@incodetech/core 0.0.0-dev-20260914-8aef7789 → 0.0.0-dev-20260914-ebfc99a7

package/dist/{idCaptureStateMachine-D3pqfK2Z.esm.js → idCaptureStateMachine-JE8limLp.esm.js}

@@ -1,16 +1,16 @@
-import { l as BrowserStorageProvider } from "./setup-CfNAVG-d.esm.js";
+import { l as BrowserStorageProvider } from "./setup-DrJjG62h.esm.js";
 import { r as WasmUtilProvider } from "./safeStorage-1O9k0ulP.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { s as exposeExperimentOnce } from "./feature-management-BEqf3Sr3.esm.js";
+import { s as exposeExperimentOnce } from "./feature-management-HxOVB0zA.esm.js";
 import { n as revokeObjectURL, t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
 import { r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { c as trueSightHintTransition, l as trueSightLog, m as isTrueSightTesting, r as noteTrueSightCaptureActivity } from "./trueSightService-TqmmYye3.esm.js";
+import { c as trueSightHintTransition, l as trueSightLog, m as isTrueSightTesting, r as noteTrueSightCaptureActivity } from "./trueSightService-C1Y4c-FL.esm.js";
 import { n as eventModuleNames, s as recordExperimentAssignmentOnce } from "./events-ijlbX_Wx.esm.js";
-import { t as getDisableIpify } from "./sessionInitializer-CUpgbHzs.esm.js";
+import { t as getDisableIpify } from "./sessionInitializer-DmOfm4im.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
 import { t as addDeviceStats } from "./stats-DkK-f8JT.esm.js";
 import { a as isIOS, s as isIPad, t as isAndroid, u as isMacOsSafari } from "./platform-DkcRc9JV.esm.js";
-import "./session-m9j27bHm.esm.js";
+import "./session-L-fDJmvT.esm.js";
 import { c as not, i as assign, l as raise, n as enqueueActions, o as and, r as sendTo, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
 import { n as getUrlSearchParam, t as buildUrlWithSearchParams } from "./urlUtils-D6phjq1-.esm.js";
@@ -24,8 +24,8 @@ import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
 import { t as getBrowser } from "./getBrowser-Cbe1C4Tn.esm.js";
 import { n as getWindowDimensions } from "./getDeviceClass-CeBiEayS.esm.js";
 import { n as runVirtualCameraCheck, t as frameSources } from "./virtualCameraCheck-WOloJ-do.esm.js";
-import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider } from "./idCaptureDefaults-C66YvkgN.esm.js";
-import { S as getIdCameraStream, _ as ID_ERROR_CODES, a as getRealQualityValue, b as CAPTURE_OPTIMIZING, d as startRecordingSession, f as stopRecording, g as validateUploadResponse, h as uploadManualIdFile, i as finalizeRecordingSession, l as prepareRecordingForCameraRetry, m as uploadIdImage, o as initializeIdCapture, p as stopStream, r as disposeRecordingSession, t as addBarcode, u as processId, x as OPTIMIZING_WATCHDOG_MARGIN_MS, y as resolveIdCaptureThresholds } from "./idCaptureServices-UXYCBZPK.esm.js";
+import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider } from "./idCaptureDefaults-BwHGyv9V.esm.js";
+import { S as getIdCameraStream, _ as ID_ERROR_CODES, a as getRealQualityValue, b as CAPTURE_OPTIMIZING, d as startRecordingSession, f as stopRecording, g as validateUploadResponse, h as uploadManualIdFile, i as finalizeRecordingSession, l as prepareRecordingForCameraRetry, m as uploadIdImage, o as initializeIdCapture, p as stopStream, r as disposeRecordingSession, t as addBarcode, u as processId, x as OPTIMIZING_WATCHDOG_MARGIN_MS, y as resolveIdCaptureThresholds } from "./idCaptureServices-DqwZvVCO.esm.js";
 import { t as StreamCanvasCapture } from "./StreamCanvasCapture-C9jtgBdT.esm.js";
 //#region src/modules/id/digitalUpload/digitalUploadErrors.ts
 const TERMINAL_FAIL_REASONS = /* @__PURE__ */ new Set(["DIGITAL_ID_REQUESTED_BUT_OTHER_PROVIDED", "ID_TYPE_UNACCEPTABLE"]);
@@ -1781,7 +1781,7 @@ fromPromise(async ({ input }) => {
 });
 fromPromise(async ({ input }) => {
 	if (!input.dependencies) return;
-	const { loadDeepsightSession } = await import("./deepsightLoader-Dhz9T_KJ.esm.js");
+	const { loadDeepsightSession } = await import("./deepsightLoader-mtiw6oVx.esm.js");
 	return loadDeepsightSession({
 		ds: input.ds,
 		storage: input.dependencies.storage,
@@ -2224,7 +2224,7 @@ function cleanup(service) {
 		service.cleanup();
 	} catch {}
 }
-function createIdMetadataPreparationCoordinator(load = async (input) => (await import("./deepsightLoader-Dhz9T_KJ.esm.js")).loadDeepsightSession(input)) {
+function createIdMetadataPreparationCoordinator(load = async (input) => (await import("./deepsightLoader-mtiw6oVx.esm.js")).loadDeepsightSession(input)) {
 	let disposed = false;
 	let preparation;
 	let service;
@@ -3124,6 +3124,75 @@ function getProtectedIdUploadRequest(context, sessionToken = getToken()) {
 	} : { target };
 }
 //#endregion
+//#region src/modules/digital-id-redirect/pollCadence.ts
+/**
+* Cadence used when the response carries no usable `Retry-After` — a
+* non-terminal `CREATED` (the backend only sets the header on `IN_PROGRESS`),
+* a transient poll failure, or a header the browser cannot read because the
+* cross-origin response does not expose it.
+*/
+const DEFAULT_POLL_INTERVAL_MS = 1500;
+/** The slower cadence the contract asks for past `POLL_BACKOFF_AFTER_MS`. */
+const BACKOFF_POLL_INTERVAL_MS = 5e3;
+/**
+* Sanity bound on a server-sent `Retry-After`, mirroring the same cap in
+* `videoSelfieChunkUploader` — the only other place the SDK honours the header.
+*/
+const RETRY_AFTER_CAP_MS = 3e4;
+/**
+* Client-side ceiling on a single polling run. Deliberately far beyond both the
+* back-off point and any realistic bank round-trip: reaching it means something
+* is wrong on our side, not that the user's verification expired, so the
+* machine routes it to the recoverable `error` state and NOT to a
+* `SESSION_EXPIRED` failure. The verification itself may still complete and
+* land through the backend callback.
+*/
+const MAX_POLL_DURATION_MS = 10 * 6e4;
+const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+	"COMPLETED",
+	"FAILED",
+	"EXPIRED",
+	"CANCELLED"
+]);
+/** A terminal status is what stops the poll loop — never an attempt counter. */
+function isTerminal(status) {
+	return TERMINAL_STATUSES.has(status);
+}
+/**
+* Reads `Retry-After` (seconds) off a status response. Returns `null` when the
+* header is absent, unreadable, or not a usable positive number of seconds —
+* callers fall back to `DEFAULT_POLL_INTERVAL_MS`.
+*
+* Only the delta-seconds form is honoured (what the backend sends); the RFC
