verant_id_cloud_scan 1.4.5 → 1.4.6-beta.0

package/Api.test.js

@@ -0,0 +1,338 @@
+/**
+ * Tests for the structured scanner-presence API (VNT-1522).
+ *
+ * Uses node:test (built-in, no extra deps) — run with `npm test`.
+ * `globalThis.fetch` is stubbed per test so we can simulate timeouts,
+ * network failures, HTTP errors, and scanner-layer body errors without
+ * needing a real local scanner.
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  checkScannerPresentDetailed,
+  buildSecurelinkUrl,
+  getNetworkInfo,
+} from "./Api.js";
+
+let originalFetch;
+
+beforeEach(() => {
+  originalFetch = globalThis.fetch;
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+/** Build a Response-like object the production code will treat as a real Response. */
+function jsonResponse(body, init = {}) {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { "Content-Type": "application/json" },
+    ...init,
+  });
+}
+
+describe("buildSecurelinkUrl — case-insensitive scheme detection (VNT-1522)", () => {
+  it("prepends http:// when no scheme is given", () => {
+    assert.equal(
+      buildSecurelinkUrl("192.168.1.50"),
+      "http://192.168.1.50/securelink",
+    );
+  });
+
+  it("preserves a lowercase https:// scheme", () => {
+    assert.equal(
+      buildSecurelinkUrl("https://192.168.1.50"),
+      "https://192.168.1.50/securelink",
+    );
+  });
+
+  it("preserves a lowercase http:// scheme", () => {
+    assert.equal(
+      buildSecurelinkUrl("http://192.168.1.50"),
+      "http://192.168.1.50/securelink",
+    );
+  });
+
+  it("preserves an UPPERCASE HTTPS:// scheme and does not double-prefix", () => {
+    // Previously this regressed to `http://HTTPS://...` because the SDK's
+    // `startsWith("https://")` check was case-sensitive.
+    assert.equal(
+      buildSecurelinkUrl("HTTPS://192.168.1.50"),
+      "HTTPS://192.168.1.50/securelink",
+    );
+  });
+
+  it("preserves a mixed-case Https:// scheme", () => {
+    assert.equal(
+      buildSecurelinkUrl("Https://192.168.1.50"),
+      "Https://192.168.1.50/securelink",
+    );
+  });
+
+  it("strips trailing slashes so /securelink is appended cleanly", () => {
+    assert.equal(
+      buildSecurelinkUrl("http://192.168.1.50/"),
+      "http://192.168.1.50/securelink",
+    );
+    assert.equal(
+      buildSecurelinkUrl("http://192.168.1.50///"),
+      "http://192.168.1.50/securelink",
+    );
+  });
+});
+
+describe("checkScannerPresentDetailed — happy path", () => {
+  it("returns ok=true when Connect responds with a SessionId", async () => {
+    let connectCalled = false;
+    let disconnectCalled = false;
+
+    globalThis.fetch = async (_url, init) => {
+      const body = JSON.parse(init.body);
+      if (body.Command === "Connect") {
+        connectCalled = true;
+        return jsonResponse({ SessionId: "abc-123" });
+      }
+      if (body.Command === "Disconnect") {
+        disconnectCalled = true;
+        return jsonResponse({});
+      }
+      throw new Error(`Unexpected command: ${body.Command}`);
+    };
+
+    const result = await checkScannerPresentDetailed("192.168.1.50");
+    assert.deepEqual(result, { ok: true });
+    assert.equal(connectCalled, true, "Connect should have been called");
+    assert.equal(disconnectCalled, true, "Disconnect should have been called");
+  });
+
+  it("still returns ok=true when Disconnect fails (scanner is present regardless)", async () => {
+    let attempt = 0;
+    globalThis.fetch = async (_url, init) => {
+      attempt += 1;
+      const body = JSON.parse(init.body);
+      if (body.Command === "Connect") {
+        return jsonResponse({ SessionId: "abc-123" });
+      }
+      // Disconnect call fails — should NOT degrade the ok=true return,
+      // since the host app's question ("is the scanner present?") has
+      // already been answered yes.
