@incodetech/core 2.2.0 → 2.3.0-rc.0

package/dist/selfieStateMachine-fwMmNtOi.esm.js

@@ -0,0 +1,69 @@
+import { i as assign } from "./xstate.esm-BuFLFuzz.esm.js";
+import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
+import { n as createDefaultProtectedFaceControllerActor, r as manualFaceUploadMachine, t as faceCaptureMachine } from "./faceCaptureSetup-BSextack.esm.js";
+import { u as isOnDeviceMode } from "./FaceDetectionProvider-DTetAE8H.esm.js";
+import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
+import { s as PROTECTED_CAPTURE_TARGET } from "./createCameraCycleOwnership-DQ5-F2oW.esm.js";
+import { i as uploadManualSelfie, n as validateUploadResponse, r as processFace } from "./selfieErrorUtils-C77GXJH6.esm.js";
+//#region src/modules/selfie/selfieStateMachine.ts
+/**
+* Validates like the camera path does: a 200 that reports lenses, a mask or
+* failed liveness is still a rejection, and throwing lets the child machine
+* spend a retry and map the code to copy.
+*/
+const manualUploadMachine = manualFaceUploadMachine.provide({ actors: {
+	protectedFaceController: createDefaultProtectedFaceControllerActor({
+		target: PROTECTED_CAPTURE_TARGET.selfie,
+		delivery: "protected"
+	}),
+	uploadFile: fromPromise(async ({ input, signal }) => {
+		const { base64Image, config, dependencies } = input;
+		const validationError = validateUploadResponse({
+			config,
+			response: await uploadManualSelfie({
+				base64Image,
+				dependencies,
+				signal
+			})
+		});
+		if (validationError) throw new Error(validationError);
+	})
+} });
+/**
+* The selfie capture state machine.
+*
+* Note: Uses AnyStateMachine type for declaration file portability.
+* Type safety is ensured via the machine configuration.
+*/
+const selfieMachine = faceCaptureMachine.provide({
+	actors: {
+		manualUploadMachine,
+		processFace: fromPromise(async ({ input, signal }) => {
+			if (isOnDeviceMode(input.config)) return {};
+			return processFace("selfie", signal);
+		})
+	},
+	actions: {
+		prepareStreamForRetry: () => void 0,
+		setUploadErrorFromUploadValidation: assign({ uploadError: ({ context }) => {
+			if (isOnDeviceMode(context.config)) return;
+			return validateUploadResponse({
+				config: context.config,
+				response: context.uploadResponse
+			}) ?? FACE_ERROR_CODES.SERVER;
+		} })
+	},
+	guards: {
+		hasUploadValidationError: ({ context }) => {
+			if (isOnDeviceMode(context.config)) return false;
+			return validateUploadResponse({
+				config: context.config,
+				response: context.uploadResponse
+			}) !== void 0;
+		},
+		isTerminalUploadError: () => false,
+		hasManualUploadEnabled: ({ context }) => context.config.manualUploadSelfieCapture === true
+	}
+});
+//#endregion
+export { selfieMachine as t };

package/dist/{session-BFdLgN4i.esm.js → session-BHIeAamR.esm.js}

@@ -1,9 +1,8 @@
 import { n as getApi } from "./api-Bx3gKW_y.esm.js";
-import { h as noteSessionCreated, l as trueSightLog } from "./trueSightService---iW2KKJ.esm.js";
-import "./sessionInitializer-dlfDehHk.esm.js";
-import { t as endpoints } from "./endpoints-CCzL3XD_.esm.js";
-import "./trueSight-B_icM8r2.esm.js";
-import { r as toIncodeApiError } from "./apiError-BA1d_au0.esm.js";
+import { g as noteSessionCreated, l as trueSightLog } from "./trueSightService-CKrrfV0Q.esm.js";
+import "./sessionInitializer-BLoK7SP9.esm.js";
+import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
+import { i as toIncodeApiError } from "./apiError-D0v5hFyN.esm.js";
 //#region src/internal/session/sessionService.ts
 /**
 * HTTP status codes the QR validation endpoint emits, keyed by their semantic

package/dist/session.d.ts

@@ -1,13 +1,5 @@
-import { a as RegulationTypes } from "./types-KPvmag_B.js";
+import { t as DeviceFingerprintResult } from "./types-DgDvvzg0.js";
 import { n as FinishStatus, r as GetFinishStatusFn, s as getFinishStatus } from "./flowCompletionService-BlAHsKyv.js";
-//#region src/internal/fingerprint/types.d.ts
-type DeviceFingerprintResult = {
-  success: boolean;
-  sessionStatus: string;
-  showMandatoryConsent?: boolean;
-  regulationType?: RegulationTypes;
-};
-//#endregion
 //#region src/internal/session/sessionService.d.ts
 type CreateSessionOptions = {
   /** The configuration/flow ID from the Incode dashboard */
@@ -196,6 +188,13 @@ type Features = {
 };
 //#endregion
 //#region src/internal/session/sessionInitializer.d.ts
+/**
+ * Resolves once the device-fingerprint step of the current session
+ * activation has settled (submitted, failed, or skipped) — with the backend's
+ * result when there is one. Resolves immediately when no activation is in
+ * flight. Pairs with `initializeSession({ awaitFingerprint: false })`.