+* 9110 HTTP-date form falls back rather than being mis-parsed as `NaN`. A
+* literal `0` also falls back — polling as fast as the network allows is never
+* what the contract means.
+*
+* NOTE (cross-origin): `Retry-After` is not a CORS-safelisted response header.
+* A browser only surfaces it when the response also carries
+* `Access-Control-Expose-Headers: Retry-After`. Absence therefore degrades to
+* the fallback cadence instead of breaking the loop.
+*/
+function parseRetryAfterMs(headers) {
+	const raw = headers?.["retry-after"];
+	if (raw === void 0) return null;
+	const seconds = Number(raw);
+	if (!Number.isFinite(seconds) || seconds <= 0) return null;
+	return Math.min(seconds * 1e3, RETRY_AFTER_CAP_MS);
+}
+/**
+* The delay before the next poll.
+*
+* `retryAfterMs` is the server's ask (or `null` when it did not ask); once
+* `elapsedMs` passes `POLL_BACKOFF_AFTER_MS` the documented 5 s back-off
+* applies as a floor — the server's value is still honoured when it is the
+* slower of the two, so a backend that asks for more than 5 s always wins.
+*/
+function nextPollDelayMs(retryAfterMs, elapsedMs) {
+	const base = retryAfterMs ?? 1500;
+	return elapsedMs >= 3e4 ? Math.max(base, BACKOFF_POLL_INTERVAL_MS) : base;
+}
+//#endregion
 //#region src/modules/digital-id-redirect/digitalIdRedirectServices.ts
 function withQuery(path, params) {
 	if (!params) return path;
@@ -3193,12 +3262,22 @@ async function submitWalletResponse(verificationId, params, signal) {
 	if (!res.ok) throw new Error(`POST ${url} failed: ${res.status} ${res.statusText}`);
 	return res.data;
 }
-/** Poll fallback — used when the user does not return or results are delayed. */
+/**
+* Poll fallback — used when the user does not return or results are delayed.
+*
+* Returns the cadence alongside the verification: the backend sets
+* `Retry-After` while the status is `IN_PROGRESS` and the caller is expected to
+* pace itself by it (see `pollCadence`). Dropping the header here is what made
+* the SDK poll on a fixed interval and give up early.
+*/
 async function getVerificationStatus(verificationId, signal) {
 	const url = `${endpoints.digitalIdVerifications}/${verificationId}/status`;
 	const res = await api.get(url, { signal });
 	if (!res.ok) throw new Error(`GET ${url} failed: ${res.status} ${res.statusText}`);
-	return res.data;
+	return {
+		verification: res.data,
+		retryAfterMs: parseRetryAfterMs(res.headers)
+	};
 }
 /**
 * Refresh an expiring `launchUrl` (maps to `flowData.expiresAt`). Do NOT create
@@ -3244,17 +3323,13 @@ async function clearPendingRedirect(storage) {
 }
 //#endregion
 //#region src/modules/digital-id-redirect/digitalIdRedirectStateMachine.ts
-const POLL_INTERVAL_MS = 1500;
-const MAX_POLL_ATTEMPTS = 20;
-const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
-	"COMPLETED",
-	"FAILED",
-	"EXPIRED",
-	"CANCELLED"
-]);
-function isTerminal(status) {
-	return TERMINAL_STATUSES.has(status);
-}
+/**
+* Diagnostic message when the client-side polling ceiling is hit. Routed to the
+* recoverable `error` state — NOT to a `SESSION_EXPIRED` failure. A client that
+* stopped polling is not an expired session, and the difference decides whether
+* the user is told to start over (which would bill a second provider session).
+*/
+const POLL_CEILING_ERROR = "Digital ID status polling exceeded the client ceiling; the verification may still complete via the backend callback.";
 const digitalIdRedirectMachine = setup({
 	types: {
 		context: {},
@@ -3267,20 +3342,50 @@ const digitalIdRedirectMachine = setup({
 		createVerification: fromPromise(async ({ input, signal }) => createVerification(input, signal)),
 		submitWalletResponse: fromPromise(async ({ input, signal }) => submitWalletResponse(input.verificationId, input.params, signal)),
 		refreshVerification: fromPromise(async ({ input, signal }) => refreshVerification(input.verificationId, signal)),
+		/**
+		* Poll fallback: emits POLL_RESULT once the status turns terminal.
+		*
+		* Self-rescheduling `setTimeout` rather than a fixed `setInterval`, because
+		* the cadence is the backend's to set — each response's `Retry-After` picks
+		* the next delay (see `pollCadence`). Two things fall out of that shape:
+		* the loop never overlaps requests the way an interval with an async
+		* callback does, and it stops on a terminal status instead of running until
+		* an attempt budget expires.
+		*/
 		pollStatus: fromCallback(({ sendBack, input }) => {
 			const timer = BrowserTimerProvider.getInstance();
-			const interval = timer.setInterval(async () => {
+			const startedAt = getTimestamp();
+			let handle;
+			let stopped = false;
+			function schedule(delayMs) {
+				if (stopped) return;
+				handle = timer.setTimeout(() => void tick(), delayMs);
+			}
+			async function tick() {
+				let retryAfterMs = null;
 				try {
-					const v = await getVerificationStatus(input.verificationId);
-					if (isTerminal(v.status)) sendBack({
-						type: "POLL_RESULT",
-						verification: v
-					});
+					const poll = await getVerificationStatus(input.verificationId);
+					if (stopped) return;
+					if (isTerminal(poll.verification.status)) {
+						stopped = true;
+						sendBack({
+							type: "POLL_RESULT",
+							verification: poll.verification
+						});
+						return;
+					}
+					retryAfterMs = poll.retryAfterMs;
 				} catch (error) {
+					if (stopped) return;
 					console.warn("[DigitalIdRedirect] status poll failed:", error);
 				}
-			}, POLL_INTERVAL_MS);
-			return () => timer.clearInterval(interval);
+				schedule(nextPollDelayMs(retryAfterMs, getTimestamp() - startedAt));
+			}
+			schedule(DEFAULT_POLL_INTERVAL_MS);
+			return () => {
+				stopped = true;
+				if (handle !== void 0) timer.clearTimeout(handle);
+			};
 		}),
 		persistPending: fromPromise(async ({ input }) => {
 			await persistPendingRedirect(input.storage, {
@@ -3472,9 +3577,9 @@ const digitalIdRedirectMachine = setup({
 				target: "failed",
 				actions: "setVerificationFromEvent"
 			}] },
-			after: { [POLL_INTERVAL_MS * MAX_POLL_ATTEMPTS]: {
-				target: "failed",
-				actions: assign({ failureReason: () => "SESSION_EXPIRED" })
+			after: { [MAX_POLL_DURATION_MS]: {
+				target: "error",
+				actions: assign({ error: () => POLL_CEILING_ERROR })
 			} }
 		},
 		succeeded: { on: { CONTINUE: { target: "finished" } } },

