@trustchex/react-native-sdk 1.500.1 → 1.501.0

package/lib/module/Shared/EIDReader/passiveAuth/integrity.js

@@ -0,0 +1,71 @@
+"use strict";
+
+import { sha1 } from '@noble/hashes/sha1';
+import { sha256, sha224 } from '@noble/hashes/sha256';
+import { sha512, sha384 } from '@noble/hashes/sha512';
+import { toHex } from "./der.js";
+
+/**
+ * On-device Passive Authentication integrity check (ICAO 9303-11 §5.1, step 3).
+ * Recompute the hash of each raw data-group the chip returned and compare it to
+ * the hash the issuer signed into EF.SOD. A mismatch means the data was altered
+ * after signing → TAMPERED. This runs offline, with no trust store; SOD
+ * signature + CSCA chaining is verified server-side.
+ */
+
+function digest(algorithm, data) {
+  switch (algorithm) {
+    case 'SHA-1':
+      return sha1(data);
+    case 'SHA-224':
+      return sha224(data);
+    case 'SHA-256':
+      return sha256(data);
+    case 'SHA-384':
+      return sha384(data);
+    case 'SHA-512':
+      return sha512(data);
+    default:
+      throw new Error(`Unsupported digest algorithm: ${algorithm}`);
+  }
+}
+
+/**
+ * Compare the raw bytes of each read data group against the SOD's hash list.
+ *
+ * @param sod          parsed LDSSecurityObject (digest alg + per-DG hashes)
+ * @param rawDataGroups map of DG number → exact wire bytes read from the chip
+ */
+export function checkIntegrity(sod, rawDataGroups) {
+  const results = [];
+  for (const [dgStr, bytes] of Object.entries(rawDataGroups)) {
+    const dg = Number(dgStr);
+    const expectedHash = sod.dataGroupHashes[dg];
+    if (!expectedHash) continue; // DG not listed in SOD — nothing to compare
+    const actualHash = toHex(digest(sod.digestAlgorithm, bytes));
+    results.push({
+      dataGroup: dg,
+      expectedHash: expectedHash.toLowerCase(),
+      actualHash,
+      matched: actualHash === expectedHash.toLowerCase()
+    });
+  }
+
+  // DG hashes present in the SOD that we did not read → cannot verify those.
+  const readDgs = new Set(Object.keys(rawDataGroups).map(Number));
+  const unverified = Object.keys(sod.dataGroupHashes).map(Number).filter(dg => !readDgs.has(dg)).sort((a, b) => a - b);
+  let status;
+  if (results.some(r => !r.matched)) {
+    status = 'TAMPERED';
+  } else if (results.length === 0) {
+    status = 'INCOMPLETE';
+  } else {
+    status = 'MATCH';
+  }
+  return {
+    status,
+    digestAlgorithm: sod.digestAlgorithm,
+    results,
+    unverified
+  };
+}