+      throw new TypeError("network error on disconnect");
+    };
+
+    const result = await checkScannerPresentDetailed("192.168.1.50");
+    assert.equal(result.ok, true);
+    assert.equal(attempt, 2, "both Connect and Disconnect should be attempted");
+  });
+});
+
+describe("checkScannerPresentDetailed — error codes", () => {
+  it("returns SCANNER_ERROR when 200 OK has no SessionId in body", async () => {
+    // Becca's case: HTTPS-only scanner being hit over HTTP returns 200 OK
+    // with a body like `{"HttpRC":"403", "ExtInformation":"Scanner not
+    // configured for HTTP"}`. The SDK's old boolean form collapsed this
+    // to `false`; the detailed form surfaces the vendor message.
+    globalThis.fetch = async () =>
+      jsonResponse({
+        HttpRC: "403",
+        Result: "12",
+        ErrorInformation: "Device specific error",
+        ExtInformation: "Scanner not configured for HTTP",
+      });
+
+    const result = await checkScannerPresentDetailed("192.168.1.50");
+    assert.equal(result.ok, false);
+    assert.equal(result.error.code, "SCANNER_ERROR");
+    assert.equal(result.error.message, "Scanner not configured for HTTP");
+    assert.equal(result.error.status, 403);
+    assert.equal(result.error.attemptedUrl, "http://192.168.1.50/securelink");
+    assert.equal(
+      result.error.scannerResponse.ExtInformation,
+      "Scanner not configured for HTTP",
+    );
+  });
+
+  it("returns HTTP_ERROR when the server replies with a non-2xx status", async () => {
+    globalThis.fetch = async () =>
+      new Response("Forbidden", { status: 403, statusText: "Forbidden" });
+
+    const result = await checkScannerPresentDetailed("192.168.1.50");
+    assert.equal(result.ok, false);
+    assert.equal(result.error.code, "HTTP_ERROR");
+    assert.equal(result.error.status, 403);
+    assert.equal(result.error.message, "Forbidden");
+    assert.equal(result.error.attemptedUrl, "http://192.168.1.50/securelink");
+  });
+
+  it("returns NETWORK_ERROR when fetch throws a TypeError (DNS, CORS, mixed content, etc.)", async () => {
+    globalThis.fetch = async () => {
+      throw new TypeError("Failed to fetch");
+    };
+
+    const result = await checkScannerPresentDetailed("192.168.1.50");
+    assert.equal(result.ok, false);
+    assert.equal(result.error.code, "NETWORK_ERROR");
+    assert.equal(result.error.name, "TypeError");
+    assert.match(result.error.message, /Failed to fetch/);
+    assert.equal(result.error.attemptedUrl, "http://192.168.1.50/securelink");
+  });
+
+  it("returns ABORTED when an already-aborted external signal is passed", async () => {
+    // Real browser fetch rejects synchronously when given an already-
+    // aborted signal — mirror that contract in the mock so the test
+    // doesn't deadlock if the listener is attached post-abort.
+    globalThis.fetch = async (_url, init) => {
+      if (init.signal?.aborted) {
+        const err = new Error("aborted");
+        err.name = "AbortError";
+        throw err;
+      }
+      return new Promise((_resolve, reject) => {
+        init.signal?.addEventListener("abort", () => {
+          const err = new Error("aborted");
+          err.name = "AbortError";
+          reject(err);
+        });
+      });
+    };
+
+    const controller = new AbortController();
+    controller.abort();
+    const result = await checkScannerPresentDetailed("192.168.1.50", {
+      signal: controller.signal,
+    });
+
+    assert.equal(result.ok, false);
+    assert.equal(result.error.code, "ABORTED");
+    assert.equal(result.error.name, "AbortError");
+  });
+
+  it("returns TIMEOUT when fetch aborts and no external signal was supplied", async () => {
+    // Simulates the internal 5s AbortController firing — fetch throws
+    // AbortError, no external signal was passed in, so classification
+    // falls through to TIMEOUT rather than ABORTED.
+    globalThis.fetch = async () => {
+      const err = new Error("aborted");
+      err.name = "AbortError";
+      throw err;
+    };
+
+    const result = await checkScannerPresentDetailed("192.168.1.50");
+
+    assert.equal(result.ok, false);
+    assert.equal(result.error.code, "TIMEOUT");
+    assert.equal(result.error.name, "AbortError");
+  });
+
+  it("returns INVALID_RESPONSE when the body isn't JSON", async () => {
+    globalThis.fetch = async () =>
+      new Response("<html>not json</html>", {
+        status: 200,
+        headers: { "Content-Type": "text/html" },
+      });
+
+    const result = await checkScannerPresentDetailed("192.168.1.50");
+    assert.equal(result.ok, false);
+    // The body parses as a non-object string, so the `typeof !== "object"`
+    // branch fires before the SessionId check.