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-import { a as isConfigured, l as setup, o as reset, t as SetupOptions } from "./setup-CEX95gJ1.js";
+import { a as isConfigured, l as setup, o as reset, t as SetupOptions } from "./setup-riMNzcSh.js";
 export { type SetupOptions, isConfigured, reset, setup };

package/dist/index.esm.js

@@ -1,2 +1,2 @@
-import { i as reset, r as isConfigured, s as setup } from "./setup-CfNAVG-d.esm.js";
+import { i as reset, r as isConfigured, s as setup } from "./setup-DrJjG62h.esm.js";
 export { isConfigured, reset, setup };

package/dist/mandatory-consent.d.ts

@@ -1,3 +1,3 @@
 import { r as MandatoryConsentConfig } from "./types-BzuUebkB.js";
-import { a as MandatoryConsentActor, i as createMandatoryConsentManagerFromActor, n as MandatoryConsentState, o as mandatoryConsentMachine, r as createMandatoryConsentManager, t as MandatoryConsentManager } from "./mandatoryConsentManager-CZwhsUlO.js";
+import { a as MandatoryConsentActor, i as createMandatoryConsentManagerFromActor, n as MandatoryConsentState, o as mandatoryConsentMachine, r as createMandatoryConsentManager, t as MandatoryConsentManager } from "./mandatoryConsentManager-8esu6ZIP.js";
 export { type MandatoryConsentActor, type MandatoryConsentConfig, type MandatoryConsentManager, type MandatoryConsentState, createMandatoryConsentManager, createMandatoryConsentManagerFromActor, mandatoryConsentMachine };

package/dist/{mandatoryConsentManager-CZwhsUlO.d.ts → mandatoryConsentManager-8esu6ZIP.d.ts}

