@incodetech/core 2.4.0-rc.4 → 2.4.1-agentic

package/dist/{sessionInitializer-c3CChZts.esm.js → sessionInitializer-CWFT4dfw.esm.js}

@@ -1,23 +1,86 @@
-import { C as subscribeEvent, b as getAnalyticsBatcher, y as addEvent } from "./events-Du2A4-Qr.esm.js";
-import { c as setToken, r as getToken, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
-import { C as noteTokenActivated, _ as isFeatureEnabled, b as noteEnvironment, c as startTrueSightCollection, g as fetchFeatureConfig, u as trueSightLog, v as resetFeatureConfigCache } from "./trueSightService-BAvhAU7T.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-xE2xE2_9.esm.js";
-import { E as updateFeatureManagementUser } from "./feature-management-DCD0I_XZ.esm.js";
-import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-BEvexnKC.esm.js";
+import { n as getTimestamp } from "./IBrowserEnvironmentCapability-D7JG7ML3.esm.js";
+import { n as setWasmMetadataV2Enabled } from "./wasmMetadataVersionSync-U8EFUr1T.esm.js";
+import { C as subscribeEvent, b as getAnalyticsBatcher, y as addEvent } from "./events-CQteqXfy.esm.js";
+import { c as setToken, r as getToken, t as api, u as endpoints } from "./api-BO8JA7Pf.esm.js";
+import { C as noteTokenActivated, _ as isFeatureEnabled, b as noteEnvironment, c as startTrueSightCollection, g as fetchFeatureConfig, u as trueSightLog, v as resetFeatureConfigCache } from "./trueSightService-BujtUIW6.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-C3_P-Qbq.esm.js";
+import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
+import { E as updateFeatureManagementUser } from "./feature-management-DjAG5lsJ.esm.js";
+import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue } from "./stats-BpMz-hTP.esm.js";
 import { t as getParsedUserAgent } from "./getParsedUserAgent-DhQPeKqw.esm.js";
-import { t as BrowserLazyImportProvider } from "./BrowserLazyImportProvider-BhoA957O.esm.js";
-import { a as isIOS } from "./platform-DkcRc9JV.esm.js";
+import { a as isIOS } from "./platform-aPh7gTWh.esm.js";
 import { t as getUserAgent } from "./getBrowser-CBiibsL-.esm.js";
-import { i as linkSessionWithTRI, r as isTRIStarted } from "./tri-xzRLIIMN.esm.js";
+import { a as linkSessionWithTRI, i as isTRIStarted, o as readTRIFpSignals } from "./tri-BajQnjbf.esm.js";
+import { i as retryAfterReconnect } from "./connectivity-HSl0diCx.esm.js";
+//#region src/internal/fingerprint/incodeDeviceHash.ts
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.trim() !== "";
+}
+/**
+* Reads the device hash from a PID signal response. The SDK never pairs a
+* hash with an algorithm user-service didn't name, so all three fields must be
+* present.
+*/
+function readIncodeDeviceHash(data) {
+	if (typeof data !== "object" || data === null) return null;
+	const { deviceHash, algorithmName, algorithmVersion } = data;
+	if (!isNonEmptyString(deviceHash) || !isNonEmptyString(algorithmName) || !isNonEmptyString(algorithmVersion)) return null;
+	return {
+		hash: deviceHash,
+		algorithmName,
+		algorithmVersion
+	};
+}
+function createIncodeDeviceHashWaiter(timer) {
+	const pendingByToken = /* @__PURE__ */ new Map();
+	function pendingFor(token) {
+		let pending = pendingByToken.get(token);
+		if (!pending) {
+			let settle = () => void 0;
+			pending = {
+				deviceHash: new Promise((resolve) => {
+					settle = resolve;
+				}),
+				settle
+			};
+			pendingByToken.set(token, pending);
+		}
+		return pending;
+	}
+	return {
+		settle(token, deviceHash) {
