@incodetech/core 0.0.0-dev-20260728-af4e1aee → 0.0.0-dev-20260729-e2dda0b0

package/dist/{selfieManager-BT7dmOHi.d.ts → selfieManager-CxeMb2tM.d.ts}

@@ -1,6 +1,6 @@
 import { t as Manager } from "./Manager-CQQ99QOI.js";
 import { t as IVisibilityObserverCapability } from "./IVisibilityObserverCapability-D4tvIB5v.js";
-import { c as SelfieActor, n as FaceCaptureManagerState, s as CreateSelfieActorOptions, t as FaceCaptureManager } from "./faceCaptureManagerFactory-B2TUje5s.js";
+import { c as SelfieActor, n as FaceCaptureManagerState, s as CreateSelfieActorOptions, t as FaceCaptureManager } from "./faceCaptureManagerFactory-B92LFT16.js";
 //#region src/modules/selfie/selfieUploadService.d.ts
 type ProcessFaceImageType = 'selfie' | 'videoSelfie';
 type ProcessFaceResponse = {

package/dist/{selfieManager-9Eci1f5e.esm.js → selfieManager-DTiBsQNn.esm.js}

@@ -1,9 +1,9 @@
-import { t as WasmUtilProvider } from "./WasmUtilProvider-BrWOTaVG.esm.js";
-import { n as eventModuleNames } from "./events-Dy8PyVO5.esm.js";
-import { o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
-import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-DaYwl0Yq.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-D13sxEmA.esm.js";
 import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
-import { t as selfieMachine } from "./selfieStateMachine-CKRTfYh8.esm.js";
+import { n as eventModuleNames } from "./events-CMFCCu1H.esm.js";
+import { o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
+import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-D2pR3ZnX.esm.js";
+import { t as selfieMachine } from "./selfieStateMachine-CxabK5_3.esm.js";
 //#region src/modules/selfie/selfieActor.ts
 function createSelfieActor(options) {
 	const dependencies = options.dependencies ?? {

package/dist/{selfieStateMachine-CKRTfYh8.esm.js → selfieStateMachine-CxabK5_3.esm.js}

@@ -1,9 +1,9 @@
 import { r as assign } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-CtI5S0f4.esm.js";
-import { t as faceCaptureMachine } from "./faceCaptureSetup-DlmX-9nD.esm.js";
-import { i as prepareOnDeviceFaceUpload, n as isOnDeviceMode, r as postOnDeviceFaceResults, t as defaultPrepareFaceUpload } from "./onDeviceFaceResults-bUR2uNg0.esm.js";
+import { t as faceCaptureMachine } from "./faceCaptureSetup-DbhDPMjb.esm.js";
+import { i as prepareOnDeviceFaceUpload, n as isOnDeviceMode, r as postOnDeviceFaceResults, t as defaultPrepareFaceUpload } from "./onDeviceFaceResults-CVhk1BWp.esm.js";
 import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
-import { i as uploadSelfie, n as validateUploadResponse, r as processFace } from "./selfieErrorUtils-BAEYvNVr.esm.js";
+import { i as uploadSelfie, n as validateUploadResponse, r as processFace } from "./selfieErrorUtils-DCRRRj38.esm.js";
 /**
 * The selfie capture state machine.
 *