+    assert.equal(result.error.code, "INVALID_RESPONSE");
+    assert.equal(result.error.status, 200);
+    assert.equal(result.error.attemptedUrl, "http://192.168.1.50/securelink");
+  });
+});
+
+describe("checkScannerPresentDetailed — AbortSignal support", () => {
+  it("propagates an external abort to the in-flight fetch", async () => {
+    let fetchSignal = null;
+    globalThis.fetch = async (_url, init) => {
+      fetchSignal = init.signal;
+      if (init.signal?.aborted) {
+        const err = new Error("aborted");
+        err.name = "AbortError";
+        throw err;
+      }
+      return new Promise((_resolve, reject) => {
+        init.signal.addEventListener("abort", () => {
+          const err = new Error("aborted");
+          err.name = "AbortError";
+          reject(err);
+        });
+      });
+    };
+
+    const controller = new AbortController();
+    const resultPromise = checkScannerPresentDetailed("192.168.1.50", {
+      signal: controller.signal,
+    });
+
+    // Give the fetch microtask a beat to start, then abort externally.
+    await Promise.resolve();
+    controller.abort();
+
+    const result = await resultPromise;
+    assert.equal(result.ok, false);
+    assert.equal(result.error.code, "ABORTED");
+    assert.equal(
+      fetchSignal.aborted,
+      true,
+      "the fetch's signal should have been aborted",
+    );
+  });
+});
+
+describe("postToScannerApi (throw-on-error wrapper) — JSON contract (VNT-1522)", () => {
+  // Tested via `getNetworkInfo`, the simplest of the thin wrappers around
+  // `postToScannerApi`. Behaviour must match here for every wrapper —
+  // they're identical one-liners.
+
+  it("returns the parsed object on a 2xx JSON response", async () => {
+    globalThis.fetch = async () => jsonResponse({ NetworkInfo: { ip: "x" } });
+    const result = await getNetworkInfo("192.168.1.50", { Command: "GetNetworkInfo" });
+    assert.deepEqual(result, { NetworkInfo: { ip: "x" } });
+  });
+
+  it("throws on a 2xx response with a non-JSON body (preserves the response.json() contract)", async () => {
+    // Pre-VNT-1522 behaviour: the wrapper called `response.json()` which
+    // threw `SyntaxError` on invalid JSON. The detailed-form refactor
+    // accepted non-JSON bodies (kept them as strings for diagnostics);
+    // the wrapper has to re-throw so existing callers — which all read
+    // object properties off the return value — fail loudly instead of
+    // silently receiving a string.
+    globalThis.fetch = async () =>
+      new Response("not json", {
+        status: 200,
+        headers: { "Content-Type": "text/plain" },
+      });
+
+    await assert.rejects(
+      getNetworkInfo("192.168.1.50", { Command: "GetNetworkInfo" }),
+      /not a JSON object/,
+    );
+  });
+
+  it("throws on a 2xx response with an empty body", async () => {
+    globalThis.fetch = async () =>
+      new Response("", {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+
+    await assert.rejects(
+      getNetworkInfo("192.168.1.50", { Command: "GetNetworkInfo" }),
+      /not a JSON object/,
+    );
+  });
+
+  it("throws on non-2xx HTTP responses (unchanged)", async () => {
+    globalThis.fetch = async () =>
+      new Response("Forbidden", { status: 403, statusText: "Forbidden" });
+
+    await assert.rejects(
+      getNetworkInfo("192.168.1.50", { Command: "GetNetworkInfo" }),
+      /Forbidden/,
+    );
+  });
+});

package/CHANGELOG.md

@@ -0,0 +1,254 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.4.6-beta.0] - 2026-07-01
+
+> First beta of the `1.4.6` line, cut from the reset (SF-free) `staging`
+> (`1.4.5` is already published as `latest`, so further `1.4.5-beta`s would sort
+> below it). Does **not** include the VNT-1464 / AAMVA 3.0 work
+> (`extractPortraitFromLicense`, `person_digital_image`) — that rejoins on a
+> later beta once AAMVA 3.0 ships.