+			pendingFor(token).settle(deviceHash);
+		},
+		async waitFor(token, timeoutMs) {
+			let timeout;
+			const timedOut = new Promise((resolve) => {
+				timeout = timer.setTimeout(() => resolve(null), Math.max(0, timeoutMs));
+			});
+			try {
+				return await Promise.race([pendingFor(token).deviceHash, timedOut]);
+			} finally {
+				if (timeout !== void 0) timer.clearTimeout(timeout);
+			}
+		},
+		reset() {
+			pendingByToken.forEach((pending) => pending.settle(null));
+			pendingByToken.clear();
+		}
+	};
+}
+const incodeDeviceHashWaiter = createIncodeDeviceHashWaiter(BrowserTimerProvider.getInstance());
+//#endregion
 //#region src/internal/fingerprint/fingerprintSignalsReporter.ts
 const START_INTERVIEW_EVENT = "modelLoadEnd";
 const CAPTURE_INTERVIEW_EVENT = "captureAttemptFinished";
-const START_SIGNALS = ["pid", "device"];
+const START_SIGNALS = ["device"];
+const MAX_KEPT_SIGNALS = 20;
 function createFingerprintSignalsReporter(deps) {
 	let enabled = true;
 	let sessionActive = false;
 	let wasmReady = false;
 	let started = false;
+	let pidStarted = false;
 	let pendingStartSignals = START_SIGNALS;
 	let prefetchStarted = false;
 	let deviceDataUpdated = true;
@@ -26,6 +89,21 @@ function createFingerprintSignalsReporter(deps) {
 	let optInPending = false;
 	let queue = Promise.resolve();
 	let generation = 0;
+	let keptSignals = [];
+	let forward = null;
+	let forwardRefused = false;
+	function keepOrForward(metadata) {
+		if (forward) {
+			if (!forward(metadata)) {
+				forward = null;
+				forwardRefused = true;
+			}
+			return;
+		}
+		if (forwardRefused) return;
+		keptSignals.push(metadata);
+		if (keptSignals.length > MAX_KEPT_SIGNALS) keptSignals.shift();
+	}
 	function enqueue(work) {
 		const scheduledGeneration = generation;
 		queue = queue.then(async () => {
@@ -34,13 +112,24 @@ function createFingerprintSignalsReporter(deps) {
 		});
 	}
 	async function send(token, interviewEvent, type) {
-		const metadata = await (await deps.getWasmUtil()).getFingerprintSignals(type);
-		if (!metadata) return;
-		if (deps.getToken() !== token) return;
-		await deps.post(endpoints.deviceFingerprintSignals, {
-			interviewEvent,
-			metadata
-		}, { "X-Incode-Hardware-Id": token });
+		const isPid = type === "pid";
+		let deviceHash = null;
+		try {
+			const metadata = await (await deps.getWasmUtil()).getFingerprintSignals(type);
+			if (!metadata || deps.getToken() !== token) return;
+			keepOrForward(metadata);
+			const response = await deps.post(endpoints.deviceFingerprintSignals, isPid ? {
+				interviewEvent,
+				metadata,
+				deviceHashRequested: true
+			} : {
+				interviewEvent,
+				metadata
+			}, { "X-Incode-Hardware-Id": token });
+			deviceHash = isPid && enabled ? readIncodeDeviceHash(response) : null;
+		} finally {
+			if (isPid) deps.onDeviceHash(token, deviceHash);
+		}
 	}
 	/**
 	* Sends `types` in order and stops at the first failure. Resolves to the
@@ -98,6 +187,7 @@ function createFingerprintSignalsReporter(deps) {
 		if (!token) return;
 		startPrefetch();
 		if (optInPending) enqueue(applyNativeOptIn);
+		startPid(token);
 		if (started || !sessionActive) return;
 		started = true;
 		ensureSubscribed();
@@ -117,6 +207,38 @@ function createFingerprintSignalsReporter(deps) {
 			if (unsent.length > 0) allowRetry(unsent);
 		});
 	}
+	/**
+	* PID goes ahead of activation: the activation post waits for the pid. It is
+	* queued before DEVICE, so it still precedes it.