package/dist/session-Ccob4IUP.esm.js

@@ -0,0 +1,161 @@
+import { n as getApi } from "./api-Bx3gKW_y.esm.js";
+import { h as noteSessionCreated, l as trueSightLog } from "./trueSightService-DKC-gmQC.esm.js";
+import "./sessionInitializer-DEd0CQ74.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
+import "./trueSight-4L5GCqKy.esm.js";
+import { r as toIncodeApiError } from "./apiError-GA6MbJpI.esm.js";
+//#region src/internal/session/sessionService.ts
+/**
+* HTTP status codes the QR validation endpoint emits, keyed by their semantic
+* name. Hosts switch on these to render distinct messaging — `invalidQRuuid`
+* for an unknown/expired link, `onboardingUrlAlreadyUsed` for a one-time link
+* that has already been consumed.
+*/
+const QR_VALIDATION_ERROR_CODES = {
+	expiredUUID: 4026,
+	invalidQRuuid: 4081,
+	onboardingUrlAlreadyUsed: 4083
+};
+var QrValidationError = class extends Error {
+	constructor(status, statusText) {
+		super(`POST ${endpoints.qrValidateUuid} failed: ${status} ${statusText}`);
+		this.name = "QrValidationError";
+		this.status = status;
+		this.statusText = statusText;
+	}
+};
+/**
+* Creates a new onboarding session.
+*
+* @param apiKey - The API key from the Incode dashboard
+* @param options - Session creation options
+* @param signal - Optional AbortSignal for request cancellation
+* @returns The created session with token
+*
+* @example
+* ```ts
+* const session = await createSession('your-api-key', {
+*   configurationId: 'your-flow-id',
+*   language: 'en-US',
+* });
+* console.log(session.token); // Use this token for subsequent API calls
+* ```
+*/
+async function createSession(apiKey, options, signal) {
+	try {
+		const session = (await getApi().post(endpoints.createSession, {
+			configurationId: options.configurationId,
+			externalId: options.externalId,
+			externalCustomerId: options.externalCustomerId,
+			language: options.language ?? "en-US",
+			customFields: options.customFields,
+			uuid: options.uuid ?? null,
+			urlUuid: options.urlUuid ?? null,
+			interviewId: options.interviewId ?? null,
+			...options.loginHint != null && options.loginHint !== "" ? { loginHint: options.loginHint } : {}
+		}, {
+			headers: {
+				"x-api-key": apiKey,
+				"api-version": "1.0"
+			},
+			signal
+		})).data;
+		noteSessionCreated(session, {
+			configurationId: options.configurationId,
+			externalCustomerId: options.externalCustomerId,
+			interviewId: options.interviewId,
+			language: options.language
+		});
+		trueSightLog("info", "session", "orchestration", "session created");
+		return session;
+	} catch (error) {
+		toIncodeApiError(endpoints.createSession, error);
+	}
+}
+/**
+* Validates and rotates a QR anti-phishing URL UUID before creating a session.
+*
+* This call is unauthenticated; the `{ onboardingId, urlUuid }` pair itself
+* acts as the credential. The server burns the incoming `urlUuid` and returns
+* a freshly minted one that must be used in the subsequent `createSession`
+* call.
+*
+* @param options - `{ onboardingId, urlUuid }` from the incoming URL
+* @param signal - Optional AbortSignal for request cancellation
+* @returns The refreshed `urlUuid` to use for the session
+* @throws {QrValidationError} When the server rejects the validation request.
+*/
+async function validateQrUuid(options, signal) {
+	try {
+		return (await getApi().post(endpoints.qrValidateUuid, {
+			onboardingId: options.onboardingId,
+			urlUuid: options.urlUuid
+		}, {
+			headers: { "api-version": "1.0" },
+			signal
+		})).data;
+	} catch (error) {
+		const httpError = error;
+		throw new QrValidationError(httpError.data?.status ?? httpError.status, httpError.statusText);
+	}
+}
+/**
+* One-shot QR phishing-resistance helper.
+*
+* When `urlUuid` is a non-empty string, burns the stale value via
+* `validateQrUuid`, invokes `onRefreshed` with the fresh value, and returns
+* it so callers can forward it into `createSession`. When `urlUuid` is
+* absent, returns `undefined` without making any network call.
+*
+* Consolidates the rotation + callback logic shared by Flow self-loading and
+* Workflow token-mode bootstraps.
+*
+* @throws {QrValidationError} When the server rejects the validation request.
+*/
+async function refreshQrUrlUuid(options, signal) {
+	if (typeof options.urlUuid !== "string" || options.urlUuid.length === 0) return;
+	const result = await validateQrUuid({
+		onboardingId: options.onboardingId ?? null,
+		urlUuid: options.urlUuid
+	}, signal);
+	options.onRefreshed?.(result.urlUuid);
+	return result.urlUuid;
+}
+/**
+* Validates and rotates a QR anti-phishing `urlUuid` (when present), then
+* creates a session bound to the refreshed value. When `urlUuid` is absent,
+* behaves identically to {@link createSession}.
+*
+* Use this when the host owns session creation and wants the SDK to handle
+* phishing-resistance rotation in a single call. For raw control, compose
+* `refreshQrUrlUuid` and `createSession` directly.
+*
+* @throws {QrValidationError} When the server rejects the QR validation step.
+*
+* @example
+* ```ts
+* const session = await bootstrapSession(apiKey, {
+*   configurationId,
+*   urlUuid,
+*   onUrlUuidRefreshed: (refreshed) => {
+*     const url = new URL(window.location.href);
+*     url.searchParams.set('url_uuid', refreshed);
+*     window.history.replaceState({}, '', url);
+*   },
+* });
+* ```
+*/
+async function bootstrapSession(apiKey, options, signal) {
+	const { onUrlUuidRefreshed, ...createSessionOptions } = options;
+	const refreshedUrlUuid = await refreshQrUrlUuid({
+		urlUuid: options.urlUuid,
+		onboardingId: options.uuid ?? null,
+		onRefreshed: onUrlUuidRefreshed
+	}, signal);
+	return createSession(apiKey, {
+		...createSessionOptions,
+		urlUuid: refreshedUrlUuid
+	}, signal);
+}
+//#endregion
+export { refreshQrUrlUuid as a, createSession as i, QrValidationError as n, validateQrUuid as o, bootstrapSession as r, QR_VALIDATION_ERROR_CODES as t };

