@incodetech/core 2.3.2-rc.4 → 2.4.0-rc.0

package/dist/sessionInitializer-jxbfCnE-.esm.js

@@ -0,0 +1,974 @@
+import { S as noteTokenActivated, _ as resetFeatureConfigCache, g as isFeatureEnabled, h as fetchFeatureConfig, l as trueSightLog, s as startTrueSightCollection, y as noteEnvironment } from "./trueSightService-BWgRVGIT.esm.js";
+import { S as subscribeEvent, v as addEvent, y as getAnalyticsBatcher } from "./events-CAgFE-k3.esm.js";
+import { c as setToken, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
+import { t as endpoints } from "./endpoints-DHzlkQNe.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-F5YZbjip.esm.js";
+import { E as updateFeatureManagementUser } from "./feature-management-BTbYruNe.esm.js";
+import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-DmG_tkGk.esm.js";
+import { t as getParsedUserAgent } from "./getParsedUserAgent-DhQPeKqw.esm.js";
+import { t as BrowserLazyImportProvider } from "./BrowserLazyImportProvider-BhoA957O.esm.js";
+import { a as isIOS } from "./platform-DkcRc9JV.esm.js";
+import { t as getUserAgent } from "./getBrowser-CBiibsL-.esm.js";
+import { i as linkSessionWithTRI, r as isTRIStarted } from "./tri-xzRLIIMN.esm.js";
+//#region src/internal/fingerprint/fingerprintSignalsReporter.ts
+const START_INTERVIEW_EVENT = "modelLoadEnd";
+const CAPTURE_INTERVIEW_EVENT = "captureAttemptFinished";
+const START_SIGNALS = ["pid", "device"];
+function createFingerprintSignalsReporter(deps) {
+	let enabled = true;
+	let sessionActive = false;
+	let wasmReady = false;
+	let started = false;
+	let pendingStartSignals = START_SIGNALS;
+	let prefetchStarted = false;
+	let deviceDataUpdated = true;
+	let unsubscribe = null;
+	let optOutApplied = false;
+	let optInPending = false;
+	let queue = Promise.resolve();
+	let generation = 0;
+	function enqueue(work) {
+		const scheduledGeneration = generation;
+		queue = queue.then(async () => {
+			if (scheduledGeneration !== generation) return;
+			await work();
+		});
+	}
+	async function send(token, interviewEvent, type) {
+		const metadata = await (await deps.getWasmUtil()).getFingerprintSignals(type);
+		if (!metadata) return;
+		if (deps.getToken() !== token) return;
+		await deps.post(endpoints.deviceFingerprintSignals, {
+			interviewEvent,
+			metadata
+		}, { "X-Incode-Hardware-Id": token });
+	}
+	/**
+	* Sends `types` in order and stops at the first failure. Resolves to the
+	* types left unsent (empty when every send went through).
+	*/
+	async function sendAll(token, interviewEvent, types) {
+		for (const [index, type] of types.entries()) try {
+			await send(token, interviewEvent, type);
+		} catch (error) {
+			deps.reportFailure({
+				message: error instanceof Error ? error.message : String(error),
+				signalsType: type,
+				interviewEvent
+			});
+			return types.slice(index);
+		}
+		return [];
+	}
+	/** Switches native behaviour collection (`sbc`); resolves to whether it worked. */
+	async function applyNativeCollection(on) {
+		try {
+			(await deps.getWasmUtil()).setBehaviourSignalsCollection(on);
+			return true;
+		} catch (error) {
+			deps.reportFailure({
+				message: error instanceof Error ? error.message : String(error),
+				signalsType: "behaviour",
+				interviewEvent: START_INTERVIEW_EVENT
+			});
+			return false;
+		}
+	}
+	async function applyNativeOptOut() {
+		if (optOutApplied || enabled) return;
+		optOutApplied = true;
+		if (!await applyNativeCollection(false)) optOutApplied = false;
+	}
+	async function applyNativeOptIn() {
+		if (!optInPending) return;
+		optInPending = false;
+		if (!await applyNativeCollection(true)) optInPending = true;
+	}
+	function startPrefetch() {
+		if (prefetchStarted) return;
+		prefetchStarted = true;
+		deps.getWasmUtil().then((wasmUtil) => wasmUtil.prefetchFingerprintSignals()).catch(() => void 0);
+	}
+	function tryStart() {
+		if (!wasmReady) return;
+		if (!enabled) {
+			enqueue(applyNativeOptOut);
+			return;
+		}
+		const token = deps.getToken();
+		if (!token) return;
+		startPrefetch();
+		if (optInPending) enqueue(applyNativeOptIn);
+		if (started || !sessionActive) return;
+		started = true;
+		ensureSubscribed();
+		const startGeneration = generation;
+		const allowRetry = (unsent) => {
+			if (startGeneration !== generation) return;
+			pendingStartSignals = unsent;
+			started = false;
+		};
+		enqueue(async () => {
+			if (!await applyNativeCollection(true)) {
+				allowRetry(pendingStartSignals);
+				return;
+			}
+			deviceDataUpdated = false;
+			const unsent = await sendAll(token, START_INTERVIEW_EVENT, pendingStartSignals);