+	*/
+	function startPid(token) {
+		if (pidStarted) return;
+		pidStarted = true;
+		const pidGeneration = generation;
+		enqueue(async () => {
+			if ((await sendAll(token, START_INTERVIEW_EVENT, ["pid"])).length > 0 && pidGeneration === generation) pidStarted = false;
+		});
+	}
+	/** Resolves the pid user-service returned for a host's PID, or `null`. */
+	async function postHostPid(token, readPid) {
+		try {
+			const metadata = await readPid();
+			if (!metadata || deps.getToken() !== token) return null;
+			const response = await deps.post(endpoints.deviceFingerprintSignals, {
+				interviewEvent: START_INTERVIEW_EVENT,
+				metadata,
+				deviceHashRequested: true
+			}, { "X-Incode-Hardware-Id": token });
+			return enabled ? readIncodeDeviceHash(response) : null;
+		} catch (error) {
+			deps.reportFailure({
+				message: error instanceof Error ? error.message : String(error),
+				signalsType: "pid",
+				interviewEvent: START_INTERVIEW_EVENT
+			});
+			return null;
+		}
+	}
 	function onCaptureAttemptFinished() {
 		wasmReady = true;
 		tryStart();
@@ -142,6 +264,7 @@ function createFingerprintSignalsReporter(deps) {
 		generation += 1;
 		sessionActive = false;
 		started = false;
+		pidStarted = false;
 		pendingStartSignals = START_SIGNALS;
 		optInPending = false;
 		deviceDataUpdated = true;
@@ -173,6 +296,32 @@ function createFingerprintSignalsReporter(deps) {
 		onCameraInfoUpdated() {
 			deviceDataUpdated = true;
 		},
+		sendHostPid(token, readPid) {
+			if (!enabled || pidStarted) return Promise.resolve(false);
+			pidStarted = true;
+			const pidGeneration = generation;
+			const sent = queue.then(async () => {
+				if (pidGeneration !== generation) return false;
+				const deviceHash = await postHostPid(token, readPid);
+				if (pidGeneration !== generation) return false;
+				if (deviceHash) {
+					deps.onDeviceHash(token, deviceHash);
+					return true;
+				}
+				pidStarted = false;
+				tryStart();
+				return false;
+			});
+			queue = sent.then(() => void 0);
+			return sent;
+		},
+		forwardTo(sink) {
+			forward = sink;
+			forwardRefused = false;
+			const kept = keptSignals;
+			keptSignals = [];
+			kept.forEach(keepOrForward);
+		},
 		resetSession,
 		reset() {
 			resetSession();
@@ -181,16 +330,19 @@ function createFingerprintSignalsReporter(deps) {
 			prefetchStarted = false;
 			unsubscribe?.();
 			unsubscribe = null;
+			keptSignals = [];
+			forward = null;
+			forwardRefused = false;
 		}
 	};
 }
 const fingerprintSignalsReporter = createFingerprintSignalsReporter({
 	getWasmUtil: async () => {
-		const { WasmUtilProvider } = await import("./WasmUtilProvider-DtJuBdt-.esm.js").then((n) => n.n);
-		return WasmUtilProvider.getInstance();
+		return (await import("./WasmUtilProvider-GTkoJyFY.esm.js").then((n) => n.n)).WasmUtilProvider.getInstance();
 	},
 	getToken: () => getToken(),
-	post: (url, body, headers) => api.post(url, body, { headers }),
+	post: async (url, body, headers) => (await api.post(url, body, { headers })).data,
+	onDeviceHash: (token, deviceHash) => incodeDeviceHashWaiter.settle(token, deviceHash),
 	subscribe: (listener) => subscribeEvent(listener),
 	reportFailure: ({ message, signalsType, interviewEvent }) => trueSightLog("warning", "wasm", "other", `fingerprint signals failed type=${signalsType} event=${interviewEvent} error=${message}`)
 });
@@ -328,6 +480,55 @@ var BrowserInfoProvider = class {
 	}
 };
 //#endregion
+//#region ../infra/src/providers/browser/IpifyProvider.ts
+let cachedIp;
+let inFlightLookup;
+/**
+* Resets the module-level IP cache. Intended for tests and full session resets.
+*/
+function resetIpifyCache() {
+	cachedIp = void 0;
+	inFlightLookup = void 0;
+}
+async function fetchIpFromIpify() {
+	if (typeof fetch === "undefined") return "";
+	let timeoutId = 0;
+	const controller = new AbortController();
+	if (AbortSignal.timeout) {
+		const signal = AbortSignal.timeout(3e3);
+		return (await (await fetch("https://api.ipify.org?format=json", { signal })).json()).ip;
+	}
+	const timeoutPromise = new Promise((_, reject) => {
+		timeoutId = setTimeout(() => {
+			controller.abort();
+			reject(/* @__PURE__ */ new Error("Request timeout"));
+		}, 3e3);
+	});
+	const fetchPromise = fetch("https://api.ipify.org?format=json", { signal: controller.signal }).then((res) => res.json()).then((data) => data.ip);
+	const result = await Promise.race([fetchPromise, timeoutPromise]);
+	clearTimeout(timeoutId);
+	return result;
+}
+var IpifyProvider = class {
+	async getIp() {
+		if (cachedIp !== void 0) return cachedIp;
+		if (inFlightLookup) return inFlightLookup;
+		inFlightLookup = (async () => {
+			try {
+				const ip = await fetchIpFromIpify();
+				cachedIp = ip;
+				return ip;
+			} catch {
+				cachedIp = "";
+				return "";
+			} finally {
+				inFlightLookup = void 0;
+			}
+		})();
+		return inFlightLookup;
+	}
+};
+//#endregion
 //#region ../infra/src/device/getDeviceData.ts
 const HIGH_ENTROPY_HINTS = /* @__PURE__ */ new Set([
 	"model",
@@ -425,171 +626,59 @@ async function getDeviceFingerprintInfo() {
 	}
 }
 //#endregion
-//#region ../infra/src/scheduling/yieldUntilNextPaint.ts
-/**
-* Resolves after the browser has had a chance to commit and paint a queued
-* render.
