import { n as WasmPipeline } from "./warmup-Dv2alr2-.js";
import { s as TransactionalRiskIntelligenceSetupConfig } from "./index-BKOWUhxG.js";
import { c as FeatureManagementRedactedUserInfo } from "./IFeatureManagementCapability-De8wpbGh.js";
//#region src/internal/environment/environment.d.ts
/**
 * Coarse deployment tier for feature-management targeting.
 * See `SetupOptions.environment` in `../../setup.ts` for the public-facing contract
 * (locked by the first `setup()` call that supplies it).
 */
type EnvironmentTier = 'development' | 'staging' | 'production';
//#endregion
//#region src/setup.d.ts
/**
 * WASM warmup configuration. Path fields are optional; omitted values resolve to the Incode CDN defaults.
 */
type WasmConfig = {
  /**
   * Self-hosted WASM root directory. Resolves standard ml-wasm-kit filenames
   * under this path (`webLib.wasm`, `webLib.js`, `models/`, etc.). Pin a
   * specific version folder when self-hosting so SDK updates do not change
   * which binaries your app loads until you update this path.
   *
   * Example: `https://my-cdn.example.com/ml-wasm-kit-release/v2.13.21`
   *
   * Individual path fields override values derived from `basePath`.
   */
  basePath?: string;
  /** Path to the WASM binary */
  wasmPath?: string;
  /** Path to the SIMD-optimized WASM binary (optional) */
  wasmSimdPath?: string;
  /** Path to the WASM glue code (paired with `wasmPath`) */
  glueCodePath?: string;
  /**
   * Path to the SIMD-optimized WASM glue code (paired with `wasmSimdPath`).
   * If omitted, defaults to a sibling `.js` derived from `wasmSimdPath`.
   */
  glueCodeSimdPath?: string;
  /** Whether to use SIMD optimizations (default: true) */
  useSimd?: boolean;
  /** Which pipelines to preload models for */
  pipelines?: WasmPipeline[];
  /**
   * Base path for ML model files. Models will be loaded from `${modelsBasePath}/${modelFileName}`.
   * If not provided, models are expected in a 'models' subdirectory relative to the WASM binary.
   */
  modelsBasePath?: string;
  /**
   * Enables the WASM module's verbose debug logging/console output.
   *
   * Defaults to `false` — the SDK forces WASM into production mode, so the
   * native module stays quiet. Set to `true` only when you need the WASM
   * diagnostics while debugging.
   */
  showLogs?: boolean;
};
/**
 * Object form of the `encryption` option for {@link SetupOptions}. Reach for
 * this when you need to pin the OAEP MGF1 hash; the boolean shorthand
 * (`encryption: true`) is equivalent to `{}` and uses the SHA-1 default.
 *
 * Which value to pass is **dictated by the E2EE environment Incode has
 * provisioned for your account** — confirm with your Incode account team
 * before changing it.
 */
type EncryptionOptions = {
  /**
   * OAEP MGF1 hash for the in-binary RSA handshake.
   * - `'sha1'` (default) — matches the legacy Java backend default. Most
   *   E2EE environments are happy with this.
   * - `'sha256'` — sends the
   *   `X-RSA-Encryption-Scheme: RSA/NONE/OAEPWITHSHA-256ANDMGF1PADDING`
   *   header on every encrypted request so the server matches. Only use this
   *   if the environment has been configured to honor the explicit header.
   *
   * Locked at the first `setup()` call. To change it, call `reset()` and
   * re-`setup()` from scratch.
   */
  mgf1?: 'sha1' | 'sha256';
};
type FlowSetup = false | {
  preload?: boolean;
  mergeConfig?: boolean;
};
/**
 * Configuration options for the SDK setup.
 */
type SetupOptions = {
  /** The base URL for the API. When omitted, no HTTP client is created — useful when all API actors are overridden via .provide(). */
  apiURL?: string;
  /**
   * The session token for API requests.
   *
   * Optional convenience — when provided, `setup` delegates to
   * `initializeSession({ token, hostingApp })` after the HTTP client is in
   * place. Equivalent to calling `initializeSession` yourself after
   * `setup({ apiURL })` returns, which is the preferred shape when you want to
   * own the moment the session is activated (e.g. between `createSession` and
   * mounting `<incode-flow>`).
   */
  token?: string;
  /**
   * Video Selfie module configuration — see {@link VideoSelfieSetupOptions}.