+			if (unsent.length > 0) allowRetry(unsent);
+		});
+	}
+	function onCaptureAttemptFinished() {
+		wasmReady = true;
+		tryStart();
+		const token = deps.getToken();
+		if (!enabled || !started || !token) return;
+		enqueue(async () => {
+			const types = [];
+			if (deviceDataUpdated) {
+				deviceDataUpdated = false;
+				types.push("device");
+			}
+			types.push("behaviour");
+			await sendAll(token, CAPTURE_INTERVIEW_EVENT, types);
+		});
+	}
+	function ensureSubscribed() {
+		if (unsubscribe) return;
+		unsubscribe = deps.subscribe((event) => {
+			if (event.code === CAPTURE_INTERVIEW_EVENT) onCaptureAttemptFinished();
+		});
+	}
+	function resetSession() {
+		generation += 1;
+		sessionActive = false;
+		started = false;
+		pendingStartSignals = START_SIGNALS;
+		optInPending = false;
+		deviceDataUpdated = true;
+	}
+	return {
+		setEnabled(value) {
+			if (value === enabled) return;
+			enabled = value;
+			if (value) {
+				const wasOptedOut = optOutApplied;
+				optOutApplied = false;
+				optInPending = wasOptedOut && started;
+			} else optInPending = false;
+			tryStart();
+		},
+		onSessionActivated() {
+			sessionActive = true;
+			ensureSubscribed();
+			tryStart();
+		},
+		onWasmReady() {
+			wasmReady = true;
+			ensureSubscribed();
+			tryStart();
+		},
+		onTokenAvailable() {
+			tryStart();
+		},
+		onCameraInfoUpdated() {
+			deviceDataUpdated = true;
+		},
+		resetSession,
+		reset() {
+			resetSession();
+			wasmReady = false;
+			optOutApplied = false;
+			prefetchStarted = false;
+			unsubscribe?.();
+			unsubscribe = null;
+		}
+	};
+}
+const fingerprintSignalsReporter = createFingerprintSignalsReporter({
+	getWasmUtil: async () => {
+		const { WasmUtilProvider } = await import("./WasmUtilProvider-CIdnE7Fx.esm.js").then((n) => n.n);
+		return WasmUtilProvider.getInstance();
+	},
+	getToken: () => getToken(),
+	post: (url, body, headers) => api.post(url, body, { headers }),
+	subscribe: (listener) => subscribeEvent(listener),
+	reportFailure: ({ message, signalsType, interviewEvent }) => trueSightLog("warning", "wasm", "other", `fingerprint signals failed type=${signalsType} event=${interviewEvent} error=${message}`)
+});
+//#endregion
+//#region ../infra/src/providers/browser/BrowserEnvironmentProvider.ts
+var BrowserEnvironmentProvider = class {
+	getScreenDimensions() {
+		if (typeof screen === "undefined") return {
+			width: 0,
+			height: 0
+		};
+		return {
+			width: screen.width,
+			height: screen.height
+		};
+	}
+	generateCanvasFingerprint() {
+		try {
+			if (typeof document === "undefined") return "";
+			const canvas = document.createElement("canvas");
+			const ctx = canvas.getContext("2d");
+			if (!ctx) return "";
+			ctx.textBaseline = "top";
+			ctx.font = "14px Arial";
+			ctx.fillText("fingerprint", 2, 2);
+			return canvas.toDataURL().slice(-50);
+		} catch {
+			return "";
+		}
+	}
+	getWebGLRenderer() {
+		try {
+			if (typeof document === "undefined") return "";
+			const canvas = document.createElement("canvas");
+			const gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl");
+			if (!gl) return "";
+			const debugInfo = gl.getExtension("WEBGL_debug_renderer_info");
+			if (!debugInfo) return "";
+			return gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) || "";
+		} catch {
+			return "";
+		}
+	}
+	getWindowProperty(prop) {
+		if (typeof window === "undefined") return;
+		return window[prop];
+	}
+	getNavigatorProperty(prop) {
+		if (typeof navigator === "undefined") return;
+		return navigator[prop];
+	}
+	getNavigatorPrefixes() {
+		if (typeof navigator === "undefined") return {
+			webkit: false,
+			moz: false,
+			o: false,
+			ms: false
+		};
+		const nav = navigator;
+		return {
+			webkit: nav.webkitGetUserMedia !== void 0,
+			moz: nav.mozGetUserMedia !== void 0,
+			o: nav.oGetUserMedia !== void 0,
+			ms: nav.msGetUserMedia !== void 0
+		};
+	}
+	getMaxTouchPoints() {
+		if (typeof navigator === "undefined") return 0;
+		return navigator.maxTouchPoints;
+	}
+	hasOnTouchStart() {
+		if (typeof window !== "undefined" && "ontouchstart" in window) return true;
+		if (typeof document !== "undefined") return "ontouchstart" in document.documentElement;
+		return false;
+	}
+	getNavigatorProductSub() {
+		if (typeof navigator === "undefined") return;
+		return navigator.productSub;
+	}
+	getEvalToStringLength() {
+		return eval.toString().length;
+	}
+	tryFirefoxToSource() {
+		try {
+			throw "a";
+		} catch (err) {
+			try {
+				err.toSource();
+				return true;
+			} catch {
