@incodetech/core 2.3.2 → 2.4.0-rc.1

package/dist/{StreamCanvasCapture-_8gdW5Lk.d.ts → StreamCanvasCapture-7JRf-2ck.d.ts}

@@ -1,5 +1,5 @@
-import { y as IncodeCanvas } from "./createFaceAvatar-BlcTYgJv.js";
-import "./IWasmUtilCapability-CNWRl7jr.js";
+import { y as IncodeCanvas } from "./createFaceAvatar-lYX0VTYs.js";
+import "./IWasmUtilCapability-GF2n7sfm.js";
 import { t as CameraStream } from "./camera-9wWD-pwg.js";
 //#region ../infra/src/capabilities/IMotionSensorCapability.d.ts
 type MotionStatus = 'PASS' | 'FAIL' | 'UNCLEAR';

package/dist/{safeStorage-BdU9_m2E.esm.js → WasmUtilProvider-DtJuBdt-.esm.js}

@@ -1,5 +1,6 @@
-import { c as wasmCallWrapper, s as ML_CALL_MAX_POLLS } from "./wasmWebClient-B7baE-Wf.esm.js";
-import { a as waitForWasm, n as getWasmStatus, o as warmupWasm, r as isWasmReady, s as wasmRuntime } from "./warmup-ChDwHSel.esm.js";
+import { n as __exportAll } from "./rolldown-runtime-B-1-B7_t.esm.js";
+import { c as wasmCallWrapper, d as noteUnlockedCallStart, s as ML_CALL_MAX_POLLS, u as noteUnlockedCallEnd } from "./wasmWebClient-BjZw_7OB.esm.js";
+import { c as wasmRuntime, i as isWasmReady, o as waitForWasm, r as getWasmStatus, s as warmupWasm } from "./warmup-BElYWRh7.esm.js";
 //#region ../infra/src/wasm/utilityWasmApi.ts
 /**
 * Utility / metadata domain facade over {@link WasmRuntime}.
@@ -17,8 +18,11 @@ import { a as waitForWasm, n as getWasmStatus, o as warmupWasm, r as isWasmReady
 * Both are deliberately **unguarded** setters: they never throw, so the SDK can
 * record them during setup and have them honored once WASM comes up.
 *
+* `fpPrefetch_` is a third, derived piece of JS state: the memoized `ppf` poll
+* that `getFPData` awaits, keyed by the embind handle it was started on.
+*
 * `prc`/`poc`/`rsp` are the only methods here that hold the ML semaphore.
-* `ssl`/`stl`/`osv`/`oev`/`ckvcks` and everything else are unlocked **by design**
+* `ssl`/`stl`/`osv`/`oev`/`ckvcks`/`sbc`/`ppf` and everything else are unlocked **by design**
 * (decision D6) — never add locking.
 *
 * Method names, argument order and the pre-initialization error strings are
@@ -26,10 +30,27 @@ import { a as waitForWasm, n as getWasmStatus, o as warmupWasm, r as isWasmReady
 * stays a diff against upstream (`docs/processes/WASM_VERSION_MIGRATION.md`).
 * `setSdkPlatform`'s message says "device type" on purpose — do not "fix" it.
 */
+/**
+* Upstream `SignalDataType` (`MetadataController.h`): the `signalsType` argument
+* of `getFPData`. `SIGNAL_NETWORK = 4` is reserved upstream and not mirrored.
+*/
+const SignalDataType = {
+	Device: 1,
+	Behaviour: 2,
+	Pid: 3
+};
+/**
+* Poll bound for the `ppf` fingerprint prefetch. Larger than
+* {@link ML_CALL_MAX_POLLS} because the prefetch waits on async browser APIs
+* (storage estimate, persistent ID) rather than camera frames, and it is
+* unlocked, so a stuck poll cannot freeze detection — it only delays signals.
+*/
+const FP_PREFETCH_MAX_POLLS = 1e4;
 var UtilityWasmApi = class {
 	constructor(runtime = wasmRuntime) {
 		this.runtime = runtime;
 		this.inspectorOpened_ = false;
+		this.fpPrefetch_ = null;
 		this.dsEnabled_ = false;
 	}
 	ens(image) {
@@ -50,14 +71,20 @@ var UtilityWasmApi = class {
 		const message = "Unable to analyze the frame, cpp API hasn't been initialized";
 		this.runtime.requireUtilityApi(message);
 		await this.runtime.allocateImageBuffers(image.width, image.height);
-		this.runtime.writeFrame(image);
-		this.runtime.requireUtilityApi(message).analyzeFrame();
+		noteUnlockedCallStart("analyzeFrame");
+		const startedAt = performance.now();
+		try {
