@trustchex/react-native-sdk 1.495.10 → 1.495.12

package/src/Shared/Components/IdentityDocumentCamera.flows.ts

@@ -28,10 +28,17 @@
  *   - No face, has MRZ with code 'I'
  */
 
-import type { Face } from './IdentityDocumentCamera.types';
+import type { Face, DocumentType } from './IdentityDocumentCamera.types';
 import type { MRZFields } from '../Types/mrzFields';
-import { PASSPORT_MRZ_PATTERN } from './IdentityDocumentCamera.constants';
-import { isIDCardDocumentCode } from './IdentityDocumentCamera.utils';
+import {
+  PASSPORT_MRZ_PATTERN,
+  MRZ_DENSE_PATTERN,
+} from './IdentityDocumentCamera.constants';
+import {
+  isIDCardDocumentCode,
+  isPassportDocumentCode,
+  documentHasBackSide,
+} from './IdentityDocumentCamera.utils';
 
 /**
  * After this many retry attempts for ID_FRONT flow, proceed with face detection alone
@@ -54,6 +61,7 @@ export interface IDFrontFlowResult {
   reason?: string;
   nextAction?:
     | 'WAIT_FOR_ELEMENTS'
+    | 'WAIT_FOR_MRZ'
     | 'REJECT_AS_PASSPORT'
     | 'PROCEED_TO_HOLOGRAM';
 }
@@ -183,8 +191,17 @@ export function handleIDFrontFlow(
     };
   }
 
-  if (mrzText && PASSPORT_MRZ_PATTERN.test(mrzText)) {
-    // Passport MRZ pattern visible even if not fully parsed
+  // Passport MRZ pattern visible even if not fully parsed. Check BOTH the
+  // parsed `mrzText` (null until the MRZ validates) AND the raw OCR `text` — a
+  // passport's MRZ is dense and frequently OCRs a few frames after its face +
+  // signature, so on the accepting frame `mrzText` is often still null while the
+  // raw `P<XXX...` run is already visible. Testing only `mrzText` (the old bug)
+  // let such a passport pass as an ID front and get routed to a back side that
+  // does not exist.
+  if (
+    (mrzText && PASSPORT_MRZ_PATTERN.test(mrzText)) ||
+    PASSPORT_MRZ_PATTERN.test(text)
+  ) {
     return {
       shouldProceed: false,
       reason: 'Passport MRZ pattern visible - not an ID card',
@@ -204,6 +221,39 @@ export function handleIDFrontFlow(
     };
   }
 
