@velion-la/onboarding-sdk-react-native 1.0.0-beta.2

package/lib/module/utils/base64.js

@@ -0,0 +1,47 @@
+"use strict";
+
+/**
+ * Base64 helpers without `Buffer` (RN does not ship a Buffer global) and
+ * without leaning on `react-native-quick-base64`. Hermes provides `btoa` /
+ * `atob`, which take Latin-1 strings — we wrap them with byte arrays so
+ * callers don't have to think about the in-between.
+ */
+
+/**
+ * Encodes a `Uint8Array` to a standard base64 string.
+ *
+ * Implementation note: `btoa` requires a Latin-1 string. We convert the byte
+ * array to one char per byte via `String.fromCharCode`, in chunks to avoid
+ * blowing the JS argument-list limit on large frames (~1 MB JPEG).
+ */
+export function bytesToBase64(bytes) {
+  const CHUNK = 0x8000; // 32 KiB — well below the spread-args limit.
+  let binary = '';
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    const slice = bytes.subarray(i, i + CHUNK);
+    binary += String.fromCharCode(...slice);
+  }
+  // `btoa` is part of the WHATWG spec and is available on Hermes (RN ≥ 0.74).
+  return globalThis.btoa(binary);
+}
+
+/** Decodes a standard base64 string into a `Uint8Array`. */
+export function base64ToBytes(b64) {
+  const binary = globalThis.atob(b64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+/** Lowercase hex (`'a1f3…'`) — matches the canonical Iris HMAC format. */
+export function bytesToHexLower(bytes) {
+  let out = '';
+  for (let i = 0; i < bytes.length; i += 1) {
+    const v = bytes[i] ?? 0;
+    out += v.toString(16).padStart(2, '0');
+  }
+  return out;
+}
+//# sourceMappingURL=base64.js.map

package/lib/module/utils/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["bytesToBase64","bytes","CHUNK","binary","i","length","slice","subarray","String","fromCharCode","globalThis","btoa","base64ToBytes","b64","atob","Uint8Array","charCodeAt","bytesToHexLower","out","v","toString","padStart"],"sourceRoot":"../../../src","sources":["utils/base64.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASA,aAAaA,CAACC,KAAiB,EAAU;EACvD,MAAMC,KAAK,GAAG,MAAM,CAAC,CAAC;EACtB,IAAIC,MAAM,GAAG,EAAE;EACf,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGH,KAAK,CAACI,MAAM,EAAED,CAAC,IAAIF,KAAK,EAAE;IAC5C,MAAMI,KAAK,GAAGL,KAAK,CAACM,QAAQ,CAACH,CAAC,EAAEA,CAAC,GAAGF,KAAK,CAAC;IAC1CC,MAAM,IAAIK,MAAM,CAACC,YAAY,CAAC,GAAGH,KAAK,CAAC;EACzC;EACA;EACA,OAAOI,UAAU,CAACC,IAAI,CAACR,MAAM,CAAC;AAChC;;AAEA;AACA,OAAO,SAASS,aAAaA,CAACC,GAAW,EAAc;EACrD,MAAMV,MAAM,GAAGO,UAAU,CAACI,IAAI,CAACD,GAAG,CAAC;EACnC,MAAMZ,KAAK,GAAG,IAAIc,UAAU,CAACZ,MAAM,CAACE,MAAM,CAAC;EAC3C,KAAK,IAAID,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGD,MAAM,CAACE,MAAM,EAAED,CAAC,IAAI,CAAC,EAAE;IACzCH,KAAK,CAACG,CAAC,CAAC,GAAGD,MAAM,CAACa,UAAU,CAACZ,CAAC,CAAC;EACjC;EACA,OAAOH,KAAK;AACd;;AAEA;AACA,OAAO,SAASgB,eAAeA,CAAChB,KAAiB,EAAU;EACzD,IAAIiB,GAAG,GAAG,EAAE;EACZ,KAAK,IAAId,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGH,KAAK,CAACI,MAAM,EAAED,CAAC,IAAI,CAAC,EAAE;IACxC,MAAMe,CAAC,GAAGlB,KAAK,CAACG,CAAC,CAAC,IAAI,CAAC;IACvBc,GAAG,IAAIC,CAAC,CAACC,QAAQ,CAAC,EAAE,CAAC,CAACC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;EACxC;EACA,OAAOH,GAAG;AACZ","ignoreList":[]}

