vuer_web_sdk

Browser-embeddable FaceKom Web SDK: a React/TypeScript single-page client that runs the FaceKom self-service v2 identity-verification flow (registration, ID photos, liveness, hologram, consents, 2FA, data confirmation) inside a partner’s website. It is built with Vite into an IIFE bundle + CSS that partners load via a <script>/<link> tag pointing at their CSS (Customer Self-Service) host. The SDK talks to the FaceKom backend over a Socket.IO connection and a WebRTC peer connection; it has no backend of its own.

Repo: github.com/TechTeamer/vuer_web_sdk (base branch devel, HEAD f28daf7 “chore: [fkqa-327] maintenance/devel (#115)”). Verified vuer_web_sdk/ (git remote + log).
Related: architecture-overview, vuer_oss, vuer_css, customization-architecture, customization-branch-catalog.

Naming

Internal version constants are APP_VERSION = '1.0.0' and SDK_VERSION = '2.7.6' (src/core/version.ts:1-2); package.json version is 1.0.0. The RELEASE.md changelog tracks SDK_VERSION semantics (latest entry v2.7.6).

1. Purpose & role in FaceKom

package.json:5 — "description": "Facekom Web SDK". public/index.html:10-11 describes the sample harness as “Sample app for FaceKom WebSDK”.
docs/developer.guide.en.md:33 — “The WebSDK is designed to enable FaceKom partners to integrate FaceKom features into their websites intended for their customers.”
Integration model (docs/developer.guide.en.md:39-58): partner embeds two files from their CSS host —
- <script id="facekom-web-sdk-script" defer src="https://{{cssHost}}/sdk/web-sdk.js" data-css-host="{{cssHost}}">
- <link rel="stylesheet" href="https://{{cssHost}}/sdk/web-sdk.css">
- plus a mount point <div id="facekom-web-sdk-root">.
The SDK reads runtime options from the <script> tag’s data-* attributes (src/index.tsx:8-30): cssHost, customText, registration, exit, torch, goodbye, token, language.
It is the browser-side counterpart to the FaceKom self-service feature; the backend (CSS/OSS) drives the step flow by emitting selfService:v2:nextStep etc. over Socket.IO (src/core/self-service-v2/controller.ts:216-224).

The 10 verification-flow steps supported (src/core/self-service-v2/version.ts → SUPPORTED_STEPS, and StepType enum src/core/self-service-v2/types/step.types.ts:1-15): registration, 2-factor, consent-pep (prominent public figure), consent-ttny (beneficial owner / “tényleges tulajdonos”), customer-portrait, id-front, id-back, proof-of-address, liveness-check-v1, hologram-v2, data-confirmation, plus terminal error / good_bye. (SUPPORTED_STEPS lists the 10 sent to the backend; registration, error, good_bye are client-local.)

2. Tech stack & runtime

Aspect	Value	Source
Language	TypeScript 5.5 (`^5.5.4`)	`package.json:56`
UI framework	React 18 (`^18.2.0`) + ReactDOM	`package.json:25-26`
Build tool	Vite 8 (`^8.0.8`) + `@vitejs/plugin-react`	`package.json:51,57`
Component lib	MUI 5 (`@mui/material ^5.10.0`, `@mui/icons-material`), Emotion	`package.json:11-16`
Styling	SASS (`.sass` modules), `sass ^1.54.4`	`package.json:55`
Realtime	`socket.io-client ^4.5.1`, `webrtc-adapter ^9.0.1`	`package.json:32,35`
i18n	`i18next ^23.14`, `react-i18next ^15.0.1` (hu/en)	`package.json:22,28`
Forms / validation	`react-hook-form 7.48.2`, `yup ^1.4`, `@hookform/resolvers`, `class-validator ^0.15.1`, `class-transformer ^0.5.1`	`package.json:14,17-18,27,36`
Other	`eventemitter3`, `framer-motion`, `react-webcam`, `ua-parser-js`, `usehooks-ts`, `classnames`, `lodash.isequal`	`package.json:19-34`
Node engine	`>=20.9.0` (`engines`); README pins v20.19.5 (“higher versions not currently supported”)	`package.json:7-9`, `README.md:3-4`
Package manager	Yarn (classic v1.22.x) — `yarn.lock` present (147 KB); CI uses `yarn install --frozen-lockfile`; maintenance logs show `yarn v1.22.22`	`yarn.lock`, `.github/workflows/lint.yaml:17`, `maintenance/2026-05-04.md:86`
Lint	ESLint 9 flat config (`eslint.config.mjs`), `@typescript-eslint` v8	`package.json:43-52`, `eslint.config.mjs`

