@incodetech/core 0.0.0-dev-20260716-2b4f5edb → 0.0.0-dev-20260717-87fac45b

package/dist/mandatory-consent.d.ts

@@ -1,2 +1,2 @@
-import { a as MandatoryConsentActor, i as createMandatoryConsentManagerFromActor, n as MandatoryConsentState, o as mandatoryConsentMachine, r as createMandatoryConsentManager, s as MandatoryConsentConfig, t as MandatoryConsentManager } from "./mandatoryConsentManager-B2gRcE_x.js";
+import { a as MandatoryConsentActor, i as createMandatoryConsentManagerFromActor, n as MandatoryConsentState, o as mandatoryConsentMachine, r as createMandatoryConsentManager, s as MandatoryConsentConfig, t as MandatoryConsentManager } from "./mandatoryConsentManager-BR8SLvd1.js";
 export { type MandatoryConsentActor, type MandatoryConsentConfig, type MandatoryConsentManager, type MandatoryConsentState, createMandatoryConsentManager, createMandatoryConsentManagerFromActor, mandatoryConsentMachine };

package/dist/{mandatoryConsentManager-B2gRcE_x.d.ts → mandatoryConsentManager-BR8SLvd1.d.ts}

@@ -80,18 +80,18 @@ declare const mandatoryConsentMachine: StateMachine<MandatoryConsentContext, {
     type: "clearError";
     params: NonReducibleUnknown;
   };
-  resetContext: {
-    type: "resetContext";
-    params: NonReducibleUnknown;
-  };
   toggleSigned: {
     type: "toggleSigned";
     params: NonReducibleUnknown;
   };
+  resetContext: {
+    type: "resetContext";
+    params: NonReducibleUnknown;
+  };
 }>, {
   type: "canSubmit";
   params: unknown;
-}, never, "error" | "idle" | "closed" | "finished" | "loading" | "submitting" | "display", string, MandatoryConsentInput, NonReducibleUnknown, EventObject, MetaObject, {
+}, never, "error" | "idle" | "closed" | "finished" | "loading" | "display" | "submitting", string, MandatoryConsentInput, NonReducibleUnknown, EventObject, MetaObject, {
   readonly id: "mandatoryConsent";
   readonly initial: "idle";
   readonly context: ({ input }: {

package/dist/{onDeviceFaceResults-4ODIm8fO.esm.js → onDeviceFaceResults-B3oTx-NK.esm.js}

@@ -516,7 +516,7 @@ async function stopRecording(session) {
 	}
 }
 async function initializeDeepsightSession(options) {
-	const { loadDeepsightSession } = await import("./deepsightLoader-BGu6zfoZ.esm.js");
+	const { loadDeepsightSession } = await import("./deepsightLoader-C7HOhX6C.esm.js");
 	return loadDeepsightSession({
 		ds: options.ds,
 		storage: options.storage

package/dist/personhood.esm.js

@@ -4,13 +4,13 @@ import { t as api } from "./api-BDTZNnca.esm.js";
 import { a as createApi$1, t as getStoredHttpConfig } from "./clientLifecycle-DzT65Fvf.esm.js";
 import { n as eventModuleNames } from "./events-Dy8PyVO5.esm.js";
 import { t as endpoints } from "./endpoints-DLQ0g4-R.esm.js";
-import { c as isBrowserSimulation, d as getThumbmarkId, f as getDeviceFingerprintInfo, n as getFingerprintEnabled, p as BrowserEnvironmentProvider } from "./sessionInitializer-B6n-FYf7.esm.js";
+import { c as isBrowserSimulation, d as getThumbmarkId, f as getDeviceFingerprintInfo, n as getFingerprintEnabled, p as BrowserEnvironmentProvider } from "./sessionInitializer-CrzyJ4Y0.esm.js";
 import { c as createManager, o as createActor, r as assign, t as setup } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-CtI5S0f4.esm.js";
 import { i as requestPermission, t as checkPermission } from "./permissionServices-DwNCUB2I.esm.js";
 import { a as stopCameraStream, r as requestCameraAccess } from "./camera-BmFEyPP_.esm.js";
 import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
-import { f as stopStream, l as startDetection, s as initializeDeepsightSession, v as FaceDetectionProvider } from "./onDeviceFaceResults-4ODIm8fO.esm.js";
+import { f as stopStream, l as startDetection, s as initializeDeepsightSession, v as FaceDetectionProvider } from "./onDeviceFaceResults-B3oTx-NK.esm.js";
 import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
 import { t as StreamCanvasCapture } from "./StreamCanvasCapture-D2XcXCZ4.esm.js";
 //#region ../infra/src/crypto/randomUUID.ts

package/dist/{recordingService-CkLJ00Pw.esm.js → recordingService-Comyo6yK.esm.js}