+  // ============================================================================
+  // STEP 2b: An ID-card FRONT has NO MRZ (the MRZ is on the back). So if a real
+  // MRZ is currently visible on this "front", it is almost certainly a passport
+  // data page whose 'P' code we just haven't parsed yet — do NOT accept it as an
+  // ID front; wait for the MRZ to resolve (→ a 'P' code routes it to the
+  // passport flow). This is the guard that stops a passport (face + signature +
+  // not-yet-parsed MRZ) being accepted as ID_FRONT and then getting stuck at
+  // SCAN_ID_BACK, which rejects the passport's photo page because it has a face.
+  //
+  // We use MRZ_DENSE_PATTERN (requires a `<<` filler run), NOT the loose
+  // MRZ_BLOCK_PATTERN — a card face has no MRZ, but a stray single `<` OCR'd
+  // from a guilloche could match the loose pattern and wedge a real ID front.
+  // We ALSO honor the signature retry threshold: a real ID front genuinely has
+  // no MRZ, so if a "dense MRZ" keeps matching frame after frame past the
+  // threshold it is OCR noise, not a passport — fall through and let STEP 3's
+  // face-only acceptance proceed rather than waiting forever.
+  const mrzVisibleOnFront = !!mrzText || MRZ_DENSE_PATTERN.test(text);
+  const stillWaitingForMrz = retryCount <= SIGNATURE_RETRY_THRESHOLD;
+  if (
+    mrzVisibleOnFront &&
+    stillWaitingForMrz &&
+    !isIDCardDocumentCode(mrzFields?.documentCode)
+  ) {
+    // An ID-card MRZ code (I/A/C) is allowed to proceed (handled in STEP 4); any
+    // other visible MRZ → keep waiting for it to parse and reveal a 'P' code.
+    return {
+      shouldProceed: false,
+      reason:
+        'MRZ block visible on front - waiting to confirm it is not a passport',
+      nextAction: 'WAIT_FOR_MRZ',
+    };
+  }
+
   // ============================================================================
   // STEP 3: Check for signature (optional front side confirmation)
   // ============================================================================
@@ -350,27 +400,34 @@ export function handleIDBackFlow(
 export function getNextStepAfterHologram(
   detectedDocumentType: 'ID_FRONT' | 'ID_BACK' | 'PASSPORT' | 'UNKNOWN',
   currentFrameDocType: 'ID_FRONT' | 'ID_BACK' | 'PASSPORT' | 'UNKNOWN',
-  mrzDocCode: string | undefined
+  mrzDocCode: string | undefined,
+  // True if a passport MRZ pattern / 'P' code was seen in ANY front frame this
+  // session — not just the accepting one. The passport MRZ is dense and often
+  // OCRs a few frames AFTER the face + signature, so a passport can get locked
+  // as ID_FRONT before its MRZ is read. Latching the signal across frames is
+  // what stops that passport from being wrongly routed to SCAN_ID_BACK here.
+  sawPassportSignal: boolean = false
 ): 'COMPLETED' | 'SCAN_ID_BACK' {
-  // Any positive passport signal → done (no back side).
+  // Resolve to a single document type, passport-biased: any positive passport
+  // signal wins (a passport must never wait for a back that does not exist),
+  // then positive ID-card evidence (a non-'P' MRZ code, or an ID_FRONT
+  // classification — an ID front legitimately has no MRZ, so the classification
+  // is the only signal we get), else UNKNOWN.
   const isPassport =
+    sawPassportSignal ||
     detectedDocumentType === 'PASSPORT' ||
     currentFrameDocType === 'PASSPORT' ||
-    mrzDocCode === 'P';
-
-  if (isPassport) {
-    return 'COMPLETED';
-  }
-
-  // Positive ID-card evidence → scan the back. Either a non-'P' MRZ code, or a
-  // front classified as ID_FRONT (an ID front legitimately has no MRZ, so the
-  // classification is the only signal we get).
-  const hasIdCardMrzCode = !!mrzDocCode && mrzDocCode !== 'P';
+    isPassportDocumentCode(mrzDocCode);
+  const hasIdCardMrzCode = !!mrzDocCode && !isPassportDocumentCode(mrzDocCode);
   const isIdFront =
     detectedDocumentType === 'ID_FRONT' || currentFrameDocType === 'ID_FRONT';
-  if (hasIdCardMrzCode || isIdFront) {
-    return 'SCAN_ID_BACK';
-  }
 
-  return 'COMPLETED';
+  const resolved: DocumentType = isPassport
+    ? 'PASSPORT'
+    : hasIdCardMrzCode || isIdFront
+      ? 'ID_FRONT'
+      : 'UNKNOWN';
+
+  // Single source of truth for "is there a back side left to scan?".
+  return documentHasBackSide(resolved) ? 'SCAN_ID_BACK' : 'COMPLETED';
 }

package/src/Shared/Components/IdentityDocumentCamera.tsx

@@ -47,6 +47,7 @@ import {
   areMRZFieldsEqual,
   hasRequiredMRZFields,
   validateFacePosition,
+  isPassportDocumentCode,
 } from './IdentityDocumentCamera.utils';
 import {
   handlePassportFlow,
@@ -68,7 +69,6 @@ import {
   REQUIRED_CONSISTENT_DOCTYPE_DETECTIONS,
   SIGNATURE_TEXT_REGEX,
   MRZ_BLOCK_PATTERN,
-  PASSPORT_MRZ_PATTERN,
   MIN_CARD_FACE_SIZE_PERCENT,
 } from './IdentityDocumentCamera.constants';
 import type {
@@ -178,6 +178,15 @@ const IdentityDocumentCamera = ({
   >('UNKNOWN');
   const consistentDocTypeCount = useRef(0);
 