+ */
+declare function whenSessionFingerprintSettled(): Promise<DeviceFingerprintResult | undefined>;
 type SessionInitOptions = {
   /**
    * Session token returned by `createSession`. Persisted on the HTTP client
@@ -207,12 +206,23 @@ type SessionInitOptions = {
    * token. Application code should always pass `token` explicitly.
    */
   token?: string;
-  /** Custom hosting app name for fingerprint */
+  /**
+   * Custom hosting app name for fingerprint. Defaults to the value given to
+   * `setup({ hostingApp })`, so internal activations inherit the host identity.
+   */
   hostingApp?: string;
   /** Abort signal for cancellation */
   signal?: AbortSignal;
   /** Set to `true` to preload Flow configuration during session activation. */
   preloadFlow?: boolean;
+  /**
+   * `false` resolves as soon as the feature config is in, leaving the device
+   * fingerprint (thumbmark + IP lookup + submit) to finish in the background;
+   * `fingerprintSuccess`/`fingerprintResult` on the result are then not yet
+   * known — read them via `whenSessionFingerprintSettled()`. Default `true`
+   * keeps the historical contract: the promise settles after the fingerprint.
+   */
+  awaitFingerprint?: boolean;
 };
 type SessionInitResult = {
   features: Features;
@@ -251,4 +261,4 @@ type SessionInitResult = {
  */
 declare function initializeSession(options?: SessionInitOptions): Promise<SessionInitResult>;
 //#endregion
-export { type BootstrapSessionOptions, type CreateSessionOptions, type FinishStatus, type GetFinishStatusFn, IncodeApiError, QR_VALIDATION_ERROR_CODES, QrValidationError, type QrValidationErrorCode, type QrValidationResult, type RefreshQrUrlUuidOptions, type Session, type SessionInitOptions, type SessionInitResult, type ValidateQrUuidOptions, bootstrapSession, createSession, getFinishStatus, initializeSession, refreshQrUrlUuid, validateQrUuid };
+export { type BootstrapSessionOptions, type CreateSessionOptions, type DeviceFingerprintResult, type FinishStatus, type GetFinishStatusFn, IncodeApiError, QR_VALIDATION_ERROR_CODES, QrValidationError, type QrValidationErrorCode, type QrValidationResult, type RefreshQrUrlUuidOptions, type Session, type SessionInitOptions, type SessionInitResult, type ValidateQrUuidOptions, bootstrapSession, createSession, getFinishStatus, initializeSession, refreshQrUrlUuid, validateQrUuid, whenSessionFingerprintSettled };

package/dist/session.esm.js

@@ -1,5 +1,5 @@
-import { i as initializeSession } from "./sessionInitializer-dlfDehHk.esm.js";
-import { t as IncodeApiError } from "./apiError-BA1d_au0.esm.js";
-import { a as refreshQrUrlUuid, i as createSession, n as QrValidationError, o as validateQrUuid, r as bootstrapSession, t as QR_VALIDATION_ERROR_CODES } from "./session-BFdLgN4i.esm.js";
-import { n as getFinishStatus } from "./flowCompletionService-tfeoGre9.esm.js";
-export { IncodeApiError, QR_VALIDATION_ERROR_CODES, QrValidationError, bootstrapSession, createSession, getFinishStatus, initializeSession, refreshQrUrlUuid, validateQrUuid };
+import { i as initializeSession, l as whenSessionFingerprintSettled } from "./sessionInitializer-BLoK7SP9.esm.js";
+import { t as IncodeApiError } from "./apiError-D0v5hFyN.esm.js";
+import { a as refreshQrUrlUuid, i as createSession, n as QrValidationError, o as validateQrUuid, r as bootstrapSession, t as QR_VALIDATION_ERROR_CODES } from "./session-BHIeAamR.esm.js";