+			this.runtime.writeFrame(image);
+			this.runtime.requireUtilityApi(message).analyzeFrame();
+		} finally {
+			noteUnlockedCallEnd("analyzeFrame", performance.now() - startedAt);
+		}
 	}
 	/**
-	* Sets the native (C++) utility API's production mode. When `true`, the WASM
-	* module suppresses its verbose debug logging; when `false`, it emits it.
+	* Retained for callers that manually control the native log level. Console
+	* output still requires `wasm.showLogs: true` at the first module load.
 	*
-	* @param productionMode - `true` to silence WASM logs, `false` to emit them.
+	* @param productionMode - `true` for native errors only, `false` for debug logs.
 	* @throws If the WASM C++ API has not been initialized yet.
 	*/
 	async setProductionMode(productionMode) {
@@ -97,13 +124,66 @@ var UtilityWasmApi = class {
 		this.dsEnabled_ = enabled;
 	}
 	getCheck() {
-		return this.runtime.requireUtilityApi("Unable to get check, cpp API hasn't been initialized").getCheck();
+		const utilityApi = this.runtime.requireUtilityApi("Unable to get check, cpp API hasn't been initialized");
+		noteUnlockedCallStart("getCheck");
+		const startedAt = performance.now();
+		try {
+			return utilityApi.getCheck();
+		} finally {
+			noteUnlockedCallEnd("getCheck", performance.now() - startedAt);
+		}
 	}
 	getMetadata() {
 		const utilityApi = this.runtime.requireUtilityApi("Unable to get metadata, cpp API hasn't been initialized");
 		utilityApi.setInspectorOpened(this.inspectorOpened_);
 		return utilityApi.getMetadata();
 	}
+	/**
+	* Behaviour-signals collection switch (`sbc`). Collection is on by default
+	* in the native module; `false` stops and discards new behaviour events.
+	*/
+	sbc(enabled) {
+		this.runtime.requireUtilityApi("Unable to sbc, cpp API hasn't been initialized").sbc(enabled);
+	}
+	/**
+	* Reads one fingerprint signal bucket (see {@link SignalDataType}), encrypted
+	* by the native module. Waits for the one-time async prefetch (`ppf`) first.
+	* An empty string means the bucket has no data.
+	*
+	* @throws If the WASM C++ API has not been initialized yet.
+	*/
+	async getFPData(signalsType = SignalDataType.Device) {
+		const message = "Unable to get fingerprint data, cpp API hasn't been initialized";
+		const handle = this.runtime.requireUtilityApi(message);
+		await this.prefetchFingerprintData(handle, message);
+		return this.runtime.requireUtilityApi(message).getFPData(signalsType);
+	}
+	/**
+	* Starts (or joins) the one-time async prefetch (`ppf`) that {@link getFPData}
+	* awaits, so the collection can run before the first read needs it.
+	*
+	* @throws If the WASM C++ API has not been initialized yet.
+	*/
+	prefetchFPData() {
+		const message = "Unable to prefetch fingerprint data, cpp API hasn't been initialized";
+		return this.prefetchFingerprintData(this.runtime.requireUtilityApi(message), message);
+	}
+	prefetchFingerprintData(handle, message) {
+		if (this.fpPrefetch_?.handle === handle) return this.fpPrefetch_.promise;
+		const promise = wasmCallWrapper(this.runtime.mlCallSemaphore, () => this.runtime.requireUtilityApi(message).ppf(), false, {
+			maxPolls: FP_PREFETCH_MAX_POLLS,
+			label: "ppf"
+		});
+		const entry = {
+			handle,
+			promise
+		};
+		this.fpPrefetch_ = entry;
+		promise.catch(() => {
+			if (this.fpPrefetch_ === entry) this.fpPrefetch_ = null;
+		});
+		return promise;
+	}
 	async prc() {
 		const message = "Unable to prc, cpp API hasn't been initialized";
 		this.runtime.requireUtilityApi(message);
@@ -244,6 +324,12 @@ var BaseWasmProvider = class {
 };
 //#endregion
 //#region ../infra/src/providers/wasm/WasmUtilProvider.ts