package/lib/module/utils/deviceFingerprint.js

@@ -0,0 +1,129 @@
+"use strict";
+
+/**
+ * @fileoverview Device Fingerprint via Fingerprint Pro RN SDK.
+ *
+ * Uses the official `@fingerprintjs/fingerprintjs-pro-react-native` agent
+ * class to identify the device.
+ *
+ * Why a real SDK and not a hand-rolled hash:
+ *   - The backend (`PublicSdkSessionController.fingerprint`) reads only
+ *     `request_id` and `sealed_result` from the body. A custom `visitor_id`
+ *     field is silently dropped and the AML enrichment lookup never runs.
+ *   - Fingerprint Pro returns a stable `requestId` (lookup key against the
+ *     Fingerprint server) and a `sealedResult` (encrypted payload the
+ *     backend decrypts with its private key for server-side identification).
+ *
+ * The Fingerprint Pro RN SDK is loaded **dynamically** so it stays an
+ * optional peer dep: hosts that don't ship the fingerprint module get a
+ * clear `FINGERPRINT_FAILED` error instead of a hard module-resolution
+ * crash at app boot. (The Velion example app installs it; third-party
+ * consumers without a Fingerprint workspace can swap defaults via
+ * `fingerprintApiKey` / `fingerprintEndpoint` in `VelionConfig`.)
+ */
+
+import { SdkErrorCode } from '../types';
+
+/** Public shape of the result. */
+
+/**
+ * Fingerprint Pro public API key for the shared Velion workspace. Hardcoded
+ * by design — Fingerprint distinguishes public keys (safe to ship in client
+ * code; bound to your domain/bundle ID at the Fingerprint dashboard) from
+ * secret keys (server-only, used by the worker to decrypt sealedResult or
+ * call the Server API). This constant is the *public* one.
+ */
+const VELION_FP_PUBLIC_KEY = 'GU2vrZByydGqG9HYUaz2';
+
+/**
+ * Loaded once per process. We resolve the optional native module lazily so
+ * its absence is reported as a clean SDK error rather than crashing the
+ * Metro bundler at startup with "Unable to resolve module".
+ */
+
+function loadAgentCtor() {
+  // Avoid bundler hoisting at build time so missing optional dep doesn't
+  // crash the host app at boot.
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const mod = require('@fingerprintjs/fingerprintjs-pro-react-native');
+  if (typeof mod.FingerprintJsProAgent !== 'function') {
+    throw new Error('Module @fingerprintjs/fingerprintjs-pro-react-native is installed ' + 'but does not export FingerprintJsProAgent. Upgrade to v3+ of the package.');
+  }
+  return mod.FingerprintJsProAgent;
+}
+
+/**
+ * Calls Fingerprint Pro RN to obtain `requestId` + optional `sealedResult`,
+ * the only two pieces of data the Velion backend cares about. Throws a
+ * shaped `SdkError` on any failure (missing module, agent init error,
+ * network).
+ */
+export async function generateDeviceFingerprint(options) {
+  let AgentCtor;
+  try {
+    AgentCtor = loadAgentCtor();
+  } catch (err) {
+    throw {
+      code: SdkErrorCode.FINGERPRINT_FAILED,
+      message: 'Fingerprint Pro RN module is not installed. Add ' + '`@fingerprintjs/fingerprintjs-pro-react-native` to your app ' + '(and re-run `expo prebuild`) to enable the DEVICE_FINGERPRINT step.',
+      cause: err
+    };
+  }
+  const trimmedEndpoint = options.endpoint.replace(/\/$/, '').trim();
+  // An empty string is treated as "no custom endpoint" — the SDK falls through
+  // to its built-in public endpoint (api.fpjs.io). This is useful for
+  // diagnosing whether a custom proxy (e.g. fp.velion.la) is the cause of a
+  // ClientTimeout when the public path works.
+  const useCustomEndpoint = trimmedEndpoint.length > 0;
+  const apiKey = options.apiKey?.trim() || VELION_FP_PUBLIC_KEY;
+  // Internal cap for the call. The Fingerprint SDK has its own retry/timeout
+  // logic that on iOS occasionally hangs past 30s without surfacing the error
+  // to the JS layer; we Promise.race against this to guarantee a clean failure.
+  const timeoutMs = Math.max(6000, options.timeoutMs ?? 15000);
+  const agent = new AgentCtor({
+    apiKey,
+    region: 'us',
+    ...(useCustomEndpoint && {
+      endpointUrl: trimmedEndpoint,
+      // If the custom endpoint is unreachable (proxy misconfigured, DNS, etc.)
+      // the SDK falls back to the public Fingerprint Pro endpoint so the step
+      // still completes during development.
+      fallbackEndpointUrls: ['https://api.fpjs.io']
+    }),
+    extendedResponseFormat: true,
+    requestOptions: {
+      timeout: Math.floor(timeoutMs * 0.75)
+    }
+  });
+  let visitorData;
+  let timeoutHandle = null;
+  try {
+    visitorData = await Promise.race([agent.getVisitorData(), new Promise((_resolve, reject) => {
+      timeoutHandle = setTimeout(() => reject(new Error(`Fingerprint Pro getVisitorData() did not return within ${timeoutMs}ms`)), timeoutMs);
+    })]);
+  } catch (err) {
+    throw {
+      code: SdkErrorCode.FINGERPRINT_FAILED,
+      message: 'No pudimos completar el reconocimiento del dispositivo. ' + 'Probá nuevamente; si el problema persiste, verificá tu conexión ' + '(sin VPN ni proxies) o que el bundle ID de la app esté habilitado ' + 'en el dashboard de Fingerprint Pro.',
+      cause: err
+    };
+  } finally {
+    if (timeoutHandle !== null) clearTimeout(timeoutHandle);
+  }
+  const requestId = visitorData.requestId;
+  if (typeof requestId !== 'string' || requestId.length === 0) {
+    throw {
+      code: SdkErrorCode.FINGERPRINT_FAILED,
+      message: 'Fingerprint Pro did not return a requestId — backend cannot ' + 'enrich the session without it.',
+      cause: undefined
+    };
+  }
+  const result = {
+    request_id: requestId
+  };
+  if (typeof visitorData.sealedResult === 'string' && visitorData.sealedResult.length > 0) {
+    result.sealed_result = visitorData.sealedResult;
+  }
+  return result;
+}
+//# sourceMappingURL=deviceFingerprint.js.map

