@incodetech/core 2.4.1-agentic.2 → 2.4.1-agentic.4

package/dist/step-up.esm.js

@@ -0,0 +1,648 @@
+import { i as assign, s as createActor, t as setup, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
+import { n as getHttpUrlOrigin } from "./urlUtils-B2wagB5v.esm.js";
+//#region src/modules/step-up/stepUpStateMachine.ts
+/** The SDK draws the permissions, before the face check. */
+function permissionsFirst(context) {
+	return context.permissionsUi === "sdk" && context.permissionsOrder === "beforeFaceCheck";
+}
+function allScopeNames(permissions) {
+	return permissions.scopes.map((scope) => scope.name);
+}
+/** `auto-select` scopes are always approved: the person cannot untick them. */
+function isLockedScope(scope) {
+	return scope.selectionMode === "auto-select";
+}
+/** The scopes that start ticked (`autoSelect` or locked), in class order. */
+function preselectedScopes(permissions) {
+	return permissions.scopes.filter((scope) => scope.autoSelect === true || isLockedScope(scope)).map((scope) => scope.name);
+}
+/** The agent class's scopes that `approvedScopes` names, in the class order. */
+function knownScopes(permissions, approvedScopes) {
+	return allScopeNames(permissions).filter((name) => approvedScopes.includes(name));
+}
+/**
+* Step-up flow: verify the person (workflow or hosted page, driven by the UI)
+* and let them approve the agent class's scopes, in the order
+* `permissionsOrder` sets: `afterFaceCheck` (verifying → permissions →
+* finished) or `beforeFaceCheck` (permissions → verifying → finished, so Deny
+* ends the step-up before any face check).
+*
+* - `verifying` — the workflow or iframe is on screen. In hosted mode the
+*   hosted page draws the permissions itself and reports the result
+*   (`HOSTED_FINISHED` / `HOSTED_DENIED`).
+* - `permissions` — the scope checkboxes; the ones Incode marked `autoSelect`
+*   start checked (from the agent class's scope selection modes), the rest
+*   unchecked, and Approve needs at least one. `auto-select` scopes are
+*   always approved, so they stay checked and cannot be toggled.
+* - `savingPermissions` — only when the host saves the choice: waits for it,
+*   then runs the face check (`beforeFaceCheck`) or finishes. A failed save
+*   is `error` (`VERIFICATION_ERROR`, `detail.code` `PERMISSIONS_NOT_SAVED`).
+* - `finished` (final) — approved; `selectedScopes` is the result.
+* - `closed` (final) — the user pressed Deny.
+* - `error` — verification failed, is still pending, or could not finish
+*   (`errorCode`; not final, per the module convention).
+*
+* With `permissionsUi: 'none'` the machine skips `permissions` and finishes
+* with no scopes (contract v0.2 §6.3): the bank draws its own screen and its
+* server sends its own choice to `/scopes`.