+var WasmUtilProvider_exports = /* @__PURE__ */ __exportAll({ WasmUtilProvider: () => WasmUtilProvider });
+const SIGNAL_TYPE_TO_WASM = {
+	device: SignalDataType.Device,
+	behaviour: SignalDataType.Behaviour,
+	pid: SignalDataType.Pid
+};
 var WasmUtilProvider = class WasmUtilProvider extends BaseWasmProvider {
 	static async getInstance() {
 		if (WasmUtilProvider.instance) return WasmUtilProvider.instance;
@@ -318,12 +404,10 @@ var WasmUtilProvider = class WasmUtilProvider extends BaseWasmProvider {
 		return utilityWasmApi.getInspectorOpened();
 	}
 	/**
-	* Toggles the WASM module's production mode. When `true`, the native module
-	* suppresses its verbose debug logging/console output; when `false`, those
-	* logs are emitted. The SDK forces this to `true` by default and only flips
-	* it off when the caller opts in via `setup({ wasm: { showLogs: true } })`.
+	* Retained for callers that manually control the native log level. Console
+	* output still requires `wasm.showLogs: true` at the first module load.
 	*
-	* @param productionMode - `true` to silence WASM logs, `false` to emit them.
+	* @param productionMode - `true` for native errors only, `false` for debug logs.
 	*/
 	async setProductionMode(productionMode) {
 		this.ensureInitialized();
@@ -333,6 +417,18 @@ var WasmUtilProvider = class WasmUtilProvider extends BaseWasmProvider {
 		this.ensureInitialized();
 		return utilityWasmApi.getMetadata();
 	}
+	setBehaviourSignalsCollection(enabled) {
+		this.ensureInitialized();
+		utilityWasmApi.sbc(enabled);
+	}
+	async getFingerprintSignals(type) {
+		this.ensureInitialized();
+		return utilityWasmApi.getFPData(SIGNAL_TYPE_TO_WASM[type]);
+	}
+	async prefetchFingerprintSignals() {
+		this.ensureInitialized();
+		await utilityWasmApi.prefetchFPData();
+	}
 	async analyzeFrame(image) {
 		this.ensureInitialized();
 		await utilityWasmApi.analyzeFrame(image);
@@ -386,38 +482,4 @@ var WasmUtilProvider = class WasmUtilProvider extends BaseWasmProvider {
 	}
 };
 //#endregion
-//#region ../infra/src/storage/safeStorage.ts
-/**
-* Storage resolvers that tolerate hosts which make Web Storage unreachable.
-*
-* Two hostile shapes occur in the field, and they fail differently:
-*
-* 1. **Deleted bare global** — a page mitigates self-XSS with
-*    `delete window.localStorage` and keeps a module-private reference. Since
-*    `window` *is* the global object, the identifier stops resolving: a bare
-*    read throws `ReferenceError`. `typeof` is the only safe probe, because it
-*    is the one operator that tolerates an unresolvable identifier.
-* 2. **Blocked storage** — a webview or a cross-origin/partitioned context
-*    makes the accessor itself throw (`SecurityError`). Here `typeof` is *not*
-*    enough: it invokes the getter, so the throw escapes the guard.
-*
-* Handling only one shape leaves the other live, so always go through these
-* resolvers instead of touching the globals directly. A `null` return means
-* "no storage in this host" — callers degrade, they do not throw.
-*/
-function resolveLocalStorage() {
-	try {
-		return typeof localStorage === "undefined" ? null : localStorage;
-	} catch {
-		return null;
-	}
-}
-function resolveSessionStorage() {
-	try {
-		return typeof sessionStorage === "undefined" ? null : sessionStorage;
-	} catch {
-		return null;
-	}
-}
-//#endregion
-export { utilityWasmApi as a, BaseWasmProvider as i, resolveSessionStorage as n, WasmUtilProvider as r, resolveLocalStorage as t };
+export { utilityWasmApi as i, WasmUtilProvider_exports as n, BaseWasmProvider as r, WasmUtilProvider as t };

