} base64 chars)`);
+    return native;
+  }
+
   // Too large to decode synchronously without freezing the UI — keep the raw
   // JP2. The face image is still captured (the verification backend / face-match
   // accept JPEG2000); only the on-screen preview can't render it. This lets the
-  // NFC read COMPLETE instead of hanging.
+  // NFC read COMPLETE instead of hanging. (On Android the raw JP2 still renders
+  // in <Image>; on iOS the native path above normally handles it.)
   if (imageBuffer.length > MAX_JP2_DECODE_BYTES) {
     debugLog('EID', `[EID] JP2 face image is ${imageBuffer.length} bytes (> ${MAX_JP2_DECODE_BYTES}); skipping in-JS decode to avoid blocking, keeping raw JP2`);
     return {
@@ -642,7 +654,7 @@ const eidReader = async (documentNumber, dateOfBirth, dateOfExpiry, progressCall
       const buffer = Buffer.alloc(imageLength);
       await imageInputStream.readBytesWithOffset(buffer, 0, imageLength);
       const rawMimeType = faceImageInfo.getMimeType();
-      const converted = convertJP2IfNeeded(buffer, rawMimeType);
+      const converted = await convertJP2IfNeeded(buffer, rawMimeType);
       imageAsBase64 = converted.base64;
       mimeType = converted.mimeType;
     }

package/lib/module/Shared/Libs/diagnosticAuth.js

@@ -0,0 +1,36 @@
+"use strict";
+
+import { Buffer } from 'buffer';
+import { hmac } from '@noble/hashes/hmac';
+import { sha256 } from '@noble/hashes/sha2';
+
+/**
+ * Authenticity signing for the demo-diagnostics upload.
+ *
+ * Demo reports have no session/account to authenticate against, so the SDK signs
+ * each upload with HMAC-SHA256 over `timestamp.nonce.rawBody` using a shared
+ * secret. The backend recomputes and rejects mismatches and stale timestamps
+ * (replay). The secret ships in the SDK, so it's an obfuscation barrier (paired
+ * with server rate limiting), not a true secret — rotate via the env var on both
+ * sides. MUST stay byte-for-byte in sync with web-app/src/lib/diagnostic-hmac.ts.
+ */
+const SECRET = process.env.TRUSTCHEX_DIAGNOSTICS_SECRET ?? 'tcx-diag-v1-2f9c4a7e8b1d4f63a05e9c7b3d61f8a2';
+const randomNonce = () => {
+  // 16 random bytes as hex. crypto.getRandomValues is polyfilled by
+  // react-native-get-random-values (already imported in crypto.utils).
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  return Buffer.from(bytes).toString('hex');
+};
+
+/** Sign a raw JSON body for the demo-diagnostics endpoint. */
+export const signDiagnosticBody = rawBody => {
+  const timestamp = Date.now().toString();
+  const nonce = randomNonce();
+  const mac = hmac(sha256, Buffer.from(SECRET, 'utf-8'), Buffer.from(`${timestamp}.${nonce}.${rawBody}`, 'utf-8'));
+  return {
+    timestamp,
+    nonce,
+    signature: Buffer.from(mac).toString('hex')
+  };
+};

package/lib/module/Shared/Libs/jp2Decode.js

@@ -0,0 +1,43 @@
+"use strict";
+
+import { NativeModules, Platform } from 'react-native';
+
+/**
+ * Native JPEG2000 decoder bridge.
+ *
+ * The passport chip portrait (DG2) is frequently stored as JPEG2000
+ * (image/jp2). React Native's <Image> renders a JP2 data URI on Android (its
+ * Fresco/Skia pipeline decodes it) but NOT on iOS (UIImage-backed <Image>
+ * refuses the data URI), so the chip photo showed as a placeholder on iOS.
+ *
+ * iOS's ImageIO *can* decode JPEG2000, so the native `ImageDecoderModule`
+ * round-trips the JP2 to JPEG. We only need this on iOS; on Android the raw
+ * JP2 already renders, so there is no native counterpart and we no-op.
+ */
+
+const ImageDecoder = NativeModules.ImageDecoderModule;
+
+/**
+ * Decode a JPEG2000 buffer to JPEG using the native iOS decoder.
+ *
+ * Returns the JPEG bytes + mime type on success, or null when native decode is
+ * unavailable (Android, or the module isn't linked) or fails — callers should
+ * fall back to their existing behaviour (keep raw JP2).
+ */
+export async function decodeJp2ToJpeg(jp2Buffer) {
+  if (Platform.OS !== 'ios' || !ImageDecoder?.decodeJp2ToJpeg) {
+    return null;
+  }
+  try {
+    const jpegBase64 = await ImageDecoder.decodeJp2ToJpeg(jp2Buffer.toString('base64'));
+    if (!jpegBase64) {
+      return null;
+    }
+    return {
+      base64: jpegBase64,
+      mimeType: 'image/jpeg'
+    };
+  } catch {
+    return null;
+  }
+}

package/lib/module/Shared/Libs/sendDiagnosticReport.js

@@ -1,130 +1,110 @@
 "use strict";
 