@@ -1,7 +1,7 @@
 import { t as api } from "./api-BDTZNnca.esm.js";
 import { t as endpoints } from "./endpoints-DLQ0g4-R.esm.js";
 import { t as isAndroid } from "./platform-wmV7oTAJ.esm.js";
-import { d as stopRecording, g as uploadDeepsightVideo, u as startRecordingSession } from "./onDeviceFaceResults-4ODIm8fO.esm.js";
+import { d as stopRecording, g as uploadDeepsightVideo, u as startRecordingSession } from "./onDeviceFaceResults-B3oTx-NK.esm.js";
 import { t as getAdaptiveMediaRecorderOptions } from "./mediaRecorderOptions-BhSZDDNb.esm.js";
 //#region src/internal/manualReview/manualReviewService.ts
 async function flagFaceManualReview() {

package/dist/selfie.esm.js

@@ -2,12 +2,12 @@ import { t as WasmUtilProvider } from "./WasmUtilProvider-DAshwHhX.esm.js";
 import { n as eventModuleNames } from "./events-Dy8PyVO5.esm.js";
 import { o as createActor, r as assign } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-CtI5S0f4.esm.js";
-import { t as faceCaptureMachine } from "./faceCaptureSetup-BXueiZo8.esm.js";
-import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-CDpqsxiU.esm.js";
+import { t as faceCaptureMachine } from "./faceCaptureSetup-Bxo1VNVw.esm.js";
+import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-BFv1KlL_.esm.js";
 import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
 import { t as processFace } from "./selfieUploadService-B4LnSIf6.esm.js";
-import { t as selfieMachine } from "./selfieStateMachine-CFqYKJFF.esm.js";
-import { n as createSelfieManagerFromActor, t as createSelfieManager } from "./selfieManager-C_ynxeGZ.esm.js";
+import { t as selfieMachine } from "./selfieStateMachine-D30gwMGq.esm.js";
+import { n as createSelfieManagerFromActor, t as createSelfieManager } from "./selfieManager-CCR6VpoQ.esm.js";
 import { t as invokeOnCaptureCallback } from "./invokeOnCaptureCallback-B-QfsCQY.esm.js";
 //#region src/modules/selfie/selfieCaptureOnlyStateMachine.ts
 /**

package/dist/{selfieManager-C_ynxeGZ.esm.js → selfieManager-CCR6VpoQ.esm.js}

@@ -1,9 +1,9 @@
 import { t as WasmUtilProvider } from "./WasmUtilProvider-DAshwHhX.esm.js";
 import { n as eventModuleNames } from "./events-Dy8PyVO5.esm.js";
 import { o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
-import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-CDpqsxiU.esm.js";
+import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-BFv1KlL_.esm.js";
 import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
-import { t as selfieMachine } from "./selfieStateMachine-CFqYKJFF.esm.js";
+import { t as selfieMachine } from "./selfieStateMachine-D30gwMGq.esm.js";
 //#region src/modules/selfie/selfieActor.ts
 function createSelfieActor(options) {
 	const dependencies = options.dependencies ?? {

package/dist/{selfieStateMachine-CFqYKJFF.esm.js → selfieStateMachine-D30gwMGq.esm.js}

@@ -1,7 +1,7 @@
 import { r as assign } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-CtI5S0f4.esm.js";
-import { t as faceCaptureMachine } from "./faceCaptureSetup-BXueiZo8.esm.js";
-import { i as prepareOnDeviceFaceUpload, n as isOnDeviceMode, r as postOnDeviceFaceResults, t as defaultPrepareFaceUpload } from "./onDeviceFaceResults-4ODIm8fO.esm.js";
+import { t as faceCaptureMachine } from "./faceCaptureSetup-Bxo1VNVw.esm.js";
+import { i as prepareOnDeviceFaceUpload, n as isOnDeviceMode, r as postOnDeviceFaceResults, t as defaultPrepareFaceUpload } from "./onDeviceFaceResults-B3oTx-NK.esm.js";
 import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
 import { n as uploadSelfie, t as processFace } from "./selfieUploadService-B4LnSIf6.esm.js";
 Object.values(FACE_ERROR_CODES);