@@ -57,6 +57,10 @@ declare const mandatoryConsentMachine: StateMachine<MandatoryConsentContext, {
     type: "setError";
     params: NonReducibleUnknown;
   };
+  toggleSigned: {
+    type: "toggleSigned";
+    params: NonReducibleUnknown;
+  };
   clearError: {
     type: "clearError";
     params: NonReducibleUnknown;
@@ -65,10 +69,6 @@ declare const mandatoryConsentMachine: StateMachine<MandatoryConsentContext, {
     type: "resetContext";
     params: NonReducibleUnknown;
   };
-  toggleSigned: {
-    type: "toggleSigned";
-    params: NonReducibleUnknown;
-  };
 }>, {
   type: "canSubmit";
   params: unknown;

package/dist/personhood.esm.js

@@ -1,16 +1,16 @@
-import { l as BrowserStorageProvider } from "./setup-CfNAVG-d.esm.js";
+import { l as BrowserStorageProvider } from "./setup-DrJjG62h.esm.js";
 import { r as WasmUtilProvider } from "./safeStorage-1O9k0ulP.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
 import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { b as getStoredHttpConfig, w as createApi$1, y as randomUUID } from "./trueSightService-TqmmYye3.esm.js";
+import { b as getStoredHttpConfig, w as createApi$1, y as randomUUID } from "./trueSightService-C1Y4c-FL.esm.js";
 import { n as eventModuleNames } from "./events-ijlbX_Wx.esm.js";
-import { _ as getThumbmarkId, m as isBrowserSimulation, n as getFingerprintEnabled, v as getDeviceFingerprintInfo, y as BrowserEnvironmentProvider } from "./sessionInitializer-CUpgbHzs.esm.js";
+import { b as BrowserEnvironmentProvider, h as isBrowserSimulation, n as getFingerprintEnabled, v as getThumbmarkId, y as getDeviceFingerprintInfo } from "./sessionInitializer-DmOfm4im.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
 import { i as assign, s as createActor, t as setup, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
 import { i as requestCameraAccess, o as stopCameraStream } from "./camera-sIa9ceW2.esm.js";
 import { i as requestPermission, t as checkPermission } from "./permissionServices-7lzEiOsO.esm.js";
-import { i as initializeDeepsightSession, l as stopStream, o as startDetection, t as FaceDetectionProvider } from "./FaceDetectionProvider-0bWjPgW5.esm.js";
+import { i as initializeDeepsightSession, l as stopStream, o as startDetection, t as FaceDetectionProvider } from "./FaceDetectionProvider-B2fAbO2-.esm.js";
 import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
 import { t as StreamCanvasCapture } from "./StreamCanvasCapture-C9jtgBdT.esm.js";
 //#region src/modules/personhood/personhoodServices.ts

package/dist/qe-signature.esm.js

@@ -1,4 +1,4 @@
-import { a as NAMIRIAL_QES_CONSENT_KEYS, c as areAllConsented, o as NAMIRIAL_QES_PROVIDER_CODE, r as electronicSignatureMachine, s as QE_CONSENT_KEYS, t as createElectronicSignatureManager, u as getDefaultConsentChecks } from "./electronicSignatureManager-DkKQ07vx.esm.js";
+import { a as NAMIRIAL_QES_CONSENT_KEYS, c as areAllConsented, o as NAMIRIAL_QES_PROVIDER_CODE, r as electronicSignatureMachine, s as QE_CONSENT_KEYS, t as createElectronicSignatureManager, u as getDefaultConsentChecks } from "./electronicSignatureManager-BRJNLrUV.esm.js";
 //#region src/modules/qe-signature/index.ts
 function createQeSignatureManager(options) {
 	return createElectronicSignatureManager({ config: {

package/dist/{runChildModule-BDlvNMrA.esm.js → runChildModule-BmeelPDs.esm.js}

@@ -1,5 +1,5 @@
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
-import { a as notifyTrueSightManagerStopped, i as notifyTrueSightFlowEvent } from "./trueSightService-TqmmYye3.esm.js";
+import { a as notifyTrueSightManagerStopped, i as notifyTrueSightFlowEvent } from "./trueSightService-C1Y4c-FL.esm.js";
 import { C as createEventBus } from "./events-ijlbX_Wx.esm.js";
 import { s as createActor } from "./xstate.esm-BuFLFuzz.esm.js";
 import { t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";

package/dist/{sdkVersion-CS_0s_Lc.esm.js → sdkVersion-B-3S7N6Z.esm.js}

@@ -1,4 +1,4 @@
 //#region src/internal/version/sdkVersion.ts
-const SDK_VERSION = "0.0.0-dev-20260914-8aef7789";
+const SDK_VERSION = "0.0.0-dev-20260914-ebfc99a7";
 //#endregion
 export { SDK_VERSION as t };

package/dist/selfie.esm.js

@@ -1,14 +1,14 @@
-import { l as BrowserStorageProvider } from "./setup-CfNAVG-d.esm.js";
+import { l as BrowserStorageProvider } from "./setup-DrJjG62h.esm.js";
 import { r as WasmUtilProvider } from "./safeStorage-1O9k0ulP.esm.js";
 import { n as eventModuleNames } from "./events-ijlbX_Wx.esm.js";
 import { s as createActor } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
-import { n as createDefaultProtectedFaceControllerActor, t as faceCaptureMachine } from "./faceCaptureSetup-WeO8-TfR.esm.js";
-import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-D_EjQnnE.esm.js";
+import { n as createDefaultProtectedFaceControllerActor, t as faceCaptureMachine } from "./faceCaptureSetup-BDgILzIB.esm.js";
+import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-CmALSto9.esm.js";
 import { s as PROTECTED_CAPTURE_TARGET } from "./createCameraCycleOwnership-DQ5-F2oW.esm.js";
 import { r as processFace } from "./selfieErrorUtils-C77GXJH6.esm.js";
-import { t as selfieMachine } from "./selfieStateMachine-TGfI9hNp.esm.js";
-import { n as createSelfieManagerFromActor, t as createSelfieManager } from "./selfieManager-BouB9yUQ.esm.js";
+import { t as selfieMachine } from "./selfieStateMachine-kcJa_4We.esm.js";
+import { n as createSelfieManagerFromActor, t as createSelfieManager } from "./selfieManager-Dv2w6BYF.esm.js";
 import { t as invokeOnCaptureCallback } from "./invokeOnCaptureCallback-BjzPjJ_p.esm.js";
 /**
 * Selfie state machine variant for the captureOnly flow. Shares the full base