package/dist/session.d.ts

@@ -1,4 +1,4 @@
-import { a as RegulationTypes } from "./types-NSJbROLr.js";
+import { a as RegulationTypes } from "./types-KPvmag_B.js";
 import { n as FinishStatus, r as GetFinishStatusFn, s as getFinishStatus } from "./flowCompletionService-BlAHsKyv.js";
 //#region src/internal/fingerprint/types.d.ts
 type DeviceFingerprintResult = {
@@ -177,7 +177,14 @@ declare class IncodeApiError extends Error {
 }
 //#endregion
 //#region src/internal/featureConfig/types.d.ts
-type FeatureName = 'VIDEO_SELFIE_V2' | 'USE_CLIENT_GLARE' | 'USE_OPEN_VIDU' | 'DISABLE_IPIFY';
+type FeatureName = 'VIDEO_SELFIE_V2' | 'USE_CLIENT_GLARE' | 'USE_OPEN_VIDU' | 'DISABLE_IPIFY' |
+/**
+ * TrueSight diagnostics remote kill-switch (ENG-48677). Only an explicit
+ * `enabled: false` entry disables uploads — `true`, absent, or an
+ * unresolvable config all proceed (fail-open; the proxy's
+ * `truesight.api.enabled` is the environment authority).
+ */
+'TRUESIGHT_DIAGNOSTICS';
 type FeatureConfig = {
   enabled: boolean;
   feature: FeatureName;