package/lib/module/utils/deviceFingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["SdkErrorCode","VELION_FP_PUBLIC_KEY","loadAgentCtor","mod","require","FingerprintJsProAgent","Error","generateDeviceFingerprint","options","AgentCtor","err","code","FINGERPRINT_FAILED","message","cause","trimmedEndpoint","endpoint","replace","trim","useCustomEndpoint","length","apiKey","timeoutMs","Math","max","agent","region","endpointUrl","fallbackEndpointUrls","extendedResponseFormat","requestOptions","timeout","floor","visitorData","timeoutHandle","Promise","race","getVisitorData","_resolve","reject","setTimeout","clearTimeout","requestId","undefined","result","request_id","sealedResult","sealed_result"],"sourceRoot":"../../../src","sources":["utils/deviceFingerprint.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,YAAY,QAAuB,UAAU;;AAEtD;;AAeA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,oBAAoB,GAAG,sBAAsB;;AAEnD;AACA;AACA;AACA;AACA;;AAmBA,SAASC,aAAaA,CAAA,EAAyB;EAC7C;EACA;EACA;EACA,MAAMC,GAAG,GAAGC,OAAO,CAAC,+CAA+C,CAElE;EACD,IAAI,OAAOD,GAAG,CAACE,qBAAqB,KAAK,UAAU,EAAE;IACnD,MAAM,IAAIC,KAAK,CACb,oEAAoE,GAClE,2EACJ,CAAC;EACH;EACA,OAAOH,GAAG,CAACE,qBAAqB;AAClC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeE,yBAAyBA,CAC7CC,OAAiC,EACC;EAClC,IAAIC,SAA+B;EACnC,IAAI;IACFA,SAAS,GAAGP,aAAa,CAAC,CAAC;EAC7B,CAAC,CAAC,OAAOQ,GAAG,EAAE;IACZ,MAAM;MACJC,IAAI,EAAEX,YAAY,CAACY,kBAAkB;MACrCC,OAAO,EACL,kDAAkD,GAClD,8DAA8D,GAC9D,qEAAqE;MACvEC,KAAK,EAAEJ;IACT,CAAC;EACH;EAEA,MAAMK,eAAe,GAAGP,OAAO,CAACQ,QAAQ,CAACC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAACC,IAAI,CAAC,CAAC;EAClE;EACA;EACA;EACA;EACA,MAAMC,iBAAiB,GAAGJ,eAAe,CAACK,MAAM,GAAG,CAAC;EACpD,MAAMC,MAAM,GAAGb,OAAO,CAACa,MAAM,EAAEH,IAAI,CAAC,CAAC,IAAIjB,oBAAoB;EAC7D;EACA;EACA;EACA,MAAMqB,SAAS,GAAGC,IAAI,CAACC,GAAG,CAAC,IAAI,EAAEhB,OAAO,CAACc,SAAS,IAAI,KAAK,CAAC;EAE5D,MAAMG,KAAK,GAAG,IAAIhB,SAAS,CAAC;IAC1BY,MAAM;IACNK,MAAM,EAAE,IAAI;IACZ,IAAIP,iBAAiB,IAAI;MACvBQ,WAAW,EAAEZ,eAAe;MAC5B;MACA;MACA;MACAa,oBAAoB,EAAE,CAAC,qBAAqB;IAC9C,CAAC,CAAC;IACFC,sBAAsB,EAAE,IAAI;IAC5BC,cAAc,EAAE;MAAEC,OAAO,EAAER,IAAI,CAACS,KAAK,CAACV,SAAS,GAAG,IAAI;IAAE;EAC1D,CAAC,CAAC;EAEF,IAAIW,WAA0D;EAC9D,IAAIC,aAAmD,GAAG,IAAI;EAC9D,IAAI;IACFD,WAAW,GAAG,MAAME,OAAO,CAACC,IAAI,CAAC,CAC/BX,KAAK,CAACY,cAAc,CAAC,CAAC,EACtB,IAAIF,OAAO,CAAQ,CAACG,QAAQ,EAAEC,MAAM,KAAK;MACvCL,aAAa,GAAGM,UAAU,CACxB,MACED,MAAM,CACJ,IAAIjC,KAAK,CACP,0DAA0DgB,SAAS,IACrE,CACF,CAAC,EACHA,SACF,CAAC;IACH,CAAC,CAAC,CACH,CAAC;EACJ,CAAC,CAAC,OAAOZ,GAAG,EAAE;IACZ,MAAM;MACJC,IAAI,EAAEX,YAAY,CAACY,kBAAkB;MACrCC,OAAO,EACL,0DAA0D,GAC1D,kEAAkE,GAClE,oEAAoE,GACpE,qCAAqC;MACvCC,KAAK,EAAEJ;IACT,CAAC;EACH,CAAC,SAAS;IACR,IAAIwB,aAAa,KAAK,IAAI,EAAEO,YAAY,CAACP,aAAa,CAAC;EACzD;EAEA,MAAMQ,SAAS,GAAGT,WAAW,CAACS,SAAS;EACvC,IAAI,OAAOA,SAAS,KAAK,QAAQ,IAAIA,SAAS,CAACtB,MAAM,KAAK,CAAC,EAAE;IAC3D,MAAM;MACJT,IAAI,EAAEX,YAAY,CAACY,kBAAkB;MACrCC,OAAO,EACL,8DAA8D,GAC9D,gCAAgC;MAClCC,KAAK,EAAE6B;IACT,CAAC;EACH;EAEA,MAAMC,MAA+B,GAAG;IAAEC,UAAU,EAAEH;EAAU,CAAC;EACjE,IAAI,OAAOT,WAAW,CAACa,YAAY,KAAK,QAAQ,IAAIb,WAAW,CAACa,YAAY,CAAC1B,MAAM,GAAG,CAAC,EAAE;IACvFwB,MAAM,CAACG,aAAa,GAAGd,WAAW,CAACa,YAAY;EACjD;EACA,OAAOF,MAAM;AACf","ignoreList":[]}

package/lib/module/utils/documentTypeOptions.js

@@ -0,0 +1,31 @@
+"use strict";
+
+/**
+ * Default identification document option for HUMAN_BASIC_INFO when the backend
+ * does not send `accepted_country_documents` (same label keys as legacy UI).
+ */
+
+const DOCUMENT_TYPE_LABELS_BY_PRESET = {
+  es: {
+    ARG_DNI: 'DNI (Argentina)'
+  },
+  en: {
+    ARG_DNI: 'DNI (Argentina)'
+  },
+  ar: {
+    ARG_DNI: 'DNI (Argentina)'
+  }
+};
+/**
+ * Fallback list for the HUMAN_BASIC_INFO identification type selector when step config
+ * does not include document types from the backend.
+ */
+export function resolveDocumentTypeOptions(uiLocale) {
+  const labelLocale = uiLocale === 'en' ? 'en' : uiLocale === 'ar' ? 'ar' : 'es';
+  const labelMap = DOCUMENT_TYPE_LABELS_BY_PRESET[labelLocale];
+  return [{
+    value: 'ARG_DNI',
+    label: labelMap.ARG_DNI
+  }];
+}
+//# sourceMappingURL=documentTypeOptions.js.map

package/lib/module/utils/documentTypeOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DOCUMENT_TYPE_LABELS_BY_PRESET","es","ARG_DNI","en","ar","resolveDocumentTypeOptions","uiLocale","labelLocale","labelMap","value","label"],"sourceRoot":"../../../src","sources":["utils/documentTypeOptions.ts"],"mappings":";;AAAA;AACA;AACA;AACA;;AAEA,MAAMA,8BAA8B,GAAG;EACrCC,EAAE,EAAE;IACFC,OAAO,EAAE;EACX,CAAC;EACDC,EAAE,EAAE;IACFD,OAAO,EAAE;EACX,CAAC;EACDE,EAAE,EAAE;IACFF,OAAO,EAAE;EACX;AACF,CAAU;AAIV;AACA;AACA;AACA;AACA,OAAO,SAASG,0BAA0BA,CACxCC,QAAgB,EACyB;EACzC,MAAMC,WAAyB,GAC7BD,QAAQ,KAAK,IAAI,GAAG,IAAI,GAAGA,QAAQ,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI;EAC5D,MAAME,QAAQ,GAAGR,8BAA8B,CAACO,WAAW,CAAC;EAC5D,OAAO,CAAC;IAAEE,KAAK,EAAE,SAAS;IAAEC,KAAK,EAAEF,QAAQ,CAACN;EAAQ,CAAC,CAAC;AACxD","ignoreList":[]}