+import { n as getFinishStatus } from "./flowCompletionService-CLtbWhSK.esm.js";
+export { IncodeApiError, QR_VALIDATION_ERROR_CODES, QrValidationError, bootstrapSession, createSession, getFinishStatus, initializeSession, refreshQrUrlUuid, validateQrUuid, whenSessionFingerprintSettled };

package/dist/{sessionInitializer-dlfDehHk.esm.js → sessionInitializer-BLoK7SP9.esm.js}

@@ -1,14 +1,13 @@
-import { E as updateFeatureManagementUser } from "./feature-management-CPQ4qv3F.esm.js";
+import { E as updateFeatureManagementUser } from "./feature-management-B0sGlozZ.esm.js";
 import { c as setToken, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { _ as noteTokenActivated, d as fetchFeatureConfig, f as isFeatureEnabled, l as trueSightLog, m as noteEnvironment, p as resetFeatureConfigCache, s as startTrueSightCollection } from "./trueSightService---iW2KKJ.esm.js";
-import { v as addEvent, y as getAnalyticsBatcher } from "./events-DYiyoSlx.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-D1Bm59g6.esm.js";
-import { t as endpoints } from "./endpoints-CCzL3XD_.esm.js";
-import "./trueSight-B_icM8r2.esm.js";
-import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-B0nFKawG.esm.js";
-import { n as UAParser, t as getParsedUserAgent } from "./getParsedUserAgent-pJjATANs.esm.js";
-import { i as isIOS } from "./platform-BJrm5nzZ.esm.js";
-import { t as getUserAgent } from "./getBrowser-Cb8Zgrgp.esm.js";
+import { d as fetchFeatureConfig, f as isFeatureEnabled, h as noteEnvironment, l as trueSightLog, p as resetFeatureConfigCache, s as startTrueSightCollection, v as noteTokenActivated } from "./trueSightService-CKrrfV0Q.esm.js";
+import { v as addEvent, y as getAnalyticsBatcher } from "./events-ijlbX_Wx.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-CLxKvdyz.esm.js";
+import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
+import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-DkK-f8JT.esm.js";
+import { t as getParsedUserAgent } from "./getParsedUserAgent-B2iFDql1.esm.js";
+import { a as isIOS } from "./platform-DkcRc9JV.esm.js";
+import { t as getUserAgent } from "./getBrowser-CBiibsL-.esm.js";
 import { i as linkSessionWithTRI, r as isTRIStarted } from "./tri-4RsGrIt6.esm.js";
 //#region ../infra/src/providers/browser/BrowserEnvironmentProvider.ts
 var BrowserEnvironmentProvider = class {
@@ -135,28 +134,10 @@ var BrowserInfoProvider = class {
 	}
 	getBrowserInfo() {
 		const userAgent = typeof navigator !== "undefined" ? navigator.userAgent : "";
-		const result = new UAParser(userAgent).getResult();
 		return {
 			userAgent,
 			isWebRtcSupported: this.checkWebRtcSupport(),
-			browser: {
-				name: result.browser.name,
-				version: result.browser.version
-			},
-			os: {
-				name: result.os.name,
-				version: result.os.version
-			},
-			device: {
-				model: result.device.model,
-				type: result.device.type,
-				vendor: result.device.vendor
-			},
-			engine: {
-				name: result.engine.name,
-				version: result.engine.version
-			},
-			cpu: { architecture: result.cpu.architecture }
+			...getParsedUserAgent(userAgent)
 		};
 	}
 };
@@ -258,7 +239,7 @@ async function getDeviceFingerprintInfo() {
 	}
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@thumbmarkjs+thumbmarkjs@1.6.4/node_modules/@thumbmarkjs/thumbmarkjs/dist/thumbmark.esm.js