Node version mismatch between manifest and README

package.json engines.node allows >=20.9.0 and CI lints on Node 20 and 22 (.github/workflows/lint.yaml:9), but README.md:3-4 says only v20.19.5 is supported, “higher versions are not currently supported due to compatibility issues.” Treat Node 20.x as the safe target.

Vite 8 + decorators

Config uses experimentalDecorators (tsconfig.app.json:10 sets experimentalDecorators: true). class-validator/class-transformer decorators are used in src/core/self-service-v2/config.ts. The app config tsconfig.app.json is the one that includes src (tsconfig.app.json:31); tsconfig.node.json is the one scoped to vite.config.ts; root tsconfig.json is references-only (no compilerOptions).

3. Build & run

Entrypoints

Library/app entry: src/index.tsx (vite.config.ts:16 lib.entry, and rollupOptions.input.app). package.json:4 "main": "index.tsx".
Sample HTML host: public/index.html (dev server opens it — vite.config.ts:31).
Build emits an IIFE bundle named main.js into build/ with sourcemaps (vite.config.ts:14-28).

`package.json` scripts (verbatim — `package.json:59-65`)

Script	Command	What it does
`start`	`vite`	Starts the Vite dev server (HMR). Opens `public/index.html`, serves over HTTPS on `VITE_HOST:VITE_PORT` using the cert/key from `.env` (`vite.config.ts:30-38`). README: `yarn start`.
`build`	`tsc -b && NODE_ENV=production vite build`	Type-checks via project references then produces the production IIFE bundle in `build/`.
`lint`	`eslint .`	Lints the repo (ignores `build/**`).
`lint:fix`	`eslint --fix .`	Lints and auto-fixes.
`type-check`	`tsc --build`	Runs the TypeScript build (no emit) across `tsconfig.app.json` + `tsconfig.node.json`.

Start command

yarn          # install deps
yarn start    # dev server (HTTPS, port from VITE_PORT=30480)
# production:
yarn build    # -> build/  (IIFE bundle + style.css + .map)

Dockerfile

No Dockerfile / docker-compose / .dockerignore in the repo.

Verified via git ls-tree (item 3): there is no containerization in this repo. Deployment is “build the static bundle, copy it to the CSS host’s /sdk/ directory” (see copy_build.sh below).

4. Top-level structure

Verified by git ls-tree -r HEAD (binaries/images noted, never read).

Path	Role
`src/`	All first-party TypeScript/React source (see §6).
`src/core/self-service-v2/`	Headless flow engine: config, controller, state, services, steps, events, types.
`src/common/`	Cross-cutting: typed error classes, utils, WebRTC peer.
`src/ui/`	React UI: `SelfServiceV2` root, per-step pages, shared components/hooks/layouts.
`src/translations/`	Bundled i18n JSON (`en/`, `hu/`) — 11 namespaces each.
`src/@types/`	Ambient declarations (`global.d.ts`, `customColors.d.ts`, `i18next.d.ts`, `sass.d.ts`, `svg.d.ts`).
`public/`	Sample host page (`index.html`), fonts, favicons/logos, `manifest.json`, `default.css`, `static/translations/translations.json` (custom-text demo payload).
`docs/`	Developer + branding + translations guides (en/hu) and screenshot `images/`.
`maintenance/`	Dated dependency-maintenance logs (`yarn outdated` before/after). 16 files, 2023-10 → 2026-05.
`security/`	Dated `yarn audit` logs (before/after). 16 files, mirrors `maintenance/`.
`.github/workflows/lint.yaml`	CI: lint + type-check on Node 20 & 22 for PRs.
(root)	`package.json`, `vite.config.ts`, `tsconfig*.json`, `eslint.config.mjs`, `.env`, `copy_build.sh`, `README.md`, `RELEASE.md`, `.editorconfig`, `.gitignore`.