package/lib/module/utils/googleMapsPreflight.js

@@ -0,0 +1,73 @@
+"use strict";
+
+/**
+ * Pre-flight checks for the assisted address flow.
+ *
+ * The SDK no longer calls any Google REST API from the client — reverse
+ * geocoding goes through the OS native geocoder (see `osGeocoder.ts`). What
+ * we still need to verify is:
+ *   1. `react-native-maps` is linked.
+ *   2. On Android, the Google Maps key is declared in `AndroidManifest.xml`
+ *      as `<meta-data android:name="com.google.android.geo.API_KEY" .../>`.
+ *      Without that, mounting `<MapView>` throws a native
+ *      `IllegalStateException` from the Fabric UI manager — a JS error
+ *      boundary cannot catch it because the throw happens in a native
+ *      thread during the UI commit.
+ *
+ * Note that these probes cannot catch the iOS-specific case where
+ * `react-native-maps` IS installed but the `AirGoogleMaps` sub-target was
+ * never added to the Xcode project — that one only surfaces at render time
+ * and is handled by `MapFallbackBoundary`.
+ */
+
+import { Platform } from 'react-native';
+import { log } from './log';
+
+/**
+ * Returns true when `react-native-maps` is importable and exposes the
+ * MapView component we need.
+ */
+export function isReactNativeMapsAvailable() {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+    const mod = require('react-native-maps');
+    return typeof mod?.default === 'function' || typeof mod?.MapView === 'function';
+  } catch (err) {
+    log.warn('[gmaps-preflight] react-native-maps unavailable', err);
+    return false;
+  }
+}
+
+/**
+ * Best-effort probe for the Android `com.google.android.geo.API_KEY` meta-data
+ * in the host's `AndroidManifest.xml`.
+ *
+ * Returns:
+ *   - `true`  on iOS (the check does not apply — Apple Maps needs no key).
+ *   - `true`  when we can confirm the key is wired via the Expo config
+ *             (`android.config.googleMaps.apiKey`). Expo prebuild copies that
+ *             into the manifest, so its presence in `expoConfig` is a reliable
+ *             proxy for the real meta-data.
+ *   - `false` when `expo-constants` is available AND the Expo config does not
+ *             declare the key — we know prebuild produced a manifest without
+ *             the meta-data, so mounting `<MapView>` would crash.
+ *   - `undefined` when `expo-constants` is not installed (bare RN). We cannot
+ *             probe the manifest without a custom native module; the caller
+ *             should default to the previous behaviour (trust the integrator
+ *             when they pass `googleMapsApiKey` via `VelionConfig`).
+ */
+export function isAndroidGoogleMapsKeyInManifest() {
+  if (Platform.OS !== 'android') return true;
+  let Constants;
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+    const mod = require('expo-constants');
+    Constants = mod?.default ?? mod;
+  } catch {
+    return undefined;
+  }
+  const expoConfig = Constants?.expoConfig;
+  const key = expoConfig?.android?.config?.googleMaps?.apiKey;
+  return typeof key === 'string' && key.trim().length > 0;
+}
+//# sourceMappingURL=googleMapsPreflight.js.map

package/lib/module/utils/googleMapsPreflight.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["Platform","log","isReactNativeMapsAvailable","mod","require","default","MapView","err","warn","isAndroidGoogleMapsKeyInManifest","OS","Constants","undefined","expoConfig","key","android","config","googleMaps","apiKey","trim","length"],"sourceRoot":"../../../src","sources":["utils/googleMapsPreflight.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,QAAQ,QAAQ,cAAc;AACvC,SAASC,GAAG,QAAQ,OAAO;;AAE3B;AACA;AACA;AACA;AACA,OAAO,SAASC,0BAA0BA,CAAA,EAAY;EACpD,IAAI;IACF;IACA,MAAMC,GAAG,GAAGC,OAAO,CAAC,mBAAmB,CAAC;IACxC,OAAO,OAAOD,GAAG,EAAEE,OAAO,KAAK,UAAU,IAAI,OAAOF,GAAG,EAAEG,OAAO,KAAK,UAAU;EACjF,CAAC,CAAC,OAAOC,GAAG,EAAE;IACZN,GAAG,CAACO,IAAI,CAAC,iDAAiD,EAAED,GAAG,CAAC;IAChE,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,gCAAgCA,CAAA,EAAwB;EACtE,IAAIT,QAAQ,CAACU,EAAE,KAAK,SAAS,EAAE,OAAO,IAAI;EAC1C,IAAIC,SAAkB;EACtB,IAAI;IACF;IACA,MAAMR,GAAG,GAAGC,OAAO,CAAC,gBAAgB,CAAC;IACrCO,SAAS,GAAGR,GAAG,EAAEE,OAAO,IAAIF,GAAG;EACjC,CAAC,CAAC,MAAM;IACN,OAAOS,SAAS;EAClB;EACA,MAAMC,UAAU,GAAIF,SAAS,EAA2CE,UAE3D;EACb,MAAMC,GAAG,GAAGD,UAAU,EAAEE,OAAO,EAAEC,MAAM,EAAEC,UAAU,EAAEC,MAAM;EAC3D,OAAO,OAAOJ,GAAG,KAAK,QAAQ,IAAIA,GAAG,CAACK,IAAI,CAAC,CAAC,CAACC,MAAM,GAAG,CAAC;AACzD","ignoreList":[]}