package/dist/{addressSearch-DyHGgeX8.esm.js → addressSearch-DPjIKJrX.esm.js}

@@ -1,7 +1,6 @@
+import { t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-import { t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
+import { t as fromCallback } from "./xstate-actors.esm-8Gzepa_A.esm.js";
 const usStateOptions = Object.values({
 	AL: {
 		code: "AL",
@@ -376,6 +375,145 @@ function formatPostalCode(value, country) {
 	return value.slice(0, 8);
 }
 //#endregion
+//#region src/internal/forms/checkSupport.ts
+const GROUP_POLICIES = /* @__PURE__ */ new Set(["hide", "forceShow"]);
+/**
+* Compares `major.minor` vocabulary versions. The compiler's twin is
+* `compareVersions` in `packages/form-definitions/scripts/lib/checks.mjs`;
+* both are tested against that package's `fixtures/vocabularyVersions.json`.
+*/
+function compareVocabulary(a, b) {
+	const [aMajor = 0, aMinor = 0] = a.split(".").map(Number);
+	const [bMajor = 0, bMinor = 0] = b.split(".").map(Number);
+	return aMajor - bMajor || aMinor - bMinor;
+}
+/**
+* Whether this build can use a definition. Any id it doesn't implement makes
+* the definition unsupported, so the caller falls back to its bundled
+* definition or current form. Presentation hints (widget, keyboard, autofill)
+* never fail: an unknown hint falls back to the platform default.
+*/
+function checkSupport(definition, ids) {
+	const problems = [];
+	const need = (category, known, id, path) => {
+		if (!known.has(id)) problems.push({
+			category,
+			id,
+			path
+		});
+	};
+	if (!ids.schemaVersions.includes(definition.schemaVersion)) problems.push({
+		category: "schemaVersion",
+		id: String(definition.schemaVersion),
+		path: "schemaVersion"
+	});
+	if (compareVocabulary(definition.vocabulary, ids.vocabulary) > 0) problems.push({
+		category: "vocabulary",
+		id: definition.vocabulary,
+		path: "vocabulary"
+	});
+	const checkField = (field, path) => {
+		need("kind", ids.kinds, field.kind, `${path}.kind`);
+		need("group", ids.groups, field.group, `${path}.group`);
+		field.rules?.forEach((rule, i) => need("rule", ids.rules, rule.id, `${path}.rules[${i}]`));
+		field.input?.format?.forEach((t, i) => need("transform", ids.transforms, t.id, `${path}.input.format[${i}]`));
+		field.payload?.transforms?.forEach((t, i) => need("transform", ids.transforms, t.id, `${path}.payload.transforms[${i}]`));
+		if (field.optionsRef) need("optionList", ids.optionLists, field.optionsRef, `${path}.optionsRef`);
+		if (field.suggestionsRef) need("optionList", ids.optionLists, field.suggestionsRef, `${path}.suggestionsRef`);
+		field.requiredWhen?.forEach((condition, i) => {
+			const keys = Object.keys(condition);
+			if (keys.length !== 1) problems.push({
+				category: "condition",
+				id: keys.join("+") || "(empty)",
+				path: `${path}.requiredWhen[${i}]`
+			});
+			for (const key of keys) need("condition", ids.conditions, key, `${path}.requiredWhen[${i}]`);
+		});
+		const lock = field.phone?.lockCountry;
+		if (typeof lock === "string" && lock !== "whenPhoneRisk") problems.push({
+			category: "phoneLock",
+			id: lock,
+			path: `${path}.phone`
+		});
+	};
+	definition.fields.forEach((field) => checkField(field, `fields.${field.name}`));
+	definition.groups?.forEach((policy) => {
+		need("group", ids.groups, policy.group, `groups.${policy.group}`);
+		if (!GROUP_POLICIES.has(policy.whenDisabled)) problems.push({
+			category: "groupPolicy",
+			id: policy.whenDisabled,
+			path: `groups.${policy.group}`
+		});
+	});
+	definition.groupRules?.forEach((rule, i) => need("groupRule", ids.groupRules, rule.id, `groupRules[${i}]`));
+	definition.collections?.forEach((collection) => {
+		need("group", ids.groups, collection.group, `collections.${collection.id}`);
+		collection.fields.forEach((field) => checkField(field, `collections.${collection.id}.fields.${field.name}`));