package/dist/session-B9KT6qnE.esm.js

@@ -0,0 +1 @@
+import "./sessionInitializer-CrzyJ4Y0.esm.js";

package/dist/session.esm.js

@@ -1,8 +1,8 @@
 import { n as getApi } from "./api-BDTZNnca.esm.js";
 import { t as endpoints } from "./endpoints-DLQ0g4-R.esm.js";
-import { i as initializeSession } from "./sessionInitializer-B6n-FYf7.esm.js";
+import { i as initializeSession } from "./sessionInitializer-CrzyJ4Y0.esm.js";
 import { n as toIncodeApiError, t as IncodeApiError } from "./apiError-COvIGYWe.esm.js";
-import "./session-CThOl8m5.esm.js";
+import "./session-B9KT6qnE.esm.js";
 import { n as getFinishStatus } from "./flowCompletionService-DQSC7Kso.esm.js";
 //#region src/internal/session/sessionService.ts
 /**

package/dist/{sessionInitializer-B6n-FYf7.esm.js → sessionInitializer-CrzyJ4Y0.esm.js}

@@ -1,3 +1,4 @@
+import { g as updateFeatureManagementUser } from "./feature-management-Dw96qEMs.esm.js";
 import { r as getToken, s as setToken, t as api } from "./api-BDTZNnca.esm.js";
 import { h as getAnalyticsBatcher, m as addEvent } from "./events-Dy8PyVO5.esm.js";
 import { t as endpoints } from "./endpoints-DLQ0g4-R.esm.js";
@@ -5,7 +6,7 @@ import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-
 import { n as UAParser, t as getParsedUserAgent } from "./getParsedUserAgent-pJjATANs.esm.js";
 import { r as isIOS } from "./platform-wmV7oTAJ.esm.js";
 import { t as getUserAgent } from "./getBrowser-Cb8Zgrgp.esm.js";
-import { i as linkSessionWithTRI, r as isTRIStarted } from "./tri-N-xlKhZK.esm.js";
+import { i as linkSessionWithTRI, r as isTRIStarted } from "./tri-4RsGrIt6.esm.js";
 //#region ../infra/src/providers/browser/BrowserEnvironmentProvider.ts
 var BrowserEnvironmentProvider = class {
 	getScreenDimensions() {
@@ -1608,7 +1609,7 @@ function isBrowserSimulation(browserEnv) {
 }
 //#endregion
 //#region src/internal/version/sdkVersion.ts
-const SDK_VERSION = "0.0.0-dev-20260716-2b4f5edb";
+const SDK_VERSION = "0.0.0-dev-20260717-87fac45b";
 //#endregion
 //#region src/internal/fingerprint/fingerprintService.ts
 function formatOsVersion(os) {
@@ -1710,6 +1711,7 @@ async function initializeSession(options = {}) {
 			features = { sessionIdentifier: "" };
 		}
 		const disableIpify = resolveDisableIpify(serverDisableIpify);
+		await updateFeatureManagementUser({ customIDs: { hashed_onboarding_id: features.sessionIdentifier || void 0 } });
 		let fingerprintSuccess = false;
 		let fingerprintResult;
 		if (clientFingerprintEnabled) try {