+
+### Added
+- **`checkDigitalIDFeature(clientId)`** (VNT-1643). Returns `true` only when the
+  client has a `mobile_id` feature license that exists and is unexpired, by
+  POSTing to the license server's `/mobile_id/check_license` endpoint. Mirrors
+  `checkDmvFeature` / `checkFaceCompareFeature` through `Api.js` →
+  `ScannerApi.js` → `CloudScan.js`, and is typed in `index.d.ts`. Lets host apps
+  gate the "Read Digital ID" capture method on MDL licensing.
+
+## [1.4.5-beta.11] - 2026-05-21
+
+### Added
+- **`scannerPresentDetailed(scannerAddress, options?)`** (VNT-1522). Returns
+  a structured `{ ok, error? }` result so host apps can distinguish
+  timeouts, host-app cancellations, network errors, HTTP-level errors,
+  application-layer scanner errors (e.g. HTTPS-only scanner refusing HTTP
+  with `HttpRC:403` / `ExtInformation` in the body), and missing-
+  `SessionId` responses. The `error` object carries `code` (`TIMEOUT` |
+  `ABORTED` | `NETWORK_ERROR` | `HTTP_ERROR` | `INVALID_RESPONSE` |
+  `SCANNER_ERROR`), `name`, `message`, `status`, `attemptedUrl`, and the
+  raw `scannerResponse` body for the `SCANNER_ERROR` case so callers can
+  surface vendor-specific text. `ABORTED` is distinct from `TIMEOUT` so
+  UI copy that branches on "scanner timed out" doesn't mislabel a user-
+  cancelled probe.
+- Optional `signal: AbortSignal` parameter on `scannerPresentDetailed` so
+  host apps can cancel an in-flight probe on retry / unmount instead of
+  waiting for the internal 5s timeout.
+- `Api.test.js` — first test suite in this repo, using Node's built-in
+  `node:test` runner (zero new dependencies). Covers timeout, HTTP 4xx,
+  network error, scanner-error-in-body, invalid response, AbortSignal
+  propagation, happy path, and case-insensitive scheme detection.
+
+### Fixed
+- Case-insensitive scheme detection in `postToScannerApi` URL builder
+  (VNT-1522). Previously `HTTPS://192.168.1.50` was treated as having no
+  scheme and double-prefixed to `http://HTTPS://...`; now matches `/^https?:\/\//i`
+  per RFC 3986.
+
+### Changed
+- `scannerPresent` (boolean) now delegates to `scannerPresentDetailed`.
+  One small behaviour difference: a failed Disconnect after a successful
+  Connect no longer flips the return to `false`. From the host app's
+  perspective the scanner IS present at that point, and the leaked
+  session times out server-side per the scanner's `IdleTimeout`. The
+  pre-refactor behaviour was a side-effect of the older try/catch wrap;
+  treating the disconnect as best-effort is the intended contract.
+- `package.json` `test` script now runs Node's built-in `node --test`
+  runner instead of stubbing an error.
+
+## [1.4.5-beta.10] - 2026-05-11
+
+### Fixed
+- iOS HPKE decryption failure on non-default hosts (e.g. ngrok tunnels,
+  custom staging domains). `startMobileVerification()` now derives the
+  holder page origin from `mobileVerifyBaseUrl` (falling back to the
+  CSR page's `window.location.origin` for same-origin dev setups) and
+  forwards it to `POST /sessions`. The backend uses this origin to
+  build its SessionTranscript, which must match the origin the mobile
+  wallet binds to. Without it, the server fell back to a per-environment
+  default that disagreed with the wallet's view, causing
+  `"Decryption failed: Could not decrypt credential response"` (400).
+- `WebSocketClient.connect()` no longer hangs forever when the underlying
+  socket emits `onerror` or `onclose` before `onopen`. The returned Promise
+  now rejects with a tagged error in those paths so awaiters can handle
+  connection failures instead of waiting indefinitely.
+- `startMobileVerification()` QR code URL construction now uses `new URL()`
+  to safely combine `mobileVerifyBaseUrl` with the session id. Previously,
+  a base URL containing a query string or hash (e.g. `https://host/path?x=1`)
+  produced an invalid result like `https://host/path?x=1/{session_id}`.
+- `createVerificationSession()` no longer throws "body stream already
+  read" when an error response is not valid JSON. The response body is
+  now read once as text, then parsed in a try/catch instead of using
+  `response.json()` followed by a `response.text()` fallback.
+- `startMobileVerification()` no longer emits duplicate `onError`
+  callbacks when a WebSocket failure surfaces via both
+  `WebSocketClient.connect()` and the outer catch. Errors already
+  reported by a lower layer carry an `error.reported` flag, and the
+  outer catch skips re-emitting in that case.