+//#region ../../node_modules/.pnpm/@thumbmarkjs+thumbmarkjs@1.6.4_patch_hash=4567be4f9456c742dbb8f16dd684bd7f9e5d056dfdc5a42aa48c836cab4a540a/node_modules/@thumbmarkjs/thumbmarkjs/dist/thumbmark.esm.js
 const e = 2592e5;
 const t = "thumbmark";
 const n = "https://api.thumbmarkjs.com";
@@ -331,6 +312,11 @@ function c(e) {
 function l(e, t, n) {
 	let o = [];
 	for (let t = 0; t < e[0].data.length; t++) {
+		const first = e[0].data[t];
+		if (e.every((image) => image.data[t] === first)) {
+			o.push(first);
+			continue;
+		}
 		let n = [];
 		for (let o = 0; o < e.length; o++) n.push(e[o].data[t]);
 		o.push(u(n));
@@ -414,7 +400,7 @@ async function g(e) {
 	o.setProperty("position", "fixed"), o.setProperty("display", "block", "important"), o.setProperty("visibility", "visible"), o.setProperty("border", "0"), o.setProperty("opacity", "0"), n.src = "about:blank", document.body.appendChild(n);
 	const r = n.contentDocument || (null === (t = n.contentWindow) || void 0 === t ? void 0 : t.document);
 	if (!r) throw new Error("Iframe document is not accessible");
-	e({ iframe: r }), setTimeout((() => {
+	await e({ iframe: r }), setTimeout((() => {
 		document.body.removeChild(n);
 	}), 0);
 }
@@ -821,7 +807,7 @@ const V = {
 			0 !== t.length ? e({ commonPixelsHash: h(l(t, p, 20).data.toString()).toString() }) : e(null);
 		}));
 	},
-	fonts: async function(e) {
+	fonts: async function(options) {
 		return new Promise(((e) => {
 			try {
 				g((async ({ iframe: t }) => {
@@ -829,10 +815,12 @@ const V = {
 					if (!n) return void e(null);
 					const o = y.map(((e) => S(n, e)));
 					let r = {};
-					v.forEach(((e) => {
-						const t = S(n, e);
+					for (let i = 0; i < v.length; i++) {
+						if (options?.yield && i % 8 === 0) await options.yield();
+						const e = v[i], t = S(n, e);
 						o.includes(t) || (r[e] = t);
-					})), e(r);
+					}
+					e(r);
 				}));
 			} catch (t) {
 				e(null);
@@ -1409,7 +1397,14 @@ async function oe(e, t) {
 	})).filter((([e]) => {
 		var t, o, r, i;
 		return (null === (t = null == n ? void 0 : n.include) || void 0 === t ? void 0 : t.some(((e) => e.includes(".")))) ? null === (o = null == n ? void 0 : n.include) || void 0 === o ? void 0 : o.some(((t) => t.startsWith(e))) : 0 === (null === (r = null == n ? void 0 : n.include) || void 0 === r ? void 0 : r.length) || (null === (i = null == n ? void 0 : n.include) || void 0 === i ? void 0 : i.includes(e));
-	})), i = r.map((([e]) => e)), s = await function(e, t, n) {
+	})), i = r.map((([e]) => e)), a = [];
+	for (const [e, fn] of r) {
+		if (n.yield) await n.yield();
+		const pending = fn(t);
+		pending.catch(() => void 0);
+		a.push(pending);
+	}
+	const s = await function(e, t, n) {
 		return Promise.all(e.map(((e) => {
 			const o = performance.now();
 			return Promise.race([e.then(((e) => ({
@@ -1423,7 +1418,7 @@ async function oe(e, t) {
 			})))]);
 			var r, i;
 		})));
-	}(r.map((([e, n]) => n(t))), (null == n ? void 0 : n.timeout) || 5e3, j), c = {}, l = {};
+	}(a, (null == n ? void 0 : n.timeout) || 5e3, j), c = {}, l = {};
 	s.forEach(((e, t) => {
 		var n;
 		null != e.value && (l[i[t]] = e.value, c[i[t]] = null !== (n = e.elapsed) && void 0 !== n ? n : 0);
@@ -1454,6 +1449,54 @@ var se = class {
 	}
 };
 //#endregion
+//#region ../infra/src/scheduling/yieldUntilNextPaint.ts
+/**
+* Resolves after the browser has had a chance to commit and paint a queued
+* render.