-*
-* Strategy:
-* - `requestAnimationFrame` callbacks fire BEFORE the paint of the frame
-*   they belong to (per the HTML5 "update the rendering" step). If we
-*   resolve the promise inside a rAF callback, the await-continuation
-*   runs as a microtask immediately after the callback returns — still
-*   before the paint phase of that frame. A caller that then blocks the
-*   main thread (e.g. synchronous WASM `processPhoto`) starves the paint.
-* - We therefore chain rAF → setTimeout: the rAF fires before frame N's
-*   paint, the setTimeout runs as a macrotask scheduled after frame N's
-*   "update the rendering" step, which the browser will only get to once
-*   the paint actually lands. By the time setTimeout fires, the paint
-*   for the queued render is on screen.
-* - In environments where rAF never ticks (jsdom, happy-dom, backgrounded
-*   tabs), a parallel `setTimeout` fallback at 100 ms resolves instead.
-*   100 ms is comfortably longer than two real-browser frames so rAF +
-*   setTimeout wins reliably in any foregrounded browser. (An earlier
-*   implementation raced rAF against a `MessageChannel` macrotask, but
-*   MessageChannel drains immediately after the current task's
-*   microtasks — before the next paint — so it resolved the promise too
-*   early and defeated the whole point of the helper.)
-*
-* Lives in infra because it touches browser APIs (`requestAnimationFrame`,
-* `setTimeout`) that the architecture rules forbid from core. Core modules
-* that need to yield to the browser render loop should import this helper
-* directly via its file path.
-*/
-function yieldUntilNextPaint() {
-	return new Promise((resolve) => {
-		let resolved = false;
-		const done = () => {
-			if (resolved) return;
-			resolved = true;
-			resolve();
-		};
-		if (typeof requestAnimationFrame === "function") requestAnimationFrame(() => {
-			requestAnimationFrame(() => {
-				setTimeout(done, 0);
-			});
-		});
-		setTimeout(done, 100);
-	});
-}
-//#endregion
-//#region ../infra/src/providers/browser/thumbmarkAdapter.ts
-/**
-* Adapter for @thumbmarkjs/thumbmarkjs. Single point of dependency so bundlers
-* resolve it from infra's node_modules when building apps that depend on core → infra.
-*/
-const THUMBMARK_ALGORITHM = {
-	algorithmName: "thumbmarkjs",
-	algorithmVersion: "1.6.4"
-};
-/**
-* `logging` must stay disabled. With it on (the upstream default) `getThumbmark()`
-* evaluates a bare, unguarded storage read:
-*
-*   options.logging && !sessionStorage.getItem("_tmjs_l") && Math.random() < 1e-4
-*
-* Hosts that delete the bare global as a self-XSS mitigation (`delete
-* window.sessionStorage`) make that a `ReferenceError`, which would cost us the
-* device fingerprint. `logging: false` short-circuits the expression before the
-* read. It also stops upstream's 1-in-10 000 telemetry POST to
-* api.thumbmarkjs.com. Re-check this when bumping the dependency.
-*/
-const THUMBMARK_OPTIONS = {
-	logging: false,
-	yield: yieldUntilNextPaint
-};
-const lazyThumbmark = BrowserLazyImportProvider.getInstance().create(() => import("./thumbmark.esm-CRc0cYvz.esm.js"), {
-	label: "Fingerprint",
-	moduleName: "@thumbmarkjs/thumbmarkjs",
-	timeoutMs: 1e4,
-	disabledMessage: "the device fingerprint is unavailable for this attempt."
-});
-async function getThumbmarkId() {
-	const module = await lazyThumbmark.load();
-	if (!module) throw new Error("@thumbmarkjs/thumbmarkjs failed to load");
-	return (await new module.Thumbmark(THUMBMARK_OPTIONS).get()).thumbmark;
-}
-//#endregion
 //#region ../infra/src/providers/browser/FingerprintProvider.ts
 var FingerprintProvider = class {
-	constructor(ipLookup) {
+	/**
+	* @param readVisitorId - The device id to report, or `null` without one;
+	*   the result then has an empty `visitorId` and no algorithm fields.