 /**
- * Assembles and shares the support diagnostic report.
+ * Assembles and uploads the support diagnostic report to the backend.
  *
- * `react-native-share` is an OPTIONAL dependency: the host app opts into the
- * diagnostic feature by installing it. When it's present we open the OS share
- * sheet with the full report (the user picks email / WhatsApp / Drive / etc. and
- * reviews before sending); when it's absent the feature is silently unavailable
- * — `isDiagnosticSharingAvailable()` returns false and the result-screen button
- * renders nothing, so apps that don't want it incur no dependency.
+ * This runs from the SDK's DEMO flow only, which is simulated client-side and
+ * has no real verification session or account — so there's no session key to
+ * encrypt with and nothing to authenticate against. The report is POSTed
+ * unauthenticated to the global demo-diagnostics endpoint over HTTPS (encrypted
+ * in transit); the backend encrypts the PII fields at rest. Internal developers
+ * view and download the reports from a hidden dashboard page.
  *
- * Attached files (staged to a temp dir via react-native-fs, already an SDK dep):
- *  - `diagnostics.json` — technical signals (device, camera, MRZ, NFC steps),
- *  - `scan-data.json`   — the scanned identity data (PII; user reviews it),
- *  - the captured document/face images.
- *
- * The readable summary rides as the share `message` so it's visible in the
- * draft regardless of the chosen app.
+ * Uploaded payload (one JSON body):
+ *  - non-PII technical metadata (platform, sdkVersion, documentType,
+ *    nfcErrorCode, paceFallbackReason, succeeded) for the list/filter,
+ *  - `diagnosticsJson` — technical signals (device, camera, MRZ, NFC steps),
+ *  - `scanDataJson`   — the scanned identity data (PII),
+ *  - `images`         — the captured document/face images (base64, PII).
  */
-import RNFS from 'react-native-fs';
+import 'react-native-get-random-values';
 import { diagnostics } from "./diagnostics.js";
 import { gatherDeviceDetails } from "./native-device-info.utils.js";
 import { buildDiagnosticReport } from "./diagnosticReport.js";
+import { signDiagnosticBody } from "./diagnosticAuth.js";
 import { logError } from "./debug.utils.js";
-
-// `react-native-share` is OPTIONAL. Load it softly so the SDK bundles and runs
-// without it; only host apps that installed it get the diagnostic feature. A
-// static `import` would make Metro fail to resolve the module when it's absent,
-// so we use a guarded require and keep the reference typed loosely.
-
-let shareModule;
-const loadShare = () => {
-  if (shareModule !== undefined) return shareModule;
-  try {
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const mod = require('react-native-share');
-    shareModule = mod?.default ?? mod;
-  } catch {
-    shareModule = null; // not installed — feature unavailable
-  }
-  return shareModule;
-};
+const mimeToType = mime => mime === 'png' ? 'image/png' : 'image/jpeg';
 