+*
+* Strategy:
+* - `requestAnimationFrame` callbacks fire BEFORE the paint of the frame
+*   they belong to (per the HTML5 "update the rendering" step). If we
+*   resolve the promise inside a rAF callback, the await-continuation
+*   runs as a microtask immediately after the callback returns — still
+*   before the paint phase of that frame. A caller that then blocks the
+*   main thread (e.g. synchronous WASM `processPhoto`) starves the paint.
+* - We therefore chain rAF → setTimeout: the rAF fires before frame N's
+*   paint, the setTimeout runs as a macrotask scheduled after frame N's
+*   "update the rendering" step, which the browser will only get to once
+*   the paint actually lands. By the time setTimeout fires, the paint
+*   for the queued render is on screen.
+* - In environments where rAF never ticks (jsdom, happy-dom, backgrounded
+*   tabs), a parallel `setTimeout` fallback at 100 ms resolves instead.
+*   100 ms is comfortably longer than two real-browser frames so rAF +
+*   setTimeout wins reliably in any foregrounded browser. (An earlier
+*   implementation raced rAF against a `MessageChannel` macrotask, but
+*   MessageChannel drains immediately after the current task's
+*   microtasks — before the next paint — so it resolved the promise too
+*   early and defeated the whole point of the helper.)
+*
+* Lives in infra because it touches browser APIs (`requestAnimationFrame`,
+* `setTimeout`) that the architecture rules forbid from core. Core modules
+* that need to yield to the browser render loop should import this helper
+* directly via its file path.
+*/
+function yieldUntilNextPaint() {
+	return new Promise((resolve) => {
+		let resolved = false;
+		const done = () => {
+			if (resolved) return;
+			resolved = true;
+			resolve();
+		};
+		if (typeof requestAnimationFrame === "function") requestAnimationFrame(() => {
+			requestAnimationFrame(() => {
+				setTimeout(done, 0);
+			});
+		});
+		setTimeout(done, 100);
+	});
+}
+//#endregion
 //#region ../infra/src/providers/browser/thumbmarkAdapter.ts
 /**
 * Adapter for @thumbmarkjs/thumbmarkjs. Single point of dependency so bundlers
@@ -1475,7 +1518,10 @@ const THUMBMARK_ALGORITHM = {
 * read. It also stops upstream's 1-in-10 000 telemetry POST to
 * api.thumbmarkjs.com. Re-check this when bumping the dependency.
 */
-const THUMBMARK_OPTIONS = { logging: false };
+const THUMBMARK_OPTIONS = {
+	logging: false,
+	yield: yieldUntilNextPaint
+};
 async function getThumbmarkId() {
 	return (await new se(THUMBMARK_OPTIONS).get()).thumbmark;
 }
@@ -1485,8 +1531,18 @@ var FingerprintProvider = class {
 	constructor(ipLookup) {
 		this.ipLookup = ipLookup;
 	}
+	prime() {
+		this.startVisitorId();
+	}
+	startVisitorId() {
+		if (!this.visitorIdPromise) {
+			this.visitorIdPromise = getThumbmarkId();
+			this.visitorIdPromise.catch(() => void 0);
+		}
+		return this.visitorIdPromise;
+	}
 	async getFingerprint(disableIpify = false) {
-		const visitorId = await getThumbmarkId();
+		const visitorId = await this.startVisitorId();
 		const [deviceInfo, ip] = await Promise.all([getDeviceFingerprintInfo(), disableIpify ? Promise.resolve("") : this.ipLookup.getIp()]);
 		return {
 			visitorId,
@@ -1619,7 +1675,9 @@ function formatBrowser(browser) {
 }
 async function submitDeviceFingerprint(options = {}, dependencies) {
 	const { disableIpify = false, hostingApp, signal } = options;
+	const token = getToken();
 	const fingerprint = await dependencies.fingerprintProvider.getFingerprint(disableIpify);
+	if (getToken() !== token || dependencies.isCurrentSession?.() === false) throw new Error("Session changed during fingerprint collection");
 	const hasLiedBrowser = isBrowserSimulation(dependencies.browserEnv);
 	const payload = {
 		hash: fingerprint.visitorId || "",
@@ -1675,9 +1733,20 @@ let cachedFeatures = null;
 let cachedDisableIpify = false;
 let clientIpLookupEnabled = true;
 let clientFingerprintEnabled = true;
+let clientHostingApp;
 function setClientIpLookupEnabled(enabled) {
 	clientIpLookupEnabled = enabled;
 }
+/**
+* Host identifier from `setup({ hostingApp })`, used as the default for every
+* activation. Without it the option only reached the fingerprint when the host
+* also passed `token` to `setup()` — activations triggered later from inside
+* `<incode-flow>` / `<incode-workflow>` / standalone modules carry a token but
+* no host identity, so those sessions fell back to the `'Web SDK'` default.
