@incodetech/web 0.0.0-dev-20260428-98e9ebb → 0.0.0-dev-20260428-7b99b18

package/dist/flow/flow.es.js

@@ -7,9 +7,9 @@ import { t as d } from "../incodeModule-CHzKl22Y.js";
 import { a as f, c as p, d as m, i as h, l as g, n as _, o as v, p as y, r as b, s as x, t as S, u as C } from "../useModuleLoader-D_nCByUY.js";
 import { getDeviceClass as w } from "@incodetech/core/device";
 import { getRequiredWasmPipelines as T } from "@incodetech/core/flow";
-import { createSession as E, validateQrUuid as D } from "@incodetech/core/session";
+import { QrValidationError as E, bootstrapSession as D, refreshQrUrlUuid as O } from "@incodetech/core/session";
 //#region src/shared/processing/useDelayedFlag.ts
-function O(e, n) {
+function k(e, n) {
 	let [r, i] = a(!1);
 	return t(() => {
 		if (e === !1) {
@@ -26,38 +26,30 @@ function O(e, n) {
 }
 //#endregion
 //#region src/modules/flow/createFlowSession.ts
-function k(e) {
+function A(e) {
 	return Array.from(new Uint8Array(e), (e) => e.toString(16).padStart(2, "0")).join("");
 }
-async function A(e) {
+async function j(e) {
 	let t = globalThis.crypto?.subtle;
 	if (!t) throw Error("SHA-1 is not available in this environment");
-	return k(await t.digest("SHA-1", new TextEncoder().encode(e)));
+	return A(await t.digest("SHA-1", new TextEncoder().encode(e)));
 }
-async function j(e) {
+async function M(e) {
 	if (typeof e.apiKey == "string") return e.apiKey;
-	if (typeof e.clientId == "string") return A(e.clientId);
+	if (typeof e.clientId == "string") return j(e.clientId);
 	throw Error("Flow self-loading mode requires apiKey or clientId");
 }
-async function M(e, t) {
-	if (typeof e.urlUuid != "string" || e.urlUuid.length === 0) return;
-	let n = await D({
-		onboardingId: e.uuid ?? null,
-		urlUuid: e.urlUuid
-	}, t);
-	return e.onUrlUuidRefreshed?.(n.urlUuid), n.urlUuid;
-}
 async function N(e, t) {
-	let n = await j(e), r = await M(e, t);
-	return E(n, {
+	return D(await M(e), {
 		configurationId: e.configurationId,
 		externalId: e.externalId,
 		externalCustomerId: e.externalCustomerId,
 		language: e.lang,
 		customFields: e.customFields,
 		uuid: e.uuid,
-		urlUuid: r,
-		interviewId: e.interviewId
+		urlUuid: e.urlUuid,
+		interviewId: e.interviewId,
+		onUrlUuidRefreshed: e.onUrlUuidRefreshed
 	}, t);
 }
 //#endregion
@@ -95,6 +87,7 @@ function L(e) {
 }
 function R(e) {
 	let { token: t } = e;
+	if (e.urlUuid) throw Error("preloadIncodeFlow does not support urlUuid; pass it to <IncodeFlow> directly so the SDK can rotate it on mount.");
 	if (I.has(t)) return L(t);
 	let n, r, i = new Promise((e, t) => {
 		n = e, r = t;
@@ -179,20 +172,28 @@ function U(e) {
 					flowManager: e.flowManager
 				}));
 			}).catch((e) => {
-				let t = e instanceof Error ? e.message : "Preload failed";
+				let t = e instanceof Error ? e.message : "Preload failed", n = e instanceof E ? e.status : void 0;
 				f({
 					status: "error",
 					error: t,
+					errorCode: n,
 					flowManager: d.flowManager
-				}), c?.(t);
+				}), c?.(t, n);
 			});
 			return;
 		}
-		m.current || (m.current = !0, (async () => {
+		if (m.current) return;
+		m.current = !0;
+		let r = new AbortController(), { signal: a } = r;
+		return (async () => {
 			try {
 				let t;
-				if (P(e)) t = e.token;
-				else if (F(e)) t = (await N(e)).token;
+				if (P(e)) t = e.token, e.urlUuid && await O({
+					urlUuid: e.urlUuid,
+					onboardingId: null,
+					onRefreshed: e.onUrlUuidRefreshed
+				}, a);
+				else if (F(e)) t = (await N(e, a)).token;
 				else throw Error("Flow requires token, or configurationId with apiKey or clientId");
 				await p({
 					token: t,