package/dist/{selfieManager-BouB9yUQ.esm.js → selfieManager-Dv2w6BYF.esm.js}

@@ -1,9 +1,9 @@
-import { l as BrowserStorageProvider } from "./setup-CfNAVG-d.esm.js";
+import { l as BrowserStorageProvider } from "./setup-DrJjG62h.esm.js";
 import { r as WasmUtilProvider } from "./safeStorage-1O9k0ulP.esm.js";
 import { n as eventModuleNames } from "./events-ijlbX_Wx.esm.js";
 import { s as createActor } from "./xstate.esm-BuFLFuzz.esm.js";
-import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-D_EjQnnE.esm.js";
-import { t as selfieMachine } from "./selfieStateMachine-TGfI9hNp.esm.js";
+import { t as createFaceCaptureManagerFromActor } from "./faceCaptureManagerFactory-CmALSto9.esm.js";
+import { t as selfieMachine } from "./selfieStateMachine-kcJa_4We.esm.js";
 //#region src/modules/selfie/selfieActor.ts
 function createSelfieActor(options) {
 	const dependencies = options.dependencies ?? {

package/dist/{selfieStateMachine-TGfI9hNp.esm.js → selfieStateMachine-kcJa_4We.esm.js}

@@ -1,7 +1,7 @@
 import { i as assign } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
-import { n as createDefaultProtectedFaceControllerActor, r as manualFaceUploadMachine, t as faceCaptureMachine } from "./faceCaptureSetup-WeO8-TfR.esm.js";
-import { u as isOnDeviceMode } from "./FaceDetectionProvider-0bWjPgW5.esm.js";
+import { n as createDefaultProtectedFaceControllerActor, r as manualFaceUploadMachine, t as faceCaptureMachine } from "./faceCaptureSetup-BDgILzIB.esm.js";
+import { u as isOnDeviceMode } from "./FaceDetectionProvider-B2fAbO2-.esm.js";
 import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
 import { s as PROTECTED_CAPTURE_TARGET } from "./createCameraCycleOwnership-DQ5-F2oW.esm.js";
 import { i as uploadManualSelfie, n as validateUploadResponse, r as processFace } from "./selfieErrorUtils-C77GXJH6.esm.js";

package/dist/{session-m9j27bHm.esm.js → session-L-fDJmvT.esm.js}

@@ -1,8 +1,8 @@
 import { n as getApi } from "./api-Bx3gKW_y.esm.js";
-import { g as noteSessionCreated, l as trueSightLog } from "./trueSightService-TqmmYye3.esm.js";
-import "./sessionInitializer-CUpgbHzs.esm.js";
+import { g as noteSessionCreated, l as trueSightLog } from "./trueSightService-C1Y4c-FL.esm.js";
+import "./sessionInitializer-DmOfm4im.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
-import { i as toIncodeApiError } from "./apiError-CixFeCyt.esm.js";
+import { i as toIncodeApiError } from "./apiError-dMNmcdTq.esm.js";
 //#region src/internal/session/sessionService.ts
 /**
 * HTTP status codes the QR validation endpoint emits, keyed by their semantic

package/dist/session.d.ts

@@ -206,7 +206,10 @@ type SessionInitOptions = {
    * token. Application code should always pass `token` explicitly.
    */
   token?: string;
-  /** Custom hosting app name for fingerprint */
+  /**
+   * Custom hosting app name for fingerprint. Defaults to the value given to
+   * `setup({ hostingApp })`, so internal activations inherit the host identity.
+   */
   hostingApp?: string;
   /** Abort signal for cancellation */
   signal?: AbortSignal;

package/dist/session.esm.js

@@ -1,5 +1,5 @@
-import { c as whenSessionFingerprintSettled, i as initializeSession } from "./sessionInitializer-CUpgbHzs.esm.js";
-import { t as IncodeApiError } from "./apiError-CixFeCyt.esm.js";
-import { a as refreshQrUrlUuid, i as createSession, n as QrValidationError, o as validateQrUuid, r as bootstrapSession, t as QR_VALIDATION_ERROR_CODES } from "./session-m9j27bHm.esm.js";
-import { n as getFinishStatus } from "./flowCompletionService-DELbVeL5.esm.js";
+import { i as initializeSession, l as whenSessionFingerprintSettled } from "./sessionInitializer-DmOfm4im.esm.js";
+import { t as IncodeApiError } from "./apiError-dMNmcdTq.esm.js";
+import { a as refreshQrUrlUuid, i as createSession, n as QrValidationError, o as validateQrUuid, r as bootstrapSession, t as QR_VALIDATION_ERROR_CODES } from "./session-L-fDJmvT.esm.js";
+import { n as getFinishStatus } from "./flowCompletionService-B90FsIvP.esm.js";
 export { IncodeApiError, QR_VALIDATION_ERROR_CODES, QrValidationError, bootstrapSession, createSession, getFinishStatus, initializeSession, refreshQrUrlUuid, validateQrUuid, whenSessionFingerprintSettled };

package/dist/{sessionInitializer-CUpgbHzs.esm.js → sessionInitializer-DmOfm4im.esm.js}