No build/, dist/, or node_modules/ are tracked (.gitignore:4-12). No Git-LFS (.gitattributes absent — confirmed). public/font/*.woff*, public/img/**, docs/images/** are static binaries (not read).

5. First-party helper scripts (bin / shell)

There is no first-party bin/ directory.

Verified via git ls-tree (item 5). The only shell script in the repo is:

copy_build.sh (copy_build.sh:1-27) — build-and-deploy helper. Defines two bash functions:
- Build: echo "Running yarn & yarn build"; yarn && yarn build.
- Copy: copies the three build artifacts into the vuer_css SDK serving directory:
  - build/style.css → $css_sdk_folder/web-sdk.css
  - build/vuer_web_sdk.iife.js → $css_sdk_folder/web-sdk.js
  - build/vuer_web_sdk.iife.js.map → $css_sdk_folder/vuer_web_sdk.iife.js.map
- Hard-coded paths: sdk_folder=/workspace/vuer_web_sdk, css_sdk_folder=/workspace/vuer_css/web/sdk. Runs Build then Copy.

copy_build.sh couples this repo to a sibling vuer_css checkout

It assumes both repos live under /workspace/ and copies the bundle straight into vuer_css/web/sdk/. The output filenames it copies (vuer_web_sdk.iife.js, style.css) are Vite/Rollup defaults; they are not pinned in vite.config.ts (which only sets lib.name = 'main.js' and output.dir = 'build'). Confirm artifact names after a yarn build before relying on this script.

6. Key modules / services / entities

The codebase splits cleanly into core/self-service-v2 (framework-agnostic flow engine) and ui (React rendering). The controller is the bridge.

Bootstrap

src/index.tsx — DOM bootstrap. Reads the <script id="facekom-web-sdk-script"> data-* attributes into a config object (:8-30), parses an optional <script id="facekom-web-sdk-colors" type="application/json"> block and applies each valid color as a --fk-{group}-{key} CSS custom property (:37-51, validated by an isColor regex :32-35), builds an MUI theme from those CSS vars (:53-120), and renders <App> inside ThemeProvider. Listens for facekom-web-sdk-exit to root.unmount() (:128-130).
src/App.tsx — instantiates SelfServiceV2Controller(new SelfServiceV2Config(props)) and orchestrates lifecycle in useEffect: controller.checkDevices() → initialize() → start({authToken, isRegistration}) (:27-32). Wires onError/onWindow (re-dispatches controller events as DOM CustomEvents, :18-25) and exposes globals window.facekomWebSDKExit and window.facekomWebSDKChangeLanguage (:35-40, typed in src/@types/global.d.ts:4-8). Handles onRestart (:61-68).

Flow engine — `src/core/self-service-v2/`

config.ts — SelfServiceV2Config (extends SelfServiceV2ConfigPlain). Uses class-validator decorators (@IsUrl, @IsBoolean, @IsInt @Min(0), @IsArray…) to validate runtime options. Defaults: socketTimeout = 30 * SECOND, screenshotMaxWidth = 1280, screenshotMargin = 30, supportedLocales = ['hu','en'], defaultLanguage = 'hu'. transform() strips the https?:// scheme from cssHost (:72-74). Validates via ValidationUtils.validate (:68-70). Stores a JSON snapshot for instance comparison (:53-65).
controller.ts — SelfServiceV2Controller extends SelfServiceV2EventController (≈290 lines, the heart of the SDK). Owns config, state, services, steps.
- checkDevices() throws DEVICE_CHECK_NO_CAMERA if camCount === 0 (:64-69).
- initialize() — inits services, languages, fetches settings (compat check), connects the socket, registers socket listeners (:71-96).
- start() — if no token or isRegistration, shows the local Registration step; otherwise calls backend selfService:v2:auth + selfService:v2:start (:131-158).
- Backend-driven step routing via socket subscriptions: selfService:v2:nextStep → changeStep, selfService:v2:stepMessage → onStepMessage, selfService:v2:end → onRoomEnd (:216-224).
- changeStep() — creates the next step via the factory, runs onBeforeNewStep/onSameStep, disposes the old step (:226-251).
- User actions: exit() → selfService:v2:abort, skip() → selfService:v2:skip (guards required steps), stop() → GoodBye or exit event, setLocale() (:160-206).
- Socket disconnect handling: reconnect-with-error vs terminal SOCKET_DISCONNECTED error step (:112-129).
state.ts — tiny: authToken, settings, currentStep (:4-8).
events.ts — SelfServiceV2EventController abstract base over eventemitter3; public onRestart/onWindow/onNewStep/onUpdateStep/onError/onResetError/onInitialize/onEnd subscription API with disposable listener IDs.
event-topics.ts — frozen topic constants, incl. nested Socket.{END,NEXT_STEP,STEP_MESSAGE}.

