@incodetech/core 0.0.0-dev-20260729-9461bce1 → 0.0.0-dev-20260729-e2dda0b0

package/dist/{mandatoryConsentManager-Dcgmj1Cd.d.ts → mandatoryConsentManager-CzsVFG33.d.ts}

@@ -61,18 +61,18 @@ declare const mandatoryConsentMachine: StateMachine<MandatoryConsentContext, {
     type: "clearError";
     params: NonReducibleUnknown;
   };
-  toggleSigned: {
-    type: "toggleSigned";
-    params: NonReducibleUnknown;
-  };
   resetContext: {
     type: "resetContext";
     params: NonReducibleUnknown;
   };
+  toggleSigned: {
+    type: "toggleSigned";
+    params: NonReducibleUnknown;
+  };
 }>, {
   type: "canSubmit";
   params: unknown;
-}, never, "error" | "idle" | "closed" | "finished" | "loading" | "submitting" | "display", string, MandatoryConsentInput, NonReducibleUnknown, EventObject, MetaObject, {
+}, never, "error" | "idle" | "closed" | "finished" | "submitting" | "loading" | "display", string, MandatoryConsentInput, NonReducibleUnknown, EventObject, MetaObject, {
   readonly id: "mandatoryConsent";
   readonly initial: "idle";
   readonly context: ({ input }: {

package/dist/{mandatoryConsentManager-BAKnA7U_.esm.js → mandatoryConsentManager-DaKK7S4q.esm.js}

@@ -1,6 +1,6 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-Dy8PyVO5.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-CMFCCu1H.esm.js";
 import { c as createManager, o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
-import { t as mandatoryConsentMachine } from "./mandatoryConsentStateMachine-3a1psaoK.esm.js";
+import { t as mandatoryConsentMachine } from "./mandatoryConsentStateMachine-CjKpOQXU.esm.js";
 //#region src/modules/mandatory-consent/mandatoryConsentActor.ts
 function createMandatoryConsentActor(options) {
 	return createActor(mandatoryConsentMachine, { input: { config: options.config } }).start();

package/dist/{mandatoryConsentStateMachine-3a1psaoK.esm.js → mandatoryConsentStateMachine-CjKpOQXU.esm.js}

@@ -1,5 +1,5 @@
-import { t as api } from "./api-BDTZNnca.esm.js";
-import { t as endpoints } from "./endpoints-BwKx4Gne.esm.js";
+import { t as api } from "./api-Bx3gKW_y.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
 import { r as assign, t as setup } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-CtI5S0f4.esm.js";
 //#region src/modules/mandatory-consent/mandatoryConsentServices.ts

package/dist/{onDeviceFaceResults-DbSP6iTw.esm.js → onDeviceFaceResults-CVhk1BWp.esm.js}