+- `WebSocketClient.connect()` now invokes `callbacks.onError` from the
+  close-before-open path (previously only `onerror` did). Direct
+  `connectToVerificationSession` callers receive the failure event
+  even when no preceding `onerror` fires (e.g., server closes the
+  socket immediately). The synthesized error carries `reported: true`
+  so `startMobileVerification`'s outer catch still avoids double-emit.
+- `WebSocketClient._handleMessage()` no longer logs the raw WebSocket
+  frame to the console. Verification payloads carry PII (mDL fields,
+  portrait base64), so the raw `console.log` of `data` was dropped.
+  Per-route type logs below remain for debug visibility.
+- `WebSocketClient.connect()` now releases its socket reference when
+  `onerror` fires before `onopen`, so callers can immediately retry
+  `connect()` without hitting "WebSocket connection already exists"
+  in implementations where `onclose` doesn't fire after `onerror`.
+- `WebSocketClient` now transitions to the `ERROR` state (not
+  `CLOSED`) when the socket closes before opening, so
+  `status`/`onStatusChange` reflect a connection failure rather than
+  a normal disconnect. Post-open closes still transition to `CLOSED`.
+  Now driven by an explicit `hasOpened` flag (set in `onopen`) — the
+  previous version used the Promise's `settled` flag, which is also
+  set by pre-open `onerror` and would incorrectly downgrade the
+  ERROR state to CLOSED when the follow-up onclose fired.
+- `WebSocketClient.connect()` synchronous-throw rejections now carry
+  a stable `.code` (`NO_WEBSOCKET_IMPL` when the Node fallback fails,
+  `CONNECTION_FAILED` when the `WebSocket` constructor throws). The
+  thrown/rejected error now matches the structured `onError` payload,
+  so awaiters of the Promise can branch on the failure reason without
+  relying on the `onError` callback.
+- `WebSocketClient.disconnect()` called while the socket is still
+  CONNECTING no longer reports a spurious connection error. The
+  `onclose` triggered by the user-initiated close used to flip
+  `status` from `closed` back to `error` and emit `onError`; it now
+  detects an instance-level `_closeRequested` flag set by
+  `disconnect()` and skips both. The pending `connect()` Promise
+  rejects with `code: 'CLIENT_DISCONNECTED'` so awaiters resolve.
+- `WebSocketClient._handleMessage()` now decodes binary WebSocket
+  frames (Node `Buffer` from the `ws` package, browser `ArrayBuffer`
+  / `Uint8Array` when `binaryType === 'arraybuffer'`) via `TextDecoder`
+  before `JSON.parse`. Previously, anything that wasn't a string
+  passed through as-is, so `routeKey` was always undefined and every
+  frame was silently dropped as "Unknown message route."
+- Removed informational `console.log` calls from the mobile
+  verification code path (`WebSocketClient` + `startMobileVerification`).
+  Several of them embedded the `session_id` or QR target URL, which
+  is effectively a session access token and shouldn't be sent to
+  application logs / monitoring. Diagnostic `console.warn` and
+  `console.error` calls are preserved.
+
+### Changed
+- `startMobileVerification()` error callbacks now emit stage-specific
+  codes — `SESSION_CREATION_FAILED`, `QR_GENERATION_FAILED`, or
+  `WEBSOCKET_CONNECTION_FAILED` — so callers can distinguish which step
+  failed. Upstream `error.code` values are preserved when present.
+
+### Internal
+- The internal `createVerificationSession()` API helper gained an
+  optional third `origin` parameter; `startMobileVerification()` now
+  populates it from `mobileVerifyBaseUrl` (or `window.location.origin`
+  for same-origin dev). Host apps don't need to change anything — keep
+  calling `startMobileVerification()` as before.
+- `package.json` now declares a `"browser": { "ws": false }` field so
+  browser bundlers (Vite / Webpack / Rollup) stub out the Node-only
+  `ws` optional dependency instead of trying to bundle it. Has no
+  effect in Node — the dynamic `import('ws')` fallback still works.