package/lib/module/Shared/EIDReader/passiveAuth/sodParser.js

@@ -0,0 +1,123 @@
+"use strict";
+
+import { readNode, readChildren, decodeOid, decodeInteger, toHex } from "./der.js";
+
+/**
+ * Parse EF.SOD (ICAO 9303-11 §5.1) to extract the LDSSecurityObject: the digest
+ * algorithm and the per-data-group hash list the chip's issuer signed. This is
+ * the input to the on-device integrity check (recompute each read DG's hash and
+ * compare). Signature verification + CSCA chaining is done server-side.
+ *
+ * Dependency-free DER walking so it is fully unit-testable from hex fixtures.
+ */
+
+/** Map of OID → digest algorithm name used for DG hashing. */
+const DIGEST_OIDS = {
+  '1.3.14.3.2.26': 'SHA-1',
+  '2.16.840.1.101.3.4.2.1': 'SHA-256',
+  '2.16.840.1.101.3.4.2.2': 'SHA-384',
+  '2.16.840.1.101.3.4.2.3': 'SHA-512',
+  '2.16.840.1.101.3.4.2.4': 'SHA-224'
+};
+const OID_SIGNED_DATA = '1.2.840.113549.1.7.2';
+const TAG_SEQUENCE = 0x10;
+const TAG_OID = 0x06;
+const TAG_OCTET_STRING = 0x04;
+const TAG_INTEGER = 0x02;
+const TAG_SET = 0x11;
+
+/** Find the first child whose masked tag number equals `tagNumber`. */
+function findChild(children, tagNumber) {
+  return children.find(c => c.tagNumber === tagNumber);
+}
+
+/**
+ * Parse the EF.SOD bytes (with or without the outer 0x77 application wrapper).
+ * Throws on a malformed structure.
+ */
+export function parseSod(sodBytes) {
+  let root = readNode(sodBytes, 0);
+
+  // Unwrap the [APPLICATION 23] (0x77) wrapper if present.
+  if (root.tag === 0x77) {
+    root = readNode(root.content, 0);
+  }
+
+  // root = ContentInfo SEQUENCE { OID id-signedData, [0] SignedData }
+  if (root.tagNumber !== TAG_SEQUENCE) {
+    throw new Error('SOD: expected ContentInfo SEQUENCE');
+  }
+  const contentInfo = readChildren(root.content);
+  const ciOid = findChild(contentInfo, TAG_OID);
+  if (!ciOid || decodeOid(ciOid.content) !== OID_SIGNED_DATA) {
+    throw new Error('SOD: ContentInfo is not signedData');
+  }
+  // [0] explicit wrapper around SignedData.
+  const signedDataWrapper = contentInfo.find(c => c.constructed && c.tag === 0xa0);
+  if (!signedDataWrapper) throw new Error('SOD: missing SignedData wrapper');
+  const signedData = readNode(signedDataWrapper.content, 0);
+  if (signedData.tagNumber !== TAG_SEQUENCE) {
+    throw new Error('SOD: SignedData not a SEQUENCE');
+  }
+
+  // SignedData = { version, digestAlgorithms SET, encapContentInfo SEQUENCE, ... }
+  const sdChildren = readChildren(signedData.content);
+  // encapContentInfo is the first SEQUENCE after the digestAlgorithms SET.
+  const setIdx = sdChildren.findIndex(c => c.tagNumber === TAG_SET);
+  const encap = sdChildren.slice(setIdx + 1).find(c => c.tagNumber === TAG_SEQUENCE);
+  if (!encap) throw new Error('SOD: missing encapContentInfo');
+
+  // encapContentInfo = { eContentType OID, [0] eContent OCTET STRING }
+  const encapChildren = readChildren(encap.content);
+  const eContentWrapper = encapChildren.find(c => c.constructed && c.tag === 0xa0);
+  if (!eContentWrapper) throw new Error('SOD: missing eContent');
+  const eContentOctet = readNode(eContentWrapper.content, 0);
+  if (eContentOctet.tagNumber !== TAG_OCTET_STRING) {
+    throw new Error('SOD: eContent not an OCTET STRING');
+  }
+  return parseLdsSecurityObject(eContentOctet.content);
+}
+
+/**
+ * Parse the LDSSecurityObject:
+ *   SEQUENCE { version INTEGER, hashAlgorithm AlgorithmIdentifier,
+ *              SEQUENCE OF DataGroupHash { number INTEGER, hash OCTET STRING } }
+ */
+function parseLdsSecurityObject(bytes) {
+  const lds = readNode(bytes, 0);
+  if (lds.tagNumber !== TAG_SEQUENCE) {
+    throw new Error('SOD: LDSSecurityObject not a SEQUENCE');
+  }
+  const children = readChildren(lds.content);
+
+  // hashAlgorithm AlgorithmIdentifier = SEQUENCE { OID, params? }
+  const algId = children.find(c => c.tagNumber === TAG_SEQUENCE);
+  if (!algId) throw new Error('SOD: missing hashAlgorithm');
+  const algOidNode = findChild(readChildren(algId.content), TAG_OID);
+  if (!algOidNode) throw new Error('SOD: missing hashAlgorithm OID');
+  const digestAlgorithm = DIGEST_OIDS[decodeOid(algOidNode.content)];
+  if (!digestAlgorithm) {
+    throw new Error(`SOD: unsupported digest OID ${decodeOid(algOidNode.content)}`);
+  }
+
+  // dataGroupHashValues — the SEQUENCE OF after the hashAlgorithm.
+  const algIdx = children.indexOf(algId);
+  const hashSeq = children.slice(algIdx + 1).find(c => c.tagNumber === TAG_SEQUENCE);
+  if (!hashSeq) throw new Error('SOD: missing dataGroupHashValues');
+  const dataGroupHashes = {};
+  for (const dgh of readChildren(hashSeq.content)) {
+    if (dgh.tagNumber !== TAG_SEQUENCE) continue;
+    const parts = readChildren(dgh.content);
+    const numNode = parts.find(p => p.tagNumber === TAG_INTEGER);
+    const hashNode = parts.find(p => p.tagNumber === TAG_OCTET_STRING);
+    if (!numNode || !hashNode) continue;
+    dataGroupHashes[decodeInteger(numNode.content)] = toHex(hashNode.content);
+  }
+  if (Object.keys(dataGroupHashes).length === 0) {
+    throw new Error('SOD: no data-group hashes found');
+  }
+  return {
+    digestAlgorithm,
+    dataGroupHashes
+  };
+}