+*/
+const stepUpMachine = setup({
+	types: {
+		context: {},
+		events: {},
+		input: {}
+	},
+	guards: {
+		bankDrawsPermissions: ({ context }) => context.permissionsUi === "none",
+		permissionsFirst: ({ context }) => permissionsFirst(context),
+		hasSelection: ({ context }) => context.selectedScopes.length > 0,
+		approvedForHostSave: ({ context }) => context.hostSavesPermissions && context.selectedScopes.length > 0,
+		approvedBeforeFaceCheck: ({ context }) => permissionsFirst(context) && context.selectedScopes.length > 0,
+		hostedApprovalUsable: ({ context, event }) => {
+			const { approvedScopes } = event;
+			return knownScopes(context.permissions, approvedScopes).length > 0;
+		}
+	},
+	actions: {
+		toggleScope: assign(({ context, event }) => {
+			const { name } = event;
+			const known = allScopeNames(context.permissions);
+			const scope = context.permissions.scopes.find((candidate) => candidate.name === name);
+			if (!scope || isLockedScope(scope)) return {};
+			const selected = new Set(context.selectedScopes);
+			if (selected.has(name)) selected.delete(name);
+			else selected.add(name);
+			return { selectedScopes: known.filter((scope) => selected.has(scope)) };
+		}),
+		setHostedSelection: assign(({ context, event }) => {
+			const { approvedScopes } = event;
+			return { selectedScopes: knownScopes(context.permissions, approvedScopes) };
+		}),
+		clearSelection: assign({ selectedScopes: () => [] }),
+		setError: assign(({ event }) => {
+			const failed = event;
+			return {
+				error: failed.error,
+				errorCode: failed.code,
+				errorDetail: failed.detail
+			};
+		}),
+		setSaveError: assign(({ event }) => {
+			const { error } = event;
+			return {
+				error: "The approved permissions could not be saved",
+				errorCode: "VERIFICATION_ERROR",
+				errorDetail: {
+					code: "PERMISSIONS_NOT_SAVED",
+					message: error
+				}
+			};
+		}),
+		setNoKnownScopesError: assign(({ event }) => {
+			const { approvedScopes } = event;
+			return {
+				error: "The hosted page approved none of the agent class's scopes",
+				errorCode: "VERIFICATION_ERROR",
+				errorDetail: {
+					code: "NO_KNOWN_SCOPES",
+					message: `approvedScopes: ${JSON.stringify(approvedScopes)}`
+				}
+			};
+		})
+	}
+}).createMachine({
+	id: "stepUp",
+	initial: "starting",
+	context: ({ input }) => ({
+		stepUpId: input.stepUpId,
+		permissions: input.permissions,
+		permissionsUi: input.permissionsUi,
+		permissionsOrder: input.permissionsOrder,
+		hostSavesPermissions: input.hostSavesPermissions,
+		selectedScopes: preselectedScopes(input.permissions),
+		error: void 0,
+		errorCode: void 0,
+		errorDetail: void 0
+	}),
+	states: {
+		starting: { always: [{
+			guard: "permissionsFirst",
+			target: "permissions"
+		}, { target: "verifying" }] },
+		verifying: { on: {
+			VERIFICATION_FINISHED: [
+				{
+					guard: "bankDrawsPermissions",
+					target: "finished",
+					actions: "clearSelection"
+				},
+				{
+					guard: "permissionsFirst",
+					target: "finished"
+				},
+				{ target: "permissions" }
+			],
+			VERIFICATION_FAILED: {
+				target: "error",
+				actions: "setError"
+			},
+			HOSTED_FINISHED: [
+				{
+					guard: "bankDrawsPermissions",
+					target: "finished",
+					actions: "clearSelection"
+				},
+				{
+					guard: "hostedApprovalUsable",
+					target: "finished",
+					actions: "setHostedSelection"
+				},
+				{
+					target: "error",
+					actions: "setNoKnownScopesError"
+				}
+			],
+			HOSTED_DENIED: { target: "closed" }
+		} },
+		permissions: { on: {
+			TOGGLE_SCOPE: { actions: "toggleScope" },
+			APPROVE: [
+				{
+					guard: "approvedForHostSave",
+					target: "savingPermissions"
+				},
+				{
+					guard: "approvedBeforeFaceCheck",
+					target: "verifying"
+				},
+				{
+					guard: "hasSelection",
+					target: "finished"
+				}
+			],
+			DENY: { target: "closed" }
+		} },
+		savingPermissions: { on: {
+			PERMISSIONS_SAVED: [{
+				guard: "permissionsFirst",
+				target: "verifying"
+			}, { target: "finished" }],
+			PERMISSIONS_SAVE_FAILED: {
+				target: "error",
+				actions: "setSaveError"
+			}
+		} },
+		finished: { type: "final" },
+		closed: { type: "final" },
+		error: {}
+	}
+});
+//#endregion
+//#region src/modules/step-up/stepUpActor.ts
+function createStepUpActor(options) {
+	return createActor(stepUpMachine, { input: options }).start();
+}
+//#endregion
+//#region src/modules/step-up/stepUpError.ts
+/**
+* Error passed to the step-up `onError` callback (and thrown for invalid
+* options). `code` is stable; `message` is for developers, not end users.