Services (`services/`) — registered & initialized in order (`services/index.ts:32-43`)

Service	File	Responsibility
`SocketService`	`socket.service.ts` (123)	Socket.IO client. Connects to `wss://${cssHost}` (`:103-104`), `sendRequest` with per-call timeout (`:85-93`), subscribe-with-error-emit (`:70-83`), manual reconnect loop (`:55-68,95-100`).
`SettingsService`	`settings.service.ts` (27)	`GET https://${cssHost}/api/mobile/settings?osType=web&version=${APP_VERSION}&sdkVersion=${SDK_VERSION}`; throws `CompatibilityError` if `!isCompatible` (`:11-26`).
`SelfServiceV2Service`	`self-service-v2.service.ts` (109)	All backend RPCs over the socket (`executeAction` unwraps `[errorMessage, response]`, throws `BackendError` `:100-108`). Auth (`:15-31`), photo, video, peer config, abort, debug. Manages `localStorage.authToken` (`:33-43`) and the WebRTC `SelfServicePeer` (`:67-82`).
`DeviceService`	`device.service.ts` (93)	Enumerates `mediaDevices` to count mic/cam/speaker, detects mobile via UAParser, NFC capability via `NDEFReader`, returns `DeviceInfo` (`:81-92`).
`LanguageService`	`language.service.ts` (157)	i18next init with bundled `en`/`hu` JSON across 11 namespaces; if `isCustomText`, fetches `GET https://${cssHost}/sdk/translations` and overlays it (`:69-115`).
`BaseService` / `service.dependencies.ts`		Base classes injecting `{config, services, emitter}` (`base.service.ts`, `components/service.dependencies.ts`).

Steps (`steps/`) — factory pattern

steps/index.ts — SelfServiceV2Steps.STEP_FACTORY maps each StepType to a BaseStep subclass. Notably customer-portrait, id-front, id-back, proof-of-address all instantiate PhotoStep (:23-34). createStep throws on unknown type (:37-44).
steps/base.step.ts — BaseStep abstract; holds stepData, optional handler, scoped event-listener registration that only fires while the step is current (:30-51), dispose() removes listeners.
Step files (each exports a *Step + a *StepHandler): error.step.ts, registration.step.ts, two-factor.step.ts, consent-pep.step.ts, consent-ttny.step.ts, photo.step.ts, liveness-check.step.ts, hologram.step.ts, data-confirmation.step.ts, good-bye.step.ts.
steps/components/step.handler.ts — StepHandler base: localId counter, isExitEnabled = config.isExit, debug() proxy. The handler is the API the React page calls (e.g. PhotoStepHandler.uploadPhoto → selfService:v2:photo:candidate, .acceptPhoto → selfService:v2:photo:finalize, photo.step.ts:26-44).

Common — `src/common/`

webrtc/self-service-peer.ts (SelfServicePeer, 161 lines) — wraps RTCPeerConnection (+ webrtc-adapter). Creates an offer (no audio/video receive), sends JSEP via selfService:v2:video:peer:start, applies the remote description, then flushes ICE candidates over selfService:v2:video:peer:candidate. Emits granular log:webrtc telemetry on every state change (:32-78).
errors/ — typed error hierarchy: base.error.ts, backend.error.ts, compatibility.error.ts, timeout.error.ts, validation.error.ts.
utils/ — async.utils.ts (createPromiseWithTimeout, used by socket), date-time.utils.ts (SECOND), number.utils.ts, validation.utils.ts (validateSync → ValidationError with formatted messages, :5-23).