package/dist/{setup-CgBvqGWw.d.ts → setup-BBfVpTog.d.ts}

@@ -1,5 +1,14 @@
 import { n as WasmPipeline } from "./warmup-Dv2alr2-.js";
 import { s as TransactionalRiskIntelligenceSetupConfig } from "./index-BKOWUhxG.js";
+import { s as FeatureManagementRedactedUserInfo } from "./IFeatureManagementCapability-ErPJywQ_.js";
+//#region src/internal/environment/environment.d.ts
+/**
+ * Coarse deployment tier for feature-management targeting.
+ * See `SetupOptions.environment` in `../../setup.ts` for the public-facing contract
+ * (locked by the first `setup()` call that supplies it).
+ */
+type EnvironmentTier = 'development' | 'staging' | 'production';
+//#endregion
 //#region src/setup.d.ts
 /**
  * WASM warmup configuration. Path fields are optional; omitted values resolve to the Incode CDN defaults.
@@ -216,6 +225,112 @@ type SetupOptions = {
    * collection should begin.
    */
   tri?: TransactionalRiskIntelligenceSetupConfig;
+  /**
+   * Enables feature management. Loaded during `setup()` as a separate dynamic chunk,
+   * never part of the main `@incodetech/core` bundle.
+   *
+   * Uses no customer API key: identity starts with the client SDK's
+   * auto-generated StableID plus the deployment tier from `environment`
+   * below (plus `clientExperimentId`, when supplied), and is enriched over
+   * the session lifecycle with `hashed_onboarding_id` (once the session
+   * initializes), `flow_id` (from the flow response), or `workflow_id` (from
+   * the workflow configuration). The applicable enrichments are awaited
+   * before the first module renders. Read gates/experiments via
+   * `@incodetech/core/feature-management`.
+   *
+   * Boot is awaited as part of `setup()` and never throws. Session, flow, and
+   * workflow loaders then await their identity enrichments before the first
+   * module renders, so evaluations never use a stale identity.
+   *
+   * Accepts:
+   * - `true` (default) or omitted — enabled, no `clientExperimentId` or
+   *   privacy flags.
+   * - `false` — full opt-out: no chunk is fetched and no
+   *   feature-management network traffic occurs. Reads from
+   *   `@incodetech/core/feature-management` still work when disabled; they
+   *   simply resolve to their documented defaults (gates `false`,
+   *   experiments fall back, dynamic configs `null`).
+   * - `{ clientExperimentId?, disableStableId?, disablePersistence? }` —
+   *   enabled with the given identity/privacy configuration.
+   *
+   * **Only the first `setup()` call that enables feature management may
+   * initialize it.** Every later enabled `setup()` call logs a `console.error`
+   * and is ignored, regardless of whether its values match. For multi-step
+   * boot, call `setup()` once and activate the token later with
+   * `initializeSession({ token })`. Call `reset()` before starting a new SDK
+   * lifecycle.
+   *
+   * Default: `true`.
+   */
+  featureManagement?: boolean | FeatureManagementSetupOptions;
+  /**
+   * Coarse deployment tier for feature-management (Statsig) targeting: one of
+   * `'development'`, `'staging'`, or `'production'`. No finer granularity.
+   * Default: `'production'`.
+   *
+   * Used by the first enabled feature-management initialization only — see
+   * `featureManagement` above.
+   *
+   * No effect when `featureManagement` is `false`.
+   *
+   * @example
+   * ```ts
+   * await setup({ apiURL, environment: 'staging' });
+   * ```
+   */
+  environment?: EnvironmentTier;
+};
+/**
+ * Object form of the `featureManagement` option for {@link SetupOptions}.
+ * The boolean shorthand (`featureManagement: true`) is equivalent to `{}`.
+ */
+type FeatureManagementSetupOptions = {
+  /**
+   * Integrator-scoped randomization/targeting unit, registered as
+   * the `client_experiment_id` custom ID during initialization.
+   * Agreed with your Incode representative — use it to
+   * target or bucket gates/experiments for a specific integrator (e.g. a
+   * pilot rollout), independent of the per-user/per-session identity built
+   * up from StableID, `hashed_onboarding_id`, `flow_id`, and `workflow_id`.
+   */
+  clientExperimentId?: string;
+  /**
+   * Prevents the feature-management from generating a StableID for this
+   * user at all. The strongest privacy control: with no StableID and
+   * no other randomization-unit ID yet known, evaluations
+   * resolve to control/default until `hashed_onboarding_id`, `flow_id`, or
+   * `workflow_id` arrives later in the session. Default: `false` (StableID
+   * enabled).
+   */
+  disableStableId?: boolean;
+  /**
+   * Prevents the feature-management from persisting any state
+   * (including the StableID) to local storage (`disableStorage`) — identity
+   * is in-memory only for the lifetime of the page and is never linkable
+   * across page loads. Trades away feature-management's local bootstrap cache, so
+   * every session re-fetches on boot. Default: `false` (persistence
+   * enabled).
+   */
+  disablePersistence?: boolean;
+  /**
+   * Arbitrary attributes attached to the feature-management user for
+   * targeting rules and analytics. Unlike `clientExperimentId`, these are not randomization units
+   * — they don't bucket experiments, but gate/experiment targeting conditions can read
+   * them, and they annotate exposure/event logs.
+   *
+   * Set once at boot; enriching later is not currently supported here.
+   * Avoid putting PII or secrets in these values — they reach the
+   * feature-management backend's logs as-is.
+   */
+  custom?: Record<string, unknown>;
+  /**
+   * Which auto-collected feature-management user fields to blank out before
+   * sending them to the provider. Covers every field the underlying SDK
+   * collects except `custom`/`customIDs` (already caller-controlled above).
+   * `ip` and `country` are redacted by default; pass `false` for either to
+   * send it, or `true` for any other field to redact it too.
+   */
+  redactedUserInfo?: FeatureManagementRedactedUserInfo;
 };
 /**
  * Initializes the SDK with the provided configuration.