+* `detail` is what the workflow or hosted page reported underneath (set for
+* `VERIFICATION_ERROR`, and for `FACE_CHECK_FAILED` from the workflow).
+*/
+var StepUpError = class extends Error {
+	constructor(code, message, stepUpId, detail) {
+		super(message);
+		this.name = "StepUpError";
+		this.code = code;
+		this.stepUpId = stepUpId;
+		if (detail) this.detail = detail;
+	}
+};
+function isStepUpError(error) {
+	return error instanceof StepUpError;
+}
+//#endregion
+//#region src/modules/step-up/stepUpOptions.ts
+const MODES = ["embedded", "hosted"];
+const PERMISSIONS_UIS = ["sdk", "none"];
+const PERMISSIONS_ORDERS = ["afterFaceCheck", "beforeFaceCheck"];
+/** Largest delay setTimeout honours; above it browsers fire after ~1 ms. */
+const MAX_TIMER_DELAY_MS = 2147483647;
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function optionalString(value) {
+	return isNonEmptyString(value) ? value : void 0;
+}
+/** The query part of a URL (between `?` and `#`), or `''`. */
+function queryOf(url) {
+	const withoutFragment = url.split("#", 1)[0];
+	const index = withoutFragment.indexOf("?");
+	return index === -1 ? "" : withoutFragment.slice(index + 1);
+}
+function invalid(message, stepUpId) {
+	throw new StepUpError("INVALID_OPTIONS", message, stepUpId);
+}
+function normalizeScope(raw, index) {
+	if (!isRecord$1(raw) || !isNonEmptyString(raw.name)) invalid(`permissions.scopes[${index}].name must be a non-empty string`);
+	const displayName = optionalString(raw.displayName);
+	const description = optionalString(raw.description);
+	const autoSelect = typeof raw.autoSelect === "boolean" ? raw.autoSelect : void 0;
+	const selectionMode = raw.selectionMode === "auto-select" || raw.selectionMode === "dynamic-select" ? raw.selectionMode : void 0;
+	return {
+		name: raw.name,
+		displayName: displayName ?? raw.name,
+		...description ? { description } : {},
+		...autoSelect !== void 0 ? { autoSelect } : {},
+		...selectionMode ? { selectionMode } : {}
+	};
+}
+function nonNegativeNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+}
+function normalizeLimit(raw) {
+	if (!isRecord$1(raw)) return void 0;
+	const budgetLimit = nonNegativeNumber(raw.budgetLimit);
+	const usageLimit = nonNegativeNumber(raw.usageLimit);
+	const usageLimitLabel = optionalString(raw.usageLimitLabel);
+	if (budgetLimit === void 0 && usageLimit === void 0) return void 0;
+	return {
+		...budgetLimit !== void 0 ? { budgetLimit } : {},
+		...usageLimit !== void 0 ? { usageLimit } : {},
+		...usageLimit !== void 0 && usageLimitLabel ? { usageLimitLabel } : {}
+	};
+}
+/** Display only: a malformed limit is dropped rather than failing the call. */
+function normalizeLimits(raw, scopeNames) {
+	if (!isRecord$1(raw)) return void 0;
+	const limits = {};
+	for (const [name, value] of Object.entries(raw)) {
+		const limit = scopeNames.has(name) ? normalizeLimit(value) : void 0;
+		if (limit) limits[name] = limit;
+	}
+	return Object.keys(limits).length > 0 ? limits : void 0;
+}
+/**
+* Checks the permissions block from the start response and fills in
+* `displayName` (falls back to the scope name). Keeps each scope's boolean
+* `autoSelect` and known `selectionMode`, and the valid limits of known
+* scopes. A missing or `null` `durationSeconds` is left out. Throws
+* `INVALID_OPTIONS` when a required field is missing, or `durationSeconds` is
+* given but not a positive number.