package/dist/session.esm.js

@@ -1,153 +1,5 @@
-import { n as getApi } from "./api-BDTZNnca.esm.js";
-import { t as endpoints } from "./endpoints-CfRg7iAr.esm.js";
-import { i as initializeSession } from "./sessionInitializer-CgjN51b2.esm.js";
-import { r as toIncodeApiError, t as IncodeApiError } from "./apiError-B-PkYxln.esm.js";
-import "./session-B3d0Xtee.esm.js";
-import { n as getFinishStatus } from "./flowCompletionService-D5oIlcza.esm.js";
-//#region src/internal/session/sessionService.ts
-/**
-* HTTP status codes the QR validation endpoint emits, keyed by their semantic
-* name. Hosts switch on these to render distinct messaging — `invalidQRuuid`
-* for an unknown/expired link, `onboardingUrlAlreadyUsed` for a one-time link
-* that has already been consumed.
-*/
-const QR_VALIDATION_ERROR_CODES = {
-	expiredUUID: 4026,
-	invalidQRuuid: 4081,
-	onboardingUrlAlreadyUsed: 4083
-};
-var QrValidationError = class extends Error {
-	constructor(status, statusText) {
-		super(`POST ${endpoints.qrValidateUuid} failed: ${status} ${statusText}`);
-		this.name = "QrValidationError";
-		this.status = status;
-		this.statusText = statusText;
-	}
-};
-/**
-* Creates a new onboarding session.
-*
-* @param apiKey - The API key from the Incode dashboard
-* @param options - Session creation options
-* @param signal - Optional AbortSignal for request cancellation
-* @returns The created session with token
-*
-* @example
-* ```ts
-* const session = await createSession('your-api-key', {
-*   configurationId: 'your-flow-id',
-*   language: 'en-US',
-* });
-* console.log(session.token); // Use this token for subsequent API calls
-* ```
-*/
-async function createSession(apiKey, options, signal) {
-	try {
-		return (await getApi().post(endpoints.createSession, {
-			configurationId: options.configurationId,
-			externalId: options.externalId,
-			externalCustomerId: options.externalCustomerId,
-			language: options.language ?? "en-US",
-			customFields: options.customFields,
-			uuid: options.uuid ?? null,
-			urlUuid: options.urlUuid ?? null,
-			interviewId: options.interviewId ?? null,
-			...options.loginHint != null && options.loginHint !== "" ? { loginHint: options.loginHint } : {}
-		}, {
-			headers: {
-				"x-api-key": apiKey,
-				"api-version": "1.0"
-			},
-			signal
-		})).data;
-	} catch (error) {
-		toIncodeApiError(endpoints.createSession, error);
-	}
-}
-/**
-* Validates and rotates a QR anti-phishing URL UUID before creating a session.
-*
-* This call is unauthenticated; the `{ onboardingId, urlUuid }` pair itself
-* acts as the credential. The server burns the incoming `urlUuid` and returns
-* a freshly minted one that must be used in the subsequent `createSession`
-* call.
-*
-* @param options - `{ onboardingId, urlUuid }` from the incoming URL
-* @param signal - Optional AbortSignal for request cancellation
-* @returns The refreshed `urlUuid` to use for the session
-* @throws {QrValidationError} When the server rejects the validation request.
-*/
-async function validateQrUuid(options, signal) {
-	try {
-		return (await getApi().post(endpoints.qrValidateUuid, {
-			onboardingId: options.onboardingId,
-			urlUuid: options.urlUuid
-		}, {
-			headers: { "api-version": "1.0" },
-			signal
-		})).data;
-	} catch (error) {
-		const httpError = error;
-		throw new QrValidationError(httpError.data?.status ?? httpError.status, httpError.statusText);
-	}
-}
-/**
-* One-shot QR phishing-resistance helper.
-*
-* When `urlUuid` is a non-empty string, burns the stale value via
-* `validateQrUuid`, invokes `onRefreshed` with the fresh value, and returns
-* it so callers can forward it into `createSession`. When `urlUuid` is
-* absent, returns `undefined` without making any network call.
-*
-* Consolidates the rotation + callback logic shared by Flow self-loading and
-* Workflow token-mode bootstraps.
-*
-* @throws {QrValidationError} When the server rejects the validation request.
-*/
-async function refreshQrUrlUuid(options, signal) {
-	if (typeof options.urlUuid !== "string" || options.urlUuid.length === 0) return;
-	const result = await validateQrUuid({
-		onboardingId: options.onboardingId ?? null,
-		urlUuid: options.urlUuid
-	}, signal);
-	options.onRefreshed?.(result.urlUuid);
-	return result.urlUuid;
-}
-/**
-* Validates and rotates a QR anti-phishing `urlUuid` (when present), then
-* creates a session bound to the refreshed value. When `urlUuid` is absent,
-* behaves identically to {@link createSession}.
-*
-* Use this when the host owns session creation and wants the SDK to handle
-* phishing-resistance rotation in a single call. For raw control, compose
-* `refreshQrUrlUuid` and `createSession` directly.
-*
-* @throws {QrValidationError} When the server rejects the QR validation step.
-*
-* @example
-* ```ts
-* const session = await bootstrapSession(apiKey, {
-*   configurationId,
-*   urlUuid,
-*   onUrlUuidRefreshed: (refreshed) => {
-*     const url = new URL(window.location.href);
-*     url.searchParams.set('url_uuid', refreshed);
-*     window.history.replaceState({}, '', url);
-*   },
-* });
-* ```
-*/
-async function bootstrapSession(apiKey, options, signal) {
-	const { onUrlUuidRefreshed, ...createSessionOptions } = options;
-	const refreshedUrlUuid = await refreshQrUrlUuid({
-		urlUuid: options.urlUuid,
-		onboardingId: options.uuid ?? null,
-		onRefreshed: onUrlUuidRefreshed
-	}, signal);
-	return createSession(apiKey, {
-		...createSessionOptions,
-		urlUuid: refreshedUrlUuid
-	}, signal);
-}
-//#endregion
+import { i as initializeSession } from "./sessionInitializer-DEd0CQ74.esm.js";
+import { t as IncodeApiError } from "./apiError-GA6MbJpI.esm.js";
+import { a as refreshQrUrlUuid, i as createSession, n as QrValidationError, o as validateQrUuid, r as bootstrapSession, t as QR_VALIDATION_ERROR_CODES } from "./session-Ccob4IUP.esm.js";
+import { n as getFinishStatus } from "./flowCompletionService-BdZR6HyE.esm.js";
 export { IncodeApiError, QR_VALIDATION_ERROR_CODES, QrValidationError, bootstrapSession, createSession, getFinishStatus, initializeSession, refreshQrUrlUuid, validateQrUuid };

package/dist/{sessionInitializer-CgjN51b2.esm.js → sessionInitializer-DEd0CQ74.esm.js}