package/lib/module/Shared/Libs/chipVizMatch.js

@@ -0,0 +1,93 @@
+"use strict";
+
+/**
+ * Verdict of comparing the NFC chip-read (DG1) identity data against the
+ * camera-OCR-read (printed / VIZ) identity data.
+ *
+ * Required by MASAK Tebliğ No. 32, Article 4/C(1)(b): for remote identity
+ * verification of non-Turkish nationals via NFC passport, the chip data must be
+ * verified — via NFC — to match the data printed on the passport. If it cannot
+ * be verified (`MISMATCH` or `UNVERIFIABLE`), no business relationship may be
+ * established through the remote flow.
+ *
+ * - `MATCH`        — every identity-critical field is equal.
+ * - `MISMATCH`     — at least one identity-critical field differs.
+ * - `UNVERIFIABLE` — one of the two sources is missing, so no comparison is possible.
+ */
+
+/** Why a comparison came back `UNVERIFIABLE`. */
+
+/**
+ * Identity-critical fields. These are the ICAO check-digit-protected MRZ fields
+ * plus the core identity claim; any difference here is a hard mismatch.
+ */
+const IDENTITY_CRITICAL_FIELDS = ['documentNumber', 'dateOfBirth', 'dateOfExpiry', 'nationality', 'sex'];
+
+/** Uppercase, strip `<` filler and surrounding whitespace. */
+function normalizeField(value) {
+  if (!value) return '';
+  return value.replace(/</g, '').trim().toUpperCase();
+}
+
+/** Collapse internal whitespace runs and strip `<` filler, for name comparison. */
+function normalizeName(value) {
+  if (!value) return '';
+  return value.replace(/</g, ' ').replace(/\s+/g, ' ').trim().toUpperCase();
+}
+
+/**
+ * Compare the chip-read (DG1) document data against the OCR-read (printed/VIZ)
+ * document data and produce a match verdict.
+ *
+ * Both inputs are the normalized {@link DocumentData} shape, so they are
+ * directly comparable regardless of which read path produced them. Pass raw MRZ
+ * names via {@link ChipVizCompareOptions} — the `firstName`/`lastName` on
+ * `DocumentData` may already be the Unicode display form, which legitimately
+ * diverges between paths and would cause false mismatches.
+ *
+ * @param chip Chip-read data (from `normalizeFromMRZInfo`), or `undefined` if NFC did not complete.
+ * @param viz  OCR-read data (from `normalizeFromMRZFields`), or `undefined` if no OCR step ran.
+ */
+export function compareChipToViz(chip, viz, options = {}) {
+  if (!chip) {
+    return {
+      verdict: 'UNVERIFIABLE',
+      mismatchedFields: [],
+      reason: 'missing-chip-source'
+    };
+  }
+  if (!viz) {
+    return {
+      verdict: 'UNVERIFIABLE',
+      mismatchedFields: [],
+      reason: 'missing-ocr-source'
+    };
+  }
+  const mismatchedFields = [];
+  for (const field of IDENTITY_CRITICAL_FIELDS) {
+    if (normalizeField(chip[field]) !== normalizeField(viz[field])) {
+      mismatchedFields.push(field);
+    }
+  }
+
+  // Names: compare the raw MRZ ASCII when provided, otherwise fall back to the
+  // (possibly display-form) DocumentData names. Recorded always; only flips the
+  // verdict when strictNames is enabled.
+  const chipFirst = options.chipName?.first ?? chip.firstName;
+  const chipLast = options.chipName?.last ?? chip.lastName;
+  const vizFirst = options.vizName?.first ?? viz.firstName;
+  const vizLast = options.vizName?.last ?? viz.lastName;
+  const firstDiffers = normalizeName(chipFirst) !== normalizeName(vizFirst);
+  const lastDiffers = normalizeName(chipLast) !== normalizeName(vizLast);
+  const nameMismatchedFields = [];
+  if (firstDiffers) nameMismatchedFields.push('firstName');
+  if (lastDiffers) nameMismatchedFields.push('lastName');
+  mismatchedFields.push(...nameMismatchedFields);
+
+  // Identity-critical fields always drive the verdict; names only when strict.
+  const hardMismatch = mismatchedFields.some(f => IDENTITY_CRITICAL_FIELDS.includes(f)) || options.strictNames === true && nameMismatchedFields.length > 0;
+  return {
+    verdict: hardMismatch ? 'MISMATCH' : 'MATCH',
+    mismatchedFields
+  };
+}