package/lib/module/utils/hmac.js

@@ -0,0 +1,53 @@
+"use strict";
+
+/**
+ * @fileoverview HMAC-SHA256 over JPEG frames for the Iris liveness flow.
+ *
+ * React Native's WebCrypto support is incomplete in Hermes (no `subtle.sign`),
+ * so we lean on `@noble/hashes` — pure JavaScript, ~10 KB, no native code.
+ *
+ * Canonical message (must match the Iris orchestrator exactly):
+ *   `${sessionId}\n${frameId}\n${ts}\n${sha256hex(jpeg)}`
+ *
+ * Output: lowercase hex MAC, sent in the JSON envelope's `mac` field.
+ */
+
+import { hmac } from '@noble/hashes/hmac';
+import { sha256 } from '@noble/hashes/sha256';
+import { base64ToBytes, bytesToHexLower } from './base64';
+/** Decode the base64 frame_integrity_key from `/liveness-init`. */
+export function importHmacKey(base64) {
+  return {
+    raw: base64ToBytes(base64)
+  };
+}
+
+/**
+ * Build the signed envelope sent over the Iris WebSocket. Mirrors
+ * `LivenessModule.buildSignedEnvelope`:
+ *   1. Compute SHA-256 of the JPEG bytes (hex, lowercase).
+ *   2. Build the canonical message.
+ *   3. HMAC-SHA256 with the imported key.
+ *   4. Wrap into `{ type: 'FRAME', frameId, timestamp, image, mac }`.
+ *
+ * Returns the JSON string ready to `ws.send`.
+ */
+export function buildSignedFrameEnvelope(args) {
+  const ts = args.timestamp ?? Date.now();
+  const digest = sha256(args.jpegBytes);
+  const digestHex = bytesToHexLower(digest);
+  const canonical = `${args.sessionId}\n${args.frameId}\n${ts}\n${digestHex}`;
+  const mac = hmac(sha256, args.key.raw, new TextEncoder().encode(canonical));
+  const macHex = bytesToHexLower(mac);
+  return {
+    json: JSON.stringify({
+      type: 'FRAME',
+      frameId: args.frameId,
+      timestamp: ts,
+      image: args.jpegBase64,
+      mac: macHex
+    }),
+    timestamp: ts
+  };
+}
+//# sourceMappingURL=hmac.js.map

package/lib/module/utils/hmac.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["hmac","sha256","base64ToBytes","bytesToHexLower","importHmacKey","base64","raw","buildSignedFrameEnvelope","args","ts","timestamp","Date","now","digest","jpegBytes","digestHex","canonical","sessionId","frameId","mac","key","TextEncoder","encode","macHex","json","JSON","stringify","type","image","jpegBase64"],"sourceRoot":"../../../src","sources":["utils/hmac.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,IAAI,QAAQ,oBAAoB;AACzC,SAASC,MAAM,QAAQ,sBAAsB;AAC7C,SAASC,aAAa,EAAEC,eAAe,QAAQ,UAAU;AAMzD;AACA,OAAO,SAASC,aAAaA,CAACC,MAAc,EAAW;EACrD,OAAO;IAAEC,GAAG,EAAEJ,aAAa,CAACG,MAAM;EAAE,CAAC;AACvC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,wBAAwBA,CAACC,IAQxC,EAAuC;EACtC,MAAMC,EAAE,GAAGD,IAAI,CAACE,SAAS,IAAIC,IAAI,CAACC,GAAG,CAAC,CAAC;EACvC,MAAMC,MAAM,GAAGZ,MAAM,CAACO,IAAI,CAACM,SAAS,CAAC;EACrC,MAAMC,SAAS,GAAGZ,eAAe,CAACU,MAAM,CAAC;EACzC,MAAMG,SAAS,GAAG,GAAGR,IAAI,CAACS,SAAS,KAAKT,IAAI,CAACU,OAAO,KAAKT,EAAE,KAAKM,SAAS,EAAE;EAC3E,MAAMI,GAAG,GAAGnB,IAAI,CAACC,MAAM,EAAEO,IAAI,CAACY,GAAG,CAACd,GAAG,EAAE,IAAIe,WAAW,CAAC,CAAC,CAACC,MAAM,CAACN,SAAS,CAAC,CAAC;EAC3E,MAAMO,MAAM,GAAGpB,eAAe,CAACgB,GAAG,CAAC;EACnC,OAAO;IACLK,IAAI,EAAEC,IAAI,CAACC,SAAS,CAAC;MACnBC,IAAI,EAAE,OAAO;MACbT,OAAO,EAAEV,IAAI,CAACU,OAAO;MACrBR,SAAS,EAAED,EAAE;MACbmB,KAAK,EAAEpB,IAAI,CAACqB,UAAU;MACtBV,GAAG,EAAEI;IACP,CAAC,CAAC;IACFb,SAAS,EAAED;EACb,CAAC;AACH","ignoreList":[]}