@@ -1,8 +1,10 @@
 import { g as updateFeatureManagementUser } from "./feature-management-Dw96qEMs.esm.js";
-import { r as getToken, s as setToken, t as api } from "./api-BDTZNnca.esm.js";
-import { h as getAnalyticsBatcher, m as addEvent } from "./events-Dy8PyVO5.esm.js";
-import { t as endpoints } from "./endpoints-CfRg7iAr.esm.js";
-import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-4DAk7TYl.esm.js";
+import { c as setToken, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
+import { _ as noteTokenActivated, d as fetchFeatureConfig, f as isFeatureEnabled, l as trueSightLog, m as noteEnvironment, p as resetFeatureConfigCache, s as startTrueSightCollection, v as SDK_VERSION } from "./trueSightService-DKC-gmQC.esm.js";
+import { h as getAnalyticsBatcher, m as addEvent } from "./events-CMFCCu1H.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
+import "./trueSight-4L5GCqKy.esm.js";
+import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-6sK3f5pc.esm.js";
 import { n as UAParser, t as getParsedUserAgent } from "./getParsedUserAgent-pJjATANs.esm.js";
 import { r as isIOS } from "./platform-Cd_yWGNG.esm.js";
 import { t as getUserAgent } from "./getBrowser-Cb8Zgrgp.esm.js";
@@ -1530,30 +1532,10 @@ var IpifyProvider = class {
 	}
 };
 //#endregion
-//#region src/internal/featureConfig/featureConfigService.ts
-let cachedFeatures$1 = null;
-/**
-* Checks if a feature is enabled in the feature config.
-*/
-function isFeatureEnabled(feature, features) {
-	return features?.find((f) => f.feature === feature)?.enabled ?? false;
-}
-/**
-* Fetches feature configuration from the backend.
-* Results are cached for the session lifetime.
-*/
-async function fetchFeatureConfig(signal) {
-	if (cachedFeatures$1) return cachedFeatures$1;
-	const response = await api.get(endpoints.featureConfig, { signal });
-	if (!response.ok) throw new Error(`Failed to fetch feature config: ${response.status} ${response.statusText}`);
-	cachedFeatures$1 = response.data;
-	return cachedFeatures$1;
-}
-/**
-* Resets the cached feature config (useful for testing).
-*/
-function resetFeatureConfigCache() {
-	cachedFeatures$1 = null;
+//#region src/internal/fingerprint/fingerprintApi.ts
+async function getFingerprint(disableIpify) {
+	const shouldDisableIpify = disableIpify ?? getDisableIpify();
+	return new FingerprintProvider(new IpifyProvider()).getFingerprint(shouldDisableIpify);
 }
 //#endregion
 //#region src/internal/device/hasLiedBrowser.ts
@@ -1613,9 +1595,6 @@ function isBrowserSimulation(browserEnv) {
 	return false;
 }
 //#endregion
-//#region src/internal/version/sdkVersion.ts
-const SDK_VERSION = "0.0.0-dev-20260728-af4e1aee";
-//#endregion
 //#region src/internal/fingerprint/fingerprintService.ts
 function formatOsVersion(os) {
 	return `${os.name || "Unknown"} ${os.version || ""}`.trim();
@@ -1691,6 +1670,11 @@ function setClientFingerprintEnabled(enabled) {
 function resolveDisableIpify(serverDisableIpify) {
 	return !clientIpLookupEnabled || serverDisableIpify;
 }
+/** `"Chrome" + "126"` -> `"Chrome 126"`; undefined when nothing was parsed. */
+function composeNameVersion(name, version) {
+	const value = [name, version].filter(Boolean).join(" ");
+	return value === "" ? void 0 : value;
+}
 function preloadOptionalFlow() {
 	try {
 		return preloadSessionFlow().catch(() => void 0);
@@ -1738,6 +1722,7 @@ async function initializeSession(options = {}) {
 		resetSessionInit();
 		if (isTRIStarted()) triLinkPromise = linkSessionWithTRI(token);
 	}
+	if (token !== void 0) noteTokenActivated();
 	const flowPreloadPromise = getToken() && preloadFlow === true ? preloadOptionalFlow() : Promise.resolve();
 	await triLinkPromise;
 	if (sessionInitialized && cachedFeatures) {
@@ -1760,8 +1745,11 @@ async function initializeSession(options = {}) {
 		try {
 			features = await fetchFeatureConfig(signal);
 			serverDisableIpify = isFeatureEnabled("DISABLE_IPIFY", features.features);
+			startTrueSightCollection(features);
 		} catch {
 			features = { sessionIdentifier: "" };
+			trueSightLog("warning", "session", "orchestration", "feature-config fetch failed");
+			startTrueSightCollection();
 		}
 		const disableIpify = resolveDisableIpify(serverDisableIpify);
 		await updateFeatureManagementUser({ customIDs: { hashed_onboarding_id: features.sessionIdentifier || void 0 } });
@@ -1782,10 +1770,17 @@ async function initializeSession(options = {}) {
 			flushDeviceStatsQueue();
 		} catch (error) {
 			console.warn("Failed to submit device fingerprint:", error);
+			trueSightLog("warning", "session", "other", "device fingerprint submit failed");
 		}
 		else flushDeviceStatsQueue();
 		try {
 			const browserInfo = new BrowserInfoProvider().getBrowserInfo();
+			const language = new BrowserEnvironmentProvider().getNavigatorProperty("language");
+			noteEnvironment({
+				browser: composeNameVersion(browserInfo.browser.name, browserInfo.browser.version),
+				osVersion: composeNameVersion(browserInfo.os.name, browserInfo.os.version),
+				osLanguage: typeof language === "string" ? language : void 0
+			});
 			addEvent({
 				code: "browser",
 				payload: {
@@ -1854,4 +1849,4 @@ function resetSessionInit() {
 	resetDeviceStatsQueue();
 }
 //#endregion
-export { getDeviceFingerprintInfo as _, resetSessionInit as a, getStandaloneFlowPolicy as c, resolveStandaloneFlowPolicy as d, setStandaloneFlowPolicy as f, getThumbmarkId as g, FingerprintProvider as h, initializeSession as i, registerFlowPreloader as l, IpifyProvider as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, isBrowserSimulation as p, getSessionFingerprintResult as r, setClientIpLookupEnabled as s, getDisableIpify as t, resetStandaloneFlowPolicy as u, BrowserEnvironmentProvider as v };
+export { getDeviceFingerprintInfo as _, resetSessionInit as a, getStandaloneFlowPolicy as c, resolveStandaloneFlowPolicy as d, setStandaloneFlowPolicy as f, getThumbmarkId as g, IpifyProvider as h, initializeSession as i, registerFlowPreloader as l, getFingerprint as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, isBrowserSimulation as p, getSessionFingerprintResult as r, setClientIpLookupEnabled as s, getDisableIpify as t, resetStandaloneFlowPolicy as u, BrowserEnvironmentProvider as v };