+*/
+function setClientHostingApp(hostingApp) {
+	clientHostingApp = hostingApp;
+}
 function setClientFingerprintEnabled(enabled) {
 	clientFingerprintEnabled = enabled;
 }
@@ -1699,6 +1768,25 @@ function preloadOptionalFlow() {
 let cachedFingerprintSuccess = false;
 let cachedFingerprintResult;
 let sessionInitPromise = null;
+let fingerprintSettled = null;
+function createFingerprintSettled() {
+	let resolve = () => void 0;
+	return {
+		promise: new Promise((r) => {
+			resolve = r;
+		}),
+		resolve
+	};
+}
+/**
+* Resolves once the device-fingerprint step of the current session
+* activation has settled (submitted, failed, or skipped) — with the backend's
+* result when there is one. Resolves immediately when no activation is in
+* flight. Pairs with `initializeSession({ awaitFingerprint: false })`.
+*/
+function whenSessionFingerprintSettled() {
+	return fingerprintSettled?.promise ?? Promise.resolve(cachedFingerprintResult);
+}
 /**
 * Activates a session by setting the auth token on the HTTP client and
 * preloading session-scoped state.
@@ -1729,7 +1817,7 @@ let sessionInitPromise = null;
 * ```
 */
 async function initializeSession(options = {}) {
-	const { token, hostingApp, signal, preloadFlow } = options;
+	const { token, hostingApp = clientHostingApp, signal, preloadFlow, awaitFingerprint = true } = options;
 	let triLinkPromise = Promise.resolve();
 	if (token !== void 0 && token !== getToken()) {
 		setToken(token);
@@ -1740,6 +1828,7 @@ async function initializeSession(options = {}) {
 	const flowPreloadPromise = getToken() && preloadFlow === true ? preloadOptionalFlow() : Promise.resolve();
 	await triLinkPromise;
 	if (sessionInitialized && cachedFeatures) {
+		if (awaitFingerprint) await whenSessionFingerprintSettled();
 		await flowPreloadPromise;
 		return {
 			features: cachedFeatures,
@@ -1750,9 +1839,19 @@ async function initializeSession(options = {}) {
 	}
 	if (sessionInitPromise) {
 		const result = await sessionInitPromise;
+		if (awaitFingerprint) await whenSessionFingerprintSettled();
 		await flowPreloadPromise;
-		return result;
+		return {
+			...result,
+			fingerprintSuccess: cachedFingerprintSuccess,
+			fingerprintResult: cachedFingerprintResult
+		};
 	}
+	const settled = createFingerprintSettled();
+	fingerprintSettled = settled;
+	const fingerprintProvider = clientFingerprintEnabled ? new FingerprintProvider(new IpifyProvider()) : void 0;
+	fingerprintProvider?.prime?.();
+	let fingerprintPromise;
 	sessionInitPromise = (async () => {
 		let features;
 		let serverDisableIpify = false;
@@ -1766,27 +1865,16 @@ async function initializeSession(options = {}) {
 			startTrueSightCollection();
 		}
 		const disableIpify = resolveDisableIpify(serverDisableIpify);
-		await updateFeatureManagementUser({ customIDs: { hashed_onboarding_id: features.sessionIdentifier || void 0 } });
-		let fingerprintSuccess = false;
-		let fingerprintResult;
-		if (clientFingerprintEnabled) try {
-			const fingerprintProvider = new FingerprintProvider(new IpifyProvider());
-			const browserEnv = new BrowserEnvironmentProvider();
-			fingerprintResult = await submitDeviceFingerprint({
-				disableIpify,
-				hostingApp,
-				signal
-			}, {
-				fingerprintProvider,
-				browserEnv
-			});
-			fingerprintSuccess = true;
-			flushDeviceStatsQueue();
-		} catch (error) {
-			console.warn("Failed to submit device fingerprint:", error);
-			trueSightLog("warning", "session", "other", "device fingerprint submit failed");
-		}
-		else flushDeviceStatsQueue();
+		const preloadedFlow = await flowPreloadPromise;
+		await updateFeatureManagementUser({ customIDs: {
+			hashed_onboarding_id: features.sessionIdentifier || void 0,
+			flow_id: preloadedFlow?.flowId