@@ -1,7 +1,9 @@
-import { n as BaseWasmProvider, o as mlWasmJSApi_default } from "./WasmUtilProvider-BrWOTaVG.esm.js";
-import { r as getToken, t as api } from "./api-BDTZNnca.esm.js";
-import { t as endpoints } from "./endpoints-BwKx4Gne.esm.js";
-import { t as addDeviceStats } from "./stats-CKtpeAhi.esm.js";
+import { n as BaseWasmProvider, o as mlWasmJSApi_default } from "./WasmUtilProvider-D13sxEmA.esm.js";
+import { r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
+import { c as trueSightHintTransition, l as trueSightLog, r as noteTrueSightCaptureActivity } from "./trueSightService-DKC-gmQC.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
+import "./trueSight-4L5GCqKy.esm.js";
+import { t as addDeviceStats } from "./stats-6sK3f5pc.esm.js";
 import { a as isIPhone14OrHigher, n as isDesktop } from "./platform-Cd_yWGNG.esm.js";
 import { a as stopCameraStream, r as requestCameraAccess } from "./camera-BmFEyPP_.esm.js";
 import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
@@ -401,10 +403,12 @@ function startDetection(params) {
 		if (session?.isDisposed() === true) return;
 		if (lastStatus === status) return;
 		lastStatus = status;
+		trueSightHintTransition("module.face-capture", "faceScan", status);
 		params.onUpdate(status);
 	};
 	const stopDetectionLoop = () => {
 		session?.dispose();
+		noteTrueSightCaptureActivity(false);
 	};
 	const reset = () => {
 		provider.reset();
@@ -457,6 +461,7 @@ function startDetection(params) {
 				provider,
 				onFrame: params.onFrame
 			});
+			noteTrueSightCaptureActivity(true);
 		} catch {
 			setStatus("error");
 			cleanup();
@@ -516,7 +521,7 @@ async function stopRecording(session) {
 	}
 }
 async function initializeDeepsightSession(options) {
-	const { loadDeepsightSession } = await import("./deepsightLoader-AdX0vjwb.esm.js");
+	const { loadDeepsightSession } = await import("./deepsightLoader-CHG26pOB.esm.js");
 	return loadDeepsightSession({
 		ds: options.ds,
 		storage: options.storage
@@ -561,7 +566,9 @@ async function defaultPrepareFaceUpload(ctx) {
 	const recordingId = (await ctx.recordingService?.stop())?.recordingId ?? null;
 	try {
 		if (ctx.deepsightService) await Promise.all([ctx.deepsightService.performVirtualCameraCheck(sessionToken, "SELFIE"), ctx.deepsightService.analyzeFrame(ctx.capturedImage.getImageData())]);
-	} catch (error) {}
+	} catch (error) {
+		trueSightLog("warning", "deepsight", "faceScan", `deepsight selfie analysis failed error=${String(error)}`);
+	}
 	const logs = ctx.deepsightService?.getPipelineState() ?? "";
 	ctx.dependencies.trackCaptureAttemptFinished?.({ logs });
 	return {

package/dist/{permissionGuards-5Cu6a8iN.esm.js → permissionGuards-UMiLlPfq.esm.js}

@@ -1,4 +1,4 @@
-import { a as isWasmMotionPrimedForModule } from "./permissionServices-CkHL1BjH.esm.js";
+import { a as isWasmMotionPrimedForModule } from "./permissionServices-C4qKxOl4.esm.js";
 //#region src/internal/permissions/permissionGuards.ts
 function resolveStoredPermissionResult(fromEvent, fromContext) {
 	if (fromEvent === "granted" || fromEvent === "denied" || fromEvent === "prompt" || fromEvent === "refresh") return fromEvent;

package/dist/{permissionServices-CkHL1BjH.esm.js → permissionServices-C4qKxOl4.esm.js}

@@ -1,4 +1,4 @@
-import { t as WasmUtilProvider } from "./WasmUtilProvider-BrWOTaVG.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-D13sxEmA.esm.js";
 import { t as MotionSensorProvider } from "./MotionSensorProvider-DYvM90IX.esm.js";
 import { a as stopCameraStream, r as requestCameraAccess } from "./camera-BmFEyPP_.esm.js";
 //#region ../infra/src/media/cameraPermissionSession.ts