 /**
- * Whether diagnostic sharing is available (i.e. `react-native-share` is
- * installed in the host app). The result-screen button hides itself when false.
- */
-export const isDiagnosticSharingAvailable = () => loadShare() != null;
-const writeTemp = async (dir, name, data, encoding) => {
-  const path = `${dir}/${name}`;
-  await RNFS.writeFile(path, data, encoding);
-  return path.startsWith('file://') ? path : `file://${path}`;
-};
-/**
- * Build the report, stage attachments, and present the share sheet. Returns
- * { shared } — false on error, with `dismissed` set when the user cancelled.
+ * Build the report and upload it (over HTTPS) to the demo-diagnostics endpoint.
+ * Returns { uploaded } — false on any error (best-effort; a failed report must
+ * never disrupt the user's flow).
  */
 export const sendDiagnosticReport = async params => {
-  const share = loadShare();
-  if (!share) {
-    // Optional dependency not installed — nothing to do.
-    return {
-      shared: false
-    };
-  }
   const {
+    baseUrl,
+    sessionId,
     scan,
     sdkVersion,
-    sessionId,
     images = []
   } = params;
+  if (!baseUrl) {
+    return {
+      uploaded: false
+    };
+  }
   const now = Date.now();
   const iso = new Date(now).toISOString();
-  const device = await gatherDeviceDetails();
-  const report = buildDiagnosticReport({
-    diag: diagnostics.snapshot(now, iso),
-    device,
-    scan,
-    sdkVersion,
-    sessionId
-  });
-  const dir = `${RNFS.TemporaryDirectoryPath}/trustchex-diagnostics-${now}`;
   try {
-    await RNFS.mkdir(dir);
-    const urls = [];
-    urls.push(await writeTemp(dir, 'diagnostics.json', report.diagnosticsJson, 'utf8'));
-    urls.push(await writeTemp(dir, 'scan-data.json', report.scanDataJson, 'utf8'));
-    for (const img of images) {
-      if (!img.base64) continue;
-      urls.push(await writeTemp(dir, `${img.name}.${img.mime}`, img.base64, 'base64'));
-    }
-    try {
-      await share.open({
-        title: report.subject,
-        subject: report.subject,
-        // used by email targets
-        message: report.body,
-        urls,
-        // Per-file MIME types so targets render attachments correctly.
-        filenames: urls.map(u => u.split('/').pop() ?? 'attachment'),
-        failOnCancel: false
-      });
-      return {
-        shared: true
-      };
-    } catch (shareErr) {
-      // react-native-share throws on user cancel unless failOnCancel:false; treat
-      // a cancel as a non-error dismissal.
-      const msg = shareErr instanceof Error ? shareErr.message : String(shareErr);
-      if (/cancel|dismiss|user did not share/i.test(msg)) {
-        return {
-          shared: false,
-          dismissed: true
-        };
-      }
-      throw shareErr;
-    }
+    const device = await gatherDeviceDetails();
+    const snapshot = diagnostics.snapshot(now, iso);
+    const report = buildDiagnosticReport({
+      diag: snapshot,
+      device,
+      scan,
+      sdkVersion,
+      sessionId
+    });
+
+    // Queryable, non-PII technical metadata for the dashboard list/filter.
+    const nfc = snapshot.nfc;
+    const failingSw = nfc.failureStep ? nfc.steps.find(s => s.step === nfc.failureStep && !s.ok)?.sw : undefined;
+    const nfcErrorCode = nfc.attempted && !nfc.succeeded ? `NFC-${(nfc.errorCategory ?? 'reading_error').toUpperCase()}${failingSw ? `-${failingSw}` : ''}` : null;
+    const payload = {
+      // metadata (stored in plaintext, no PII)
+      platform: device.platform,
+      osVersion: device.systemVersion,
+      sdkVersion,
+      documentType: scan.documentType ?? snapshot.documentType ?? null,
+      dataSource: scan.dataSource ?? snapshot.dataSource ?? null,
+      nfcErrorCode,
+      paceFallbackReason: nfc.paceFallbackReason ?? null,
+      succeeded: nfc.attempted ? nfc.succeeded : null,
+      // full report (PII, encrypted at rest by the backend)
+      diagnosticsJson: report.diagnosticsJson,
+      scanDataJson: report.scanDataJson,
+      images: images.filter(img => img.base64).map(img => ({
+        name: img.name,
+        base64: img.base64,
+        mimeType: mimeToType(img.mime)
+      }))
+    };
+
+    // Sign the EXACT body bytes so the backend can verify authenticity. Use
+    // fetch directly (httpClient doesn't expose custom headers / raw body).
+    const rawBody = JSON.stringify(payload);
+    const {
+      timestamp,
+      nonce,
+      signature
+    } = signDiagnosticBody(rawBody);
+    const response = await fetch(`${baseUrl}/api/app/mobile/diagnostics`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Trustchex-Timestamp': timestamp,
+        'X-Trustchex-Nonce': nonce,
+        'X-Trustchex-Signature': signature
+      },
+      body: rawBody
+    });
+    return {
+      uploaded: response.ok
+    };
   } catch (e) {
-    logError('Diagnostics', 'Failed to share diagnostic report', e instanceof Error ? e.message : String(e));
+    logError('Diagnostics', 'Failed to upload diagnostic report', e instanceof Error ? e.message : String(e));
     return {
-      shared: false
+      uploaded: false
     };
-  } finally {
-    // Best-effort cleanup — temp files are short-lived.
-    setTimeout(() => {
-      RNFS.unlink(dir).catch(() => {});
-    }, 60_000);
   }
 };