+				return false;
+			}
+		}
+	}
+	async fetchJson(url, timeoutMs = 3e3) {
+		try {
+			if (typeof fetch === "undefined") return null;
+			const controller = new AbortController();
+			const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+			const response = await fetch(url, { signal: controller.signal });
+			clearTimeout(timeoutId);
+			return await response.json();
+		} catch {
+			return null;
+		}
+	}
+	async enumerateVideoDeviceLabels() {
+		try {
+			if (typeof navigator === "undefined" || !navigator.mediaDevices?.enumerateDevices) return [];
+			return (await navigator.mediaDevices.enumerateDevices()).filter((device) => device.kind === "videoinput").map((device) => device.label);
+		} catch {
+			return [];
+		}
+	}
+	getTimestamp() {
+		return Date.now();
+	}
+};
+//#endregion
+//#region ../infra/src/providers/browser/BrowserInfoProvider.ts
+var BrowserInfoProvider = class {
+	checkWebRtcSupport() {
+		if (typeof window === "undefined") return false;
+		const hasRTCPeerConnection = "RTCPeerConnection" in window || "webkitRTCPeerConnection" in window || "mozRTCPeerConnection" in window;
+		const hasGetUserMedia = typeof navigator !== "undefined" && navigator.mediaDevices?.getUserMedia !== void 0;
+		return hasRTCPeerConnection && hasGetUserMedia;
+	}
+	getBrowserInfo() {
+		const userAgent = typeof navigator !== "undefined" ? navigator.userAgent : "";
+		return {
+			userAgent,
+			isWebRtcSupported: this.checkWebRtcSupport(),
+			...getParsedUserAgent(userAgent)
+		};
+	}
+};
+//#endregion
+//#region ../infra/src/device/getDeviceData.ts
+const HIGH_ENTROPY_HINTS = /* @__PURE__ */ new Set([
+	"model",
+	"platformVersion",
+	"fullVersionList",
+	"brands",
+	"platform"
+]);
+function getFallbackDeviceInfo() {
+	const parsed = getParsedUserAgent();
+	return {
+		device: { model: parsed.device.model },
+		os: {
+			name: parsed.os.name,
+			version: parsed.os.version
+		},
+		browser: {
+			name: parsed.browser.name,
+			version: parsed.browser.version
+		}
+	};
+}
+function sanitizeString(value) {
+	return value?.trim() || void 0;
+}
+function extractPrimaryBrandInfo(fullVersionList, brands) {
+	const primaryBrand = fullVersionList?.[0] || brands?.[0];
+	return {
+		name: sanitizeString(primaryBrand?.brand),
+		version: sanitizeString(primaryBrand?.version)
+	};
+}
+async function getHighEntropyDeviceInfo(userAgentData) {
+	const highEntropyValues = await userAgentData.getHighEntropyValues(Array.from(HIGH_ENTROPY_HINTS));
+	const { name: browserName, version: browserVersion } = extractPrimaryBrandInfo(highEntropyValues.fullVersionList, userAgentData.brands);
+	return {
+		device: { model: sanitizeString(highEntropyValues.model) },
+		os: {
+			name: sanitizeString(highEntropyValues.platform),
+			version: sanitizeString(highEntropyValues.platformVersion)
+		},
+		browser: {
+			name: browserName,
+			version: browserVersion
+		}
+	};
+}
+const checkForUnbrandedBrowser = (browser) => {
+	const userAgent = typeof navigator !== "undefined" ? navigator.userAgent : "";
+	const fallback = getFallbackDeviceInfo();
+	if (!userAgent) return browser;
+	try {
+		return {
+			...browser,
+			name: fallback.browser.name,
+			version: fallback.browser.version
+		};
+	} catch {
+		return {
+			...browser,
+			name: "Unknown",
+			version: "Unknown"
+		};
+	}
+};
+function mergeDeviceInfo(fallback, enhanced) {
+	return {
+		device: { model: enhanced.device?.model || fallback.device.model },
+		os: {
+			name: enhanced.os?.name || fallback.os.name,
+			version: enhanced.os?.version || fallback.os.version
+		},
+		browser: checkForUnbrandedBrowser({
+			name: enhanced.browser?.name || fallback.browser.name,
+			version: enhanced.browser?.version || fallback.browser.version
+		})
+	};
+}
+function isUserAgentClientHintsSupported(navigator) {
+	return Boolean(navigator.userAgentData?.getHighEntropyValues && typeof navigator.userAgentData.getHighEntropyValues === "function");
+}
+async function getDeviceFingerprintInfo() {
+	if (typeof navigator === "undefined") return {
+		device: {},
+		os: {},
+		browser: {}
+	};
+	const customNavigator = navigator;
+	const fallbackInfo = getFallbackDeviceInfo();
+	if (!isUserAgentClientHintsSupported(customNavigator)) return fallbackInfo;
+	try {
+		return mergeDeviceInfo(fallbackInfo, await getHighEntropyDeviceInfo(customNavigator.userAgentData));
+	} catch {
+		return fallbackInfo;
+	}
+}
+//#endregion
+//#region ../infra/src/scheduling/yieldUntilNextPaint.ts
+/**
+* Resolves after the browser has had a chance to commit and paint a queued
+* render.