+	*/
+	constructor(ipLookup, readVisitorId) {
 		this.ipLookup = ipLookup;
-	}
-	prime() {
-		this.startVisitorId();
-	}
-	startVisitorId() {
-		if (!this.visitorIdPromise) {
-			this.visitorIdPromise = getThumbmarkId();
-			this.visitorIdPromise.catch(() => void 0);
-		}
-		return this.visitorIdPromise;
+		this.readVisitorId = readVisitorId;
 	}
 	async getFingerprint(disableIpify = false) {
-		const visitorId = await this.startVisitorId();
-		const [deviceInfo, ip] = await Promise.all([getDeviceFingerprintInfo(), disableIpify ? Promise.resolve("") : this.ipLookup.getIp()]);
+		const [visitor, deviceInfo, ip] = await Promise.all([
+			this.readVisitorId(),
+			getDeviceFingerprintInfo(),
+			disableIpify ? Promise.resolve("") : this.ipLookup.getIp()
+		]);
 		return {
-			visitorId,
+			...visitor ?? { visitorId: "" },
 			ip,
-			deviceInfo,
-			...THUMBMARK_ALGORITHM
+			deviceInfo
 		};
 	}
 };
 //#endregion
-//#region ../infra/src/providers/browser/IpifyProvider.ts
-let cachedIp;
-let inFlightLookup;
+//#region src/internal/fingerprint/fingerprintApi.ts
+const PID_WAIT_MS = 3e3;
 /**
-* Resets the module-level IP cache. Intended for tests and full session resets.
+* Collects the device fingerprint: device info, the IP, and the Incode pid.
+*
+* `visitorId` is the current session's Incode pid, the device hash
+* user-service returned for the session's PID signal, with the
+* `algorithmName` and `algorithmVersion` it named. While that signal is in
+* flight, this waits up to 3 s for it.
+*
+* Without a session (no token), with `setup({ fingerprint: false })`, or when
+* no pid arrives within 3 s (WASM not loaded, or an older server), `visitorId`
+* is `''` and `algorithmName` and `algorithmVersion` are absent.
+*
+* @param disableIpify - Skip the IP lookup. Defaults to the session's setting.
 */
-function resetIpifyCache() {
-	cachedIp = void 0;
-	inFlightLookup = void 0;
-}
-async function fetchIpFromIpify() {
-	if (typeof fetch === "undefined") return "";
-	let timeoutId = 0;
-	const controller = new AbortController();
-	if (AbortSignal.timeout) {
-		const signal = AbortSignal.timeout(3e3);
-		return (await (await fetch("https://api.ipify.org?format=json", { signal })).json()).ip;
-	}
-	const timeoutPromise = new Promise((_, reject) => {
-		timeoutId = setTimeout(() => {
-			controller.abort();
-			reject(/* @__PURE__ */ new Error("Request timeout"));
-		}, 3e3);
-	});
-	const fetchPromise = fetch("https://api.ipify.org?format=json", { signal: controller.signal }).then((res) => res.json()).then((data) => data.ip);
-	const result = await Promise.race([fetchPromise, timeoutPromise]);
-	clearTimeout(timeoutId);
-	return result;
-}
-var IpifyProvider = class {
-	async getIp() {
-		if (cachedIp !== void 0) return cachedIp;
-		if (inFlightLookup) return inFlightLookup;
-		inFlightLookup = (async () => {
-			try {
-				const ip = await fetchIpFromIpify();
-				cachedIp = ip;
-				return ip;
-			} catch {
-				cachedIp = "";
-				return "";
-			} finally {
-				inFlightLookup = void 0;
-			}
-		})();
-		return inFlightLookup;
-	}
-};
-//#endregion
-//#region src/internal/fingerprint/fingerprintApi.ts
 async function getFingerprint(disableIpify) {
 	const shouldDisableIpify = disableIpify ?? getDisableIpify();
-	return new FingerprintProvider(new IpifyProvider()).getFingerprint(shouldDisableIpify);
+	return new FingerprintProvider(new IpifyProvider(), readSessionPid).getFingerprint(shouldDisableIpify);
+}
+async function readSessionPid() {
+	const token = getToken();
+	if (!token || !getFingerprintEnabled()) return null;
+	const pid = await incodeDeviceHashWaiter.waitFor(token, PID_WAIT_MS);
+	return pid ? {
+		visitorId: pid.hash,
+		algorithmName: pid.algorithmName,
+		algorithmVersion: pid.algorithmVersion
+	} : null;
 }
 //#endregion
 //#region src/internal/device/hasLiedBrowser.ts
@@ -657,25 +746,37 @@ function formatBrowser(browser) {
 	if (!browser.name || !browser.version) return "Unknown";
 	return `${browser.name} ${browser.version}`;
 }
+/**
+* The session's activation post: device data (IP, browser, OS) and, when it
+* arrives in time, the pid as the device hash. Mandatory consent rides on its
+* response.