+*/
+function normalizeStepUpPermissions(raw) {
+	if (!isRecord$1(raw)) invalid("permissions is required");
+	const scopesRaw = raw.scopes;
+	if (!Array.isArray(scopesRaw) || scopesRaw.length === 0) invalid("permissions.scopes must list at least one scope");
+	const scopes = scopesRaw.map(normalizeScope);
+	const names = new Set(scopes.map((scope) => scope.name));
+	if (names.size !== scopes.length) invalid("permissions.scopes must not repeat a scope name");
+	const { durationSeconds } = raw;
+	if (durationSeconds !== void 0 && durationSeconds !== null && (typeof durationSeconds !== "number" || !Number.isFinite(durationSeconds) || durationSeconds <= 0)) invalid("permissions.durationSeconds must be a positive number when given");
+	const agentClassId = optionalString(raw.agentClassId);
+	const purpose = optionalString(raw.purpose);
+	const limits = normalizeLimits(raw.limits, names);
+	return {
+		...agentClassId ? { agentClassId } : {},
+		...purpose ? { purpose } : {},
+		scopes,
+		...limits ? { limits } : {},
+		...typeof durationSeconds === "number" ? { durationSeconds } : {}
+	};
+}
+/**
+* Exact origin (`scheme://host[:port]`) of an absolute http(s) URL, or
+* `undefined` when the URL is not one.
+*/
+function getUrlOrigin(url) {
+	return getHttpUrlOrigin(url);
+}
+/**
+* Validates the `renderStepUp` options (everything except the DOM container,
+* which the UI layer checks) and fills in defaults:
+* `mode: 'embedded'`, `permissionsUi: 'sdk'`,
+* `permissionsOrder: 'beforeFaceCheck'` (`'afterFaceCheck'` in hosted mode),
+* `readyTimeoutMs: DEFAULT_STEP_UP_READY_TIMEOUT_MS` (15 s),
+* `disableDashboardTheme: false`.
+*
+* Throws {@link StepUpError} with code `INVALID_OPTIONS`.
+*/
+function validateStepUpOptions(raw) {
+	if (!isRecord$1(raw)) invalid("options are required");
+	const { stepUpId } = raw;
+	if (!isNonEmptyString(stepUpId)) invalid("stepUpId must be a non-empty string");
+	if (typeof raw.onFinish !== "function") invalid("onFinish must be a function", stepUpId);
+	if (raw.onError !== void 0 && typeof raw.onError !== "function") invalid("onError must be a function when given", stepUpId);
+	if (raw.onPermissionsApproved !== void 0 && typeof raw.onPermissionsApproved !== "function") invalid("onPermissionsApproved must be a function when given", stepUpId);
+	const mode = raw.mode ?? "embedded";
+	if (!MODES.includes(mode)) invalid(`mode must be one of ${MODES.join(", ")}`, stepUpId);
+	const permissionsUi = raw.permissionsUi ?? "sdk";
+	if (!PERMISSIONS_UIS.includes(permissionsUi)) invalid(`permissionsUi must be one of ${PERMISSIONS_UIS.join(", ")}`, stepUpId);
+	const permissionsOrder = raw.permissionsOrder ?? (mode === "hosted" ? "afterFaceCheck" : "beforeFaceCheck");
+	if (!PERMISSIONS_ORDERS.includes(permissionsOrder)) invalid(`permissionsOrder must be one of ${PERMISSIONS_ORDERS.join(", ")}`, stepUpId);
+	if (mode === "hosted" && permissionsOrder === "beforeFaceCheck") invalid("permissionsOrder 'beforeFaceCheck' needs embedded mode", stepUpId);
+	const sessionToken = optionalString(raw.sessionToken);
+	if (mode === "embedded" && !sessionToken) invalid("sessionToken is required in embedded mode", stepUpId);