+*
+* Strategy:
+* - `requestAnimationFrame` callbacks fire BEFORE the paint of the frame
+*   they belong to (per the HTML5 "update the rendering" step). If we
+*   resolve the promise inside a rAF callback, the await-continuation
+*   runs as a microtask immediately after the callback returns — still
+*   before the paint phase of that frame. A caller that then blocks the
+*   main thread (e.g. synchronous WASM `processPhoto`) starves the paint.
+* - We therefore chain rAF → setTimeout: the rAF fires before frame N's
+*   paint, the setTimeout runs as a macrotask scheduled after frame N's
+*   "update the rendering" step, which the browser will only get to once
+*   the paint actually lands. By the time setTimeout fires, the paint
+*   for the queued render is on screen.
+* - In environments where rAF never ticks (jsdom, happy-dom, backgrounded
+*   tabs), a parallel `setTimeout` fallback at 100 ms resolves instead.
+*   100 ms is comfortably longer than two real-browser frames so rAF +
+*   setTimeout wins reliably in any foregrounded browser. (An earlier
+*   implementation raced rAF against a `MessageChannel` macrotask, but
+*   MessageChannel drains immediately after the current task's
+*   microtasks — before the next paint — so it resolved the promise too
+*   early and defeated the whole point of the helper.)
+*
+* Lives in infra because it touches browser APIs (`requestAnimationFrame`,
+* `setTimeout`) that the architecture rules forbid from core. Core modules
+* that need to yield to the browser render loop should import this helper
+* directly via its file path.
+*/
+function yieldUntilNextPaint() {
+	return new Promise((resolve) => {
+		let resolved = false;
+		const done = () => {
+			if (resolved) return;
+			resolved = true;
+			resolve();
+		};
+		if (typeof requestAnimationFrame === "function") requestAnimationFrame(() => {
+			requestAnimationFrame(() => {
+				setTimeout(done, 0);
+			});
+		});
+		setTimeout(done, 100);
+	});
+}
+//#endregion
+//#region ../infra/src/providers/browser/thumbmarkAdapter.ts
+/**
+* Adapter for @thumbmarkjs/thumbmarkjs. Single point of dependency so bundlers
+* resolve it from infra's node_modules when building apps that depend on core → infra.
+*/
+const THUMBMARK_ALGORITHM = {
+	algorithmName: "thumbmarkjs",
+	algorithmVersion: "1.6.4"
+};
+/**
+* `logging` must stay disabled. With it on (the upstream default) `getThumbmark()`
+* evaluates a bare, unguarded storage read:
+*
+*   options.logging && !sessionStorage.getItem("_tmjs_l") && Math.random() < 1e-4
+*
+* Hosts that delete the bare global as a self-XSS mitigation (`delete
+* window.sessionStorage`) make that a `ReferenceError`, which would cost us the
+* device fingerprint. `logging: false` short-circuits the expression before the
+* read. It also stops upstream's 1-in-10 000 telemetry POST to
+* api.thumbmarkjs.com. Re-check this when bumping the dependency.
+*/
+const THUMBMARK_OPTIONS = {
+	logging: false,
+	yield: yieldUntilNextPaint
+};
+const lazyThumbmark = BrowserLazyImportProvider.getInstance().create(() => import("./thumbmark.esm-CRc0cYvz.esm.js"), {
+	label: "Fingerprint",
+	moduleName: "@thumbmarkjs/thumbmarkjs",
+	timeoutMs: 1e4,
+	disabledMessage: "the device fingerprint is unavailable for this attempt."