@@ -201,20 +202,22 @@ function U(e) {
 				});
 				let r = i ? Promise.resolve() : x().then((e) => {
 					e.uiConfig && s(e.uiConfig);
-				}), a = d.flowManager.waitForReady();
-				await Promise.all([a, r]), f({
+				}), o = d.flowManager.waitForReady();
+				await Promise.all([o, r]), f({
 					status: "ready",
 					flowManager: d.flowManager
 				});
 			} catch (e) {
-				let t = e instanceof Error ? e.message : "Failed to initialize SDK";
+				if (a.aborted) return;
+				let t = e instanceof Error ? e.message : "Failed to initialize SDK", n = e instanceof E ? e.status : void 0;
 				f({
 					status: "error",
 					error: t,
+					errorCode: n,
 					flowManager: d.flowManager
-				}), c?.(t);
+				}), c?.(t, n);
 			}
-		})());
+		})(), () => r.abort();
 	}, [
 		l,
 		n,
@@ -242,7 +245,7 @@ var W = n(() => import("../homeScreen-CS1MmbXm.js").then((e) => ({ default: e.Ho
 		moduleKey: d.status === "ready" && d.homeScreen.visible ? g : void 0,
 		modules: f
 	});
-	let x = v.status === "loaded", w = n.enableHome === !0 && d.status === "ready" && d.flow.disableLaunchScreen !== !0 && d.currentStepIndex === 0 && d.homeScreen.visible === !1 && v.status === "loading", E = O(d.presentation.isAwaitingReady === !0, 150), D = O(d.status === "ready" && (v.status === "idle" || v.status === "loading" || v.status === "error"), 150);
+	let x = v.status === "loaded", w = n.enableHome === !0 && d.status === "ready" && d.flow.disableLaunchScreen !== !0 && d.currentStepIndex === 0 && d.homeScreen.visible === !1 && v.status === "loading", E = k(d.presentation.isAwaitingReady === !0, 150), D = k(d.status === "ready" && (v.status === "idle" || v.status === "loading" || v.status === "error"), 150);
 	b(d?.status === "ready" ? d.steps : [], d?.status === "ready" ? d.currentStepIndex : -1, f, x), t(() => {
 		if (n.onFlowEvent) return p.subscribeFlowEvent(n.onFlowEvent);
 	}, [p, n.onFlowEvent]), t(() => {
@@ -268,7 +271,7 @@ var W = n(() => import("../homeScreen-CS1MmbXm.js").then((e) => ({ default: e.Ho
 	]), t(() => {
 		d?.status === "ready" && d.currentStep === "ID" && d.steps.includes("TUTORIAL_ID") && p.completeModule();
 	}, [d, p]);
-	let k = !(n.spinnerConfig?.title || n.spinnerConfig?.subtitle);
+	let O = !(n.spinnerConfig?.title || n.spinnerConfig?.subtitle);
 	if (l.status === "error") return /* @__PURE__ */ o("div", {
 		class: "IncodeFlow",
 		children: /* @__PURE__ */ o("div", { children: ["Error: ", l.error] })
@@ -287,14 +290,14 @@ var W = n(() => import("../homeScreen-CS1MmbXm.js").then((e) => ({ default: e.Ho
 		class: "IncodeFlow",
 		children: /* @__PURE__ */ o(u, {
 			spinnerConfig: n.spinnerConfig,
-			hideText: k
+			hideText: O
 		})
 	});
 	if (d.presentation.isAwaitingReady) return E ? /* @__PURE__ */ o("div", {
 		class: "IncodeFlow",
 		children: /* @__PURE__ */ o(u, {
 			spinnerConfig: n.spinnerConfig,
-			hideText: k
+			hideText: O
 		})
 	}) : /* @__PURE__ */ o("div", { class: "IncodeFlow" });
 	if (d.status === "error") return /* @__PURE__ */ o("div", {
@@ -308,7 +311,7 @@ var W = n(() => import("../homeScreen-CS1MmbXm.js").then((e) => ({ default: e.Ho
 			class: "IncodeFlow",
 			children: /* @__PURE__ */ o(u, {
 				spinnerConfig: n.spinnerConfig,
-				hideText: k
+				hideText: O
 			})
 		});
 		if (v.status === "unsupported") return /* @__PURE__ */ o("div", {
@@ -322,7 +325,7 @@ var W = n(() => import("../homeScreen-CS1MmbXm.js").then((e) => ({ default: e.Ho
 			class: "IncodeFlow",
 			children: /* @__PURE__ */ o(u, {
 				spinnerConfig: n.spinnerConfig,
-				hideText: k
+				hideText: O
 			})
 		}) : /* @__PURE__ */ o("div", { class: "IncodeFlow" });
 		let { Component: s } = v;