+  // Latches true the moment a passport MRZ pattern / 'P' document code is seen in
+  // ANY front frame this session. The passport MRZ is dense and often OCRs a few
+  // frames AFTER the face + signature, so without this a passport can be locked
+  // as ID_FRONT (which has no MRZ on its front) and then wrongly asked for a back
+  // side that does not exist. Once latched, the front is never accepted as
+  // ID_FRONT and the post-hologram routing always completes instead of scanning
+  // a back. Reset only when a brand-new scan session starts.
+  const sawPassportSignal = useRef(false);
+
   // Frame quality tracking - persist across callbacks
   const lastFrameQuality = useRef({
     hasAcceptableQuality: true,
@@ -325,6 +334,7 @@ const IdentityDocumentCamera = ({
       lastValidMRZText.current = null;
       lastValidMRZFields.current = null;
       validMRZConsecutiveCount.current = 0;
+      sawPassportSignal.current = false;
       mrzAggregator.current.reset();
       setMrzReliable(false);
       // Start a fresh diagnostics session for the support report.
@@ -666,6 +676,15 @@ const IdentityDocumentCamera = ({
 
       // Reset MRZ retry counter for each new step so retries start fresh
       mrzDetectionCurrentRetryCount.current = 0;
+      // A transition back to the initial front step means a brand-new document
+      // scan is starting, so the sticky passport signal from any previous
+      // document must NOT carry over — otherwise an ID card scanned after a
+      // passport (without the camera unfocusing) would be forced into the
+      // passport flow and skip its back side. (The focus-based reset above only
+      // fires when the camera goes inactive.)
+      if (nextStepType === 'SCAN_ID_FRONT_OR_PASSPORT') {
+        sawPassportSignal.current = false;
+      }
       // Only clear MRZ text when entering SCAN_ID_BACK (new MRZ expected).
       // Preserve across SCAN_HOLOGRAM so passport completion has MRZ data.
       if (nextStepType === 'SCAN_ID_BACK') {
@@ -1149,7 +1168,9 @@ const IdentityDocumentCamera = ({
       // Surface the reliable-detection signal to the render so the UI can show a
       // green "GO" the moment (and only once) the consensus is stable + valid.
       // Never flips green on an early/transient valid read.
-      setMrzReliable((prev) => (prev === mrzStableAndValid ? prev : mrzStableAndValid));
+      setMrzReliable((prev) =>
+        prev === mrzStableAndValid ? prev : mrzStableAndValid
+      );
 
       // Test-mode panel: show the MRZ ONLY once it is stable + valid (the same
       // consensus matched across `stabilityTarget` consecutive frames). Showing
@@ -1159,9 +1180,7 @@ const IdentityDocumentCamera = ({
       // check-digit-valid consensus and never an unstable intermediate.
       if (testMode && mrzStableAndValid && mrzText) {
         setTestModeData((prev) =>
-          prev?.mrzText === mrzText
-            ? prev
-            : { mrzText, timestamp: Date.now() }
+          prev?.mrzText === mrzText ? prev : { mrzText, timestamp: Date.now() }
         );
       }
 
@@ -1174,30 +1193,42 @@ const IdentityDocumentCamera = ({
           const hasFaces = primaryFaces.length > 0;
           const hasSignature = /signature|imza|İmza/i.test(text);
           const hasPassportMRZ = parsedMRZData?.fields?.documentCode === 'P';
-          const hasPassportMRZPattern =
-            mrzText && PASSPORT_MRZ_PATTERN.test(mrzText);
-
-          if (
-            hasFaces ||
-            hasSignature ||
-            hasPassportMRZ ||
-            hasPassportMRZPattern
-          ) {
-            setStatus('INCORRECT');
-            return;
-          }
 
-          // Safety: passport somehow reached ID_BACK step
-          if (detectedDocumentType === 'PASSPORT') {
+          // RECOVERY (must run BEFORE the wrong-side guard below): a passport was
+          // misrouted to SCAN_ID_BACK. A passport has only its data page, which
+          // carries a face + MRZ — exactly what the wrong-side guard treats as
+          // "wrong side", so without this it would loop on INCORRECT forever
+          // (the reported "stuck asking for ID back" case). If we have positive
+          // passport evidence here, the front was already captured, so complete
+          // as a passport instead of waiting for a back that does not exist.
+          //
+          // We deliberately gate ONLY on authoritative signals: a locked PASSPORT
+          // classification, or a PARSED MRZ document code of 'P'. We do NOT test
+          // the raw OCR `text` against PASSPORT_MRZ_PATTERN here — an ID card's
+          // BACK legitimately carries an MRZ whose name line ("PAPPAS<<MARIA…",
+          // "…<<PHILIPP…") can false-match the unanchored pattern and would then
+          // wrongly complete a real ID card as a passport, skipping the back-side
+          // MRZ + barcode validation entirely.
+          if (detectedDocumentType === 'PASSPORT' || hasPassportMRZ) {
             transitionStepWithCallback('COMPLETED', 'SCAN_ID_BACK', {
               image,
               documentType: 'PASSPORT',
-              mrzText: mrzText ?? undefined,
-              mrzFields: parsedMRZData?.fields,
+              mrzText: mrzText ?? lastValidMRZText.current ?? undefined,
+              mrzFields:
+                parsedMRZData?.fields ??
+                lastValidMRZFields.current ??
+                undefined,
             });
             return;
           }
 