package/lib/module/Shared/Libs/country-allow.js

@@ -0,0 +1,16 @@
+"use strict";
+
+/**
+ * Country allow-list check for a workflow step's `allowedCountries`.
+ *
+ * Semantics (mirrors the server engine): an empty or unset list means ALL
+ * countries are allowed; a non-empty list allows ONLY those ICAO-3 codes.
+ * Matching is case-insensitive. `allowedCountries` carries any ICAO-3 code
+ * (server-driven), so the client treats the values as opaque strings.
+ */
+export function isCountryAllowed(issuingState, allowedCountries) {
+  if (!allowedCountries || allowedCountries.length === 0) return true;
+  const code = issuingState?.toUpperCase();
+  if (!code) return false;
+  return allowedCountries.map(c => c.toUpperCase()).includes(code);
+}

package/lib/module/Shared/Libs/documentDataNormalizer.js

@@ -1,26 +1,36 @@
 "use strict";
 
 /**
- * Expand a 2-digit MRZ year to a 4-digit calendar year.
- * ICAO 9303: YY >= 30 → 19YY, YY < 30 → 20YY.
- * (Threshold 30 keeps all current valid documents in range.)
+ * Expand a 2-digit MRZ year to a 4-digit calendar year, using a century rule
+ * appropriate to the kind of date:
+ *
+ * - `'birth'`: a birth date is never in the future. Any YY greater than the
+ *   current 2-digit year must be the previous century (e.g. in 2026, "85" →
+ *   1985, "20" → 2020). This is the ICAO-style sliding window pegged to "now".
+ * - `'expiry'`: a travel/ID document's expiry is recent-past-to-future and no
+ *   document valid today expired in the 1900s, so expiry years are always 20YY
+ *   (e.g. "36" → 2036, not 1936 — the previous fixed-threshold bug).
  */
-function expandYear(yy) {
+function expandYear(yy, kind) {
+  if (kind === 'expiry') return `20${yy}`;
   const n = parseInt(yy, 10);
-  return n >= 30 ? `19${yy}` : `20${yy}`;
+  // Current 2-digit year as the sliding pivot (e.g. 26 in 2026). Years after it
+  // can't be a birth this century, so they belong to the 1900s.
+  const pivot = new Date().getFullYear() % 100;
+  return n > pivot ? `19${yy}` : `20${yy}`;
 }
 
 /**
  * Convert a YYMMDD MRZ date string to ISO 8601 YYYY-MM-DD.
  * Returns null for empty, null, or malformed input.
  */
-function mrzDateToISO(raw) {
+function mrzDateToISO(raw, kind) {
   if (!raw || raw.length !== 6) return null;
   const yy = raw.slice(0, 2);
   const mm = raw.slice(2, 4);
   const dd = raw.slice(4, 6);
   if (!/^\d{6}$/.test(raw)) return null;
-  return `${expandYear(yy)}-${mm}-${dd}`;
+  return `${expandYear(yy, kind)}-${mm}-${dd}`;
 }
 
 /**
@@ -80,8 +90,8 @@ export function normalizeFromMRZInfo(mrz) {
     lastName: mrz.getPrimaryIdentifier().trim(),
     firstName: mrz.getSecondaryIdentifier().trim(),
     sex: normalizeSex(mrz.getGender().getStrCode()),
-    dateOfBirth: mrzDateToISO(mrz.getDateOfBirth()),
-    dateOfExpiry: mrzDateToISO(mrz.getDateOfExpiry())
+    dateOfBirth: mrzDateToISO(mrz.getDateOfBirth(), 'birth'),
+    dateOfExpiry: mrzDateToISO(mrz.getDateOfExpiry(), 'expiry')
   };
 }
 
@@ -98,7 +108,7 @@ export function normalizeFromMRZFields(fields) {
     lastName: clean(fields.lastName) ?? '',
     firstName: clean(fields.firstName) ?? '',
     sex: normalizeSex(fields.sex),
-    dateOfBirth: mrzDateToISO(fields.birthDate),
-    dateOfExpiry: mrzDateToISO(fields.expirationDate)
+    dateOfBirth: mrzDateToISO(fields.birthDate, 'birth'),
+    dateOfExpiry: mrzDateToISO(fields.expirationDate, 'expiry')
   };
 }