+	if (raw.interviewId !== void 0 && !isNonEmptyString(raw.interviewId)) invalid("interviewId must be a non-empty string when given", stepUpId);
+	let onboardingUrl;
+	let onboardingOrigin;
+	if (mode === "hosted") {
+		if (!isNonEmptyString(raw.onboardingUrl)) invalid("onboardingUrl is required in hosted mode", stepUpId);
+		onboardingOrigin = getUrlOrigin(raw.onboardingUrl);
+		if (!onboardingOrigin) invalid("onboardingUrl must be an absolute http(s) URL", stepUpId);
+		if (sessionToken && queryOf(raw.onboardingUrl).includes(sessionToken)) invalid("onboardingUrl must carry the session token in the fragment, not the query", stepUpId);
+		onboardingUrl = raw.onboardingUrl;
+	}
+	const readyTimeoutMs = raw.readyTimeoutMs ?? 15e3;
+	if (typeof readyTimeoutMs !== "number" || !Number.isFinite(readyTimeoutMs) || readyTimeoutMs <= 0 || readyTimeoutMs > MAX_TIMER_DELAY_MS) invalid(`readyTimeoutMs must be a positive number up to ${MAX_TIMER_DELAY_MS} when given`, stepUpId);
+	if (raw.lang !== void 0 && !isNonEmptyString(raw.lang)) invalid("lang must be a non-empty string when given", stepUpId);
+	if (raw.disableDashboardTheme !== void 0 && typeof raw.disableDashboardTheme !== "boolean") invalid("disableDashboardTheme must be a boolean when given", stepUpId);
+	let permissions;
+	try {
+		permissions = normalizeStepUpPermissions(raw.permissions);
+	} catch (error) {
+		invalid(error instanceof Error ? error.message : String(error), stepUpId);
+	}
+	return {
+		stepUpId,
+		sessionToken: sessionToken ?? "",
+		...isNonEmptyString(raw.interviewId) ? { interviewId: raw.interviewId } : {},
+		permissions,
+		mode,
+		...onboardingUrl ? {
+			onboardingUrl,
+			onboardingOrigin
+		} : {},
+		permissionsUi,
+		permissionsOrder,
+		readyTimeoutMs,
+		...isNonEmptyString(raw.lang) ? { lang: raw.lang } : {},
+		disableDashboardTheme: raw.disableDashboardTheme === true,
+		...raw.onPermissionsApproved ? { onPermissionsApproved: raw.onPermissionsApproved } : {},
+		onFinish: raw.onFinish,
+		...raw.onError ? { onError: raw.onError } : {}
+	};
+}
+const UNITS = [
+	{
+		unit: "days",
+		seconds: 86400
+	},
+	{
+		unit: "hours",
+		seconds: 3600
+	},
+	{
+		unit: "minutes",
+		seconds: 60
+	}
+];
+/**
+* Picks the largest unit that divides the duration exactly, so
+* 36000 s → 10 hours, 5400 s → 90 minutes. A duration that is not a whole
+* number of minutes is rounded up to minutes (never shown shorter than it is),
+* and anything under a minute stays in seconds. No duration gives `undefined`.
+*/
+function describeStepUpDuration(durationSeconds) {
+	if (durationSeconds === void 0) return void 0;
+	const seconds = Math.ceil(durationSeconds);
+	for (const { unit, seconds: size } of UNITS) if (seconds >= size && seconds % size === 0) return {
+		unit,
+		count: seconds / size
+	};
+	if (seconds >= 60) return {
+		unit: "minutes",
+		count: Math.ceil(seconds / 60)
+	};
+	return {
+		unit: "seconds",
+		count: seconds
+	};
+}
+//#endregion
+//#region src/modules/step-up/stepUpManager.ts
+/**
+* What the workflow's `onFinish` result means for the step-up:
+* - `failed` — `action: 'rejected'`, or score `FAIL` / `MANUAL_FAIL`.
+* - `pending` — no result (the workflow went to async resolution).