+          // Wrong-side detection: a face or signature means we're looking at a
+          // front, not an ID-card back (which has neither).
+          if (hasFaces || hasSignature) {
+            setStatus('INCORRECT');
+            return;
+          }
+
           setElementsOutsideScanArea([]);
 
           const flowResult = handleIDBackFlow(
@@ -1764,7 +1795,8 @@ const IdentityDocumentCamera = ({
           const nextStepAfterHologram = getNextStepAfterHologram(
             detectedDocumentType,
             documentType,
-            mrzDocCode
+            mrzDocCode,
+            sawPassportSignal.current
           );
 
           transitionStepWithCallback(
@@ -1783,11 +1815,35 @@ const IdentityDocumentCamera = ({
       // INITIAL SCAN STEP - Detect document type and validate
       // ============================================================================
       if (nextStep === 'SCAN_ID_FRONT_OR_PASSPORT') {
+        // Latch ANY passport signal seen in a front frame — the parsed 'P' code
+        // OR the raw passport MRZ pattern (which survives even when full MRZ
+        // parsing fails). The passport MRZ often OCRs a few frames after the
+        // face + signature, so we remember it across frames; once latched, this
+        // front can never be accepted as an ID card / asked for a back side.
+        // Only AUTHORITATIVE passport signals latch — a parsed MRZ document code
+        // of 'P', or a settled PASSPORT classification. We deliberately do NOT
+        // latch on a raw PASSPORT_MRZ_PATTERN substring match against OCR text:
+        // that loose test can fire on ID-card MRZ noise, and because the latch is
+        // sticky and one-directional a single false match would force the
+        // passport flow for the rest of the session and silently skip the ID
+        // card's back side. The parsed 'P' code still covers the lagging-MRZ case
+        // (it just requires the MRZ to have actually parsed first).
+        if (
+          isPassportDocumentCode(parsedMRZData?.fields?.documentCode) ||
+          documentType === 'PASSPORT' ||
+          detectedDocumentType === 'PASSPORT'
+        ) {
+          sawPassportSignal.current = true;
+        }
+
         // Determine which flow handler to use.
         // Current-frame passport detection always takes precedence over a locked
-        // ID_FRONT — passport MRZ may not appear until later frames.
+        // ID_FRONT — passport MRZ may not appear until later frames. A latched
+        // passport signal also forces the passport flow, so a passport that was
+        // momentarily locked as ID_FRONT (before its MRZ was read) is corrected
+        // instead of being driven into the ID-card back-side flow.
         const flowDocumentType =
-          documentType === 'PASSPORT'
+          documentType === 'PASSPORT' || sawPassportSignal.current
             ? 'PASSPORT'
             : detectedDocumentType !== 'UNKNOWN'
               ? detectedDocumentType
@@ -2015,7 +2071,8 @@ const IdentityDocumentCamera = ({
         frameH: ds.frameH,
         avgBrightness:
           ds.frames > 0 ? Math.round(ds.brightnessSum / ds.frames) : 0,
-        minBrightness: ds.minBrightness === 255 && ds.frames === 0 ? 0 : ds.minBrightness,
+        minBrightness:
+          ds.minBrightness === 255 && ds.frames === 0 ? 0 : ds.minBrightness,
         maxBrightness: ds.maxBrightness,
         hadLowBrightness: ds.hadLowBrightness,
         hadBlurryFrames: ds.hadBlurryFrames,
@@ -2651,8 +2708,7 @@ const IdentityDocumentCamera = ({
                       : isBrightnessLow || isFrameBlurry
                         ? '#FFC107'
                         : 'white',
-              borderWidth:
-                mrzReliable || status === 'SCANNING' ? 3 : 2,
+              borderWidth: mrzReliable || status === 'SCANNING' ? 3 : 2,
             },
           ]}
         >

package/src/Shared/Components/IdentityDocumentCamera.types.ts

@@ -115,6 +115,27 @@ export type ScanStep =
 
 export type ScanStatus = 'SEARCHING' | 'SCANNING' | 'SCANNED' | 'INCORRECT';
 