package/lib/module/Shared/Libs/geolocation.utils.js

@@ -0,0 +1,77 @@
+"use strict";
+
+import { Platform, NativeModules, PermissionsAndroid } from 'react-native';
+import { debugError } from "./debug.utils.js";
+
+/**
+ * Coarse geolocation capture for the MASAK Tebliğ No. 32 Article 4/C(1)(e)
+ * technical-data requirement. Invoked when a workflow step enables
+ * collectGeolocation.
+ *
+ * Implemented entirely with the platform's native location framework via the
+ * SDK's own native modules (iOS Core Location through PermissionModule, Android
+ * LocationManager through GeolocationModule) — no third-party module. The host
+ * app must declare the OS permission strings (iOS
+ * `NSLocationWhenInUseUsageDescription`, Android `ACCESS_COARSE_LOCATION`).
+ *
+ * Everything is fail-soft: if the native module is missing, services are off,
+ * permission is denied, or the fix times out, this returns null and the flow
+ * proceeds — the backend treats a missing geolocation as "not provided".
+ *
+ * @returns "lat,lng" rounded to ~city-block precision (~110 m), or null.
+ */
+export async function captureCoarseGeolocation(timeoutMs = 8000) {
+  try {
+    if (Platform.OS === 'android') {
+      const granted = await requestAndroidLocationPermission();
+      if (!granted) return null;
+      const mod = NativeModules.GeolocationModule;
+      if (!mod?.getCoarseLocation) return null;
+      return normalize(await withJsBackstop(mod.getCoarseLocation(timeoutMs), timeoutMs));
+    }
+
+    // iOS: Core Location (via the existing PermissionModule) requests
+    // when-in-use authorization itself given the Info.plist usage string.
+    const mod = NativeModules.PermissionModule;
+    if (!mod?.getCoarseLocation) return null;
+    return normalize(await withJsBackstop(mod.getCoarseLocation(timeoutMs), timeoutMs));
+  } catch (e) {
+    debugError('geolocation.utils', 'native capture failed', e);
+    return null;
+  }
+}
+function normalize(value) {
+  if (typeof value !== 'string' || value.length === 0) return null;
+  return value;
+}
+
+/**
+ * JS-side backstop: the native side enforces its own timeout, but if a native
+ * regression left the promise unsettled, this resolves null so the flow can't
+ * hang. The margin keeps the native timeout authoritative on the happy path.
+ */
+async function withJsBackstop(native, timeoutMs) {
+  let timer;
+  const backstop = new Promise(resolve => {
+    timer = setTimeout(() => resolve(null), timeoutMs + 2000);
+  });
+  try {
+    return await Promise.race([native, backstop]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+/**
+ * Request coarse location permission on Android. The host app must declare
+ * ACCESS_COARSE_LOCATION in its manifest. iOS handles its own prompt through
+ * Core Location, so this is Android-only.
+ */
+async function requestAndroidLocationPermission() {
+  try {
+    const result = await PermissionsAndroid.request(PermissionsAndroid.PERMISSIONS.ACCESS_COARSE_LOCATION);
+    return result === PermissionsAndroid.RESULTS.GRANTED;
+  } catch {
+    return false;
+  }
+}

package/lib/module/Shared/Libs/mrz.utils.js

@@ -383,7 +383,30 @@ const reconstructMRZCandidates = rawText => {
             head = fixed + head.slice(9);
           }
         }
-        const optional = '<'.repeat(14);
+
+        // Recover the REAL optional/personal-number field (line-2 positions
+        // 29–42, i.e. 0-indexed 28–41) instead of blanking it. Many passports
+        // (and most residence permits) carry a personal number here; blanking it
+        // silently drops that data. Stitch any split fragment lines onto this
+        // line so the optional window is present, then accept the OCR'd optional
+        // ONLY if its own check digit (position 43, 0-indexed 42) validates —
+        // that proves the 14 chars were read correctly. If it doesn't validate
+        // (garbled/split-filler), fall back to the canonical blank, preserving
+        // the previous robustness for the empty-optional case.
+        let stitched = ocrLines[i];
+        let sj = i + 1;
+        while (stitched.length < 44 && sj < ocrLines.length) {
+          stitched += ocrLines[sj];
+          sj++;
+        }
+        let optional = '<'.repeat(14);
+        if (stitched.length >= 43) {
+          const candidateOptional = stitched.slice(28, 42);
+          const optionalCheck = stitched[42];
+          if (/^[A-Z0-9<]{14}$/.test(candidateOptional) && cd731(candidateOptional) === optionalCheck) {
+            optional = candidateOptional;
+          }
+        }
         const l2NoComposite = head + optional + cd731(optional);
         const composite = l2NoComposite.slice(0, 10) + l2NoComposite.slice(13, 20) + l2NoComposite.slice(21, 43);
         return l2NoComposite + cd731(composite);