package/dist/{setup-BFGd-cxt.esm.js → setup-BR4G3NHV.esm.js}

@@ -1,15 +1,18 @@
-import { a as warmupWasm, i as setWasmOnDeviceMode, t as WasmUtilProvider } from "./WasmUtilProvider-BrWOTaVG.esm.js";
-import { a as resolveWasmConfig } from "./wasmDefaults-B4DUtYET.esm.js";
+import { a as resolveWasmConfig } from "./wasmDefaults-DJiEvV7f.esm.js";
+import { a as warmupWasm, i as setWasmOnDeviceMode, t as WasmUtilProvider } from "./WasmUtilProvider-D13sxEmA.esm.js";
+import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
 import { _ as applyEnvironment, c as getIsFeatureManagementLocked, f as optOutFeatureManagement, m as resetFeatureManagementProviderInstance, p as resetFeatureManagement, u as initializeFeatureManagement, v as getEnvironment, y as resetEnvironment } from "./feature-management-Dw96qEMs.esm.js";
-import { a as resetApi, i as isApiConfigured, n as getApi, r as getToken, t as api } from "./api-BDTZNnca.esm.js";
-import { i as upgradeToWasmHttpClient$1, n as installFreshHttpClient, r as resetHttpClientState, t as getStoredHttpConfig } from "./clientLifecycle-BX83zwtT.esm.js";
-import { _ as setAnalyticsBatcher, g as resetAnalyticsBatcher, h as getAnalyticsBatcher } from "./events-Dy8PyVO5.esm.js";
-import { t as endpoints } from "./endpoints-CfRg7iAr.esm.js";
-import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-4DAk7TYl.esm.js";
-import { a as resetSessionInit, d as resolveStandaloneFlowPolicy, f as setStandaloneFlowPolicy, i as initializeSession, l as registerFlowPreloader, o as setClientFingerprintEnabled, s as setClientIpLookupEnabled, u as resetStandaloneFlowPolicy } from "./sessionInitializer-CgjN51b2.esm.js";
+import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
+import { a as resetApi, i as isApiConfigured, n as getApi, r as getToken, s as setHttpRequestObserver, t as api } from "./api-Bx3gKW_y.esm.js";
+import { C as upgradeToWasmHttpClient$1, S as resetHttpClientState, b as getStoredHttpConfig, g as noteTestingSignals, l as trueSightLog, n as initializeTrueSightDiagnostics, o as resetTrueSight, t as finalizeTrueSight, u as categoryForEndpoint, x as installFreshHttpClient } from "./trueSightService-DKC-gmQC.esm.js";
+import { _ as setAnalyticsBatcher, g as resetAnalyticsBatcher, h as getAnalyticsBatcher } from "./events-CMFCCu1H.esm.js";
+import { a as resetSessionInit, d as resolveStandaloneFlowPolicy, f as setStandaloneFlowPolicy, i as initializeSession, l as registerFlowPreloader, o as setClientFingerprintEnabled, s as setClientIpLookupEnabled, u as resetStandaloneFlowPolicy, v as BrowserEnvironmentProvider } from "./sessionInitializer-DEd0CQ74.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
+import "./trueSight-4L5GCqKy.esm.js";
+import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-6sK3f5pc.esm.js";
 import { a as resetTRI, n as initializeTRI, o as resetTRIProviderInstance } from "./tri-4RsGrIt6.esm.js";
-import { n as preloadDashboardFlow, r as resetDashboardFlowCache } from "./flowServices-T5JoA_1N.esm.js";
+import { n as preloadDashboardFlow, r as resetDashboardFlowCache } from "./flowServices-CPti9am-.esm.js";
 //#region ../infra/src/providers/browser/BrowserPageLifecycleProvider.ts
 var BrowserPageLifecycleProvider = class {
 	sendBeacon(url, body, contentType = "application/json") {
@@ -288,6 +291,44 @@ function normalizeEncryption(input) {
 }
 let configured = false;
 /**
+* One-line environment facts for TrueSight's snapshot-on-first-error entry
+* (navigator facts read through the L0 provider — core never touches
+* browser globals directly).
+*/
+function buildEnvironmentSnapshot() {
+	const environment = new BrowserEnvironmentProvider();
+	const read = (property) => {
+		try {
+			return environment.getNavigatorProperty(property);
+		} catch {
+			return;
+		}
+	};
+	const connection = read("connection");
+	return [
+		`connection=${typeof connection?.effectiveType === "string" ? connection.effectiveType : "unknown"}`,