+
+## [1.4.5-beta.9] - 2026-04-21
+
+### Added
+- Mobile ID verification support (VNT-1409, VNT-1419, VNT-1429, VNT-1455)
+  - Added `startMobileVerification()` function to initiate mobile verification sessions
+  - Added `createVerificationSession()` API function to create verification sessions with user ID and client ID
+  - Added WebSocket client (`WebSocketClient.js`) for real-time verification updates from AWS API Gateway
+  - Added mobile verification server address configuration with environment detection
+  - QR code generation for mobile verification sessions with customizable base URLs
+  - Real-time verification callbacks: `onVerificationStarted`, `onResult`, `onStatusChange`, `onError`
+  - Session management with session ID, session URL, WebSocket URL, and QR code SVG
+  - Connection state management (CONNECTING, OPEN, CLOSED, ERROR) for WebSocket connections
+
+### Changed
+- Updated environment detection to support mobile verification endpoints
+  - Mobile verification uses `staging.mdl.verantid.bluerocket.us` for staging
+  - Mobile verification uses `mdl.verantid.bluerocket.us` for production
+- Updated scanner type detection to use `scannerProfile` from scanner response in auto-DMV verification
+- Enhanced TypeScript definitions (`index.d.ts`) to include mobile verification types and callbacks
+
+## [1.4.5-beta.8] - 2026-04-15
+
+### Changed
+- Moved UV/IR image type definitions to scanner profile configuration
+  - Added `frontUvImageType`, `backUvImageType`, `frontIrImageType`, and `backIrImageType` to IDXpressPlus profile
+  - Updated image extraction logic to use profile-defined UV/IR types instead of hardcoded strings
+- Updated TypeScript definitions (`index.d.ts`) to include UV/IR base64 fields in `scanId` return type
+- Removed UV/IR fields from local scanner functions (`localScanId`, `localContinueScanId`) as local scanners do not support UV/IR imaging
+
+### Fixed
+- Eliminated redundant variable declarations in `ScannerApi.js` by declaring UV/IR variables at function scope
+
+## [1.4.5-beta.7] - 2026-04-15
+
+### Changed
+- Internal refactoring and code review fixes
+
+## [1.4.5-beta.6] - 2026-04-15
+
+### Added
+- UV/IR image support for IDXpressPlus scanner profile
+  - Added `licenseFrontUvBase64`, `licenseBackUvBase64`, `licenseFrontIrBase64`, and `licenseBackIrBase64` fields to scan results
+  - Scanner now captures and returns ultraviolet (UV) and infrared (IR) images alongside standard color images
+  - Image types supported: fclr (front color), rclr (rear color), fclruv (front UV), rclruv (rear UV), fgsir (front IR), rgsir (rear IR)
+
+### Fixed
+- Image extraction logic now captures all image types from scanner response instead of only front/back color images
+
+### Changed
+- Updated IDXpressPlus scanner profile to include UV/IR parameters in default settings and restore configuration
+  - Added `clrUvIrResolution`, `fclrUvEnabled`, `rclrUvEnabled`, `fgsIrEnabled`, and `rgsIrEnabled` to `restoreParamKeys`
+- Updated `ScannerApi.js` to extract UV/IR images from GetDocument response
+- Updated `CloudScan.js` `scanId` function to return UV/IR image data (`licenseFrontUvBase64`, `licenseBackUvBase64`, `licenseFrontIrBase64`, `licenseBackIrBase64`)
+- Local scanner functions (`localScanId`, `localContinueScanId`) do not include UV/IR fields as local scanners (VerantId6S) do not support UV/IR imaging
+
+## [1.4.5-beta.5] - 2026-04-14
+
+### Changed
+- Applied dynamic environment URLs to face comparison feature
+
+## [1.4.5-beta.4] - 2026-04-14
+
+### Added
+- Error validation for invalid environment type
+
+### Changed
+- Updated default server URLs to production endpoints
+
+## [1.4.5-beta.3] - 2026-04-13
+
+### Fixed
+- Various bug fixes and code quality improvements
+
+## [1.4.5-beta.2] - 2026-04-12
+
+### Added
+- Dynamic environment detection for server URLs
+- Support for multiple deployment environments
+
+### Changed
+- Server address handling now supports trailing slashes
+- Code improvements based on Copilot suggestions
+
+## [1.4.5-beta.1] - 2026-04-11
+
+### Added
+- IDXpress scanner profiles support
+- New scanner profile configuration options
+
+---
+
+## Version Number Guide
+
+- **Major** (1.x.x): Breaking changes
+- **Minor** (x.4.x): New features, backwards compatible
+- **Patch** (x.x.5): Bug fixes, backwards compatible
+- **Beta** (x.x.x-beta.x): Pre-release versions for testing