+	});
+	return problems.length === 0 ? { supported: true } : {
+		supported: false,
+		problems
+	};
+}
+//#endregion
+//#region src/internal/forms/definitionSource.ts
+const queryKey = ({ module, source, country }) => `${module}|${source ?? ""}|${country ?? ""}`;
+/**
+* The definitions bundled with this build. Matches module, source and country
+* exactly, so a pair without its own definition keeps the current builder.
+*/
+function createBundledDefinitionSource(definitions) {
+	const byQuery = new Map(Object.values(definitions).map((definition) => [queryKey(definition), definition]));
+	return { select: (query) => byQuery.get(queryKey(query)) };
+}
+//#endregion
+//#region src/internal/forms/resolveForm.ts
+const FORCE_SHOW = "forceShow";
+const WHEN_PHONE_RISK = "whenPhoneRisk";
+/**
+* Resolves a definition against module configuration: which fields show,
+* which are required, whether the phone is locked, and which group rules and
+* collections apply. Pure and synchronous, so it runs inside an assign action.
+*
+* Call `checkSupport` first for any definition that wasn't bundled with this
+* build; `resolveForm` ignores ids it doesn't know.
+*/
+function resolveForm(definition, context) {
+	const forcedGroups = new Set((definition.groups ?? []).filter((policy) => policy.whenDisabled === FORCE_SHOW).map((policy) => policy.group));
+	const isOn = (group) => context.groups[group] === true;
+	const isShown = (group) => isOn(group) || forcedGroups.has(group);
+	const riskAddons = new Set(context.riskAddons ?? []);
+	const shownFields = definition.fields.filter((field) => isShown(field.group));
+	const shownNames = new Set(shownFields.map((field) => field.name));
+	const fields = shownFields.map((field) => {
+		const conditions = field.requiredWhen ?? [];
+		const addonRequired = conditions.some((condition) => condition.riskAddon !== void 0 && riskAddons.has(condition.riskAddon));
+		const requiredIfFilled = conditions.map((condition) => condition.fieldFilled).filter((name) => name !== void 0 && shownNames.has(name));
+		const lock = field.phone?.lockCountry;
+		return {
+			field,
+			required: field.required === true || addonRequired,
+			requiredIfFilled,
+			forced: !isOn(field.group),
+			phoneLocked: field.kind === "phone" && (lock === true || lock === WHEN_PHONE_RISK && context.phoneRisk === true)
+		};
+	});
+	const order = shownFields.map((field) => field.name);
+	return {
+		definition,
+		fields,
+		groupRules: (definition.groupRules ?? []).map((rule) => ({
+			rule,
+			fields: order.filter((name) => rule.fields.includes(name))
+		})).filter((resolved) => resolved.fields.length > 0),
+		collections: (definition.collections ?? []).filter((collection) => isShown(collection.group)).map((collection) => ({
+			collection,
+			min: collection.min ?? 0,
+			max: collection.max
+		}))
+	};
+}
+//#endregion
 //#region src/shared/addressSearch.ts
 /** Searches for address suggestions via the address autocomplete API. */
 async function searchAddress(query, signal) {
@@ -422,4 +560,4 @@ const debounceSearchActor = fromCallback(({ input, sendBack }) => {
 	};
 });
 //#endregion
-export { getPostalCodeMaxLength as a, STREET_LEVEL_REQUIRED_ERROR as c, usStateOptions as d, getPostalCodeErrorKey as i, fillFromSuggestion as l, FIXED_DIGIT_POSTAL_CODE_LENGTH as n, validatePostalCode as o, formatPostalCode as r, DYNAMIC_REQUIRED_KEY as s, debounceSearchActor as t, getStreetLevelErrorForSuggestion as u };
+export { FIXED_DIGIT_POSTAL_CODE_LENGTH as a, getPostalCodeMaxLength as c, STREET_LEVEL_REQUIRED_ERROR as d, fillFromSuggestion as f, checkSupport as i, validatePostalCode as l, usStateOptions as m, resolveForm as n, formatPostalCode as o, getStreetLevelErrorForSuggestion as p, createBundledDefinitionSource as r, getPostalCodeErrorKey as s, debounceSearchActor as t, DYNAMIC_REQUIRED_KEY as u };