package/dist/personhood.esm.js

@@ -1,31 +1,18 @@
-import { t as WasmUtilProvider } from "./WasmUtilProvider-BrWOTaVG.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-D13sxEmA.esm.js";
+import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { t as api } from "./api-BDTZNnca.esm.js";
-import { a as createApi$1, t as getStoredHttpConfig } from "./clientLifecycle-BX83zwtT.esm.js";
-import { n as eventModuleNames } from "./events-Dy8PyVO5.esm.js";
-import { t as endpoints } from "./endpoints-BwKx4Gne.esm.js";
-import { _ as getDeviceFingerprintInfo, g as getThumbmarkId, n as getFingerprintEnabled, p as isBrowserSimulation, v as BrowserEnvironmentProvider } from "./sessionInitializer-DyJ4nLFJ.esm.js";
+import { t as api } from "./api-Bx3gKW_y.esm.js";
+import { b as getStoredHttpConfig, w as createApi$1, y as randomUUID } from "./trueSightService-DKC-gmQC.esm.js";
+import { n as eventModuleNames } from "./events-CMFCCu1H.esm.js";
+import { _ as getDeviceFingerprintInfo, g as getThumbmarkId, n as getFingerprintEnabled, p as isBrowserSimulation, v as BrowserEnvironmentProvider } from "./sessionInitializer-DEd0CQ74.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
 import { c as createManager, o as createActor, r as assign, t as setup } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-CtI5S0f4.esm.js";
-import { i as requestPermission, t as checkPermission } from "./permissionServices-CkHL1BjH.esm.js";
+import { i as requestPermission, t as checkPermission } from "./permissionServices-C4qKxOl4.esm.js";
 import { a as stopCameraStream, r as requestCameraAccess } from "./camera-BmFEyPP_.esm.js";
-import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
-import { f as stopStream, l as startDetection, s as initializeDeepsightSession, v as FaceDetectionProvider } from "./onDeviceFaceResults-DbSP6iTw.esm.js";
+import { f as stopStream, l as startDetection, s as initializeDeepsightSession, v as FaceDetectionProvider } from "./onDeviceFaceResults-CVhk1BWp.esm.js";
 import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
 import { t as StreamCanvasCapture } from "./StreamCanvasCapture-D2XcXCZ4.esm.js";
-//#region ../infra/src/crypto/randomUUID.ts
-/**
-* Cryptographically-strong UUID v4 (RFC 4122).
-*
-* Lives in infra (L0) so Core (L1) can mint secure identifiers without touching
-* the `crypto` browser API directly — Core delegates here, keeping it free of
-* browser globals (enforced by the `no-browser-api-in-core` lint rule). Backed
-* by `crypto.randomUUID`, available in every browser the SDK targets.
-*/
-function randomUUID() {
-	return crypto.randomUUID();
-}
-//#endregion
 //#region src/modules/personhood/personhoodServices.ts
 /**
 * Config used for the passive liveness pass. Deliberately stripped down from

package/dist/phone.esm.js

@@ -1,3 +1,3 @@
-import { t as phoneMachine } from "./phoneStateMachine-DxmYoLg8.esm.js";
-import { t as createPhoneManager } from "./phoneManager-dizEvG20.esm.js";
+import { t as phoneMachine } from "./phoneStateMachine-FJ-_x1G4.esm.js";
+import { t as createPhoneManager } from "./phoneManager-WImoAp4i.esm.js";
 export { createPhoneManager, phoneMachine };

package/dist/{phoneManager-dizEvG20.esm.js → phoneManager-WImoAp4i.esm.js}

@@ -1,6 +1,6 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-Dy8PyVO5.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-CMFCCu1H.esm.js";
 import { c as createManager, o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
-import { t as phoneMachine } from "./phoneStateMachine-DxmYoLg8.esm.js";
+import { t as phoneMachine } from "./phoneStateMachine-FJ-_x1G4.esm.js";
 //#region src/modules/phone/phoneActor.ts
 function createPhoneActor(options) {
 	return createActor(phoneMachine, { input: { config: options.config } }).start();

package/dist/{phoneStateMachine-DxmYoLg8.esm.js → phoneStateMachine-FJ-_x1G4.esm.js}

@@ -1,6 +1,6 @@
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { t as api } from "./api-BDTZNnca.esm.js";
-import { t as endpoints } from "./endpoints-BwKx4Gne.esm.js";
+import { t as api } from "./api-Bx3gKW_y.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
 import { r as assign, t as setup } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-CtI5S0f4.esm.js";
 import { n as isOtpComplete, t as computeOtpValidationErrors } from "./otp-D2k3PeSL.esm.js";

package/dist/qe-signature.esm.js

@@ -1,4 +1,4 @@
-import { a as areAllConsented, i as QE_CONSENT_KEYS, n as electronicSignatureMachine, s as getDefaultConsentChecks, t as createElectronicSignatureManager } from "./electronicSignatureManager-hJ9YaAvD.esm.js";
+import { a as areAllConsented, i as QE_CONSENT_KEYS, n as electronicSignatureMachine, s as getDefaultConsentChecks, t as createElectronicSignatureManager } from "./electronicSignatureManager-D0X7P-de.esm.js";
 //#region src/modules/qe-signature/index.ts
 function createQeSignatureManager(options) {
 	return createElectronicSignatureManager({ config: {

package/dist/{recordingService-C8jFtEKZ.esm.js → recordingService-BGPq5vGr.esm.js}