+});
+async function getThumbmarkId() {
+	const module = await lazyThumbmark.load();
+	if (!module) throw new Error("@thumbmarkjs/thumbmarkjs failed to load");
+	return (await new module.Thumbmark(THUMBMARK_OPTIONS).get()).thumbmark;
+}
+//#endregion
+//#region ../infra/src/providers/browser/FingerprintProvider.ts
+var FingerprintProvider = class {
+	constructor(ipLookup) {
+		this.ipLookup = ipLookup;
+	}
+	prime() {
+		this.startVisitorId();
+	}
+	startVisitorId() {
+		if (!this.visitorIdPromise) {
+			this.visitorIdPromise = getThumbmarkId();
+			this.visitorIdPromise.catch(() => void 0);
+		}
+		return this.visitorIdPromise;
+	}
+	async getFingerprint(disableIpify = false) {
+		const visitorId = await this.startVisitorId();
+		const [deviceInfo, ip] = await Promise.all([getDeviceFingerprintInfo(), disableIpify ? Promise.resolve("") : this.ipLookup.getIp()]);
+		return {
+			visitorId,
+			ip,
+			deviceInfo,
+			...THUMBMARK_ALGORITHM
+		};
+	}
+};
+//#endregion
+//#region ../infra/src/providers/browser/IpifyProvider.ts
+let cachedIp;
+let inFlightLookup;
+/**
+* Resets the module-level IP cache. Intended for tests and full session resets.
+*/
+function resetIpifyCache() {
+	cachedIp = void 0;
+	inFlightLookup = void 0;
+}
+async function fetchIpFromIpify() {
+	if (typeof fetch === "undefined") return "";
+	let timeoutId = 0;
+	const controller = new AbortController();
+	if (AbortSignal.timeout) {
+		const signal = AbortSignal.timeout(3e3);
+		return (await (await fetch("https://api.ipify.org?format=json", { signal })).json()).ip;
+	}
+	const timeoutPromise = new Promise((_, reject) => {
+		timeoutId = setTimeout(() => {
+			controller.abort();
+			reject(/* @__PURE__ */ new Error("Request timeout"));
+		}, 3e3);
+	});
+	const fetchPromise = fetch("https://api.ipify.org?format=json", { signal: controller.signal }).then((res) => res.json()).then((data) => data.ip);
+	const result = await Promise.race([fetchPromise, timeoutPromise]);
+	clearTimeout(timeoutId);
+	return result;
+}
+var IpifyProvider = class {
+	async getIp() {
+		if (cachedIp !== void 0) return cachedIp;
+		if (inFlightLookup) return inFlightLookup;
+		inFlightLookup = (async () => {
+			try {
+				const ip = await fetchIpFromIpify();
+				cachedIp = ip;
+				return ip;
+			} catch {
+				cachedIp = "";
+				return "";
+			} finally {
+				inFlightLookup = void 0;
+			}
+		})();
+		return inFlightLookup;
+	}
+};
+//#endregion
+//#region src/internal/fingerprint/fingerprintApi.ts
+async function getFingerprint(disableIpify) {
+	const shouldDisableIpify = disableIpify ?? getDisableIpify();
+	return new FingerprintProvider(new IpifyProvider()).getFingerprint(shouldDisableIpify);
+}
+//#endregion
+//#region src/internal/device/hasLiedBrowser.ts
+function detectBrowserFromUserAgent(userAgent) {
+	if (userAgent.indexOf("edge/") >= 0 || userAgent.indexOf("iemobile/") >= 0) return "Other";
+	if (userAgent.indexOf("opera mini") >= 0) return "Other";
+	if (userAgent.indexOf("firefox/") >= 0) return "Firefox";
+	if (userAgent.indexOf("opera/") >= 0 || userAgent.indexOf(" opr/") >= 0) return "Opera";
+	if (userAgent.indexOf("chrome/") >= 0) return "Chrome";
+	if (userAgent.indexOf("safari/") >= 0) {
+		if (userAgent.indexOf("android 1.") >= 0 || userAgent.indexOf("android 2.") >= 0 || userAgent.indexOf("android 3.") >= 0 || userAgent.indexOf("android 4.") >= 0) return "AOSP";
+		return "Safari";
+	}
+	if (userAgent.indexOf("trident/") >= 0) return "Internet Explorer";
+	return "Other";
+}
+function hasLiedBrowser(browserEnv) {
+	const userAgent = getUserAgent().toLowerCase();
+	if (userAgent.indexOf("edge/") >= 0 || userAgent.indexOf("iemobile/") >= 0) return false;
+	if (userAgent.indexOf("opera mini") >= 0) return false;
+	const browser = detectBrowserFromUserAgent(userAgent);
+	const productSub = browserEnv.getNavigatorProductSub();
+	if ((browser === "Chrome" || browser === "Safari" || browser === "Opera") && productSub !== "20030107") return true;
+	const evalLength = browserEnv.getEvalToStringLength();
+	if (evalLength === 37 && browser !== "Safari" && browser !== "Firefox" && browser !== "Other") return true;
+	if (evalLength === 39 && browser !== "Internet Explorer" && browser !== "Other") return true;