+*/
 async function submitDeviceFingerprint(options = {}, dependencies) {
 	const { disableIpify = false, hostingApp, signal } = options;
 	const token = getToken();
-	const fingerprint = await dependencies.fingerprintProvider.getFingerprint(disableIpify);
+	const [deviceInfo, ip, deviceHash] = await Promise.all([
+		getDeviceFingerprintInfo(),
+		disableIpify ? Promise.resolve("") : dependencies.ipLookup.getIp(),
+		dependencies.getDeviceHash?.() ?? null
+	]);
 	if (getToken() !== token || dependencies.isCurrentSession?.() === false) throw new Error("Session changed during fingerprint collection");
 	const hasLiedBrowser = isBrowserSimulation(dependencies.browserEnv);
 	const payload = {
-		hash: fingerprint.visitorId || "",
-		ip: fingerprint.ip || "",
+		hash: deviceHash?.hash ?? "",
+		ip,
 		deviceType: "WEBAPP",
-		data: JSON.stringify(fingerprint),
-		osVersion: formatOsVersion(fingerprint.deviceInfo.os),
-		deviceModel: fingerprint.deviceInfo.device.model || "",
-		browser: formatBrowser(fingerprint.deviceInfo.browser),
+		data: JSON.stringify({
+			ip,
+			deviceInfo
+		}),
+		osVersion: formatOsVersion(deviceInfo.os),
+		deviceModel: deviceInfo.device.model || "",
+		browser: formatBrowser(deviceInfo.browser),
 		hasLiedBrowser,
 		sdkVersion: SDK_VERSION,
 		hostingApp: hostingApp ?? "Web SDK",
-		algorithmName: fingerprint.algorithmName,
-		algorithmVersion: fingerprint.algorithmVersion
+		algorithmName: deviceHash?.algorithmName,
+		algorithmVersion: deviceHash?.algorithmVersion
 	};
 	const response = await api.post(endpoints.deviceFingerprint, payload, { signal });
 	if (!response.ok) throw new Error(`Failed to submit fingerprint: ${response.status} ${response.statusText}`);
@@ -718,6 +819,9 @@ let cachedDisableIpify = false;
 let clientIpLookupEnabled = true;
 let clientFingerprintEnabled = true;
 let clientHostingApp;
+let clientWasmConfig;
+let clientWasmDisabled = false;
+const DEVICE_HASH_WAIT_MS = 3e3;
 function setClientIpLookupEnabled(enabled) {
 	clientIpLookupEnabled = enabled;
 }
@@ -735,6 +839,69 @@ function setClientFingerprintEnabled(enabled) {
 	clientFingerprintEnabled = enabled;
 	fingerprintSignalsReporter.setEnabled(enabled);
 }
+/**
+* The known WASM config: from `setup({ wasm })`, `setWasmConfig`, or
+* `<incode-flow>` / `<incode-workflow>`, which pass the config their captures
+* load. Activation loads the WASM runtime only when it is known, so headless
+* hosts that never configured WASM don't download it.
+*/
+function setClientWasmConfig(config) {
+	clientWasmConfig = config;
+}
+/**
+* `setup({ wasm: false })`: activations load no WASM runtime, so their post
+* sends no device hash, until `setup({ wasm })` or `reset()`.
+*/
+function setClientWasmDisabled(disabled) {
+	clientWasmDisabled = disabled;
+}
+/** Why this activation's post won't wait for a pid, if it won't. */
+function deviceHashSkipReason(activationOptedOut) {
+	if (activationOptedOut || clientWasmDisabled) return "wasmDisabled";
+	return clientWasmConfig || isTRIStarted() ? void 0 : "noWasmConfig";
+}
+/**
+* TRI first: TRI's fpSignals PID is signed with the same key as the runtime's
+* (old signing format, so one string serves every session), so it goes to
+* user-service unchanged as this session's PID and no runtime starts for it.
+* Without a pid back (fpSignals off, blocked or timed out, or a step-up after
+* the tenant's replay window, 11,100 s by default) the runtime starts for the
+* pid as before. Needs TRI's signed `getFpSignals()`: an older TRI's string is
+* unsigned, so user-service returns no pid and the runtime is used.