+* - `passed` — anything else, `WARN` and `UNKNOWN` included. That is only a
+*   UI hint: Incode passes the face check only on `OK` / `MANUAL_OK`, so
+*   `onFinish` is never an approval.
+*/
+function readWorkflowResult(result) {
+	if (!result) return "pending";
+	if (result.action === "rejected" || result.scoreStatus === "FAIL" || result.scoreStatus === "MANUAL_FAIL") return "failed";
+	return "passed";
+}
+function toPermissionsState(context, saving) {
+	const { permissions, selectedScopes } = context;
+	const duration = describeStepUpDuration(permissions.durationSeconds);
+	return {
+		status: "permissions",
+		...permissions.purpose ? { purpose: permissions.purpose } : {},
+		scopes: permissions.scopes.map((scope) => {
+			const limit = permissions.limits?.[scope.name];
+			return {
+				...scope,
+				checked: selectedScopes.includes(scope.name),
+				locked: isLockedScope(scope),
+				...limit ? { limit } : {}
+			};
+		}),
+		...duration ? { duration } : {},
+		canApprove: selectedScopes.length > 0,
+		saving
+	};
+}
+function mapState(snapshot) {
+	const typed = snapshot;
+	const { context } = typed;
+	if (typed.matches("permissions")) return toPermissionsState(context, false);
+	if (typed.matches("savingPermissions")) return toPermissionsState(context, true);
+	if (typed.matches("finished")) return {
+		status: "finished",
+		result: {
+			stepUpId: context.stepUpId,
+			approvedScopes: [...context.selectedScopes]
+		}
+	};
+	if (typed.matches("closed")) return { status: "closed" };
+	if (typed.matches("error")) return {
+		status: "error",
+		code: context.errorCode ?? "VERIFICATION_ERROR",
+		error: context.error ?? "Verification failed",
+		...context.errorDetail ? { detail: context.errorDetail } : {}
+	};
+	return { status: "verifying" };
+}
+function createApi({ actor }) {
+	return {
+		/** Verification passed: show the permissions (or finish, `'none'`). */
+		verificationFinished() {
+			actor.send({ type: "VERIFICATION_FINISHED" });
+		},
+		/**
+		* The workflow's `onFinish`, with its result. A failed face check goes to
+		* `error` (`FACE_CHECK_FAILED`) and no result to `error`
+		* (`VERIFICATION_PENDING`); neither shows the permissions.
+		*/
+		workflowFinished(result) {
+			const outcome = readWorkflowResult(result);
+			if (outcome === "passed") actor.send({ type: "VERIFICATION_FINISHED" });
+			else if (outcome === "failed" && result) actor.send({
+				type: "VERIFICATION_FAILED",
+				code: "FACE_CHECK_FAILED",
+				error: `The face check failed (action ${result.action}, score ${result.scoreStatus})`,
+				detail: { code: result.scoreStatus }
+			});
+			else actor.send({
+				type: "VERIFICATION_FAILED",
+				code: "VERIFICATION_PENDING",
+				error: "The verification has no result yet"
+			});
+		},
+		/**
+		* The workflow or hosted page ended without a passed check. `code`
+		* defaults to `VERIFICATION_ERROR` (could not finish); pass
+		* `FACE_CHECK_FAILED` only for a check that ran and failed.
+		*/
+		verificationFailed(error, code = "VERIFICATION_ERROR", detail) {
+			actor.send({
+				type: "VERIFICATION_FAILED",
+				code,
+				error,
+				...detail ? { detail } : {}
+			});
+		},
+		/** Hosted mode: the hosted page finished, with the scopes it approved. */
+		hostedFinished(approvedScopes) {
+			actor.send({
+				type: "HOSTED_FINISHED",
+				approvedScopes
+			});
+		},
+		/** Hosted mode: the user denied on the hosted page. */
+		hostedDenied() {
+			actor.send({ type: "HOSTED_DENIED" });
+		},
+		toggleScope(name) {
+			actor.send({
+				type: "TOGGLE_SCOPE",
+				name
+			});
+		},
+		/** Ignored while no scope is checked. */
+		approve() {
+			actor.send({ type: "APPROVE" });
+		},
+		deny() {
+			actor.send({ type: "DENY" });
+		},
+		/** The host saved the approved scopes: go on to the face check or finish. */
+		permissionsSaved() {
+			actor.send({ type: "PERMISSIONS_SAVED" });
+		},
+		/** The host could not save them: the step-up ends in error. */
+		permissionsSaveFailed(error) {
+			actor.send({
+				type: "PERMISSIONS_SAVE_FAILED",
+				error
+			});
+		}
+	};
+}
+/**
+* Creates the step-up manager. Pass permissions already normalized by
+* `validateStepUpOptions` / `normalizeStepUpPermissions`.