package/dist/types/ae-signature.d.ts

@@ -22,8 +22,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/antifraud.d.ts

@@ -22,8 +22,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/authentication.d.ts

@@ -25,8 +25,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/consent.d.ts

@@ -23,8 +23,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/cross-document-data-match.d.ts

@@ -22,8 +22,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/curp-validation.d.ts

@@ -22,8 +22,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/ekyb.d.ts

@@ -22,8 +22,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/ekyc.d.ts

@@ -22,8 +22,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/electronic-signature.d.ts

@@ -25,8 +25,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/email.d.ts

@@ -49,8 +49,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/extensibility.d.ts

@@ -414,8 +414,13 @@ export declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknow
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 declare type InferState<T> = T extends {

package/dist/types/face-match.d.ts

@@ -47,8 +47,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/flow.d.ts

@@ -65,11 +65,26 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
-declare type PreloadConfig = TokenFlowRuntimeConfig;
+/**
+ * Preload runs before the Flow component mounts and only prefetches the flow
+ * config + theme — it never burns a urlUuid. Allowing one would silently skip
+ * phishing-resistance rotation on mount (the consume path bypasses the init
+ * useEffect), so the field is forbidden at the type and runtime boundaries.
+ * Topology B (mobile leg of a desktop→mobile redirect) cannot use preload —
+ * pass `urlUuid` to `<IncodeFlow>` directly instead.
+ */
+declare type PreloadConfig = Omit<TokenFlowRuntimeConfig, 'urlUuid'> & {
+    urlUuid?: never;
+};
 
 export declare type PreloadHandle = {
     get isReady(): boolean;
@@ -96,6 +111,12 @@ declare type SpinnerSize = 'small' | 'medium' | 'large';
 
 declare type TokenFlowRuntimeConfig = FlowBaseConfig & {
     token: string;
+    /** QR anti-phishing token from the incoming URL (mobile leg of a desktop→mobile redirect).
+     *  When provided, the SDK rotates it on mount via `validateQrUuid` and invokes
+     *  `onUrlUuidRefreshed` so the host can update the address bar. Validation
+     *  failures abort initialization via `onError` (with the HTTP status as
+     *  `errorCode`). */
+    urlUuid?: string;
     apiKey?: never;
     clientId?: never;
     configurationId?: never;
@@ -103,7 +124,6 @@ declare type TokenFlowRuntimeConfig = FlowBaseConfig & {
     externalCustomerId?: never;
     customFields?: never;
     uuid?: never;
-    urlUuid?: never;
     interviewId?: never;
 };
 

package/dist/types/geolocation.d.ts

@@ -23,8 +23,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/governmentValidation.d.ts