package/dist/{advanceableErrors-CpF2cBy6.esm.js → advanceableErrors-q_pfU3Cn.esm.js}

@@ -1,4 +1,3 @@
-import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
 //#region src/internal/orchestration/advanceableErrors.ts
 const VIDEO_SELFIE_VALIDATION_ATTEMPTS_EXHAUSTED_CODE = "VIDEO_SELFIE_VALIDATION_ATTEMPTS_EXHAUSTED";
 /**
@@ -8,11 +7,13 @@ const VIDEO_SELFIE_VALIDATION_ATTEMPTS_EXHAUSTED_CODE = "VIDEO_SELFIE_VALIDATION
 * "retryable" (the module's own concern): it only decides what the flow does
 * *after* a terminal error. Note `NO_MORE_ATTEMPTS` subsumes the former
 * `USER_IS_NOT_RECOGNIZED` entry — see the contract test for the full matrix.
+* The face codes are literals (checked against `FaceErrorCode`), so modules
+* without face capture do not bundle `FACE_ERROR_CODES`.
 */
 const ADVANCEABLE_ERROR_CODES = [
-	FACE_ERROR_CODES.NONEXISTENT_CUSTOMER,
-	FACE_ERROR_CODES.HINT_NOT_PROVIDED,
-	FACE_ERROR_CODES.NO_MORE_ATTEMPTS,
+	"NONEXISTENT_CUSTOMER",
+	"HINT_NOT_PROVIDED",
+	"NO_MORE_ATTEMPTS",
 	VIDEO_SELFIE_VALIDATION_ATTEMPTS_EXHAUSTED_CODE
 ];
 /** True when the given code is a module terminal error the flow should advance past rather than fail on. */

package/dist/ae-signature.d.ts

@@ -1,6 +1,6 @@
-import { t as Manager } from "./Manager-CQQ99QOI.js";
+import { t as Manager } from "./Manager-C9T5amUN.js";
 import { S as getDefaultConsentChecks, a as ElectronicSignatureConfig, b as areAllConsented, i as ConsentKey, r as ConsentChecks, s as ElectronicSignatureDocument, t as AE_CONSENT_KEYS } from "./types-D0gekt4U.js";
-import { n as ElectronicSignatureState, o as electronicSignatureMachine } from "./electronicSignatureManager-Ds-KEVTq.js";
+import { n as ElectronicSignatureState, o as electronicSignatureMachine } from "./electronicSignatureManager-DTSLOvKR.js";
 import "./electronic-signature.js";
 //#region src/modules/ae-signature/index.d.ts
 type AeSignatureConfig = Omit<ElectronicSignatureConfig, 'variant'>;

package/dist/ae-signature.esm.js

@@ -1,4 +1,4 @@
-import { c as areAllConsented, i as AE_CONSENT_KEYS, r as electronicSignatureMachine, t as createElectronicSignatureManager, u as getDefaultConsentChecks } from "./electronicSignatureManager-yYUc30na.esm.js";
+import { c as areAllConsented, i as AE_CONSENT_KEYS, r as electronicSignatureMachine, t as createElectronicSignatureManager, u as getDefaultConsentChecks } from "./electronicSignatureManager-BtWCrz5_.esm.js";
 //#region src/modules/ae-signature/index.ts
 function createAeSignatureManager(options) {
 	return createElectronicSignatureManager({ config: {

package/dist/antifraud.d.ts

@@ -1,4 +1,4 @@
-import { i as createAntifraudManagerFromActor, n as AntifraudState, o as antifraudMachine, r as createAntifraudManager, t as AntifraudManager } from "./antifraudManager-BY36bS12.js";
+import { i as createAntifraudManagerFromActor, n as AntifraudState, o as antifraudMachine, r as createAntifraudManager, t as AntifraudManager } from "./antifraudManager-DbGCvlJs.js";
 //#region src/modules/antifraud/types.d.ts
 /**
  * Configuration options for the antifraud module.

package/dist/antifraud.esm.js

@@ -1,3 +1,3 @@
-import { t as antifraudMachine } from "./antifraudStateMachine-DBeq47D2.esm.js";
-import { n as createAntifraudManagerFromActor, t as createAntifraudManager } from "./antifraudManager-DNkw66oW.esm.js";
+import { t as antifraudMachine } from "./antifraudStateMachine-DRl0UVyA.esm.js";
+import { n as createAntifraudManagerFromActor, t as createAntifraudManager } from "./antifraudManager-CaweCYnY.esm.js";
 export { antifraudMachine, createAntifraudManager, createAntifraudManagerFromActor };

package/dist/{antifraudManager-DNkw66oW.esm.js → antifraudManager-CaweCYnY.esm.js}