package/lib/module/utils/iso3166Countries.js

@@ -0,0 +1,92 @@
+"use strict";
+
+/**
+ * ISO 3166-1 alpha-2 country list with localized display names.
+ *
+ * Strategy:
+ *   1. If `Intl.DisplayNames` is available (full ICU build, polyfilled
+ *      Hermes, native iOS runtime, …), use it — it covers every BCP-47
+ *      locale and stays current with ICU updates.
+ *   2. Otherwise fall back to a built-in map covering all 249 ISO 3166-1
+ *      alpha-2 codes in `es` and `en`. The names match the official
+ *      Spanish convention (es. wikipedia.org/wiki/ISO_3166-1) and the ISO
+ *      English short name. Hermes default builds (which ship without
+ *      `Intl.DisplayNames`) get full localized names without needing
+ *      `@formatjs/intl-displaynames`.
+ */
+
+import ISO_CODES from '../data/iso3166Alpha2Codes.json';
+import COUNTRY_NAMES from '../data/iso3166CountryNames.json';
+import { log } from './log';
+function intlLocaleTag(locale) {
+  if (locale === 'en') return 'en';
+  /** Rioplatense UI uses Spanish country names with regional formatting. */
+  if (locale === 'ar') return 'es-AR';
+  return 'es';
+}
+let didWarnAboutFallback = false;
+const NAMES_MAP = COUNTRY_NAMES;
+function fallbackName(code, lang) {
+  const entry = NAMES_MAP[code.toUpperCase()];
+  if (!entry || entry.length === 0) return code;
+  // [0] = es, [1] = en. Fall through to ES (or to the code itself) if the
+  // requested locale is missing.
+  return (lang === 'en' ? entry[1] : entry[0]) ?? entry[0] ?? code;
+}
+function buildResolver(localeTag) {
+  const lang = localeTag.toLowerCase().startsWith('en') ? 'en' : 'es';
+  const intl = globalThis.Intl;
+  if (intl && typeof intl.DisplayNames === 'function') {
+    try {
+      const dn = new intl.DisplayNames([localeTag], {
+        type: 'region'
+      });
+      // Wrap so unknown codes still fall back to the built-in map.
+      return {
+        of: code => dn.of(code) ?? fallbackName(code, lang)
+      };
+    } catch (err) {
+      // Some Hermes builds expose DisplayNames but throw on construction —
+      // fall through to the built-in map.
+      log.warn('[iso3166] Intl.DisplayNames threw, falling back', err);
+    }
+  }
+  if (!didWarnAboutFallback) {
+    didWarnAboutFallback = true;
+    log.info('[iso3166] Using built-in ISO 3166-1 country names (Intl.DisplayNames unavailable). ' + 'All 249 alpha-2 codes resolved via the bundled map.');
+  }
+  return {
+    of: code => fallbackName(code, lang)
+  };
+}
+
+/**
+ * Returns all ISO 3166-1 alpha-2 countries sorted by localized display name.
+ */
+export function listIso3166CountriesForUi(locale) {
+  const tag = intlLocaleTag(locale);
+  const codes = ISO_CODES;
+  const dn = buildResolver(tag);
+  const collator = globalThis.Intl?.Collator;
+  return codes.map(code => ({
+    code,
+    name: dn.of(code) ?? code
+  })).sort((a, b) => {
+    if (collator) {
+      return new collator(tag, {
+        sensitivity: 'base'
+      }).compare(a.name, b.name);
+    }
+    return a.name.localeCompare(b.name);
+  });
+}
+
+/**
+ * Filters by country name or code (case-insensitive).
+ */
+export function filterIso3166Countries(options, query) {
+  const q = query.trim().toLowerCase();
+  if (q.length === 0) return [...options];
+  return options.filter(o => o.code.toLowerCase().includes(q) || o.name.toLowerCase().includes(q));
+}
+//# sourceMappingURL=iso3166Countries.js.map

package/lib/module/utils/iso3166Countries.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ISO_CODES","COUNTRY_NAMES","log","intlLocaleTag","locale","didWarnAboutFallback","NAMES_MAP","fallbackName","code","lang","entry","toUpperCase","length","buildResolver","localeTag","toLowerCase","startsWith","intl","globalThis","Intl","DisplayNames","dn","type","of","err","warn","info","listIso3166CountriesForUi","tag","codes","collator","Collator","map","name","sort","a","b","sensitivity","compare","localeCompare","filterIso3166Countries","options","query","q","trim","filter","o","includes"],"sourceRoot":"../../../src","sources":["utils/iso3166Countries.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAOA,SAAS,MAAM,iCAAiC;AACvD,OAAOC,aAAa,MAAM,kCAAkC;AAC5D,SAASC,GAAG,QAAQ,OAAO;AAO3B,SAASC,aAAaA,CAACC,MAAc,EAAU;EAC7C,IAAIA,MAAM,KAAK,IAAI,EAAE,OAAO,IAAI;EAChC;EACA,IAAIA,MAAM,KAAK,IAAI,EAAE,OAAO,OAAO;EACnC,OAAO,IAAI;AACb;AAaA,IAAIC,oBAAoB,GAAG,KAAK;AAChC,MAAMC,SAAS,GAAGL,aAAsD;AAExE,SAASM,YAAYA,CAACC,IAAY,EAAEC,IAAiB,EAAU;EAC7D,MAAMC,KAAK,GAAGJ,SAAS,CAACE,IAAI,CAACG,WAAW,CAAC,CAAC,CAAC;EAC3C,IAAI,CAACD,KAAK,IAAIA,KAAK,CAACE,MAAM,KAAK,CAAC,EAAE,OAAOJ,IAAI;EAC7C;EACA;EACA,OAAO,CAACC,IAAI,KAAK,IAAI,GAAGC,KAAK,CAAC,CAAC,CAAC,GAAGA,KAAK,CAAC,CAAC,CAAC,KAAKA,KAAK,CAAC,CAAC,CAAC,IAAIF,IAAI;AAClE;AAEA,SAASK,aAAaA,CAACC,SAAiB,EAAuB;EAC7D,MAAML,IAAiB,GAAGK,SAAS,CAACC,WAAW,CAAC,CAAC,CAACC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;EAChF,MAAMC,IAAI,GAAIC,UAAU,CAAqCC,IAAI;EACjE,IAAIF,IAAI,IAAI,OAAOA,IAAI,CAACG,YAAY,KAAK,UAAU,EAAE;IACnD,IAAI;MACF,MAAMC,EAAE,GAAG,IAAIJ,IAAI,CAACG,YAAY,CAAC,CAACN,SAAS,CAAC,EAAE;QAAEQ,IAAI,EAAE;MAAS,CAAC,CAAC;MACjE;MACA,OAAO;QACLC,EAAE,EAAGf,IAAI,IAAKa,EAAE,CAACE,EAAE,CAACf,IAAI,CAAC,IAAID,YAAY,CAACC,IAAI,EAAEC,IAAI;MACtD,CAAC;IACH,CAAC,CAAC,OAAOe,GAAG,EAAE;MACZ;MACA;MACAtB,GAAG,CAACuB,IAAI,CAAC,iDAAiD,EAAED,GAAG,CAAC;IAClE;EACF;EACA,IAAI,CAACnB,oBAAoB,EAAE;IACzBA,oBAAoB,GAAG,IAAI;IAC3BH,GAAG,CAACwB,IAAI,CACN,qFAAqF,GACnF,qDACJ,CAAC;EACH;EACA,OAAO;IAAEH,EAAE,EAAGf,IAAI,IAAKD,YAAY,CAACC,IAAI,EAAEC,IAAI;EAAE,CAAC;AACnD;;AAEA;AACA;AACA;AACA,OAAO,SAASkB,yBAAyBA,CAACvB,MAAc,EAA0B;EAChF,MAAMwB,GAAG,GAAGzB,aAAa,CAACC,MAAM,CAAC;EACjC,MAAMyB,KAAK,GAAG7B,SAAqB;EACnC,MAAMqB,EAAE,GAAGR,aAAa,CAACe,GAAG,CAAC;EAC7B,MAAME,QAAQ,GAAIZ,UAAU,CACzBC,IAAI,EAAEY,QAAQ;EACjB,OAAOF,KAAK,CACTG,GAAG,CAAExB,IAAI,KAAM;IAAEA,IAAI;IAAEyB,IAAI,EAAEZ,EAAE,CAACE,EAAE,CAACf,IAAI,CAAC,IAAIA;EAAK,CAAC,CAAC,CAAC,CACpD0B,IAAI,CAAC,CAACC,CAAC,EAAEC,CAAC,KAAK;IACd,IAAIN,QAAQ,EAAE;MACZ,OAAO,IAAIA,QAAQ,CAACF,GAAG,EAAE;QAAES,WAAW,EAAE;MAAO,CAAC,CAAC,CAACC,OAAO,CAACH,CAAC,CAACF,IAAI,EAAEG,CAAC,CAACH,IAAI,CAAC;IAC3E;IACA,OAAOE,CAAC,CAACF,IAAI,CAACM,aAAa,CAACH,CAAC,CAACH,IAAI,CAAC;EACrC,CAAC,CAAC;AACN;;AAEA;AACA;AACA;AACA,OAAO,SAASO,sBAAsBA,CACpCC,OAAwC,EACxCC,KAAa,EACW;EACxB,MAAMC,CAAC,GAAGD,KAAK,CAACE,IAAI,CAAC,CAAC,CAAC7B,WAAW,CAAC,CAAC;EACpC,IAAI4B,CAAC,CAAC/B,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG6B,OAAO,CAAC;EACvC,OAAOA,OAAO,CAACI,MAAM,CAClBC,CAAC,IAAKA,CAAC,CAACtC,IAAI,CAACO,WAAW,CAAC,CAAC,CAACgC,QAAQ,CAACJ,CAAC,CAAC,IAAIG,CAAC,CAACb,IAAI,CAAClB,WAAW,CAAC,CAAC,CAACgC,QAAQ,CAACJ,CAAC,CAC5E,CAAC;AACH","ignoreList":[]}