+		`saveData=${connection?.saveData === true}`,
+		`online=${read("onLine") !== false}`,
+		`language=${typeof read("language") === "string" ? String(read("language")) : "unknown"}`
+	].join(" ");
+}
+/**
+* ENG-48677 event map row 23b: every Incode HTTP request, success or
+* failure, becomes a self-health line (Android-dashboard parity). Lives here
+* rather than in `api.ts` — `trueSightService` already imports from that
+* module, so a direct `trueSightLog` import there would cycle; `setup()`
+* wires this adapter in as the decoupled observer instead.
+*/
+function logHttpRequestTiming(entry) {
+	const category = categoryForEndpoint(entry.endpoint);
+	const status = entry.httpStatus ?? "unknown";
+	if (entry.outcome === "success") {
+		trueSightLog("debug", "http", category, `http request completed endpoint=${entry.endpoint} method=${entry.method} httpStatus=${status} durationMs=${entry.durationMs}`);
+		return;
+	}
+	trueSightLog("error", "http", category, `http request failed endpoint=${entry.endpoint} method=${entry.method} httpStatus=${status} durationMs=${entry.durationMs}`);
+}
+/**
 * Initializes the SDK with the provided configuration.
 * Must be called before using any SDK functionality.
 *
@@ -442,6 +483,18 @@ async function setup(options) {
 		pageLifecycle: new BrowserPageLifecycleProvider(),
 		timer: BrowserTimerProvider.getInstance()
 	}));
+	initializeTrueSightDiagnostics({
+		enabled: options.trueSight?.enabled !== false,
+		pageLifecycle: new BrowserPageLifecycleProvider(),
+		timer: BrowserTimerProvider.getInstance(),
+		storage: new BrowserStorageProvider(),
+		getEnvironmentSnapshot: buildEnvironmentSnapshot
+	});
+	noteTestingSignals({
+		devMode: options.devMode,
+		apiUrl: options.apiURL
+	});
+	setHttpRequestObserver(logHttpRequestTiming);
 	const requestedEncryption = normalizeEncryption(options.encryption);
 	const stored = getStoredHttpConfig();
 	if (requestedEncryption && stored) {
@@ -453,7 +506,12 @@ async function setup(options) {
 		mgf1: "sha1"
 	};
 	const effectiveWasm = options.wasm || requestedEncryption?.enabled ? resolveWasmConfig(options.wasm || {}) : void 0;
-	if (options.apiURL) await installFreshHttpClient(options.apiURL, options, effectiveWasm, effectiveEncryption);
+	if (options.apiURL) try {
+		await installFreshHttpClient(options.apiURL, options, effectiveWasm, effectiveEncryption);
+	} catch (error) {
+		trueSightLog("severe", "http", "other", `http client install failed error=${String(error)}`);
+		throw error;
+	}
 	if (options.token && isApiConfigured()) {
 		const sessionOptions = {
 			token: options.token,
@@ -473,7 +531,14 @@ async function setup(options) {
 			...effectiveWasm,
 			pipelines: effectiveWasm.pipelines ? [...effectiveWasm.pipelines] : void 0
 		};
-		await warmupWasm(effectiveWasm);
+		const warmupStartedAt = getTimestamp();
+		try {
+			await warmupWasm(effectiveWasm);
+		} catch (error) {
+			trueSightLog("severe", "wasm", "other", `wasm warmup failed error=${String(error)} durationMs=${getTimestamp() - warmupStartedAt}`);
+			throw error;
+		}
+		trueSightLog("debug", "wasm", "other", `wasm warmup completed durationMs=${getTimestamp() - warmupStartedAt}`);
 		const provider = await WasmUtilProvider.getInstance();
 		await provider.initialize({
 			...effectiveWasm,
@@ -574,6 +639,7 @@ function isConfigured() {
 * Resets the SDK configuration. Useful for testing.
 */
 function reset() {
+	finalizeTrueSight("failure", "sdk_reset");
 	stopDevtoolsDetector();
 	resetDeviceStatsQueue();
 	resetApi();
@@ -593,6 +659,7 @@ function reset() {
 	resetFeatureManagement();
 	resetFeatureManagementProviderInstance();
 	resetEnvironment();
+	resetTrueSight();
 }
 //#endregion
 export { setWasmConfig as a, reset as i, initializeWasmUtil as n, setup as o, isConfigured as r, upgradeToWasmHttpClient as s, ensureWasmPipelines as t };