UI — `src/ui/`

index.ts — public UI export: export { default as SelfServiceV2 } from './self-service-v2/SelfServiceV2'.
self-service-v2/SelfServiceV2.tsx — React class component; provides the controller via context and renders <BaseLayout><StepRouter/></BaseLayout> (:21-29).
controllers/StepRouter/StepMap.tsx — maps each StepType → the React page component, casting the step handler to the concrete handler type and passing camera props (e.g. customer-portrait: mirrored cameraFacing="user"; id-*/proof-of-address: cameraFacing="environment"; liveness: user; hologram: environment) (:26-52).
pages/ — one folder per step: Registration, TwoFactor, ConsentPEP, ConsentTTNY, PhotoStep (with stages/ Camera/AcceptPhoto/Error/Loading), LivenessCheck, Hologram, DataConfirmation, GoodBye, Error, Loading.
components/ — shared: ActionBar, ActionButton, Camera/CameraUI, CameraGuide, ConsentButtonGroup, ErrorDialog, ExitButton/ExitDialog, Page/PageContext, SkipButton/SkipDialog.
common/hooks/ — use-service.ts (memoize a service instance in a ref), use-breakpoints.ts, use-cache.ts, use-video-devices.ts.
common/services/MediaService.ts (182 lines) — camera/permission helper: getUserMedia permission tracking (static permissions), device enumeration, torch capability/constraint support (MediaServiceTrackCapabilities.torch), highest-resolution probe (ideal 3840), localStorage default-camera persistence per facing mode (:32-44), convertDataURIToBinary for photo upload (:168-180).
Styling: ui/common/colors.sass, global.sass, muiStyles.sass; per-component *.module.sass.

7. Configuration

`.env` (`.env:1-5`) — dev server only, read by `vite.config.ts`

Var	Value	Use
`VITE_HOST`	`$DEV_DOMAIN`	dev server host (`vite.config.ts:33`)
`VITE_PORT`	`30480`	dev server port (`vite.config.ts:32`)
`VITE_SSL_CRT_FILE`	`../cert/dev.crt`	HTTPS cert (`vite.config.ts:35`)
`VITE_SSL_KEY_FILE`	`../cert/dev.key`	HTTPS key (`vite.config.ts:36`)
`VITE_CSS_HOST`	`"css-$DEV_DOMAIN"`	fallback CSS host when `data-css-host` absent (`src/index.tsx:20-22`)

Dev server requires TLS certs that are NOT in this repo

vite.config.ts:34-37 always sets server.https from VITE_SSL_CRT_FILE/VITE_SSL_KEY_FILE (../cert/dev.crt, ../cert/dev.key) — a sibling cert/ directory outside the repo. $DEV_DOMAIN is also an external shell var. yarn start will fail without these. (camera/getUserMedia requires a secure context, hence HTTPS.)

Runtime config — `<script data-*>` → `SelfServiceV2Config`

Set on the embedding <script id="facekom-web-sdk-script"> and parsed in src/index.tsx:8-30:

`data-*` attr	Config field	Default (index.tsx)	Validation (config.ts)
`data-css-host`	`cssHost`	`VITE_CSS_HOST`	`@IsString @IsUrl` (scheme stripped)
`data-token`	`authToken`	`''`	`@IsString @IsOptional`
`data-language`	`defaultLanguage`	`'hu'`	`@IsString @IsOptional`
`data-custom-text`	`isCustomText`	`false` (`=== 'true'`)	`@IsBoolean`
`data-registration`	`isRegistration`	`true` (`!== 'false'`)	`@IsBoolean`
`data-exit`	`isExit`	`true`	`@IsBoolean`
`data-torch`	`isTorch`	`true`	`@IsBoolean`
`data-goodbye`	`isGoodBye`	`true`	`@IsBoolean`
(not from script)	`socketTimeout`	`30000` ms	`@IsInt @Min(0)`
(not from script)	`screenshotMaxWidth` / `screenshotMargin`	`1280` / `30`	`@IsInt`
(not from script)	`supportedLocales`	`['hu','en']`	`@IsArray @IsString({each})`