@@ -1,7 +1,7 @@
-import { t as api } from "./api-BDTZNnca.esm.js";
-import { t as endpoints } from "./endpoints-BwKx4Gne.esm.js";
+import { t as api } from "./api-Bx3gKW_y.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
 import { t as isAndroid } from "./platform-Cd_yWGNG.esm.js";
-import { d as stopRecording, g as uploadDeepsightVideo, u as startRecordingSession } from "./onDeviceFaceResults-DbSP6iTw.esm.js";
+import { d as stopRecording, g as uploadDeepsightVideo, u as startRecordingSession } from "./onDeviceFaceResults-CVhk1BWp.esm.js";
 import { t as getAdaptiveMediaRecorderOptions } from "./mediaRecorderOptions-CUsftWlH.esm.js";
 //#region src/internal/manualReview/manualReviewService.ts
 async function flagFaceManualReview() {

package/dist/redirect-to-mobile.esm.js

@@ -1,3 +1,3 @@
-import { n as redirectToMobileMachine, r as defaultRedirectToMobileServices } from "./redirectToMobileStateMachine-TSHtrr5D.esm.js";
-import { n as createRedirectToMobileManagerFromActor, t as createRedirectToMobileManager } from "./redirectToMobileManager-BCInKNqp.esm.js";
+import { n as redirectToMobileMachine, r as defaultRedirectToMobileServices } from "./redirectToMobileStateMachine-jI5XPtZJ.esm.js";
+import { n as createRedirectToMobileManagerFromActor, t as createRedirectToMobileManager } from "./redirectToMobileManager-CxEu6KnV.esm.js";
 export { createRedirectToMobileManager, createRedirectToMobileManagerFromActor, defaultRedirectToMobileServices, redirectToMobileMachine };

package/dist/{redirectToMobileManager-BCInKNqp.esm.js → redirectToMobileManager-CxEu6KnV.esm.js}

@@ -1,8 +1,8 @@
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-Dy8PyVO5.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-CMFCCu1H.esm.js";
 import { c as createManager, o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-CtI5S0f4.esm.js";
-import { n as redirectToMobileMachine, r as defaultRedirectToMobileServices, t as canResendSmsFromContext } from "./redirectToMobileStateMachine-TSHtrr5D.esm.js";
+import { n as redirectToMobileMachine, r as defaultRedirectToMobileServices, t as canResendSmsFromContext } from "./redirectToMobileStateMachine-jI5XPtZJ.esm.js";
 //#region src/modules/redirect-to-mobile/redirectToMobileActor.ts
 const POLL_INTERVAL_MS = 5e3;
 const QR_REFRESH_INTERVAL_MS = 5e3;

package/dist/{redirectToMobileStateMachine-TSHtrr5D.esm.js → redirectToMobileStateMachine-jI5XPtZJ.esm.js}

@@ -1,6 +1,6 @@
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { t as api } from "./api-BDTZNnca.esm.js";
-import { t as endpoints } from "./endpoints-BwKx4Gne.esm.js";
+import { t as api } from "./api-Bx3gKW_y.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
 import { r as assign, t as setup } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-CtI5S0f4.esm.js";
 import { n as getUrlSearchParam, t as buildUrlWithSearchParams } from "./urlUtils-D6phjq1-.esm.js";

package/dist/{runChildModule-Crz1nHwJ.esm.js → runChildModule-fagPe5Ct.esm.js}

@@ -1,4 +1,6 @@
-import { b as getTimestamp, y as createEventBus } from "./events-Dy8PyVO5.esm.js";
+import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
+import { a as notifyTrueSightManagerStopped, i as notifyTrueSightFlowEvent } from "./trueSightService-DKC-gmQC.esm.js";
+import { y as createEventBus } from "./events-CMFCCu1H.esm.js";
 import { o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { t as fromCallback } from "./xstate-actors.esm-CtI5S0f4.esm.js";
 import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
@@ -61,6 +63,8 @@ function getActiveModule(state, includeHomeModule) {
 }
 function attachFlowEventEmitter(manager, options = {}) {
 	const flowEventBus = createFlowEventBus();
+	const managerKind = options.managerKind ?? "flow";
+	flowEventBus.subscribe((event) => notifyTrueSightFlowEvent(event, managerKind));
 	let hasStartedCurrentRun = false;
 	let hasReadyCurrentRun = false;
 	let hasCompletedCurrentRun = false;
@@ -183,6 +187,7 @@ function attachFlowEventEmitter(manager, options = {}) {
 		value() {
 			if (isStopped) return;
 			isStopped = true;
+			notifyTrueSightManagerStopped(managerKind);
 			unsubscribe();
 			stop();
 		},