@@ -22,8 +22,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/id.d.ts

@@ -23,8 +23,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/identity-reuse.d.ts

@@ -23,8 +23,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export { }

package/dist/types/phone.d.ts

@@ -19,8 +19,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 /**

package/dist/types/qe-signature.d.ts

@@ -18,8 +18,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export declare const QeSignature: FC<QeSignatureModuleProps>;

package/dist/types/selfie.d.ts

@@ -19,8 +19,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export declare const Selfie: FC<SelfieProps>;

package/dist/types/signature.d.ts

@@ -18,8 +18,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export declare const Signature: FC<SignatureProps>;

package/dist/types/watchlist.d.ts

@@ -18,8 +18,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export declare const Watchlist: FC<WatchlistProps>;

package/dist/types/workflow.d.ts

@@ -20,8 +20,13 @@ declare type IncodeModuleProps<TConfig, TResult = void, TManager = unknown> = {
     onFinish?: (result?: TResult) => void;
     /**
      * Callback invoked when a fatal module error occurs.
+     *
+     * @param error - Human-readable error message.
+     * @param errorCode - Optional numeric code (e.g. HTTP status). Populated by
+     *   the workflow and flow modules on QR validation failures —
+     *   `4081` (`invalidQRuuid`) or `4083` (`onboardingUrlAlreadyUsed`).
      */
-    onError?: (error: string | undefined) => void;
+    onError?: (error: string | undefined, errorCode?: number) => void;
 };
 
 export declare const IncodeWorkflow: FC<IncodeWorkflowProps>;
@@ -47,8 +52,17 @@ export declare type WorkflowComponentConfig = {
     isDesktop?: boolean;
     /** Authentication hint for AUTHENTICATION module. Required when workflow includes face authentication. */
     authHint?: string;
+    /**
+     * QR anti-phishing token from the incoming URL. When provided, the SDK burns
+     * it via `POST /omni/qr/validate` on mount and invokes `onUrlUuidRefreshed`
+     * with the rotated value so the host can update the address bar (e.g.,
+     * `history.replaceState`). Validation failures abort initialization via
+     * `onError`.
+     */
+    urlUuid?: string;
     onModuleLoading?: (moduleKey: string) => void;
     onModuleLoaded?: (moduleKey: string) => void;
+    onUrlUuidRefreshed?: (urlUuid: string) => void;
 };
 