Theming config: a <script id="facekom-web-sdk-colors" type="application/json"> block of --fk-* color groups (full schema in public/index.html:64-222) drives the MUI palette. See customization-architecture.
Validation schema: there is no AJV/getconfig. Config validation is class-validator decorators on SelfServiceV2ConfigPlain (config.ts:6-47) executed via ValidationUtils.validate (validation.utils.ts). Server Settings shape is the TypeScript interface in types/settings.types.ts (not runtime-validated).
i18n config: bundled JSON under src/translations/{en,hu}/*.json (11 namespaces); custom-text mode overlays a remote payload (demo shape: public/static/translations/translations.json).
Build/TS config: root tsconfig.json is references-only (points to tsconfig.app.json + tsconfig.node.json); tsconfig.app.json is the app config (include: ["src"], experimentalDecorators, typeRoots incl. src/@types); tsconfig.node.json (include: ["vite.config.ts"]).

8. Tests

No test suite exists in this repo.

Verified via git ls-tree (item 8): there are no test files (no *.test.*, *.spec.*, __tests__/, jest/vitest config, or test runner in devDependencies). package.json has no test script. .gitignore:9 references /coverage but nothing generates it. The only automated quality gate is CI (.github/workflows/lint.yaml): on every PR, yarn install --frozen-lockfile → yarn lint → yarn type-check, run against Node 20 and 22.

9. Dependencies on other FaceKom services

All backend coupling is to the partner’s CSS host (cssHost config). No direct DB/Redis/RabbitMQ access — the SDK is a browser client.

HTTP (fetch)

Method/URL	Purpose	Source
`GET https://${cssHost}/api/mobile/settings?osType=web&version=${APP_VERSION}&sdkVersion=${SDK_VERSION}`	App/SDK compatibility + Socket.IO/screenshot settings	`settings.service.ts:18`
`GET https://${cssHost}/sdk/translations`	Custom-text i18n overlay (only when `isCustomText`)	`language.service.ts:72`

Socket.IO — `wss://${cssHost}` (`socket.service.ts:103-104`), settings from `/api/mobile/settings` → `socketioSettings`

Outgoing actions (selfServiceV2Service.executeAction / socket.emit):

selfService:v2:auth (token, versionNumber, supportedSteps, deviceType, deviceOsVersion, locale, deviceInfo) — self-service-v2.service.ts:22
selfService:v2:start, selfService:v2:abort, selfService:v2:skip — self-service-v2.service.ts:89,93; controller.ts:186,197
selfService:v2:photo:candidate, selfService:v2:photo:finalize — photo.step.ts:27,43
selfService:v2:video:start, selfService:v2:video:peer:getConfig, selfService:v2:video:peer:start, selfService:v2:video:peer:candidate — self-service-v2.service.ts:58,85; self-service-peer.ts:74,77,132
selfService:v2:debug:app — self-service-v2.service.ts:97
log:webrtc — self-service-peer.ts:69

Incoming subscriptions (controller.ts:216-224):

selfService:v2:nextStep → changeStep (backend drives the step machine)
selfService:v2:stepMessage → onStepMessage
selfService:v2:end → onRoomEnd (deletes auth token, dispatches facekom-web-sdk-room-end)

WebRTC

Peer connection negotiated over the socket (SelfServicePeer); ICE/STUN/TURN config comes from the backend via selfService:v2:video:peer:getConfig (self-service-v2.service.ts:57-60). Video frames stream to the FaceKom backend for liveness/hologram.

DOM events emitted to the host page (integration contract)

facekom-web-sdk-exit, facekom-web-sdk-room-end (with detail.status), facekom-web-sdk-change-language via window.facekomWebSDKChangeLanguage(lng), window.facekomWebSDKExit() — App.tsx:18-40, public/index.html:28-35,53-57, global.d.ts:4-8.