package/lib/module/utils/jpegFromUri.js

@@ -0,0 +1,40 @@
+"use strict";
+
+/**
+ * Helpers for reading a captured photo into JPEG bytes.
+ *
+ * Vision-Camera writes captures to a `file://` path; consumers convert that
+ * path into either base64 (for the Iris HMAC envelope) or raw bytes (for
+ * binary WebSocket frames + direct PUT to signed URLs).
+ *
+ * Why not `fetch(uri).then(r => r.blob()).then(b => b.arrayBuffer())`?
+ *
+ * React Native's Blob polyfill does NOT implement `Blob.arrayBuffer()`
+ * (it's web-only). Calling it crashes with
+ * `TypeError: blob.arrayBuffer is not a function`. The reliable path on
+ * iOS + Android is the native `File.arrayBuffer()` from
+ * `expo-file-system` v19+, which reads directly from disk into an
+ * ArrayBuffer without going through the JS Blob bridge.
+ */
+
+import { File } from 'expo-file-system';
+import { bytesToBase64 } from './base64';
+/**
+ * Reads a `file://` URI into JPEG bytes + base64 representation.
+ *
+ * Accepts both forms vision-camera returns (`/var/mobile/...` without a
+ * scheme on iOS; `file:///data/...` on Android). Normalises to `file://`.
+ */
+export async function readJpegFromUri(uri) {
+  const normalised = uri.startsWith('file://') || uri.startsWith('http') ? uri : `file://${uri}`;
+  const file = new File(normalised);
+  const buf = await file.arrayBuffer();
+  const bytes = new Uint8Array(buf);
+  const base64 = bytesToBase64(bytes);
+  return {
+    bytes,
+    base64,
+    byteLength: bytes.byteLength
+  };
+}
+//# sourceMappingURL=jpegFromUri.js.map

package/lib/module/utils/jpegFromUri.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["File","bytesToBase64","readJpegFromUri","uri","normalised","startsWith","file","buf","arrayBuffer","bytes","Uint8Array","base64","byteLength"],"sourceRoot":"../../../src","sources":["utils/jpegFromUri.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,IAAI,QAAQ,kBAAkB;AACvC,SAASC,aAAa,QAAQ,UAAU;AAQxC;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,eAAeA,CAACC,GAAW,EAAwB;EACvE,MAAMC,UAAU,GAAGD,GAAG,CAACE,UAAU,CAAC,SAAS,CAAC,IAAIF,GAAG,CAACE,UAAU,CAAC,MAAM,CAAC,GAClEF,GAAG,GACH,UAAUA,GAAG,EAAE;EACnB,MAAMG,IAAI,GAAG,IAAIN,IAAI,CAACI,UAAU,CAAC;EACjC,MAAMG,GAAG,GAAG,MAAMD,IAAI,CAACE,WAAW,CAAC,CAAC;EACpC,MAAMC,KAAK,GAAG,IAAIC,UAAU,CAACH,GAAG,CAAC;EACjC,MAAMI,MAAM,GAAGV,aAAa,CAACQ,KAAK,CAAC;EACnC,OAAO;IAAEA,KAAK;IAAEE,MAAM;IAAEC,UAAU,EAAEH,KAAK,CAACG;EAAW,CAAC;AACxD","ignoreList":[]}

package/lib/module/utils/keepAwake.js

@@ -0,0 +1,53 @@
+"use strict";
+
+/**
+ * Thin wrapper around `expo-keep-awake` that prevents the device from
+ * locking the screen while the SDK is in the foreground. Without this,
+ * Android's screen-timeout policy kicks in during camera-heavy steps
+ * (LIVENESS_MATCH, DOCUMENTS_OCR) where the user is holding still and
+ * not interacting with the touchscreen — the screen dims, then locks,
+ * and the session is interrupted.
+ *
+ * Implementation is `require`-based so the SDK keeps working in bare
+ * React Native setups where `expo-keep-awake` may not be installed —
+ * in that case both calls degrade to no-ops and the host is expected to
+ * manage the wake lock itself.
+ */
+
+import { log } from './log';
+const TAG = 'velion-onboarding-sdk';
+let activated = false;
+function loadModule() {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+    const mod = require('expo-keep-awake');
+    return mod?.default ?? mod;
+  } catch {
+    return null;
+  }
+}
+export function activateScreenKeepAwake() {
+  if (activated) return;
+  const mod = loadModule();
+  if (!mod?.activateKeepAwakeAsync) {
+    log.info('[keep-awake] expo-keep-awake unavailable; host should manage the wake lock if screen-lock is unwanted during the flow');
+    return;
+  }
+  activated = true;
+  void mod.activateKeepAwakeAsync(TAG).catch(err => {
+    activated = false;
+    log.warn('[keep-awake] activate failed', err);
+  });
+}
+export function deactivateScreenKeepAwake() {
+  if (!activated) return;
+  const mod = loadModule();
+  activated = false;
+  if (!mod?.deactivateKeepAwake) return;
+  try {
+    void mod.deactivateKeepAwake(TAG);
+  } catch (err) {
+    log.warn('[keep-awake] deactivate failed', err);
+  }
+}
+//# sourceMappingURL=keepAwake.js.map