package/lib/module/Shared/Libs/promise.utils.js

@@ -16,6 +16,12 @@ const runWithRetry = async (fn, maxRetries = 3, delay = 1000) => {
       }
       return result;
     } catch (error) {
+      // Non-retryable errors (e.g. a server-instructed session termination,
+      // MASAK 4/C(1)(e)) must propagate immediately, with their flags intact —
+      // retrying can't help and would just delay surfacing the outcome.
+      if (error && typeof error === 'object' && (error.sessionTerminated || error.nonRetryable)) {
+        throw error;
+      }
       lastError = error;
       retries++;
       console.error(`[Retry] ✗ Attempt ${retries}/${maxRetries} failed:`, error instanceof Error ? error.message : error);

package/lib/module/Shared/Services/DataUploadService.js

@@ -47,12 +47,29 @@ export class DataUploadService {
       gender: this.getGenderEnumType(mrzFields.sex),
       number: mrzFields.documentNumber,
       country: mrzFields.issuingState,
+      // Raw ICAO nationality (for the MASAK 4/C(3) risky-country block and the
+      // server chip↔VIZ nationality comparison).
+      nationality: mrzFields.nationality,
       barcodeValue: scannedDocument.barcodeValue,
       personalNumber: mrzFields.personalNumber || mrzFields.optional1,
       birthDate: mrzUtils.convertMRZDateToISODate(mrzFields.birthDate),
       expiryDate: mrzUtils.convertMRZDateToISODate(mrzFields.expirationDate),
       dataSource: scannedDocument.dataSource,
-      mrzText: scannedDocument.mrzText
+      mrzText: scannedDocument.mrzText,
+      // Chip↔VIZ match (MASAK 4/C(1)(b)). Send the client verdict (advisory)
+      // plus the printed/VIZ MRZ comparison fields so the server can
+      // independently re-derive the authoritative verdict. Recorded for every
+      // EID scan as a security signal; absent on non-EID submissions.
+      chipVizMatch: scannedDocument.chipVizMatch,
+      vizMrz: scannedDocument.vizMrzFields ? {
+        number: scannedDocument.vizMrzFields.documentNumber,
+        birthDate: mrzUtils.convertMRZDateToISODate(scannedDocument.vizMrzFields.birthDate),
+        expiryDate: mrzUtils.convertMRZDateToISODate(scannedDocument.vizMrzFields.expirationDate),
+        nationality: scannedDocument.vizMrzFields.nationality,
+        gender: this.getGenderEnumType(scannedDocument.vizMrzFields.sex),
+        name: scannedDocument.vizMrzFields.firstName,
+        surname: scannedDocument.vizMrzFields.lastName
+      } : undefined
     };
     debugLog('DataUploadService', 'Submitting document data:', identificationDocument.type);
     const {

package/lib/module/Translation/Resources/en.js

@@ -12,6 +12,8 @@ export default {
   'verificationSessionCheckScreen.or': 'or',
   'general.warning': 'Warning',
   'general.error': 'Error',
+  'general.continue': 'Continue',
+  'general.cancel': 'Cancel',
   'general.yes': 'Yes',
   'general.no': 'No',
   'general.letsGo': 'Start',
@@ -26,6 +28,7 @@ export default {
   'termsOfUseAndDataPrivacyScreen.acceptAndContinue': 'Accept and Continue',
   'resultScreen.submitting': 'Submitting your information...',
   'resultScreen.submissionFailed': 'An error occurred. Please try again later.',
+  'resultScreen.sessionTerminated': 'This verification could not be completed and has been ended. Please contact support if you believe this is an error.',
   'resultScreen.submissionFailedTitle': 'Submission failed',
   'resultScreen.submissionFailedRetryHint': 'We could not submit your verification. Your information is saved — you can try again without re-scanning.',
   'resultScreen.retrySubmission': 'Retry',
@@ -92,10 +95,23 @@ export default {
   'eidScannerScreen.nfcAuthFailed': 'Could not establish a secure connection to the chip. Make sure the document number, date of birth and expiry date are correct, then try again.',
   'eidScannerScreen.nfcTagLost': 'Connection to the document was lost. Keep the document still against the device and try again.',
   'eidScannerScreen.nfcTimeout': 'Reading the chip timed out. Hold the document steady against the device and try again.',
+  'addressCaptureScreen.title': 'Confirm your address',
+  'addressCaptureScreen.subtitle': 'Enter your current residential address and provide a supporting document.',
+  'addressCaptureScreen.prefilledFromChip': 'We pre-filled your address from your document chip. Please review and correct it if needed.',
+  'addressCaptureScreen.addressLabel': 'Address',
+  'addressCaptureScreen.addressPlaceholder': 'Street, number, city, country',
+  'addressCaptureScreen.proofLabel': 'Proof of address',
+  'addressCaptureScreen.proofHint': 'A residence certificate, or a utility bill issued within the last 3 months, or a document from a public authority.',
+  'addressCaptureScreen.captureProof': 'Capture proof document',
+  'addressCaptureScreen.retakeProof': 'Retake proof document',
+  'addressCaptureScreen.proofCameraHint': 'Position the document within the frame and capture.',
+  'addressCaptureScreen.capture': 'Capture',
   'eidScannerScreen.faceImageNotFound': 'Photo data not found on document.',
   'eidScannerScreen.documentCode': 'Document Type',
   'eidScannerScreen.nationality': 'Nationality',
   'eidScannerScreen.personalNumber': 'Personal Number',
+  'eidScannerScreen.address': 'Address',
+  'eidScannerScreen.location': 'Location',
   'eidScannerScreen.documentNumber': 'Document Number',
   'eidScannerScreen.name': 'Name',
   'eidScannerScreen.surname': 'Surname',