10. Verified gotchas

App.tsx constructs a new controller on every render

const controller = new SelfServiceV2Controller(...) is created in the component body (App.tsx:12-14), not memoized in a ref/useMemo, and useEffect has no dependency array (App.tsx:51-59) so setupAndStartProcess runs after every render. The controller.initialize()/start() methods self-guard with _initialized/_started flags + console.warn (controller.ts:72-74,136-138), which is what makes this tolerable. Touch with care.

cssHost is used for both wss:// and https://

The same host drives the Socket.IO URL (wss://${cssHost}), the settings fetch, and the translations fetch. The scheme prefix is stripped in config.transform() (config.ts:72-74), so callers must pass a bare host (the developer guide shows data-css-host="{{cssHost}}"). Partners must also configure CSP (script-src/style-src) and CORS (Access-Control-Allow-Origin) for that host (docs/developer.guide.en.md Requirements section).

nfcEnabled is hard-coded true

DeviceService.getDeviceInfo() returns nfcEnabled: true unconditionally while nfcCapable is detected (device.service.ts:85-91). Web NFC is Chromium-only via NDEFReader.

Auth token persists in localStorage

selfService:v2:auth token is saved/read/cleared in localStorage['authToken'] (self-service-v2.service.ts:33-43); cleared on room end (controller.ts:269). The default-camera deviceId is also persisted in localStorage (MediaService.ts:32-44).

registration namespace demo value is "Registration2"

public/static/translations/translations.json (the custom-text overlay sample) sets en.registration.page_title = "Registration2" — a placeholder in the demo payload, not the bundled default.

Outstanding known issues recorded in repo logs

maintenance/2026-05-04.md documents many deps held back (“Migration needed”), notably ua-parser-js cannot move to v2 due to a license change (:78-79). security/2026-05-04.md records 2 moderate PostCSS advisories (npm 1117015) still present after maintenance (:39,74-75).

Unverified / gaps

Surveyed structurally, not line-by-line: the React src/ui/self-service-v2/pages/** and components/** trees (≈90 .tsx/.module.sass files). I read SelfServiceV2.tsx, StepMap.tsx, MediaService.ts, use-service.ts, and PhotoStep handler logic as representatives; individual page render/JSX details, per-stage components (Camera/Error/Loading stages), and .sass modules were mapped by listing but not each read.
Steps read as representative: photo.step.ts (+ base.step.ts, step.handler.ts) fully; the other 9 step files (error/registration/two-factor/consent-*/liveness-check/hologram/data-confirmation/good-bye) were confirmed by the factory/StepMap wiring and line counts but their handler bodies were not individually read.
Translation JSON contents (src/translations/{en,hu}/*.json, 22 files) not enumerated key-by-key.
maintenance/, security/, docs/ history: read the latest maintenance/security log and the developer guide head/integration sections; older dated logs and the branding/translations guides were not read in full.
Could not run anything (read-only); build artifact names in copy_build.sh (vuer_web_sdk.iife.js, style.css) inferred from Vite/Rollup defaults, not confirmed against an actual build/ output (none tracked).
src/common/errors/* and src/common/utils/{async,date-time,number}.utils.ts confirmed to exist and referenced; only validation.utils.ts read in full.

Sources

Files read in full (in vuer_web_sdk/):

package.json, README.md, RELEASE.md, vite.config.ts, .env, copy_build.sh, tsconfig.json, tsconfig.app.json, tsconfig.node.json, eslint.config.mjs, .gitignore, .editorconfig
.github/workflows/lint.yaml
public/index.html, public/manifest.json
src/index.tsx, src/App.tsx, src/vite-env.d.ts, src/@types/global.d.ts
src/core/version.ts
src/core/self-service-v2/: config.ts, controller.ts, state.ts, events.ts, event-topics.ts
src/core/self-service-v2/services/: index.ts, base.service.ts, socket.service.ts, self-service-v2.service.ts, settings.service.ts, device.service.ts, language.service.ts, components/service.dependencies.ts
src/core/self-service-v2/steps/: index.ts, base.step.ts, photo.step.ts, components/step.handler.ts, components/step.dependencies.ts
src/core/self-service-v2/types/: settings.types.ts, socket-event.types.ts, step.types.ts, event.types.ts, error-message.types.ts, id.types.ts
src/common/webrtc/self-service-peer.ts, src/common/utils/validation.utils.ts
src/ui/index.ts, src/ui/self-service-v2/SelfServiceV2.tsx, src/ui/self-service-v2/controllers/StepRouter/StepMap.tsx, src/ui/common/hooks/use-service.ts, src/ui/common/services/MediaService.ts
maintenance/2026-05-04.md, security/2026-05-04.md
docs/developer.guide.en.md (head + Requirements/Integration sections)
public/static/translations/translations.json (head)