+/**
+ * What the camera has classified the document in view as.
+ *
+ * The single most important property of a document type is whether it has a
+ * BACK SIDE that still needs scanning — that is what drives the scan flow:
+ *
+ *   PASSPORT  — ICAO TD3 booklet. The MRZ, photo and all data live on ONE page
+ *               (the data page). There is NO second machine-readable side, so a
+ *               passport must NEVER be routed to SCAN_ID_BACK. Detected by the
+ *               TD3 MRZ document code 'P' / the passport MRZ pattern.
+ *   ID_FRONT  — the photo/front side of a TD1/TD2 ID card. The front carries the
+ *               photo + signature but usually NO MRZ (the MRZ is on the back),
+ *               so the front alone is NOT enough — it MUST be followed by a back
+ *               scan (SCAN_ID_BACK).
+ *   ID_BACK   — the back side of a TD1/TD2 ID card. Carries the MRZ (document
+ *               code 'I'/'A'/'C') and usually a barcode. Terminal side.
+ *   UNKNOWN   — not yet classified, or signals conflict.
+ *
+ * Use `documentHasBackSide()` / `isPassportDocumentCode()` rather than comparing
+ * these strings ad-hoc, so the "is this a passport?" rule lives in one place.
+ */
 export type DocumentType = 'ID_FRONT' | 'ID_BACK' | 'PASSPORT' | 'UNKNOWN';
 
 export type CompletedStep =

package/src/Shared/Components/IdentityDocumentCamera.utils.ts

@@ -9,6 +9,7 @@ import type { MRZFields } from '../Types/mrzFields';
 import {
   SIGNATURE_REGEX,
   PASSPORT_MRZ_PATTERN,
+  MRZ_DENSE_PATTERN,
 } from './IdentityDocumentCamera.constants';
 import { debugLog, isDebugEnabled } from '../Libs/debug.utils';
 
@@ -21,6 +22,30 @@ export function isIDCardDocumentCode(code: string | null | undefined): boolean {
   return code.startsWith('I') || code.startsWith('A') || code.startsWith('C');
 }
 
+/**
+ * Checks if a document code represents a passport (ICAO TD3).
+ * Per ICAO 9303 Part 4, the first character of a passport MRZ document code is
+ * 'P' — for the ordinary `P<`, the German `PP`, and the diplomatic/service/
+ * official `PD`/`PS`/`PO` variants alike.
+ */
+export function isPassportDocumentCode(
+  code: string | null | undefined
+): boolean {
+  if (!code) return false;
+  return code.startsWith('P');
+}
+
+/**
+ * Single source of truth for "does this document have a second side left to
+ * scan?". A passport's data all lives on one page, so it has no back; an ID
+ * card's MRZ lives on the back, so an ID front always does. Used by the
+ * post-front / post-hologram routing so the "ask for the back side?" decision
+ * is never re-derived ad-hoc (the bug where passports were sent to SCAN_ID_BACK).
+ */
+export function documentHasBackSide(documentType: DocumentType): boolean {
+  return documentType === 'ID_FRONT';
+}
+
 /**
  * Frame-to-screen coordinate transform using FILL_CENTER scaling
  */
@@ -285,10 +310,18 @@ export function detectDocumentType(
         return 'ID_FRONT';
       }
 
-      // If signature present and NO passport MRZ pattern, likely ID_FRONT
-      // But we can't be 100% sure yet - passport MRZ might appear in next frames
+      // If signature present and NO passport MRZ pattern, likely ID_FRONT —
+      // BUT an ID-card front has no MRZ, so if a real (dense) MRZ is visible here
+      // (and it is not a confirmed ID code — that returned above) this is almost
+      // certainly a passport data page whose 'P' code just hasn't OCR'd yet.
+      // Stay UNKNOWN and let later frames resolve it, rather than locking
+      // ID_FRONT and routing a passport to a back side it does not have. We use
+      // MRZ_DENSE_PATTERN (needs a `<<` filler run) so a stray single `<` OCR'd
+      // from a card-face guilloche cannot wedge a genuine ID front at UNKNOWN.
+      const hasUnresolvedMrzBlock =
+        !!mrzText || MRZ_DENSE_PATTERN.test(ocrText);
       const hasSignature = hasSignatureMatch;
-      if (hasSignature && !hasPassportMRZPattern) {
+      if (hasSignature && !hasPassportMRZPattern && !hasUnresolvedMrzBlock) {
         return 'ID_FRONT';
       }
     }

package/src/Shared/EIDReader/eidReader.ts

@@ -248,10 +248,11 @@ async function convertJP2IfNeeded(
     return { base64: imageBuffer.toString('base64'), mimeType };
   }
 