package/lib/module/Translation/Resources/en.js

@@ -46,15 +46,14 @@ export default {
   'resultScreen.demoVerbalConsentText': 'Text',
   'resultScreen.demoStartOver': 'Start Over',
   'diagnosticReport.button': 'Report a scanning issue',
-  'diagnosticReport.noticeTitle': 'Share diagnostic report',
-  'diagnosticReport.noticeBody': 'This opens a draft with your scan data, document images and technical details so support can help resolve a scanning issue. Review it before sending.',
+  'diagnosticReport.noticeTitle': 'Report a scanning issue',
+  'diagnosticReport.noticeBody': 'This sends your scan data, document images and technical details to support so they can help resolve a scanning issue.',
   'diagnosticReport.continue': 'Continue',
   'diagnosticReport.cancel': 'Cancel',
-  'diagnosticReport.shareFailedTitle': "Couldn't open the share sheet",
-  'diagnosticReport.shareFailedBody': "We couldn't attach the report to share. Send it securely to support instead?",
-  'diagnosticReport.uploadAction': 'Send to support',
-  'diagnosticReport.uploadSuccess': 'Diagnostic report sent to support.',
-  'diagnosticReport.uploadFailed': "Couldn't send the report. Please try again later.",
+  'diagnosticReport.sentTitle': 'Report sent',
+  'diagnosticReport.sentBody': 'Your diagnostic report was sent to support. Thank you.',
+  'diagnosticReport.failedTitle': "Couldn't send the report",
+  'diagnosticReport.failedBody': 'Please try again later.',
   'livenessDetectionScreen.guideHeader': 'Face Verification',
   'livenessDetectionScreen.guideText': 'Please ensure the following for best results:',
   'livenessDetectionScreen.guidePoint1': 'Remove glasses, hats, or face coverings',

package/lib/module/Translation/Resources/tr.js

@@ -46,15 +46,14 @@ export default {
   'resultScreen.demoVerbalConsentText': 'Metin',
   'resultScreen.demoStartOver': 'Baştan Başla',
   'diagnosticReport.button': 'Tarama sorununu bildir',
-  'diagnosticReport.noticeTitle': 'Tanılama raporu paylaş',
-  'diagnosticReport.noticeBody': 'Bu işlem; tarama verilerinizi, belge görüntülerinizi ve teknik ayrıntıları içeren bir taslak açar; böylece destek ekibi tarama sorununu çözebilir. Göndermeden önce gözden geçirin.',
+  'diagnosticReport.noticeTitle': 'Tarama sorununu bildir',
+  'diagnosticReport.noticeBody': 'Bu işlem; tarama verilerinizi, belge görüntülerinizi ve teknik ayrıntıları destek ekibine gönderir; böylece tarama sorununu çözebilirler.',
   'diagnosticReport.continue': 'Devam et',
   'diagnosticReport.cancel': 'İptal',
-  'diagnosticReport.shareFailedTitle': 'Paylaşım ekranı açılamadı',
-  'diagnosticReport.shareFailedBody': 'Raporu paylaşmak için ekleyemedik. Bunun yerine destek ekibine güvenli şekilde gönderelim mi?',
-  'diagnosticReport.uploadAction': 'Desteğe gönder',
-  'diagnosticReport.uploadSuccess': 'Tanılama raporu destek ekibine gönderildi.',
-  'diagnosticReport.uploadFailed': 'Rapor gönderilemedi. Lütfen daha sonra tekrar deneyin.',
+  'diagnosticReport.sentTitle': 'Rapor gönderildi',
+  'diagnosticReport.sentBody': 'Tanılama raporunuz destek ekibine gönderildi. Teşekkürler.',
+  'diagnosticReport.failedTitle': 'Rapor gönderilemedi',
+  'diagnosticReport.failedBody': 'Lütfen daha sonra tekrar deneyin.',
   'livenessDetectionScreen.guideHeader': 'Yüz Doğrulaması',
   'livenessDetectionScreen.guideText': 'En iyi sonuç için lütfen şunları sağlayın:',
   'livenessDetectionScreen.guidePoint1': 'Gözlük, şapka veya yüz aksesuarlarını çıkarın',

package/lib/module/version.js

@@ -2,4 +2,4 @@
 
 // This file is auto-generated. Do not edit manually.
 // Version is synced from package.json during build.
-export const SDK_VERSION = '1.488.0';
+export const SDK_VERSION = '1.490.1';

package/lib/typescript/src/Screens/Static/ResultScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResultScreen.d.ts","sourceRoot":"","sources":["../../../../../src/Screens/Static/ResultScreen.tsx"],"names":[],"mappings":"AA8EA,QAAA,MAAM,YAAY,+CAyhCjB,CAAC;AA+IF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"ResultScreen.d.ts","sourceRoot":"","sources":["../../../../../src/Screens/Static/ResultScreen.tsx"],"names":[],"mappings":"AA8EA,QAAA,MAAM,YAAY,+CA0hCjB,CAAC;AA+IF,eAAe,YAAY,CAAC"}