 export { }

package/dist/workflow/workflow.es.js

@@ -7,13 +7,14 @@ import { t as c } from "../transitionSpinner-DqDwaNM6.js";
 import { t as l } from "../incodeModule-CHzKl22Y.js";
 import { a as u, f as d, i as f, m as p, t as m } from "../useModuleLoader-D_nCByUY.js";
 import { resolveWasmConfig as h, warmupWasm as g } from "@incodetech/core/wasm";
-import { createWorkflowManager as _ } from "@incodetech/core/workflow";
+import { QrValidationError as _, refreshQrUrlUuid as v } from "@incodetech/core/session";
+import { createWorkflowManager as y } from "@incodetech/core/workflow";
 //#region src/modules/workflow/workflowInit.ts
-var v = {
+var b = {
 	...u,
 	REDIRECT_TO_MOBILE: () => import("../redirectToMobile-DgKIsArJ.js").then((e) => e.RedirectToMobile)
 };
-async function y() {
+async function x() {
 	try {
 		let e = await p();
 		return {
@@ -27,14 +28,14 @@ async function y() {
 		return {};
 	}
 }
-function b(e = {}) {
-	return _({
+function S(e = {}) {
+	return y({
 		customModuleCallback: e.customModuleCallback,
 		interviewId: e.interviewId,
 		isDesktop: e.isDesktop
 	});
 }
-function x(e) {
+function C(e) {
 	e !== !1 && g(h({
 		...e,
 		pipelines: e?.pipelines ?? ["selfie", "idCapture"]
@@ -44,55 +45,65 @@ function x(e) {
 }
 //#endregion
 //#region src/modules/workflow/useWorkflowInitialization.ts
-function S(e) {
-	let { token: i, lang: o, disableDashboardTheme: s, wasmConfig: c, customModuleCallback: l, interviewId: u, isDesktop: f, onError: p } = e, m = n(null), [h, g] = r(() => {
-		let e = b({
+function w(e) {
+	let { token: i, lang: o, disableDashboardTheme: s, wasmConfig: c, customModuleCallback: l, interviewId: u, isDesktop: f, urlUuid: p, onError: m, onUrlUuidRefreshed: h } = e, g = n(null), [y, b] = r(() => {
+		let e = S({
 			customModuleCallback: l,
 			interviewId: u,
 			isDesktop: f
 		});
-		return m.current = e, {
+		return g.current = e, {
 			status: "initializing",
 			workflowManager: e
 		};
-	}), _ = n(!1);
+	}), w = n(!1);
 	return t(() => {
-		if (h.status !== "initializing" || _.current) return;
-		_.current = !0;
-		let e = m.current;
+		if (y.status !== "initializing" || w.current) return;
+		w.current = !0;
+		let e = g.current, t = new AbortController(), { signal: n } = t;
 		return (async () => {
 			try {
 				await d({
 					token: i,
 					lang: o
-				});
-				let t = s ? Promise.resolve() : y().then((e) => {
+				}), p && await v({
+					urlUuid: p,
+					onboardingId: null,
+					onRefreshed: h
+				}, n);
+				let t = s ? Promise.resolve() : x().then((e) => {
 					e.uiConfig && a(e.uiConfig);
 				});
-				x(c), e.load(), await t, g({
+				C(c), e.load(), await t, b({
 					status: "ready",
 					workflowManager: e
 				});
 			} catch (t) {
-				let n = t instanceof Error ? t.message : "Failed to initialize SDK";
-				g({
+				if (n.aborted) return;
+				let r = t instanceof Error ? t.message : "Failed to initialize SDK", i = t instanceof _ ? t.status : void 0;
+				b({
 					status: "error",
-					error: n,
+					error: r,
+					errorCode: i,
 					workflowManager: e
-				}), p?.(n);
+				}), m?.(r, i);
 			}
-		})(), () => e?.stop();
+		})(), () => {
+			t.abort(), e?.stop();
+		};
 	}, [
 		i,
 		o,
 		s,
 		c,
-		p
-	]), h;
+		p,
+		m,
+		h
+	]), y;
 }
 //#endregion
 //#region src/modules/workflow/workflow.tsx
-function C(e) {
+function T(e) {
 	let { moduleKey: t, config: n, workflowId: r, authHint: i, lang: a, mergeSessionRecordings: o, ageAssurance: s } = e;
 	switch (t) {
 		case "AUTHENTICATION": return {
@@ -132,8 +143,8 @@ function C(e) {
 		default: return n;
 	}
 }
-var w = ({ config: r, onFinish: a, onError: s }) => {