-  // Prefer the native decoder (iOS ImageIO). It decodes JPEG2000 of any size
-  // without blocking the JS thread, so it both fixes the iOS preview (RN's
-  // <Image> can't render a raw image/jp2 data URI) and avoids the slow pure-JS
-  // decoder entirely. Returns null on Android / when unavailable → fall through.
+  // Prefer the native decoder (iOS ImageIO / Android jj2000). It decodes
+  // JPEG2000 of any size off the JS thread, so it fixes the on-screen preview on
+  // BOTH platforms (RN's <Image> can't render a raw image/jp2 data URI on either)
+  // and avoids the slow pure-JS decoder entirely. Returns null only when the
+  // native module is unavailable/unlinked or it fails → fall through.
   const native = await decodeJp2ToJpeg(imageBuffer);
   if (native) {
     debugLog(
@@ -261,11 +262,12 @@ async function convertJP2IfNeeded(
     return native;
   }
 
-  // Too large to decode synchronously without freezing the UI — keep the raw
-  // JP2. The face image is still captured (the verification backend / face-match
-  // accept JPEG2000); only the on-screen preview can't render it. This lets the
-  // NFC read COMPLETE instead of hanging. (On Android the raw JP2 still renders
-  // in <Image>; on iOS the native path above normally handles it.)
+  // Native decode unavailable AND too large to decode synchronously in JS
+  // without freezing the UI — keep the raw JP2. The face image is still captured
+  // (the verification backend / face-match accept JPEG2000); only the on-screen
+  // preview can't render it. This lets the NFC read COMPLETE instead of hanging.
+  // In normal operation the native path above handles this on both platforms; we
+  // only reach here if the native module failed or isn't linked.
   if (imageBuffer.length > MAX_JP2_DECODE_BYTES) {
     debugLog(
       'EID',

package/src/Shared/Libs/jp2Decode.ts

@@ -5,13 +5,13 @@ import { Buffer } from 'buffer';
  * Native JPEG2000 decoder bridge.
  *
  * The passport chip portrait (DG2) is frequently stored as JPEG2000
- * (image/jp2). React Native's <Image> renders a JP2 data URI on Android (its
- * Fresco/Skia pipeline decodes it) but NOT on iOS (UIImage-backed <Image>
- * refuses the data URI), so the chip photo showed as a placeholder on iOS.
- *
- * iOS's ImageIO *can* decode JPEG2000, so the native `ImageDecoderModule`
- * round-trips the JP2 to JPEG. We only need this on iOS; on Android the raw
- * JP2 already renders, so there is no native counterpart and we no-op.
+ * (image/jp2). React Native's <Image> CANNOT render a JP2 data URI on EITHER
+ * platform — iOS's UIImage-backed <Image> refuses it, and Android's Fresco/Skia
+ * pipeline has no JPEG2000 decoder (the chip photo showed as a blank/white
+ * placeholder). Both platforms therefore need a native round-trip to JPEG:
+ *   - iOS: ImageIO decodes JPEG2000 natively.
+ *   - Android: the bundled pure-Java jj2000 decoder (no ImageIO/NDK).
+ * Both are exposed as the `ImageDecoderModule.decodeJp2ToJpeg` native method.
  */
 interface ImageDecoderNativeModule {
   decodeJp2ToJpeg(base64Jp2: string): Promise<string>;
@@ -22,16 +22,20 @@ const ImageDecoder = (
 ).ImageDecoderModule;
 