@@ -1,8 +1,8 @@
-import { E as updateFeatureManagementUser } from "./feature-management-BEqf3Sr3.esm.js";
+import { E as updateFeatureManagementUser } from "./feature-management-HxOVB0zA.esm.js";
 import { c as setToken, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { d as fetchFeatureConfig, f as isFeatureEnabled, h as noteEnvironment, l as trueSightLog, p as resetFeatureConfigCache, s as startTrueSightCollection, v as noteTokenActivated } from "./trueSightService-TqmmYye3.esm.js";
+import { d as fetchFeatureConfig, f as isFeatureEnabled, h as noteEnvironment, l as trueSightLog, p as resetFeatureConfigCache, s as startTrueSightCollection, v as noteTokenActivated } from "./trueSightService-C1Y4c-FL.esm.js";
 import { v as addEvent, y as getAnalyticsBatcher } from "./events-ijlbX_Wx.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-CS_0s_Lc.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-B-3S7N6Z.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
 import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-DkK-f8JT.esm.js";
 import { t as getParsedUserAgent } from "./getParsedUserAgent-B2iFDql1.esm.js";
@@ -1733,9 +1733,20 @@ let cachedFeatures = null;
 let cachedDisableIpify = false;
 let clientIpLookupEnabled = true;
 let clientFingerprintEnabled = true;
+let clientHostingApp;
 function setClientIpLookupEnabled(enabled) {
 	clientIpLookupEnabled = enabled;
 }
+/**
+* Host identifier from `setup({ hostingApp })`, used as the default for every
+* activation. Without it the option only reached the fingerprint when the host
+* also passed `token` to `setup()` — activations triggered later from inside
+* `<incode-flow>` / `<incode-workflow>` / standalone modules carry a token but
+* no host identity, so those sessions fell back to the `'Web SDK'` default.
+*/
+function setClientHostingApp(hostingApp) {
+	clientHostingApp = hostingApp;
+}
 function setClientFingerprintEnabled(enabled) {
 	clientFingerprintEnabled = enabled;
 }
@@ -1806,7 +1817,7 @@ function whenSessionFingerprintSettled() {
 * ```
 */
 async function initializeSession(options = {}) {
-	const { token, hostingApp, signal, preloadFlow, awaitFingerprint = true } = options;
+	const { token, hostingApp = clientHostingApp, signal, preloadFlow, awaitFingerprint = true } = options;
 	let triLinkPromise = Promise.resolve();
 	if (token !== void 0 && token !== getToken()) {
 		setToken(token);
@@ -1971,4 +1982,4 @@ function resetSessionInit() {
 	resetDeviceStatsQueue();
 }
 //#endregion
-export { getThumbmarkId as _, resetSessionInit as a, whenSessionFingerprintSettled as c, resetStandaloneFlowPolicy as d, resolveStandaloneFlowPolicy as f, IpifyProvider as g, getFingerprint as h, initializeSession as i, getStandaloneFlowPolicy as l, isBrowserSimulation as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, setStandaloneFlowPolicy as p, getSessionFingerprintResult as r, setClientIpLookupEnabled as s, getDisableIpify as t, registerFlowPreloader as u, getDeviceFingerprintInfo as v, BrowserEnvironmentProvider as y };
+export { IpifyProvider as _, resetSessionInit as a, BrowserEnvironmentProvider as b, setClientIpLookupEnabled as c, registerFlowPreloader as d, resetStandaloneFlowPolicy as f, getFingerprint as g, isBrowserSimulation as h, initializeSession as i, whenSessionFingerprintSettled as l, setStandaloneFlowPolicy as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, resolveStandaloneFlowPolicy as p, getSessionFingerprintResult as r, setClientHostingApp as s, getDisableIpify as t, getStandaloneFlowPolicy as u, getThumbmarkId as v, getDeviceFingerprintInfo as y };

package/dist/{setup-CfNAVG-d.esm.js → setup-DrJjG62h.esm.js}

@@ -2,16 +2,16 @@ import { f as deriveSiblingJsPath, p as WASM_MODEL_FILES, v as buildModelVariant
 import { i as setWasmOnDeviceMode, o as warmupWasm } from "./warmup-CUUnwYxe.esm.js";
 import { r as WasmUtilProvider, t as resolveLocalStorage } from "./safeStorage-1O9k0ulP.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { C as resetFeatureManagement, D as applyEnvironment, O as getEnvironment, S as optOutFeatureManagement, b as initializeFeatureManagement, c as resetResolvedExperiments, k as resetEnvironment, v as getIsFeatureManagementLocked, w as resetFeatureManagementProviderInstance } from "./feature-management-BEqf3Sr3.esm.js";
+import { C as resetFeatureManagement, D as applyEnvironment, O as getEnvironment, S as optOutFeatureManagement, b as initializeFeatureManagement, c as resetResolvedExperiments, k as resetEnvironment, v as getIsFeatureManagementLocked, w as resetFeatureManagementProviderInstance } from "./feature-management-HxOVB0zA.esm.js";
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
 import { a as resetApi, i as isApiConfigured, n as getApi, r as getToken, s as setHttpRequestObserver, t as api } from "./api-Bx3gKW_y.esm.js";
-import { C as upgradeToWasmHttpClient$1, S as resetHttpClientState, _ as noteTestingSignals, b as getStoredHttpConfig, l as trueSightLog, n as initializeTrueSightDiagnostics, o as resetTrueSight, t as finalizeTrueSight, u as categoryForEndpoint, x as installFreshHttpClient } from "./trueSightService-TqmmYye3.esm.js";