package/lib/module/Translation/Resources/tr.js

@@ -12,6 +12,8 @@ export default {
   'verificationSessionCheckScreen.or': 'veya',
   'general.warning': 'Uyarı',
   'general.error': 'Hata',
+  'general.continue': 'Devam Et',
+  'general.cancel': 'İptal',
   'general.yes': 'Evet',
   'general.no': 'Hayır',
   'general.letsGo': 'Başla',
@@ -26,6 +28,7 @@ export default {
   'termsOfUseAndDataPrivacyScreen.acceptAndContinue': 'Kabul Et ve Devam Et',
   'resultScreen.submitting': 'Bilgileriniz gönderiliyor...',
   'resultScreen.submissionFailed': 'Bir hata oluştu. Lütfen daha sonra tekrar deneyin.',
+  'resultScreen.sessionTerminated': 'Bu doğrulama tamamlanamadı ve sonlandırıldı. Bir hata olduğunu düşünüyorsanız lütfen destek ekibiyle iletişime geçin.',
   'resultScreen.submissionFailedTitle': 'Gönderim başarısız',
   'resultScreen.submissionFailedRetryHint': 'Doğrulamanız gönderilemedi. Bilgileriniz kaydedildi — yeniden taramadan tekrar deneyebilirsiniz.',
   'resultScreen.retrySubmission': 'Tekrar Dene',
@@ -92,10 +95,23 @@ export default {
   'eidScannerScreen.nfcAuthFailed': 'Çip ile güvenli bağlantı kurulamadı. Belge numarası, doğum tarihi ve son geçerlilik tarihinin doğru olduğundan emin olup tekrar deneyin.',
   'eidScannerScreen.nfcTagLost': 'Belge ile bağlantı kesildi. Belgeyi cihaza sabit tutun ve tekrar deneyin.',
   'eidScannerScreen.nfcTimeout': 'Çip okuması zaman aşımına uğradı. Belgeyi cihaza sabit tutup tekrar deneyin.',
+  'addressCaptureScreen.title': 'Adresinizi doğrulayın',
+  'addressCaptureScreen.subtitle': 'Güncel yerleşim adresinizi girin ve destekleyici bir belge sağlayın.',
+  'addressCaptureScreen.prefilledFromChip': 'Adresiniz belge yongasından önceden dolduruldu. Lütfen kontrol edin ve gerekirse düzeltin.',
+  'addressCaptureScreen.addressLabel': 'Adres',
+  'addressCaptureScreen.addressPlaceholder': 'Cadde, numara, şehir, ülke',
+  'addressCaptureScreen.proofLabel': 'Adres kanıtı',
+  'addressCaptureScreen.proofHint': 'Yerleşim yeri belgesi veya son 3 ay içinde düzenlenmiş bir fatura ya da bir kamu kurumu tarafından verilen belge.',
+  'addressCaptureScreen.captureProof': 'Kanıt belgesini çek',
+  'addressCaptureScreen.retakeProof': 'Kanıt belgesini yeniden çek',
+  'addressCaptureScreen.proofCameraHint': 'Belgeyi çerçeveye yerleştirin ve fotoğraf çekin.',
+  'addressCaptureScreen.capture': 'Çek',
   'eidScannerScreen.faceImageNotFound': 'Belgede fotoğraf verisi bulunamadı.',
   'eidScannerScreen.documentCode': 'Belge Türü',
   'eidScannerScreen.nationality': 'Uyruk',
   'eidScannerScreen.personalNumber': 'Vatandaşlık No',
+  'eidScannerScreen.address': 'Adres',
+  'eidScannerScreen.location': 'Konum',
   'eidScannerScreen.documentNumber': 'Belge No',
   'eidScannerScreen.name': 'Ad',
   'eidScannerScreen.surname': 'Soyad',