+*/
+function startSessionPid(token, config) {
+	if (!isTRIStarted()) {
+		if (config) startSessionWasm(token, config);
+		return;
+	}
+	fingerprintSignalsReporter.sendHostPid(token, async () => (await readTRIFpSignals())?.pid ?? null).then((sent) => {
+		if (sent || getToken() !== token) return;
+		if (config) startSessionWasm(token, config);
+		else incodeDeviceHashWaiter.settle(token, null);
+	});
+}
+/**
+* Starts the WASM runtime, without models, so the PID signal can return the
+* pid while activation runs: it is the device hash of the activation post.
+* Capture modules add their pipelines later. A runtime that fails to start
+* ends the post's wait at once.
+*/
+function startSessionWasm(token, config) {
+	(async () => {
+		try {
+			const warmupModule = await import("./warmup-BkfxQZsC.esm.js").then((n) => n.c);
+			const warmup = warmupModule.warmupWasm({
+				...config,
+				pipelines: []
+			});
+			warmup.catch(() => void 0);
+			await Promise.race([warmup, warmupModule.whenWasmRuntimeReady()]);
+			fingerprintSignalsReporter.onWasmReady();
+		} catch {
+			incodeDeviceHashWaiter.settle(token, null);
+		}
+	})();
+}
 function resolveDisableIpify(serverDisableIpify) {
 	return !clientIpLookupEnabled || serverDisableIpify;
 }
@@ -772,6 +939,14 @@ function createFingerprintSettled() {
 function whenSessionFingerprintSettled() {
 	return fingerprintSettled?.promise ?? Promise.resolve(cachedFingerprintResult);
 }
+/** Best-effort: the format latch must never fail session initialization. */
+function applyCaptureMetadataFormat(v2Enabled) {
+	try {
+		setWasmMetadataV2Enabled(v2Enabled);
+	} catch (error) {
+		trueSightLog("warning", "session", "orchestration", `capture metadata format not applied error=${String(error)}`);
+	}
+}
 /**
 * Activates a session by setting the auth token on the HTTP client and
 * preloading session-scoped state.
@@ -802,7 +977,7 @@ function whenSessionFingerprintSettled() {
 * ```
 */
 async function initializeSession(options = {}) {
-	const { token, hostingApp = clientHostingApp, signal, preloadFlow, awaitFingerprint = true } = options;
+	const { token, hostingApp = clientHostingApp, signal, preloadFlow, awaitFingerprint = true, wasm } = options;
 	let triLinkPromise = Promise.resolve();
 	if (token !== void 0 && token !== getToken()) {
 		setToken(token);
@@ -835,32 +1010,37 @@ async function initializeSession(options = {}) {
 	}
 	const settled = createFingerprintSettled();
 	fingerprintSettled = settled;
-	const fingerprintProvider = clientFingerprintEnabled ? new FingerprintProvider(new IpifyProvider()) : void 0;
-	fingerprintProvider?.prime?.();
+	const fingerprintEnabled = clientFingerprintEnabled;
+	const activeToken = getToken();
+	const skipReason = deviceHashSkipReason(wasm === false);
+	if (activeToken && fingerprintEnabled && !skipReason) startSessionPid(activeToken, clientWasmConfig);
 	let fingerprintPromise;
 	sessionInitPromise = (async () => {
 		let features;
 		let serverDisableIpify = false;
+		let captureMetadataV2 = false;
 		try {
-			features = await fetchFeatureConfig(signal);
+			features = await retryAfterReconnect(() => fetchFeatureConfig(signal), signal);
 			serverDisableIpify = isFeatureEnabled("DISABLE_IPIFY", features.features);
+			captureMetadataV2 = isFeatureEnabled("DEEPSIGHT_V2", features.features);
 			startTrueSightCollection(features);
 		} catch {
 			features = { sessionIdentifier: "" };
 			trueSightLog("warning", "session", "orchestration", "feature-config fetch failed");
 			startTrueSightCollection();
 		}
+		applyCaptureMetadataFormat(captureMetadataV2);
 		const disableIpify = resolveDisableIpify(serverDisableIpify);
 		const preloadedFlow = await flowPreloadPromise;
 		await updateFeatureManagementUser({ customIDs: {
 			hashed_onboarding_id: features.sessionIdentifier || void 0,
 			flow_id: preloadedFlow?.flowId
 		} });
-		fingerprintPromise = submitSessionFingerprint(fingerprintProvider, {
+		fingerprintPromise = submitSessionFingerprint(fingerprintEnabled, {
 			disableIpify,
 			hostingApp,
 			signal
-		}, settled);
+		}, settled, skipReason);
 		try {
 			const browserInfo = new BrowserInfoProvider().getBrowserInfo();
 			const language = new BrowserEnvironmentProvider().getNavigatorProperty("language");
@@ -910,25 +1090,43 @@ async function initializeSession(options = {}) {
 * while it still belongs to the current activation (a token change resets
 * `fingerprintSettled`) and always settles the waiter.