package/dist/selfie.esm.js

@@ -1,14 +1,14 @@
-import { t as WasmUtilProvider } from "./WasmUtilProvider-BrWOTaVG.esm.js";
-import { n as eventModuleNames } from "./events-Dy8PyVO5.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-D13sxEmA.esm.js";
+import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
+import { n as eventModuleNames } from "./events-CMFCCu1H.esm.js";
 import { o as createActor, r as assign } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-CtI5S0f4.esm.js";
-import { t as faceCaptureMachine } from "./faceCaptureSetup-BQEQriDi.esm.js";
-import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-Bkc1HLRL.esm.js";
-import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
-import { r as processFace } from "./selfieErrorUtils-1aFaxF3Q.esm.js";
-import { t as selfieMachine } from "./selfieStateMachine-BiuQiED3.esm.js";
-import { n as createSelfieManagerFromActor, t as createSelfieManager } from "./selfieManager-KbDEkivf.esm.js";
-import { t as invokeOnCaptureCallback } from "./invokeOnCaptureCallback-B-QfsCQY.esm.js";
+import { t as faceCaptureMachine } from "./faceCaptureSetup-DbhDPMjb.esm.js";
+import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-D2pR3ZnX.esm.js";
+import { r as processFace } from "./selfieErrorUtils-DCRRRj38.esm.js";
+import { t as selfieMachine } from "./selfieStateMachine-CxabK5_3.esm.js";
+import { n as createSelfieManagerFromActor, t as createSelfieManager } from "./selfieManager-DTiBsQNn.esm.js";
+import { t as invokeOnCaptureCallback } from "./invokeOnCaptureCallback-Cgl54qED.esm.js";
 //#region src/modules/selfie/selfieCaptureOnlyStateMachine.ts
 /**
 * Performs local finalization of a captured face frame: stops local video

package/dist/{selfieErrorUtils-1aFaxF3Q.esm.js → selfieErrorUtils-DCRRRj38.esm.js}

@@ -1,6 +1,6 @@
-import { t as api } from "./api-BDTZNnca.esm.js";
-import { t as endpoints } from "./endpoints-BwKx4Gne.esm.js";
-import { t as addDeviceStats } from "./stats-CKtpeAhi.esm.js";
+import { t as api } from "./api-Bx3gKW_y.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
+import { t as addDeviceStats } from "./stats-6sK3f5pc.esm.js";
 import { t as getDeviceClass } from "./getDeviceClass-BGmoQmjj.esm.js";
 import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
 //#region src/modules/selfie/selfieUploadService.ts

package/dist/{selfieManager-KbDEkivf.esm.js → selfieManager-DTiBsQNn.esm.js}

@@ -1,9 +1,9 @@
-import { t as WasmUtilProvider } from "./WasmUtilProvider-BrWOTaVG.esm.js";
-import { n as eventModuleNames } from "./events-Dy8PyVO5.esm.js";
-import { o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
-import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-Bkc1HLRL.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-D13sxEmA.esm.js";
 import { t as BrowserStorageProvider } from "./BrowserStorageProvider-P6aUarE9.esm.js";
-import { t as selfieMachine } from "./selfieStateMachine-BiuQiED3.esm.js";
+import { n as eventModuleNames } from "./events-CMFCCu1H.esm.js";
+import { o as createActor } from "./xstate.esm-Cf4e0Cfd.esm.js";
+import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-D2pR3ZnX.esm.js";
+import { t as selfieMachine } from "./selfieStateMachine-CxabK5_3.esm.js";
 //#region src/modules/selfie/selfieActor.ts
 function createSelfieActor(options) {
 	const dependencies = options.dependencies ?? {

package/dist/{selfieStateMachine-BiuQiED3.esm.js → selfieStateMachine-CxabK5_3.esm.js}