+*/
+function createStepUpManager(options) {
+	return createManager({
+		actor: createStepUpActor({
+			stepUpId: options.stepUpId,
+			permissions: options.permissions,
+			permissionsUi: options.permissionsUi ?? "sdk",
+			permissionsOrder: options.permissionsOrder ?? "beforeFaceCheck",
+			hostSavesPermissions: options.hostSavesPermissions ?? false
+		}),
+		mapState,
+		createApi
+	});
+}
+//#endregion
+//#region src/modules/step-up/stepUpHostedMessage.ts
+/**
+* Tag on every step-up `postMessage`, both directions. Matches the local
+* step-up mock's hosted page (contract P4.7 §6.6 reference implementation).
+*/
+const STEP_UP_MESSAGE_SOURCE = "incode-step-up";
+/**
+* True only when the message came from exactly `expectedOrigin`
+* (scheme, host and port). No suffix or prefix matching:
+* `https://onboarding.incode.com.evil.com` does not match
+* `https://onboarding.incode.com`.
+*/
+function isTrustedHostedOrigin(origin, expectedOrigin) {
+	return typeof origin === "string" && origin.length > 0 && origin !== "null" && origin === expectedOrigin;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Reads a `postMessage` from the hosted step-up page.
+*
+* Pass only messages whose `source` is the step-up iframe's own window. The
+* page tags messages `{ source: 'incode-step-up', type, ... }`:
+* - `ready` — loaded; the parent answers with {@link createStepUpInitMessage}.
+* - `finish` — `{ stepUpId, approvedScopes }`; the hosted page ran the face
+*   check and its own permissions screen. Read only when `stepUpId` is
+*   exactly `expectedStepUpId`; otherwise (missing or another step-up's)
+*   it is ignored, not relayed.
+* - `error` — `{ code, message? }`, e.g. `USER_DENIED` or
+*   `FACE_CHECK_FAILED`. Ignored when it names another `stepUpId`.
+*
+* A tagged message from another origin returns `originMismatch` (the frame
+* left the onboarding origin, for example after a redirect). Untagged
+* messages are ignored.
+*/
+function readHostedPageMessage(event, expectedOrigin, expectedStepUpId) {
+	const { data } = event;
+	if (!isRecord(data) || data.source !== "incode-step-up") return { kind: "ignored" };
+	if (!isTrustedHostedOrigin(event.origin, expectedOrigin)) return { kind: "originMismatch" };
+	if (data.type === "ready") return { kind: "ready" };
+	if (data.type === "finish") {
+		if (data.stepUpId !== expectedStepUpId) return { kind: "ignored" };
+		return {
+			kind: "finished",
+			approvedScopes: Array.isArray(data.approvedScopes) ? data.approvedScopes.filter((scope) => typeof scope === "string") : []
+		};
+	}
+	if (data.type === "error") {
+		if (data.stepUpId !== void 0 && data.stepUpId !== expectedStepUpId) return { kind: "ignored" };
+		return {
+			kind: "error",
+			code: typeof data.code === "string" && data.code ? data.code : "UNKNOWN",
+			...typeof data.message === "string" && data.message ? { message: data.message } : {}
+		};
+	}
+	return { kind: "ignored" };
+}
+/**
+* Builds the `init` message that hands the hosted page the permissions and
+* the parent's origin (contract v0.2 §6.6; the page checks `parentOrigin`
+* against its `returnOrigin`). The caller posts it with `targetOrigin` set to
+* the exact onboarding origin, never `'*'`.