+		} });
+		fingerprintPromise = submitSessionFingerprint(fingerprintProvider, {
+			disableIpify,
+			hostingApp,
+			signal
+		}, settled);
 		try {
 			const browserInfo = new BrowserInfoProvider().getBrowserInfo();
 			const language = new BrowserEnvironmentProvider().getNavigatorProperty("language");
@@ -1810,25 +1898,55 @@ async function initializeSession(options = {}) {
 		} catch (error) {
 			console.warn("Failed to send browser info event:", error);
 		}
+		if (awaitFingerprint) await fingerprintPromise;
 		sessionInitialized = true;
 		cachedFeatures = features;
 		cachedDisableIpify = disableIpify;
-		cachedFingerprintSuccess = fingerprintSuccess;
-		cachedFingerprintResult = fingerprintResult;
 		await flowPreloadPromise;
 		return {
 			features,
 			disableIpify,
-			fingerprintSuccess,
-			fingerprintResult
+			fingerprintSuccess: cachedFingerprintSuccess,
+			fingerprintResult: cachedFingerprintResult
 		};
 	})().finally(() => {
 		sessionInitPromise = null;
-		getAnalyticsBatcher()?.start();
+		if (!fingerprintPromise) settled.resolve(void 0);
+		(fingerprintPromise ?? Promise.resolve()).finally(() => {
+			if (fingerprintSettled === settled) getAnalyticsBatcher()?.start();
+		});
 	});
 	return sessionInitPromise;
 }
 /**
+* Device-fingerprint step of session activation. Writes the cached result only
+* while it still belongs to the current activation (a token change resets
+* `fingerprintSettled`) and always settles the waiter.
+*/
+async function submitSessionFingerprint(fingerprintProvider, options, settled) {
+	const isCurrent = () => fingerprintSettled === settled;
+	try {
+		if (fingerprintProvider) try {
+			const result = await submitDeviceFingerprint(options, {
+				fingerprintProvider,
+				browserEnv: new BrowserEnvironmentProvider(),
+				isCurrentSession: isCurrent
+			});
+			if (isCurrent()) {
+				cachedFingerprintResult = result;
+				cachedFingerprintSuccess = true;
+				flushDeviceStatsQueue();
+			}
+		} catch (error) {
+			console.warn("Failed to submit device fingerprint:", error);
+			trueSightLog("warning", "session", "other", "device fingerprint submit failed");
+		}
+		else if (isCurrent()) flushDeviceStatsQueue();
+	} finally {
+		settled.resolve(isCurrent() ? cachedFingerprintResult : void 0);
+	}
+}
+/**
 * Gets the cached disableIpify flag.
 * Returns false if session hasn't been initialized.
 */
@@ -1858,9 +1976,10 @@ function resetSessionInit() {
 	cachedFingerprintSuccess = false;
 	cachedFingerprintResult = void 0;
 	sessionInitPromise = null;
+	fingerprintSettled = null;
 	resetFeatureConfigCache();
 	resetIpifyCache();
 	resetDeviceStatsQueue();
 }
 //#endregion
-export { getDeviceFingerprintInfo as _, resetSessionInit as a, getStandaloneFlowPolicy as c, resolveStandaloneFlowPolicy as d, setStandaloneFlowPolicy as f, getThumbmarkId as g, IpifyProvider as h, initializeSession as i, registerFlowPreloader as l, getFingerprint as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, isBrowserSimulation as p, getSessionFingerprintResult as r, setClientIpLookupEnabled as s, getDisableIpify as t, resetStandaloneFlowPolicy as u, BrowserEnvironmentProvider as v };
+export { IpifyProvider as _, resetSessionInit as a, BrowserEnvironmentProvider as b, setClientIpLookupEnabled as c, registerFlowPreloader as d, resetStandaloneFlowPolicy as f, getFingerprint as g, isBrowserSimulation as h, initializeSession as i, whenSessionFingerprintSettled as l, setStandaloneFlowPolicy as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, resolveStandaloneFlowPolicy as p, getSessionFingerprintResult as r, setClientHostingApp as s, getDisableIpify as t, getStandaloneFlowPolicy as u, getThumbmarkId as v, getDeviceFingerprintInfo as y };