@@ -1,9 +1,9 @@
 import { r as assign } from "./xstate.esm-Cf4e0Cfd.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-CtI5S0f4.esm.js";
-import { t as faceCaptureMachine } from "./faceCaptureSetup-BQEQriDi.esm.js";
-import { i as prepareOnDeviceFaceUpload, n as isOnDeviceMode, r as postOnDeviceFaceResults, t as defaultPrepareFaceUpload } from "./onDeviceFaceResults-DbSP6iTw.esm.js";
+import { t as faceCaptureMachine } from "./faceCaptureSetup-DbhDPMjb.esm.js";
+import { i as prepareOnDeviceFaceUpload, n as isOnDeviceMode, r as postOnDeviceFaceResults, t as defaultPrepareFaceUpload } from "./onDeviceFaceResults-CVhk1BWp.esm.js";
 import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
-import { i as uploadSelfie, n as validateUploadResponse, r as processFace } from "./selfieErrorUtils-1aFaxF3Q.esm.js";
+import { i as uploadSelfie, n as validateUploadResponse, r as processFace } from "./selfieErrorUtils-DCRRRj38.esm.js";
 /**
 * The selfie capture state machine.
 *

package/dist/session-Ccob4IUP.esm.js

@@ -0,0 +1,161 @@
+import { n as getApi } from "./api-Bx3gKW_y.esm.js";
+import { h as noteSessionCreated, l as trueSightLog } from "./trueSightService-DKC-gmQC.esm.js";
+import "./sessionInitializer-DEd0CQ74.esm.js";
+import { t as endpoints } from "./endpoints-DOfmJylF.esm.js";
+import "./trueSight-4L5GCqKy.esm.js";
+import { r as toIncodeApiError } from "./apiError-GA6MbJpI.esm.js";
+//#region src/internal/session/sessionService.ts
+/**
+* HTTP status codes the QR validation endpoint emits, keyed by their semantic
+* name. Hosts switch on these to render distinct messaging — `invalidQRuuid`
+* for an unknown/expired link, `onboardingUrlAlreadyUsed` for a one-time link
+* that has already been consumed.
+*/
+const QR_VALIDATION_ERROR_CODES = {
+	expiredUUID: 4026,
+	invalidQRuuid: 4081,
+	onboardingUrlAlreadyUsed: 4083
+};
+var QrValidationError = class extends Error {
+	constructor(status, statusText) {
+		super(`POST ${endpoints.qrValidateUuid} failed: ${status} ${statusText}`);
+		this.name = "QrValidationError";
+		this.status = status;
+		this.statusText = statusText;
+	}
+};
+/**
+* Creates a new onboarding session.
+*
+* @param apiKey - The API key from the Incode dashboard
+* @param options - Session creation options
+* @param signal - Optional AbortSignal for request cancellation
+* @returns The created session with token
+*
+* @example
+* ```ts
+* const session = await createSession('your-api-key', {
+*   configurationId: 'your-flow-id',
+*   language: 'en-US',
+* });
+* console.log(session.token); // Use this token for subsequent API calls
+* ```
+*/
+async function createSession(apiKey, options, signal) {
+	try {
+		const session = (await getApi().post(endpoints.createSession, {
+			configurationId: options.configurationId,
+			externalId: options.externalId,
+			externalCustomerId: options.externalCustomerId,
+			language: options.language ?? "en-US",
+			customFields: options.customFields,
+			uuid: options.uuid ?? null,
+			urlUuid: options.urlUuid ?? null,
+			interviewId: options.interviewId ?? null,
+			...options.loginHint != null && options.loginHint !== "" ? { loginHint: options.loginHint } : {}
+		}, {
+			headers: {
+				"x-api-key": apiKey,
+				"api-version": "1.0"
+			},
+			signal
+		})).data;
+		noteSessionCreated(session, {
+			configurationId: options.configurationId,
+			externalCustomerId: options.externalCustomerId,
+			interviewId: options.interviewId,
+			language: options.language
+		});
+		trueSightLog("info", "session", "orchestration", "session created");
+		return session;
+	} catch (error) {
+		toIncodeApiError(endpoints.createSession, error);
+	}
+}
+/**
+* Validates and rotates a QR anti-phishing URL UUID before creating a session.
+*
+* This call is unauthenticated; the `{ onboardingId, urlUuid }` pair itself