-	let { i18n: l } = e(), u = S({
+var E = ({ config: r, onFinish: a, onError: s }) => {
+	let { i18n: l } = e(), u = w({
 		token: r.token,
 		lang: r.lang,
 		disableDashboardTheme: r.disableDashboardTheme,
@@ -141,10 +152,12 @@ var w = ({ config: r, onFinish: a, onError: s }) => {
 		customModuleCallback: r.customModuleCallback,
 		interviewId: r.interviewId,
 		isDesktop: r.isDesktop,
-		onError: s
+		urlUuid: r.urlUuid,
+		onError: s,
+		onUrlUuidRefreshed: r.onUrlUuidRefreshed
 	}), [d, p] = o(() => u.workflowManager, { autoLoad: !1 }), h = m({
 		moduleKey: d?.status === "ready" ? d.currentNode.moduleKey : void 0,
-		modules: v,
+		modules: b,
 		onModuleLoading: r.onModuleLoading,
 		onModuleLoaded: r.onModuleLoaded,
 		onError: s
@@ -160,7 +173,7 @@ var w = ({ config: r, onFinish: a, onError: s }) => {
 		a,
 		d
 	]), t(() => {
-		d?.status === "error" && s && s(d.error);
+		d?.status === "error" && s && s(d.error, d.errorCode);
 	}, [
 		d?.status,
 		s,
@@ -169,7 +182,7 @@ var w = ({ config: r, onFinish: a, onError: s }) => {
 	let _ = () => /* @__PURE__ */ i("div", {
 		class: "IncodeWorkflow",
 		children: /* @__PURE__ */ i(c, { spinnerConfig: r.spinnerConfig })
-	}), y = (e) => {
+	}), v = (e) => {
 		p.errorModule(e ?? "Module error"), s?.(e ?? "Module error");
 	};
 	if (u.status === "error") return null;
@@ -183,11 +196,11 @@ var w = ({ config: r, onFinish: a, onError: s }) => {
 		})
 	});
 	if (h.status === "idle" || h.status === "loading" || h.status === "error") return _();
-	let { Component: b } = h;
+	let { Component: y } = h;
 	return /* @__PURE__ */ i("div", {
 		class: "IncodeWorkflow",
-		children: /* @__PURE__ */ i(b, {
-			config: C({
+		children: /* @__PURE__ */ i(y, {
+			config: T({
 				moduleKey: d.currentNode.moduleKey,
 				config: d.config,
 				workflowId: d.workflowConfig.id,
@@ -197,15 +210,15 @@ var w = ({ config: r, onFinish: a, onError: s }) => {
 				ageAssurance: d.workflowConfig.ageAssurance
 			}),
 			onFinish: () => p.completeModule(),
-			onError: y,
+			onError: v,
 			...d.currentNode.moduleKey === "REDIRECT_TO_MOBILE" ? { onContinue: () => p.completeModule() } : {}
 		}, d.currentNode.id)
 	});
-}, T = ({ config: e, onFinish: t, onError: n }) => /* @__PURE__ */ i(s, { children: e ? /* @__PURE__ */ i(w, {
+}, D = ({ config: e, onFinish: t, onError: n }) => /* @__PURE__ */ i(s, { children: e ? /* @__PURE__ */ i(E, {
 	config: e,
 	onFinish: t,
 	onError: n
 }) : null });
-l(T, "incode-workflow");
+l(D, "incode-workflow");
 //#endregion
-export { T as IncodeWorkflow };
+export { D as IncodeWorkflow };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@incodetech/web",
-  "version": "0.0.0-dev-20260428-98e9ebb",
+  "version": "0.0.0-dev-20260428-7b99b18",
   "type": "module",
   "main": "./dist/index.es.js",
   "types": "./dist/types/index.d.ts",
@@ -230,7 +230,7 @@
     "qrcode": "^1.5.4",
     "signature_pad": "^5.1.3",
     "tailwindcss": "^4.1.17",
-    "@incodetech/core": "0.0.0-dev-20260428-98e9ebb"
+    "@incodetech/core": "0.0.0-dev-20260428-7b99b18"
   },
   "devDependencies": {
     "@microsoft/api-extractor": "^7.53.3",
@@ -273,7 +273,7 @@
     "format": "prettier --write . --ignore-path ../../.prettierignore",
     "format:check": "prettier --check . --ignore-path ../../.prettierignore",
     "typecheck": "tsgo -p tsconfig.json --noEmit",
-    "storybook": "storybook dev -p 6006",
-    "build-storybook": "storybook build"
+    "storybook": "NODE_OPTIONS=--experimental-strip-types storybook dev -p 6006",
+    "build-storybook": "NODE_OPTIONS=--experimental-strip-types storybook build"
   }
 }