+	if (evalLength === 33 && browser !== "Chrome" && browser !== "AOSP" && browser !== "Opera" && browser !== "Other") return true;
+	return browserEnv.tryFirefoxToSource() && browser !== "Firefox" && browser !== "Other";
+}
+//#endregion
+//#region src/internal/device/browserSimulation.ts
+const AUTOMATION_MARKERS = {
+	window: [
+		"callPhantom",
+		"_phantom",
+		"phantom",
+		"__nightmare",
+		"domAutomation",
+		"domAutomationController"
+	],
+	navigator: ["webdriver"]
+};
+function hasAutomationMarker(browserEnv) {
+	for (const prop of AUTOMATION_MARKERS.window) if (browserEnv.getWindowProperty(prop)) return true;
+	for (const prop of AUTOMATION_MARKERS.navigator) if (browserEnv.getNavigatorProperty(prop)) return true;
+	return false;
+}
+function isBrowserSimulation(browserEnv) {
+	if (hasAutomationMarker(browserEnv)) return true;
+	if (!getParsedUserAgent().browser.name) return true;
+	const touchPoints = browserEnv.getMaxTouchPoints();
+	const isTouch = touchPoints > 0 || browserEnv.hasOnTouchStart();
+	if (isTouch && touchPoints !== 1) return false;
+	const ua = getUserAgent();
+	if (isTouch && (hasLiedBrowser(browserEnv) || ua.includes("Mobile"))) return true;
+	if (isIOS(ua) && !browserEnv.hasOnTouchStart()) return true;
+	return false;
+}
+//#endregion
+//#region src/internal/fingerprint/fingerprintService.ts
+function formatOsVersion(os) {
+	return `${os.name || "Unknown"} ${os.version || ""}`.trim();
+}
+function formatBrowser(browser) {
+	if (!browser.name || !browser.version) return "Unknown";
+	return `${browser.name} ${browser.version}`;
+}
+async function submitDeviceFingerprint(options = {}, dependencies) {
+	const { disableIpify = false, hostingApp, signal } = options;
+	const token = getToken();
+	const fingerprint = await dependencies.fingerprintProvider.getFingerprint(disableIpify);
+	if (getToken() !== token || dependencies.isCurrentSession?.() === false) throw new Error("Session changed during fingerprint collection");
+	const hasLiedBrowser = isBrowserSimulation(dependencies.browserEnv);
+	const payload = {
+		hash: fingerprint.visitorId || "",
+		ip: fingerprint.ip || "",
+		deviceType: "WEBAPP",
+		data: JSON.stringify(fingerprint),
+		osVersion: formatOsVersion(fingerprint.deviceInfo.os),
+		deviceModel: fingerprint.deviceInfo.device.model || "",
+		browser: formatBrowser(fingerprint.deviceInfo.browser),
+		hasLiedBrowser,
+		sdkVersion: SDK_VERSION,
+		hostingApp: hostingApp ?? "Web SDK",
+		algorithmName: fingerprint.algorithmName,
+		algorithmVersion: fingerprint.algorithmVersion
+	};
+	const response = await api.post(endpoints.deviceFingerprint, payload, { signal });
+	if (!response.ok) throw new Error(`Failed to submit fingerprint: ${response.status} ${response.statusText}`);
+	return response.data;
+}
+//#endregion
+//#region src/internal/session/standaloneFlowPolicy.ts
+let standaloneFlowPolicy = Object.freeze({
+	enabled: true,
+	mergeConfig: false
+});
+let flowPreloader;
+function resolveStandaloneFlowPolicy(flow) {
+	return Object.freeze({
+		enabled: flow !== false,
+		mergeConfig: flow !== false && (typeof flow === "object" ? flow : {}).mergeConfig === true
+	});
+}
+function setStandaloneFlowPolicy(policy) {
+	standaloneFlowPolicy = policy;
+}
+function getStandaloneFlowPolicy() {
+	return standaloneFlowPolicy;
+}
+function registerFlowPreloader(preloader) {
+	flowPreloader = preloader;
+}
+function preloadSessionFlow() {
+	return flowPreloader?.() ?? Promise.resolve();
+}
+function resetStandaloneFlowPolicy() {
+	standaloneFlowPolicy = resolveStandaloneFlowPolicy(void 0);
+	flowPreloader = void 0;
+}
+//#endregion
+//#region src/internal/session/sessionInitializer.ts
+let sessionInitialized = false;
+let cachedFeatures = null;
+let cachedDisableIpify = false;
+let clientIpLookupEnabled = true;
+let clientFingerprintEnabled = true;
+let clientHostingApp;
+function setClientIpLookupEnabled(enabled) {
+	clientIpLookupEnabled = enabled;
+}
+/**
+* Host identifier from `setup({ hostingApp })`, used as the default for every
+* activation. Without it the option only reached the fingerprint when the host
+* also passed `token` to `setup()` — activations triggered later from inside
+* `<incode-flow>` / `<incode-workflow>` / standalone modules carry a token but
+* no host identity, so those sessions fell back to the `'Web SDK'` default.