+import { C as upgradeToWasmHttpClient$1, S as resetHttpClientState, _ as noteTestingSignals, b as getStoredHttpConfig, l as trueSightLog, n as initializeTrueSightDiagnostics, o as resetTrueSight, t as finalizeTrueSight, u as categoryForEndpoint, x as installFreshHttpClient } from "./trueSightService-C1Y4c-FL.esm.js";
 import { b as resetAnalyticsBatcher, c as resetExperimentAssignments, x as setAnalyticsBatcher, y as getAnalyticsBatcher } from "./events-ijlbX_Wx.esm.js";
-import { a as resetSessionInit, d as resetStandaloneFlowPolicy, f as resolveStandaloneFlowPolicy, i as initializeSession, o as setClientFingerprintEnabled, p as setStandaloneFlowPolicy, s as setClientIpLookupEnabled, u as registerFlowPreloader, y as BrowserEnvironmentProvider } from "./sessionInitializer-CUpgbHzs.esm.js";
+import { a as resetSessionInit, b as BrowserEnvironmentProvider, c as setClientIpLookupEnabled, d as registerFlowPreloader, f as resetStandaloneFlowPolicy, i as initializeSession, m as setStandaloneFlowPolicy, o as setClientFingerprintEnabled, p as resolveStandaloneFlowPolicy, s as setClientHostingApp } from "./sessionInitializer-DmOfm4im.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
 import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-DkK-f8JT.esm.js";
 import { a as resetTRI, n as initializeTRI, o as resetTRIProviderInstance } from "./tri-4RsGrIt6.esm.js";
-import { i as resetDashboardFlowCache, r as preloadDashboardFlow } from "./flowServices-Brr2fh_c.esm.js";
+import { i as resetDashboardFlowCache, r as preloadDashboardFlow } from "./flowServices-BHbkPMUr.esm.js";
 //#region ../infra/src/wasm/wasmDefaults.ts
 const WASM_CDN_BASE_URL = "https://cdn.incodesmile.com/ml-wasm-kit-release";
 /** The WASM version bundled and tested with this SDK release. */
@@ -674,6 +674,7 @@ async function setup(options) {
 	setStandaloneFlowPolicy(standaloneFlowPolicy);
 	registerFlowPreloader(preloadDashboardFlow);
 	if (options.ipLookup !== void 0) setClientIpLookupEnabled(options.ipLookup);
+	if (options.hostingApp !== void 0) setClientHostingApp(options.hostingApp);
 	if (options.fingerprint !== void 0) {
 		setClientFingerprintEnabled(options.fingerprint);
 		setWasmOnDeviceMode(options.fingerprint === false);
@@ -716,10 +717,7 @@ async function setup(options) {
 		throw error;
 	}
 	if (options.token && isApiConfigured()) {
-		const sessionOptions = {
-			token: options.token,
-			hostingApp: options.hostingApp
-		};
+		const sessionOptions = { token: options.token };
 		if (shouldPreloadFlow) sessionOptions.preloadFlow = true;
 		const sessionPromise = initializeSession(sessionOptions);
 		if (shouldPreloadFlow) await sessionPromise;
@@ -859,6 +857,7 @@ function reset() {
 	resetStandaloneFlowPolicy();
 	setClientIpLookupEnabled(true);
 	setClientFingerprintEnabled(true);
+	setClientHostingApp(void 0);
 	setWasmOnDeviceMode(false);
 	resetAnalyticsBatcher();
 	resetExperimentAssignments();

package/dist/{setup-CEX95gJ1.d.ts → setup-riMNzcSh.d.ts}

@@ -150,7 +150,26 @@ type SetupOptions = {
    *   `setup()` call.
    */
   encryption?: boolean | EncryptionOptions;
-  /** Optional hosting app identifier for fingerprint tracking */
+  /**
+   * Identifies the hosting application in the device-fingerprint record.
+   * Defaults to `'Web SDK'`. The payload has no separate field for the host's
+   * own version, so put your build in this string if you need to report it.
+   *
+   * Intended for Incode-owned host applications, and deliberately left out of
+   * the published integration docs: the field is what separates our own apps
+   * from third-party embeds in that record, so integrators should leave it
+   * unset and let it default.
+   *
+   * Registered client-side rather than consumed once: it becomes the default
+   * `hostingApp` for every later activation, including the internal
+   * `initializeSession` calls made by `<incode-flow>`, `<incode-workflow>` and
+   * standalone modules — those carry a token but no host identity, so without
+   * this they would report the default. An explicit
+   * `initializeSession({ hostingApp })` still wins.
+   *
+   * Sticky across `setup()` calls: a follow-up call that omits it keeps the
+   * value registered by an earlier one. `reset()` clears it.
+   */
   hostingApp?: string;
   /**
    * Disables the third-party public-IP lookup (`api.ipify.org`) used to

package/dist/{trueSightService-TqmmYye3.esm.js → trueSightService-C1Y4c-FL.esm.js}

@@ -2,7 +2,7 @@ import { a as setWebApiHttpTransport, i as initializeWasmWebClient, o as setupWa
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
 import { i as isApiConfigured, n as getApi, o as setClient, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
 import { S as subscribeEvent, n as eventModuleNames } from "./events-ijlbX_Wx.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-CS_0s_Lc.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-B-3S7N6Z.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