Directories listed/sampled (via git ls-tree -r HEAD, not all files read):

src/ui/self-service-v2/pages/ (dir), src/ui/self-service-v2/components/ (dir), src/translations/ (dir), src/common/errors/ (dir), docs/images/ (dir, binaries), public/font/, public/img/ (dirs, binaries), maintenance/ (dir), security/ (dir)

Git (read-only): git -C vuer_web_sdk branch -a, for-each-ref, remote -v, log --oneline, ls-tree -r --name-only HEAD.

Levandor

Explorer

vuer_web_sdk — FaceKom Web SDK (browser self-service client)

vuer_web_sdk

1. Purpose & role in FaceKom

2. Tech stack & runtime

3. Build & run

Entrypoints

`package.json` scripts (verbatim — `package.json:59-65`)

Start command

Dockerfile

4. Top-level structure

5. First-party helper scripts (bin / shell)

6. Key modules / services / entities

Bootstrap

Flow engine — `src/core/self-service-v2/`

Services (`services/`) — registered & initialized in order (`services/index.ts:32-43`)

Steps (`steps/`) — factory pattern

Common — `src/common/`

UI — `src/ui/`

7. Configuration

`.env` (`.env:1-5`) — dev server only, read by `vite.config.ts`

Runtime config — `<script data-*>` → `SelfServiceV2Config`

8. Tests

9. Dependencies on other FaceKom services

HTTP (fetch)

Socket.IO — `wss://${cssHost}` (`socket.service.ts:103-104`), settings from `/api/mobile/settings` → `socketioSettings`

WebRTC

DOM events emitted to the host page (integration contract)

10. Verified gotchas

Unverified / gaps

Sources

Graph View

Table of Contents

Levandor

Explorer

vuer_web_sdk — FaceKom Web SDK (browser self-service client)

vuer_web_sdk

1. Purpose & role in FaceKom

2. Tech stack & runtime

3. Build & run

Entrypoints

package.json scripts (verbatim — package.json:59-65)

Start command

Dockerfile

4. Top-level structure

5. First-party helper scripts (bin / shell)

6. Key modules / services / entities

Bootstrap

Flow engine — src/core/self-service-v2/

Services (services/) — registered & initialized in order (services/index.ts:32-43)

Steps (steps/) — factory pattern

Common — src/common/

UI — src/ui/

7. Configuration

.env (.env:1-5) — dev server only, read by vite.config.ts

Runtime config — <script data-*> → SelfServiceV2Config

8. Tests

9. Dependencies on other FaceKom services

HTTP (fetch)

Socket.IO — wss://${cssHost} (socket.service.ts:103-104), settings from /api/mobile/settings → socketioSettings

WebRTC

DOM events emitted to the host page (integration contract)

10. Verified gotchas

Unverified / gaps

Sources

Graph View

Table of Contents

`package.json` scripts (verbatim — `package.json:59-65`)

Flow engine — `src/core/self-service-v2/`

Services (`services/`) — registered & initialized in order (`services/index.ts:32-43`)

Steps (`steps/`) — factory pattern

Common — `src/common/`

UI — `src/ui/`

`.env` (`.env:1-5`) — dev server only, read by `vite.config.ts`

Runtime config — `<script data-*>` → `SelfServiceV2Config`

Socket.IO — `wss://${cssHost}` (`socket.service.ts:103-104`), settings from `/api/mobile/settings` → `socketioSettings`