+*/
+function createStepUpInitMessage(permissions, parentOrigin) {
+	return {
+		source: STEP_UP_MESSAGE_SOURCE,
+		type: "init",
+		permissions,
+		parentOrigin
+	};
+}
+//#endregion
+export { STEP_UP_MESSAGE_SOURCE, StepUpError, createStepUpInitMessage, createStepUpManager, describeStepUpDuration, getUrlOrigin, isStepUpError, isTrustedHostedOrigin, normalizeStepUpPermissions, readHostedPageMessage, readWorkflowResult, validateStepUpOptions };

package/dist/{tri-C9SvtzuQ.esm.js → tri-6laLcIfQ.esm.js}

@@ -1,4 +1,4 @@
-import { t as SDK_VERSION } from "./sdkVersion-DJCo6uSb.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-D0wnG9m1.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
 import { t as BrowserLazyImportProvider } from "./BrowserLazyImportProvider-BhoA957O.esm.js";
 //#region ../infra/src/providers/browser/TransactionalRiskIntelligenceProvider.ts

package/dist/tri.esm.js

@@ -1,2 +1,2 @@
-import { a as isTRIStarted, d as startTRI, f as stopTRI, l as resetTRI, n as createTRISession, r as getTRIActivityId, u as setupTRI } from "./tri-C9SvtzuQ.esm.js";
+import { a as isTRIStarted, d as startTRI, f as stopTRI, l as resetTRI, n as createTRISession, r as getTRIActivityId, u as setupTRI } from "./tri-6laLcIfQ.esm.js";
 export { createTRISession, getTRIActivityId, isTRIStarted, resetTRI, setupTRI, startTRI, stopTRI };

package/dist/{trueSightService-OZl8wQu7.esm.js → trueSightService-BPs_VmAj.esm.js}

@@ -2,7 +2,7 @@ import { T as resolveWasmConfig, _ as emitWasmDiagnostic, a as setWebApiHttpTran
 import { n as getTimestamp } from "./IBrowserEnvironmentCapability-D7JG7ML3.esm.js";
 import { C as subscribeEvent, n as eventModuleNames } from "./events-ggpBBaZ8.esm.js";
 import { i as isApiConfigured, l as withTiming, n as getApi, o as setClient, r as getToken, t as api, u as endpoints } from "./api-CpP4PS4S.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-DJCo6uSb.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-D0wnG9m1.esm.js";
 import { n as reportHttpError, t as HttpRequestError } from "./HttpRequestError-Bh0pNGSC.esm.js";
 /** Dirty-timer half of the interrupted-snapshot rebuild debounce (module boundaries + timer). */
 const SNAPSHOT_DIRTY_INTERVAL_MS = 15e3;

package/dist/{urlUtils-eYiyWjh0.esm.js → urlUtils-B2wagB5v.esm.js}

@@ -22,5 +22,18 @@ function stripUrlQueryAndFragment(url) {
 		return url.split(/[?#]/, 1)[0];
 	}
 }
+/**
+* Exact origin (`scheme://host[:port]`) of an absolute `http:` or `https:`
+* URL, or `undefined` for anything else (relative, unparsable, other schemes).
+*/
+function getHttpUrlOrigin(url) {
+	try {
+		const parsed = new URL(url);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return;
+		return parsed.origin;
+	} catch {
+		return;
+	}
+}
 //#endregion
-export { stripUrlQueryAndFragment as i, getUrlSearchParam as n, resolveAgainstPageOrigin as r, buildUrlWithSearchParams as t };
+export { stripUrlQueryAndFragment as a, resolveAgainstPageOrigin as i, getHttpUrlOrigin as n, getUrlSearchParam as r, buildUrlWithSearchParams as t };