 //#region ../infra/src/http/createApi.ts
 var FetchHttpError = class extends Error {
@@ -1320,7 +1320,7 @@ let cryptoProviderPromise = null;
 * the service's prewarm).
 */
 function loadDiagnosticsCryptoProvider() {
-	cryptoProviderPromise ??= import("./BrowserDiagnosticsCryptoProvider-BoYzmYY5.esm.js").then((module) => new module.BrowserDiagnosticsCryptoProvider());
+	cryptoProviderPromise ??= import("./BrowserDiagnosticsCryptoProvider-uam5jVpc.esm.js").then((module) => new module.BrowserDiagnosticsCryptoProvider());
 	return cryptoProviderPromise;
 }
 /**

package/dist/video-selfie.esm.js

@@ -1,16 +1,16 @@
-import { t as ensureWasmPipelines } from "./setup-CfNAVG-d.esm.js";
+import { t as ensureWasmPipelines } from "./setup-DrJjG62h.esm.js";
 import { r as WasmUtilProvider } from "./safeStorage-1O9k0ulP.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
 import { t as api } from "./api-Bx3gKW_y.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
-import { d as facingModeForStep, f as resolveVideoSelfieSteps, p as videoSelfieWasmPipelines } from "./flowServices-Brr2fh_c.esm.js";
+import { d as facingModeForStep, f as resolveVideoSelfieSteps, p as videoSelfieWasmPipelines } from "./flowServices-BHbkPMUr.esm.js";
 import { i as assign, r as sendTo, s as createActor, t as setup, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
 import { t as BrowserVisibilityObserverProvider } from "./BrowserVisibilityObserverProvider-BrJN1B8A.esm.js";
 import { t as MultipartRecordingService } from "./multipartRecordingService-B3C_zlev.esm.js";
-import { i as CameraCompositor } from "./idCaptureDefaults-C66YvkgN.esm.js";
+import { i as CameraCompositor } from "./idCaptureDefaults-BwHGyv9V.esm.js";
 import { t as VIDEO_SELFIE_VALIDATION_ATTEMPTS_EXHAUSTED_CODE } from "./advanceableErrors-CpF2cBy6.esm.js";
-import { a as isConnectionError, n as defaultAcquireCamera, r as createDefaultStepDetector, t as createVideoSelfieCameraWarmer } from "./videoSelfieCameraWarmer-C-cESczy.esm.js";
+import { a as isConnectionError, n as defaultAcquireCamera, r as createDefaultStepDetector, t as createVideoSelfieCameraWarmer } from "./videoSelfieCameraWarmer-5fwyJA0e.esm.js";
 import { t as videoSelfieFlowModuleMachine } from "./videoSelfieFlowModuleMachine-BUe2uACW.esm.js";
 //#region src/modules/video-selfie/videoSelfieWasm.ts
 function warmupVideoSelfieWasm(config, steps = resolveVideoSelfieSteps(config)) {

package/dist/{videoSelfieCameraWarmer-C-cESczy.esm.js → videoSelfieCameraWarmer-5fwyJA0e.esm.js}

@@ -1,16 +1,16 @@
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
 import { t as api } from "./api-Bx3gKW_y.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
-import { d as facingModeForStep, f as resolveVideoSelfieSteps } from "./flowServices-Brr2fh_c.esm.js";
+import { d as facingModeForStep, f as resolveVideoSelfieSteps } from "./flowServices-BHbkPMUr.esm.js";
 import { a as requestCameraWithFallback, i as requestCameraAccess } from "./camera-sIa9ceW2.esm.js";
 import { t as checkPermission } from "./permissionServices-7lzEiOsO.esm.js";
-import { n as encryptSelfieImage, o as startDetection, t as FaceDetectionProvider } from "./FaceDetectionProvider-0bWjPgW5.esm.js";
+import { n as encryptSelfieImage, o as startDetection, t as FaceDetectionProvider } from "./FaceDetectionProvider-B2fAbO2-.esm.js";
 import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
 import { a as StreamCanvasProcessingSession } from "./recordingsRepository-CCWy13M-.esm.js";
 import { n as getBackCameraStream } from "./backCameraStream-BOtyQowf.esm.js";
 import { n as getWindowDimensions } from "./getDeviceClass-CeBiEayS.esm.js";
 import { a as uploadSelfie, r as processFace, t as getFaceErrorCodeFromUnknown } from "./selfieErrorUtils-C77GXJH6.esm.js";
-import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider, t as DEFAULT_ID_CAPTURE_GEOMETRY } from "./idCaptureDefaults-C66YvkgN.esm.js";
+import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider, t as DEFAULT_ID_CAPTURE_GEOMETRY } from "./idCaptureDefaults-BwHGyv9V.esm.js";
 import { t as StreamCanvasCapture } from "./StreamCanvasCapture-C9jtgBdT.esm.js";
 //#region src/modules/video-selfie/videoSelfieCompareService.ts
 async function postVideoSelfieCompare(endpoint, base64Image) {

package/dist/wasm.d.ts

@@ -1,5 +1,5 @@
 import { a as WASM_MODEL_FILES, c as WasmPipeline, l as WasmSource, o as WasmGlueLoader, r as warmupWasm, s as WasmModelName, t as WarmupConfig } from "./warmup-Cis2p6O0.js";
-import { c as setWasmConfig, i as initializeWasmUtil, n as WasmConfig, r as ensureWasmPipelines, s as resolveWasmConfigForPipelines, u as upgradeToWasmHttpClient } from "./setup-CEX95gJ1.js";
+import { c as setWasmConfig, i as initializeWasmUtil, n as WasmConfig, r as ensureWasmPipelines, s as resolveWasmConfigForPipelines, u as upgradeToWasmHttpClient } from "./setup-riMNzcSh.js";
 //#region ../infra/src/wasm/wasmDefaults.d.ts
 /** The WASM version bundled and tested with this SDK release. */
 declare const DEFAULT_WASM_VERSION = "v2.14.49-post1";