@@ -1,7 +1,7 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-ijlbX_Wx.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-Du2A4-Qr.esm.js";
 import { t as topLevelStateName } from "./topLevelStateName-B5i2avbh.esm.js";
-import { s as createActor, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
-import { t as antifraudMachine } from "./antifraudStateMachine-DBeq47D2.esm.js";
+import { s as createActor, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
+import { t as antifraudMachine } from "./antifraudStateMachine-DRl0UVyA.esm.js";
 //#region src/modules/antifraud/antifraudActor.ts
 function createAntifraudActor() {
 	return createActor(antifraudMachine).start();

package/dist/{antifraudManager-BY36bS12.d.ts → antifraudManager-DbGCvlJs.d.ts}

@@ -1,6 +1,6 @@
 import { i as ActorRefFrom } from "./spawn-D9jgw9pW.js";
-import { t as Manager } from "./Manager-CQQ99QOI.js";
-import "./Actor-iTq7YY48.js";
+import { t as Manager } from "./Manager-C9T5amUN.js";
+import "./Actor-DpTj5PFb.js";
 //#region src/modules/antifraud/antifraudStateMachine.d.ts
 declare const antifraudMachine: any;
 type AntifraudMachine = typeof antifraudMachine;

package/dist/{antifraudStateMachine-DBeq47D2.esm.js → antifraudStateMachine-DRl0UVyA.esm.js}

@@ -1,7 +1,6 @@
-import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-import { t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
-import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
+import { t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
+import { t as setup } from "./xstate.esm-DSajW7CJ.esm.js";
+import { n as fromPromise } from "./xstate-actors.esm-8Gzepa_A.esm.js";
 //#region src/modules/antifraud/antifraudServices.ts
 async function processAntifraud(signal) {
 	const res = await api.get(endpoints.processAntifraud, { signal });