package/dist/{setup-B1WTXTQV.d.ts → setup-Dj8n_YLP.d.ts}

@@ -240,6 +240,28 @@ type SetupOptions = {
    * collection should begin.
    */
   tri?: TransactionalRiskIntelligenceSetupConfig;
+  /**
+   * TrueSight diagnostics — Incode-internal SDK-health telemetry
+   * (engineering-only dashboard, not customer analytics). During a session
+   * the SDK buffers sanitized, structured diagnostic breadcrumbs (module
+   * outcomes, error codes, timings — never PII, never captured images) and,
+   * at the session terminal, uploads ONE encrypted record to the Incode
+   * diagnostics backend. Used by Incode to debug customer-reported capture
+   * issues. Fire-and-forget and fail-open: it adds no retries, no blocking
+   * work, and can never affect the host flow.
+   *
+   * - `enabled` — set `false` to opt out entirely (no collection, no
+   *   subscriptions, no upload). Default: `true` (native SDK parity). Also
+   *   subject to a server-side kill-switch; an explicit server `false` stops
+   *   collection remotely regardless of this option.
+   *
+   * Decided by the first `setup()` call of the SDK lifecycle; later `setup()`
+   * calls cannot re-enable or disable it mid-session. Call `reset()` to start
+   * a new lifecycle with a different value.
+   */
+  trueSight?: {
+    enabled?: boolean;
+  };
   /**
    * Enables feature management. Loaded during `setup()` as a separate dynamic chunk,
    * never part of the main `@incodetech/core` bundle.