+*/
+function setClientHostingApp(hostingApp) {
+	clientHostingApp = hostingApp;
+}
+function setClientFingerprintEnabled(enabled) {
+	clientFingerprintEnabled = enabled;
+	fingerprintSignalsReporter.setEnabled(enabled);
+}
+function resolveDisableIpify(serverDisableIpify) {
+	return !clientIpLookupEnabled || serverDisableIpify;
+}
+/** `"Chrome" + "126"` -> `"Chrome 126"`; undefined when nothing was parsed. */
+function composeNameVersion(name, version) {
+	const value = [name, version].filter(Boolean).join(" ");
+	return value === "" ? void 0 : value;
+}
+function preloadOptionalFlow() {
+	try {
+		return preloadSessionFlow().catch(() => void 0);
+	} catch {
+		return Promise.resolve();
+	}
+}
+let cachedFingerprintSuccess = false;
+let cachedFingerprintResult;
+let sessionInitPromise = null;
+let fingerprintSettled = null;
+function createFingerprintSettled() {
+	let resolve = () => void 0;
+	return {
+		promise: new Promise((r) => {
+			resolve = r;
+		}),
+		resolve
+	};
+}
+/**
+* Resolves once the device-fingerprint step of the current session
+* activation has settled (submitted, failed, or skipped) — with the backend's
+* result when there is one. Resolves immediately when no activation is in
+* flight. Pairs with `initializeSession({ awaitFingerprint: false })`.
+*/
+function whenSessionFingerprintSettled() {
+	return fingerprintSettled?.promise ?? Promise.resolve(cachedFingerprintResult);
+}
+/**
+* Activates a session by setting the auth token on the HTTP client and
+* preloading session-scoped state.
+*
+* Performs:
+* 1. Sets the token (and clears stale session-init cache if the token changed)
+* 2. Links the session with the TRI activity if TRI is enabled
+* 3. Fetches feature configuration from backend
+* 4. Submits device fingerprint
+* 5. Starts the analytics batcher so buffered events are flushed
+*
+* Results are cached per token. Calling again with the same token returns the
+* cached result; calling with a different token re-initializes from scratch.
+*
+* @param options - Session activation options (`token` required)
+* @returns Session initialization result with feature config
+*
+* @example
+* ```ts
+* await setup({ apiURL: 'https://api.incode.com' });
+* const session = await createSession('api-key', options);
+* const { features } = await initializeSession({ token: session.token });
+*
+* // Check feature flags
+* if (isFeatureEnabled('DISABLE_IPIFY', features.features)) {
+*   // Handle disabled ipify
+* }
+* ```
+*/
+async function initializeSession(options = {}) {
+	const { token, hostingApp = clientHostingApp, signal, preloadFlow, awaitFingerprint = true } = options;
+	let triLinkPromise = Promise.resolve();
+	if (token !== void 0 && token !== getToken()) {
+		setToken(token);
+		resetSessionInit();
+		if (isTRIStarted()) triLinkPromise = linkSessionWithTRI(token);
+	}
+	if (token !== void 0) noteTokenActivated();
+	if (getToken()) fingerprintSignalsReporter.onTokenAvailable();
+	const flowPreloadPromise = getToken() && preloadFlow === true ? preloadOptionalFlow() : Promise.resolve();
+	await triLinkPromise;
+	if (sessionInitialized && cachedFeatures) {
+		if (awaitFingerprint) await whenSessionFingerprintSettled();
+		await flowPreloadPromise;
+		return {
+			features: cachedFeatures,
+			disableIpify: cachedDisableIpify,
+			fingerprintSuccess: cachedFingerprintSuccess,
+			fingerprintResult: cachedFingerprintResult
+		};
+	}
+	if (sessionInitPromise) {
+		const result = await sessionInitPromise;
+		if (awaitFingerprint) await whenSessionFingerprintSettled();
+		await flowPreloadPromise;
+		return {
+			...result,
+			fingerprintSuccess: cachedFingerprintSuccess,
+			fingerprintResult: cachedFingerprintResult
+		};
+	}
+	const settled = createFingerprintSettled();
+	fingerprintSettled = settled;
+	const fingerprintProvider = clientFingerprintEnabled ? new FingerprintProvider(new IpifyProvider()) : void 0;
+	fingerprintProvider?.prime?.();
+	let fingerprintPromise;
+	sessionInitPromise = (async () => {
+		let features;
+		let serverDisableIpify = false;
+		try {
+			features = await fetchFeatureConfig(signal);
+			serverDisableIpify = isFeatureEnabled("DISABLE_IPIFY", features.features);
+			startTrueSightCollection(features);
+		} catch {
+			features = { sessionIdentifier: "" };
+			trueSightLog("warning", "session", "orchestration", "feature-config fetch failed");
+			startTrueSightCollection();
+		}
+		const disableIpify = resolveDisableIpify(serverDisableIpify);