package/lib/module/utils/keepAwake.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["log","TAG","activated","loadModule","mod","require","default","activateScreenKeepAwake","activateKeepAwakeAsync","info","catch","err","warn","deactivateScreenKeepAwake","deactivateKeepAwake"],"sourceRoot":"../../../src","sources":["utils/keepAwake.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,GAAG,QAAQ,OAAO;AAE3B,MAAMC,GAAG,GAAG,uBAAuB;AAEnC,IAAIC,SAAS,GAAG,KAAK;AAOrB,SAASC,UAAUA,CAAA,EAA+B;EAChD,IAAI;IACF;IACA,MAAMC,GAAG,GAAGC,OAAO,CAAC,iBAAiB,CAAC;IACtC,OAAQD,GAAG,EAAEE,OAAO,IAAIF,GAAG;EAC7B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;AAEA,OAAO,SAASG,uBAAuBA,CAAA,EAAS;EAC9C,IAAIL,SAAS,EAAE;EACf,MAAME,GAAG,GAAGD,UAAU,CAAC,CAAC;EACxB,IAAI,CAACC,GAAG,EAAEI,sBAAsB,EAAE;IAChCR,GAAG,CAACS,IAAI,CACN,uHACF,CAAC;IACD;EACF;EACAP,SAAS,GAAG,IAAI;EAChB,KAAKE,GAAG,CAACI,sBAAsB,CAACP,GAAG,CAAC,CAACS,KAAK,CAAEC,GAAY,IAAK;IAC3DT,SAAS,GAAG,KAAK;IACjBF,GAAG,CAACY,IAAI,CAAC,8BAA8B,EAAED,GAAG,CAAC;EAC/C,CAAC,CAAC;AACJ;AAEA,OAAO,SAASE,yBAAyBA,CAAA,EAAS;EAChD,IAAI,CAACX,SAAS,EAAE;EAChB,MAAME,GAAG,GAAGD,UAAU,CAAC,CAAC;EACxBD,SAAS,GAAG,KAAK;EACjB,IAAI,CAACE,GAAG,EAAEU,mBAAmB,EAAE;EAC/B,IAAI;IACF,KAAKV,GAAG,CAACU,mBAAmB,CAACb,GAAG,CAAC;EACnC,CAAC,CAAC,OAAOU,GAAG,EAAE;IACZX,GAAG,CAACY,IAAI,CAAC,gCAAgC,EAAED,GAAG,CAAC;EACjD;AACF","ignoreList":[]}

package/lib/module/utils/log.js

@@ -0,0 +1,37 @@
+"use strict";
+
+/**
+ * @fileoverview Lightweight log gate.
+ *
+ * `log.info()` is silent unless either:
+ *   - `__DEV__` is true (Metro bundler injects this in development), or
+ *   - the host explicitly opted in via `VelionConfig.debug = true`.
+ *
+ * `log.warn()` / `log.error()` always go through. They sit on top of `console.*`
+ * so the host's logging pipeline (Sentry, Datadog, …) keeps capturing them.
+ */
+
+let runtimeDebugEnabled = false;
+
+/** Enables verbose logging at runtime. Called from VelionOnboarding when `config.debug === true`. */
+export function setDebugEnabled(enabled) {
+  runtimeDebugEnabled = enabled;
+}
+
+/** Internal — true when `log.info` should produce output. */
+function infoEnabled() {
+  return typeof __DEV__ !== 'undefined' && __DEV__ === true || runtimeDebugEnabled;
+}
+export const log = {
+  info(...args) {
+    if (!infoEnabled()) return;
+    console.info('[VelionSDK]', ...args);
+  },
+  warn(...args) {
+    console.warn('[VelionSDK]', ...args);
+  },
+  error(...args) {
+    console.error('[VelionSDK]', ...args);
+  }
+};
+//# sourceMappingURL=log.js.map

package/lib/module/utils/log.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["runtimeDebugEnabled","setDebugEnabled","enabled","infoEnabled","__DEV__","log","info","args","console","warn","error"],"sourceRoot":"../../../src","sources":["utils/log.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA,IAAIA,mBAAmB,GAAG,KAAK;;AAE/B;AACA,OAAO,SAASC,eAAeA,CAACC,OAAgB,EAAQ;EACtDF,mBAAmB,GAAGE,OAAO;AAC/B;;AAEA;AACA,SAASC,WAAWA,CAAA,EAAY;EAC9B,OAAQ,OAAOC,OAAO,KAAK,WAAW,IAAIA,OAAO,KAAK,IAAI,IAAKJ,mBAAmB;AACpF;AAEA,OAAO,MAAMK,GAAG,GAAG;EACjBC,IAAIA,CAAC,GAAGC,IAAe,EAAQ;IAC7B,IAAI,CAACJ,WAAW,CAAC,CAAC,EAAE;IACpBK,OAAO,CAACF,IAAI,CAAC,aAAa,EAAE,GAAGC,IAAI,CAAC;EACtC,CAAC;EACDE,IAAIA,CAAC,GAAGF,IAAe,EAAQ;IAC7BC,OAAO,CAACC,IAAI,CAAC,aAAa,EAAE,GAAGF,IAAI,CAAC;EACtC,CAAC;EACDG,KAAKA,CAAC,GAAGH,IAAe,EAAQ;IAC9BC,OAAO,CAACE,KAAK,CAAC,aAAa,EAAE,GAAGH,IAAI,CAAC;EACvC;AACF,CAAC","ignoreList":[]}