+* acts as the credential. The server burns the incoming `urlUuid` and returns
+* a freshly minted one that must be used in the subsequent `createSession`
+* call.
+*
+* @param options - `{ onboardingId, urlUuid }` from the incoming URL
+* @param signal - Optional AbortSignal for request cancellation
+* @returns The refreshed `urlUuid` to use for the session
+* @throws {QrValidationError} When the server rejects the validation request.
+*/
+async function validateQrUuid(options, signal) {
+	try {
+		return (await getApi().post(endpoints.qrValidateUuid, {
+			onboardingId: options.onboardingId,
+			urlUuid: options.urlUuid
+		}, {
+			headers: { "api-version": "1.0" },
+			signal
+		})).data;
+	} catch (error) {
+		const httpError = error;
+		throw new QrValidationError(httpError.data?.status ?? httpError.status, httpError.statusText);
+	}
+}
+/**
+* One-shot QR phishing-resistance helper.
+*
+* When `urlUuid` is a non-empty string, burns the stale value via
+* `validateQrUuid`, invokes `onRefreshed` with the fresh value, and returns
+* it so callers can forward it into `createSession`. When `urlUuid` is
+* absent, returns `undefined` without making any network call.
+*
+* Consolidates the rotation + callback logic shared by Flow self-loading and
+* Workflow token-mode bootstraps.
+*
+* @throws {QrValidationError} When the server rejects the validation request.
+*/
+async function refreshQrUrlUuid(options, signal) {
+	if (typeof options.urlUuid !== "string" || options.urlUuid.length === 0) return;
+	const result = await validateQrUuid({
+		onboardingId: options.onboardingId ?? null,
+		urlUuid: options.urlUuid
+	}, signal);
+	options.onRefreshed?.(result.urlUuid);
+	return result.urlUuid;
+}
+/**
+* Validates and rotates a QR anti-phishing `urlUuid` (when present), then
+* creates a session bound to the refreshed value. When `urlUuid` is absent,
+* behaves identically to {@link createSession}.
+*
+* Use this when the host owns session creation and wants the SDK to handle
+* phishing-resistance rotation in a single call. For raw control, compose
+* `refreshQrUrlUuid` and `createSession` directly.
+*
+* @throws {QrValidationError} When the server rejects the QR validation step.
+*
+* @example
+* ```ts
+* const session = await bootstrapSession(apiKey, {
+*   configurationId,
+*   urlUuid,
+*   onUrlUuidRefreshed: (refreshed) => {
+*     const url = new URL(window.location.href);
+*     url.searchParams.set('url_uuid', refreshed);
+*     window.history.replaceState({}, '', url);
+*   },
+* });
+* ```
+*/
+async function bootstrapSession(apiKey, options, signal) {
+	const { onUrlUuidRefreshed, ...createSessionOptions } = options;
+	const refreshedUrlUuid = await refreshQrUrlUuid({
+		urlUuid: options.urlUuid,
+		onboardingId: options.uuid ?? null,
+		onRefreshed: onUrlUuidRefreshed
+	}, signal);
+	return createSession(apiKey, {
+		...createSessionOptions,
+		urlUuid: refreshedUrlUuid
+	}, signal);
+}
+//#endregion
+export { refreshQrUrlUuid as a, createSession as i, QrValidationError as n, validateQrUuid as o, bootstrapSession as r, QR_VALIDATION_ERROR_CODES as t };

package/dist/session.d.ts

@@ -177,7 +177,14 @@ declare class IncodeApiError extends Error {
 }
 //#endregion
 //#region src/internal/featureConfig/types.d.ts
-type FeatureName = 'VIDEO_SELFIE_V2' | 'USE_CLIENT_GLARE' | 'USE_OPEN_VIDU' | 'DISABLE_IPIFY';
+type FeatureName = 'VIDEO_SELFIE_V2' | 'USE_CLIENT_GLARE' | 'USE_OPEN_VIDU' | 'DISABLE_IPIFY' |
+/**
+ * TrueSight diagnostics remote kill-switch (ENG-48677). Only an explicit
+ * `enabled: false` entry disables uploads — `true`, absent, or an
+ * unresolvable config all proceed (fail-open; the proxy's
+ * `truesight.api.enabled` is the environment authority).
+ */
+'TRUESIGHT_DIAGNOSTICS';
 type FeatureConfig = {
   enabled: boolean;
   feature: FeatureName;