+		const preloadedFlow = await flowPreloadPromise;
+		await updateFeatureManagementUser({ customIDs: {
+			hashed_onboarding_id: features.sessionIdentifier || void 0,
+			flow_id: preloadedFlow?.flowId
+		} });
+		fingerprintPromise = submitSessionFingerprint(fingerprintProvider, {
+			disableIpify,
+			hostingApp,
+			signal
+		}, settled);
+		try {
+			const browserInfo = new BrowserInfoProvider().getBrowserInfo();
+			const language = new BrowserEnvironmentProvider().getNavigatorProperty("language");
+			noteEnvironment({
+				browser: composeNameVersion(browserInfo.browser.name, browserInfo.browser.version),
+				osVersion: composeNameVersion(browserInfo.os.name, browserInfo.os.version),
+				osLanguage: typeof language === "string" ? language : void 0
+			});
+			addEvent({
+				code: "browser",
+				payload: {
+					userAgent: browserInfo.userAgent,
+					isWebRtcSupported: browserInfo.isWebRtcSupported,
+					browser: browserInfo.browser,
+					os: browserInfo.os,
+					device: browserInfo.device,
+					engine: browserInfo.engine,
+					cpu: browserInfo.cpu
+				}
+			});
+		} catch (error) {
+			console.warn("Failed to send browser info event:", error);
+		}
+		if (awaitFingerprint) await fingerprintPromise;
+		sessionInitialized = true;
+		cachedFeatures = features;
+		cachedDisableIpify = disableIpify;
+		fingerprintSignalsReporter.onSessionActivated();
+		await flowPreloadPromise;
+		return {
+			features,
+			disableIpify,
+			fingerprintSuccess: cachedFingerprintSuccess,
+			fingerprintResult: cachedFingerprintResult
+		};
+	})().finally(() => {
+		sessionInitPromise = null;
+		if (!fingerprintPromise) settled.resolve(void 0);
+		(fingerprintPromise ?? Promise.resolve()).finally(() => {
+			if (fingerprintSettled === settled) getAnalyticsBatcher()?.start();
+		});
+	});
+	return sessionInitPromise;
+}
+/**
+* Device-fingerprint step of session activation. Writes the cached result only
+* while it still belongs to the current activation (a token change resets
+* `fingerprintSettled`) and always settles the waiter.
+*/
+async function submitSessionFingerprint(fingerprintProvider, options, settled) {
+	const isCurrent = () => fingerprintSettled === settled;
+	try {
+		if (fingerprintProvider) try {
+			const result = await submitDeviceFingerprint(options, {
+				fingerprintProvider,
+				browserEnv: new BrowserEnvironmentProvider(),
+				isCurrentSession: isCurrent
+			});
+			if (isCurrent()) {
+				cachedFingerprintResult = result;
+				cachedFingerprintSuccess = true;
+				flushDeviceStatsQueue();
+			}
+		} catch (error) {
+			console.warn("Failed to submit device fingerprint:", error);
+			trueSightLog("warning", "session", "other", "device fingerprint submit failed");
+		}
+		else if (isCurrent()) flushDeviceStatsQueue();
+	} finally {
+		settled.resolve(isCurrent() ? cachedFingerprintResult : void 0);
+	}
+}
+/**
+* Gets the cached disableIpify flag.
+* Returns false if session hasn't been initialized.
+*/
+function getDisableIpify() {
+	if (!clientIpLookupEnabled) return true;
+	return cachedDisableIpify;
+}
+function getSessionFingerprintResult() {
+	return cachedFingerprintResult;
+}
+/**
+* Gets whether client-side device-fingerprint submission is enabled.
+* Consumed by `loadDeepsightSession` to resolve `disableFingerprint`
+* (mirrors how `getDisableIpify` is used).
+*/
+function getFingerprintEnabled() {
+	return clientFingerprintEnabled;
+}
+/**
+* Resets session initialization state.
+* Useful for testing or when starting a new session.
+*/
+function resetSessionInit() {
+	fingerprintSignalsReporter.resetSession();
+	sessionInitialized = false;
+	cachedFeatures = null;
+	cachedDisableIpify = false;
+	cachedFingerprintSuccess = false;
+	cachedFingerprintResult = void 0;
+	sessionInitPromise = null;
+	fingerprintSettled = null;
+	resetFeatureConfigCache();
+	resetIpifyCache();
+	resetDeviceStatsQueue();
+}
+//#endregion
+export { IpifyProvider as _, resetSessionInit as a, BrowserEnvironmentProvider as b, setClientIpLookupEnabled as c, registerFlowPreloader as d, resetStandaloneFlowPolicy as f, getFingerprint as g, isBrowserSimulation as h, initializeSession as i, whenSessionFingerprintSettled as l, setStandaloneFlowPolicy as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, resolveStandaloneFlowPolicy as p, getSessionFingerprintResult as r, setClientHostingApp as s, getDisableIpify as t, getStandaloneFlowPolicy as u, getThumbmarkId as v, fingerprintSignalsReporter as x, getDeviceFingerprintInfo as y };