package/dist/{endpoints-B-3Q-LUw.esm.js → api-Cz90EHyu.esm.js}

@@ -1,3 +1,4 @@
+import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
 //#region src/internal/http/endpoints.ts
 const endpoints = {
 	createSession: "/omni/start",
@@ -48,6 +49,7 @@ const endpoints = {
 	deviceStats: "/omni/device/stats",
 	featureConfig: "/omni/feature-config",
 	deviceFingerprint: "/omni/add/device-fingerprint",
+	deviceFingerprintSignals: "/omni/add/device-fingerprint-signals",
 	onboardingStatus: "/omni/get/onboarding/status",
 	customFields: "/omni/get/custom-fields",
 	addCustomFields: "/omni/add/custom-fields",
@@ -83,6 +85,7 @@ const endpoints = {
 	qrValidateUuid: "/omni/qr/validate",
 	addSignature: "/omni/add/signature",
 	addSignatureV2: "/omni/add/signature/v2",
+	identityReuseCandidates: "/omni/identity-reuse/candidates",
 	identityReuseDocuments: "/omni/identity-reuse/documents",
 	identityReuseSubmit: "/omni/identity-reuse/submit",
 	processAntifraud: "/omni/process/antifraud",
@@ -165,4 +168,151 @@ const endpoints = {
 	deviceWalletGoogleDecrypt: "/omni/v1/device/wallet/google/decrypt"
 };
 //#endregion
-export { endpoints as t };
+//#region src/internal/http/api.ts
+let client = null;
+let currentToken = null;
+function setClient(httpClient) {
+	client = httpClient;
+}
+function setToken(token) {
+	currentToken = token;
+}
+function getToken() {
+	return currentToken;
+}
+function getApi() {
+	if (!client) throw new Error("SDK not configured. Call setup({ apiURL: \"...\" }) first.");
+	return client;
+}
+function isApiConfigured() {
+	return client !== null;
+}
+function resetApi() {
+	client = null;
+	currentToken = null;
+	requestObserver = null;
+}
+let requestObserver = null;
+/**
+* Observer fired around every `api.*` call (ENG-48677 event map row 23b —
+* Android-dashboard parity: every request gets a timing line, not just
+* failures). Deliberately a plain setter, not a direct `trueSightLog` import:
+* `trueSightService` already imports from this module, so importing it back
+* here would create a cycle. `setup.ts` wires the real observer.
+*/
+function setHttpRequestObserver(observer) {
+	requestObserver = observer;
+}
+function notifyRequestObserver(entry) {
+	if (!requestObserver) return;
+	try {
+		requestObserver(entry);
+	} catch {}
+}
+/**
+* Endpoints whose next path segment is a per-request id
+* (`…/verifications/{id}/status`). The id is collapsed to `:id`: it is not a
+* label, and digital-id polling would otherwise mint one label per verification.
+*/
+const DYNAMIC_SEGMENT_PREFIXES = [`${endpoints.digitalIdVerifications}/`];
+/**
+* Strips a query string so `?communicationchannel=SMS`-style call sites don't
+* fragment the endpoint label, and collapses per-request path ids to `:id`.
+*/
+function normalizeEndpoint(url) {
+	const queryIndex = url.indexOf("?");
+	const path = queryIndex === -1 ? url : url.slice(0, queryIndex);
+	for (const prefix of DYNAMIC_SEGMENT_PREFIXES) if (path.startsWith(prefix)) {
+		const rest = path.slice(prefix.length);
+		const nextSlash = rest.indexOf("/");
+		return `${prefix}:id${nextSlash === -1 ? "" : rest.slice(nextSlash)}`;
+	}
+	return path;
+}
+function httpStatusOf(error) {
+	if (typeof error === "object" && error !== null && "status" in error && typeof error.status === "number") return error.status;
+	return null;
+}
+/**
+* Runs one request under the timing observer. The `api.*` helpers use it,
+* and so does any path that reaches the HTTP client directly — the WASM
+* `WebApi` transport behind protected image uploads (`clientLifecycle.ts`).
+*/
+async function withTiming(method, url, call) {
+	const endpoint = normalizeEndpoint(url);
+	const startedAt = getTimestamp();
+	let response;
+	try {
+		response = await call();
+	} catch (error) {
+		notifyRequestObserver({
+			method,
+			endpoint,
+			httpStatus: httpStatusOf(error),
+			durationMs: getTimestamp() - startedAt,
+			outcome: "failure"
+		});
+		throw error;
+	}
+	notifyRequestObserver({
+		method,
+		endpoint,
+		httpStatus: response.status,
+		durationMs: getTimestamp() - startedAt,
+		outcome: "success"
+	});
+	return response;
+}
+/**
+* Header-precedence contract: when a caller passes
+* `X-Incode-Hardware-Id` in `config.headers`, their value wins over
+* `currentToken`. Spreading `config?.headers` LAST achieves that
+* (later keys overwrite earlier ones in object spread).
+*
+* Existing call sites that already pass an explicit
+* `X-Incode-Hardware-Id` header (`recordingsRepository.uploadDeepsightVideo`,
+* `internal/virtualCameraCheck.logFrame`) now use the value they
+* passed in unconditionally — previously the auto-injection silently
+* clobbered them. Both call sites pass tokens that are already
+* supposed to be the active session token, so behaviour is
+* unchanged in practice; the change unblocks personhood (which
+* needs to attach its own slot's token) without bypassing the
+* shared `api` wrapper.
+*
+* Regression coverage lives in `api.test.ts → "should let explicit
+* X-Incode-Hardware-Id override the auto-injected token"`.
+*/
+function addTokenHeader(config) {
+	if (!currentToken) return config ?? {};
+	return {
+		...config,
+		headers: {
+			"X-Incode-Hardware-Id": currentToken,
+			...config?.headers
+		}
+	};
+}
+const api = {
+	get(url, config) {
+		const client = getApi();
+		return withTiming("GET", url, () => client.get(url, addTokenHeader(config)));
+	},
+	post(url, data, config) {
+		const client = getApi();
+		return withTiming("POST", url, () => client.post(url, data, addTokenHeader(config)));
+	},
+	put(url, data, config) {
+		const client = getApi();
+		return withTiming("PUT", url, () => client.put(url, data, addTokenHeader(config)));
+	},
+	patch(url, data, config) {
+		const client = getApi();
+		return withTiming("PATCH", url, () => client.patch(url, data, addTokenHeader(config)));
+	},
+	delete(url, config) {
+		const client = getApi();
+		return withTiming("DELETE", url, () => client.delete(url, addTokenHeader(config)));
+	}
+};
+//#endregion
+export { resetApi as a, setToken as c, isApiConfigured as i, withTiming as l, getApi as n, setClient as o, getToken as r, setHttpRequestObserver as s, api as t, endpoints as u };