 /**
- * Decode a JPEG2000 buffer to JPEG using the native iOS decoder.
+ * Decode a JPEG2000 buffer to JPEG using the native decoder (iOS ImageIO /
+ * Android jj2000).
  *
  * Returns the JPEG bytes + mime type on success, or null when native decode is
- * unavailable (Android, or the module isn't linked) or fails — callers should
- * fall back to their existing behaviour (keep raw JP2).
+ * unavailable (the module isn't linked) or fails — callers should fall back to
+ * their existing behaviour (keep raw JP2).
  */
 export async function decodeJp2ToJpeg(
   jp2Buffer: Buffer
 ): Promise<{ base64: string; mimeType: string } | null> {
-  if (Platform.OS !== 'ios' || !ImageDecoder?.decodeJp2ToJpeg) {
+  if (
+    (Platform.OS !== 'ios' && Platform.OS !== 'android') ||
+    !ImageDecoder?.decodeJp2ToJpeg
+  ) {
     return null;
   }
   try {

package/src/Shared/Services/DataUploadService.ts

@@ -65,9 +65,12 @@ export class DataUploadService {
       type: mrzFields.documentCode,
       name: mrzFields.firstName,
       surname: mrzFields.lastName,
-      displayName: documentName?.source === 'dg11' ? documentName.displayFirst : undefined,
-      displaySurname: documentName?.source === 'dg11' ? documentName.displayLast : undefined,
-      nameSource: documentName?.source === 'dg11' ? documentName.source : undefined,
+      displayName:
+        documentName?.source === 'dg11' ? documentName.displayFirst : undefined,
+      displaySurname:
+        documentName?.source === 'dg11' ? documentName.displayLast : undefined,
+      nameSource:
+        documentName?.source === 'dg11' ? documentName.source : undefined,
       gender: this.getGenderEnumType(mrzFields.sex),
       number: mrzFields.documentNumber,
       country: mrzFields.issuingState,
@@ -137,7 +140,11 @@ export class DataUploadService {
     // or not.
     const tempPaths: string[] = [];
 
-    const writeTempImage = async (fileName: string, base64Data: string) => {
+    const writeTempImage = async (
+      fileName: string,
+      base64Data: string,
+      mimeType: string = 'image/jpeg'
+    ) => {
       const filePath = decodeURIComponent(
         `${RNFS.TemporaryDirectoryPath}/${fileName}`
       );
@@ -147,11 +154,25 @@ export class DataUploadService {
         name: 'files',
         filename: fileName,
         filepath: filePath,
-        filetype: 'image/jpeg',
+        // The filename extension AND this filetype must reflect the REAL format.
+        // The backend keys its jp2→jpeg conversion off the .jp2 extension, so a
+        // raw JP2 mislabeled as .jpg/image/jpeg reaches face-verification as a
+        // corrupt JPEG and is rejected. Pass the actual mimeType for anything
+        // that isn't already JPEG (the chip portrait can be jp2/png).
+        filetype: mimeType,
       });
       return filePath;
     };
 
+    // Pick a file extension that matches the image's real mime type so the
+    // backend handles it correctly (it converts .jp2 → jpeg on receipt).
+    const extensionForMime = (mimeType?: string) =>
+      mimeType === 'image/jp2'
+        ? 'jp2'
+        : mimeType === 'image/png'
+          ? 'png'
+          : 'jpg';
+
     try {
       // Add document front image
       const frontImage = scannedDocument?.frontImage;
@@ -165,10 +186,17 @@ export class DataUploadService {
         await writeTempImage('DOCUMENT_BACK_IMAGE.jpg', backImage);
       }
 
-      // Add face image from document
+      // Add face image from document. The NFC chip portrait (DG2) can be JPEG,
+      // PNG (JS-decoded), or — when native JP2 decode was unavailable — raw JP2,
+      // so the extension/filetype must track the real mime type, not assume JPEG.
       const faceImage = scannedDocument?.faceImage;
       if (faceImage && faceImage !== '') {
-        await writeTempImage('FACE_IMAGE.jpg', faceImage);
+        const faceMime = scannedDocument?.faceImageMimeType || 'image/jpeg';
+        await writeTempImage(
+          `FACE_IMAGE.${extensionForMime(faceMime)}`,
+          faceImage,
+          faceMime
+        );
       }
 
       // Add secondary face image from document (optional)
@@ -335,7 +363,12 @@ export class DataUploadService {
       if (scannedDocument) {
         onProgress?.(0.1);
         await runWithRetry(() =>
-          this.submitDocumentData(identificationId, scannedDocument, authToken, documentName)
+          this.submitDocumentData(
+            identificationId,
+            scannedDocument,
+            authToken,
+            documentName
+          )
         );
         onProgress?.(0.3);
       }

package/src/version.ts

@@ -1,3 +1,3 @@
 // This file is auto-generated. Do not edit manually.
 // Version is synced from package.json during build.
-export const SDK_VERSION = '1.495.10';
+export const SDK_VERSION = '1.495.12';