package/dist/{setup-CeQfb7bE.esm.js → setup-CBijDJ0d.esm.js}

@@ -1,12 +1,13 @@
 import { d as deriveSiblingJsPath, i as warmupWasm, r as setWasmOnDeviceMode, t as WasmUtilProvider } from "./WasmUtilProvider-DAshwHhX.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
+import { _ as applyEnvironment, c as getIsFeatureManagementLocked, f as optOutFeatureManagement, m as resetFeatureManagementProviderInstance, p as resetFeatureManagement, u as initializeFeatureManagement, v as getEnvironment, y as resetEnvironment } from "./feature-management-Dw96qEMs.esm.js";
 import { a as resetApi, i as isApiConfigured, n as getApi, r as getToken, t as api } from "./api-BDTZNnca.esm.js";
 import { i as upgradeToWasmHttpClient$1, n as installFreshHttpClient, r as resetHttpClientState, t as getStoredHttpConfig } from "./clientLifecycle-DzT65Fvf.esm.js";
 import { _ as setAnalyticsBatcher, g as resetAnalyticsBatcher, h as getAnalyticsBatcher } from "./events-Dy8PyVO5.esm.js";
 import { t as endpoints } from "./endpoints-DLQ0g4-R.esm.js";
 import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-Bu6bL_CX.esm.js";
-import { a as resetSessionInit, i as initializeSession, o as setClientFingerprintEnabled, s as setClientIpLookupEnabled } from "./sessionInitializer-B6n-FYf7.esm.js";
-import { a as resetTRI, n as initializeTRI, o as resetTRIProviderInstance } from "./tri-N-xlKhZK.esm.js";
+import { a as resetSessionInit, i as initializeSession, o as setClientFingerprintEnabled, s as setClientIpLookupEnabled } from "./sessionInitializer-CrzyJ4Y0.esm.js";
+import { a as resetTRI, n as initializeTRI, o as resetTRIProviderInstance } from "./tri-4RsGrIt6.esm.js";
 //#region ../infra/src/wasm/wasmDefaults.ts
 const WASM_CDN_BASE_URL = "https://cdn.incodesmile.com/ml-wasm-kit-release";
 /** The WASM version bundled and tested with this SDK release. */
@@ -564,6 +565,7 @@ async function setup(options) {
 		console.warn("Session initialization failed:", error);
 	});
 	configured = true;
+	applyEnvironment(options.environment);
 	if (effectiveWasm) {
 		wasmConfig = {
 			...effectiveWasm,
@@ -579,6 +581,19 @@ async function setup(options) {
 		await provider.setProductionMode(!showWasmLogs);
 		if (!options.devMode) startDevtoolsDetector();
 	}
+	if (!getIsFeatureManagementLocked()) if (options.featureManagement === false) optOutFeatureManagement();
+	else {
+		const featureManagementSetupOptions = typeof options.featureManagement === "object" ? options.featureManagement : {};
+		await initializeFeatureManagement({
+			environment: getEnvironment(),
+			clientExperimentId: featureManagementSetupOptions.clientExperimentId,
+			disableStableId: featureManagementSetupOptions.disableStableId,
+			disablePersistence: featureManagementSetupOptions.disablePersistence,
+			custom: featureManagementSetupOptions.custom,
+			redactedUserInfo: featureManagementSetupOptions.redactedUserInfo
+		});
+	}
+	else if (options.featureManagement !== void 0) console.error("[FeatureManagement] Feature management is locked after the first setup() call and cannot be changed (re-enabled, disabled, or reconfigured). Ignoring this change. Call reset() before changing it.");
 	if (options.tri) await initializeTRI(options.tri, { sessionToken: options.token });
 }
 /**
@@ -671,6 +686,9 @@ function reset() {
 	wasmConfig = void 0;
 	WasmUtilProvider.resetInstance();
 	resetTRIProviderInstance();
+	resetFeatureManagement();
+	resetFeatureManagementProviderInstance();
+	resetEnvironment();
 }
 //#endregion
 export { setWasmConfig as a, DEFAULT_WASM_VERSION as c, resolveWasmConfig as d, reset as i, buildDefaultWasmConfig as l, initializeWasmUtil as n, setup as o, isConfigured as r, upgradeToWasmHttpClient as s, ensureWasmPipelines as t, buildWasmConfigFromBasePath as u };