 */
-async function submitSessionFingerprint(fingerprintProvider, options, settled) {
+async function submitSessionFingerprint(enabled, options, settled, skipReason) {
 	const isCurrent = () => fingerprintSettled === settled;
+	const token = getToken();
+	const startedAtMs = getTimestamp();
+	const deadlineMs = startedAtMs + DEVICE_HASH_WAIT_MS;
+	let outcomeLogged = false;
+	const logOutcome = (outcome) => {
+		if (!outcomeLogged) {
+			outcomeLogged = true;
+			trueSightLog("info", "session", "other", `device hash ${outcome}`);
+		}
+	};
+	const getDeviceHash = !skipReason && token ? async () => {
+		const deviceHash = await incodeDeviceHashWaiter.waitFor(token, deadlineMs - getTimestamp());
+		logOutcome(`${deviceHash ? "sent" : "missing"} waitMs=${getTimestamp() - startedAtMs}`);
+		return deviceHash;
+	} : void 0;
 	try {
-		if (fingerprintProvider) try {
-			const result = await submitDeviceFingerprint(options, {
-				fingerprintProvider,
-				browserEnv: new BrowserEnvironmentProvider(),
-				isCurrentSession: isCurrent
-			});
-			if (isCurrent()) {
-				cachedFingerprintResult = result;
-				cachedFingerprintSuccess = true;
-				flushDeviceStatsQueue();
+		if (enabled) {
+			if (skipReason) logOutcome(`skipped reason=${skipReason}`);
+			try {
+				const result = await retryAfterReconnect(() => submitDeviceFingerprint(options, {
+					ipLookup: new IpifyProvider(),
+					browserEnv: new BrowserEnvironmentProvider(),
+					isCurrentSession: isCurrent,
+					getDeviceHash
+				}), options.signal);
+				if (isCurrent()) {
+					cachedFingerprintResult = result;
+					cachedFingerprintSuccess = true;
+					flushDeviceStatsQueue();
+				}
+			} catch (error) {
+				console.warn("Failed to submit device fingerprint:", error);
+				trueSightLog("warning", "session", "other", "device fingerprint submit failed");
 			}
-		} catch (error) {
-			console.warn("Failed to submit device fingerprint:", error);
-			trueSightLog("warning", "session", "other", "device fingerprint submit failed");
-		}
-		else if (isCurrent()) flushDeviceStatsQueue();
+		} else if (isCurrent()) flushDeviceStatsQueue();
 	} finally {
 		settled.resolve(isCurrent() ? cachedFingerprintResult : void 0);
 	}
@@ -957,7 +1155,9 @@ function getFingerprintEnabled() {
 * Useful for testing or when starting a new session.
 */
 function resetSessionInit() {
+	applyCaptureMetadataFormat(false);
 	fingerprintSignalsReporter.resetSession();
+	incodeDeviceHashWaiter.reset();
 	sessionInitialized = false;
 	cachedFeatures = null;
 	cachedDisableIpify = false;
@@ -970,4 +1170,4 @@ function resetSessionInit() {
 	resetDeviceStatsQueue();
 }
 //#endregion
-export { IpifyProvider as _, resetSessionInit as a, BrowserEnvironmentProvider as b, setClientIpLookupEnabled as c, registerFlowPreloader as d, resetStandaloneFlowPolicy as f, getFingerprint as g, isBrowserSimulation as h, initializeSession as i, whenSessionFingerprintSettled as l, setStandaloneFlowPolicy as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, resolveStandaloneFlowPolicy as p, getSessionFingerprintResult as r, setClientHostingApp as s, getDisableIpify as t, getStandaloneFlowPolicy as u, getThumbmarkId as v, fingerprintSignalsReporter as x, getDeviceFingerprintInfo as y };
+export { fingerprintSignalsReporter as S, isBrowserSimulation as _, resetSessionInit as a, IpifyProvider as b, setClientIpLookupEnabled as c, whenSessionFingerprintSettled as d, getStandaloneFlowPolicy as f, setStandaloneFlowPolicy as g, resolveStandaloneFlowPolicy as h, initializeSession as i, setClientWasmConfig as l, resetStandaloneFlowPolicy as m, getFingerprintEnabled as n, setClientFingerprintEnabled as o, registerFlowPreloader as p, getSessionFingerprintResult as r, setClientHostingApp as s, getDisableIpify as t, setClientWasmDisabled as u, getFingerprint as v, BrowserEnvironmentProvider as x, getDeviceFingerprintInfo as y };