package/lib/module/Trustchex.js

@@ -18,6 +18,7 @@ import VerificationSessionCheckScreen from "./Screens/Static/VerificationSession
 import QrCodeScanningScreen from "./Screens/Static/QrCodeScanningScreen.js";
 import VideoCallScreen from "./Screens/Dynamic/VideoCallScreen.js";
 import VerbalConsentScreen from "./Screens/Dynamic/VerbalConsentScreen.js";
+import AddressCaptureScreen from "./Screens/Dynamic/AddressCaptureScreen.js";
 import OTPVerificationScreen from "./Screens/Static/OTPVerificationScreen.js";
 import MRZTestScreen from "./Screens/Debug/MRZTestScreen.js";
 import BarcodeTestScreen from "./Screens/Debug/BarcodeTestScreen.js";
@@ -237,6 +238,9 @@ const Trustchex = ({
               }), /*#__PURE__*/_jsx(Stack.Screen, {
                 name: "VerbalConsentScreen",
                 component: VerbalConsentScreen
+              }), /*#__PURE__*/_jsx(Stack.Screen, {
+                name: "AddressCaptureScreen",
+                component: AddressCaptureScreen
               }), /*#__PURE__*/_jsx(Stack.Screen, {
                 name: "MRZTestScreen",
                 component: MRZTestScreen

package/lib/module/version.js

@@ -2,4 +2,4 @@
 
 // This file is auto-generated. Do not edit manually.
 // Version is synced from package.json during build.
-export const SDK_VERSION = '1.500.1';
+export const SDK_VERSION = '1.501.0';

package/lib/typescript/src/Screens/Dynamic/AddressCaptureScreen.d.ts

@@ -0,0 +1,9 @@
+/**
+ * ADDRESS_CAPTURE step (MASAK Tebliğ No. 32 Article 4/C(1)(d)). The user confirms
+ * their address — pre-filled from the chip's DG11 address when available — and
+ * captures a proof document (residence cert / utility bill ≤3 months / public-
+ * authority doc). The address is verified later by an operator (manual review).
+ */
+declare const AddressCaptureScreen: () => import("react/jsx-runtime").JSX.Element;
+export default AddressCaptureScreen;
+//# sourceMappingURL=AddressCaptureScreen.d.ts.map

package/lib/typescript/src/Screens/Dynamic/AddressCaptureScreen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddressCaptureScreen.d.ts","sourceRoot":"","sources":["../../../../../src/Screens/Dynamic/AddressCaptureScreen.tsx"],"names":[],"mappings":"AA8BA;;;;;GAKG;AACH,QAAA,MAAM,oBAAoB,+CA6HzB,CAAC;AAkCF,eAAe,oBAAoB,CAAC"}

package/lib/typescript/src/Screens/Dynamic/ContractAcceptanceScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ContractAcceptanceScreen.d.ts","sourceRoot":"","sources":["../../../../../src/Screens/Dynamic/ContractAcceptanceScreen.tsx"],"names":[],"mappings":"AA6BA,QAAA,MAAM,wBAAwB,+CAyK7B,CAAC;AA8BF,eAAe,wBAAwB,CAAC"}
+{"version":3,"file":"ContractAcceptanceScreen.d.ts","sourceRoot":"","sources":["../../../../../src/Screens/Dynamic/ContractAcceptanceScreen.tsx"],"names":[],"mappings":"AA8BA,QAAA,MAAM,wBAAwB,+CAoL7B,CAAC;AA8BF,eAAe,wBAAwB,CAAC"}

package/lib/typescript/src/Screens/Dynamic/IdentityDocumentEIDScanningScreen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityDocumentEIDScanningScreen.d.ts","sourceRoot":"","sources":["../../../../../src/Screens/Dynamic/IdentityDocumentEIDScanningScreen.tsx"],"names":[],"mappings":"AAqBA,QAAA,MAAM,iCAAiC,+CAwNtC,CAAC;AAoBF,eAAe,iCAAiC,CAAC"}
+{"version":3,"file":"IdentityDocumentEIDScanningScreen.d.ts","sourceRoot":"","sources":["../../../../../src/Screens/Dynamic/IdentityDocumentEIDScanningScreen.tsx"],"names":[],"mappings":"AAsBA,QAAA,MAAM,iCAAiC,+CAuPtC,CAAC;AAoBF,eAAe,iCAAiC,CAAC"}