   *
   * `videoSelfie.apiURL` points the module's multipart video upload at the
   * dedicated video-selfie-service (e.g.
   * `https://video-selfie-service.stage.incodetest.com`).
   *
   * **Testing/special-env override only — omit it in production.** When
   * omitted, the upload endpoints (`/v1/video-upload/*`) resolve against the
   * main `apiURL` like every other endpoint, and the production service mesh
   * (Istio) routes them to the video-selfie-service.
   */
  videoSelfie?: VideoSelfieSetupOptions;
  /** Custom headers to include in all requests */
  customHeaders?: Record<string, string>;
  /** Request timeout in milliseconds */
  timeout?: number;
  /**
   * WASM warmup config.
   * - Omit (default): does not load WASM.
   * - `false`: explicitly disable WASM loading.
   * - Object: load WASM with CDN defaults plus any overrides you provide.
   */
  wasm?: WasmConfig | false;
  /**
   * Enable end-to-end encryption for SDK traffic. When enabled, the SDK
   * negotiates an encrypted transport during initialization (RSA-OAEP key
   * transport + AES-GCM payload encryption). Independent of `token` —
   * encryption can be set up before a session token is known.
   *
   * **Not a self-serve flag.** E2EE has to be provisioned for your account
   * by Incode, and you'll be given a dedicated `apiURL` (typically a
   * `*-e2ee-api.incodesmile.com` host) plus the `mgf1` scheme that
   * environment expects. Pointing this at a non-E2EE host will fail the
   * handshake at `setup()`. Coordinate with your Incode account team before
   * flipping this on.
   *
   * **API key transmission.** E2EE requests must identify the tenant in one
   * of two ways:
   * - Append `/0` to the `apiURL` (e.g. `https://<e2ee-host>/0`) — the
   *   trailing `/0` instructs the server to derive the API key from the
   *   session JWT. Use this whenever a session token is in play.
   * - Pass `customHeaders: { 'x-api-key': '<api key>' }` — required when
   *   the `apiURL` does not include `/0` (sessionless setup, or any flow
   *   that supplies the API key in the header instead of via JWT).
   *
   * Without one of these the server cannot identify the tenant and
   * post-handshake requests fail.
   *
   * Accepts:
   * - `true` → enabled with the default OAEP MGF1 hash (`'sha1'`).
   * - `false` (or omitted) → disabled.
   * - `{}` → same as `true`.
   * - `{ mgf1: 'sha256' }` → enabled with the SHA-256 MGF1 hash.
   *
   * Encryption requires the binary (WASM) transport. If `wasm: false` is set,
   * `setup` throws. If `wasm` is omitted, the binary transport is provisioned
   * automatically with CDN defaults.
   *
   * **Locked at boot.** The first `setup()` call decides whether encryption
   * is on, and if so which MGF1 scheme is used. Subsequent `setup()` calls
   * that would change either of those values throw with a descriptive error.
   * Call `reset()` if you need to change them.
   *
   * **Failure modes.** `setup()` rejects with a descriptive error if the
   * encrypted-transport handshake (`GET /e2ee/key/v2` + `POST /e2ee/key`)
   * cannot complete — most commonly because `apiURL` points at a host that
   * isn't provisioned for E2EE, or because the requested `mgf1` doesn't
   * match what the environment expects. There is no built-in retry; catch
   * and re-call `setup()` after `reset()` if your environment is
   * known-flaky.
   *
   * @throws If `wasm: false` is also set, or if the handshake fails, or if
   *   the encryption value differs from what was locked in on the first
   *   `setup()` call.
   */
  encryption?: boolean | EncryptionOptions;
  /** Optional hosting app identifier for fingerprint tracking */
  hostingApp?: string;
  /**
   * Disables the third-party public-IP lookup (`api.ipify.org`) used to
   * enrich fingerprint and deepsight payloads. When `false`, the SDK uses
   * an empty IP string and never hits ipify.
   *
   * OR'd with the server-side `DISABLE_IPIFY` feature flag. Default: `true`
   * (lookup enabled).
   */
  ipLookup?: boolean;
  /**
   * Disables client-side device-fingerprint submission
   * (`POST /omni/add/device-fingerprint`). When `false`, the SDK skips that
   * request entirely — `initializeSession` still runs, but
   * `getSessionFingerprintResult()` resolves to `undefined`, so
   * `showMandatoryConsent`/`regulationType` are not available and mandatory
   * consent will not be auto-injected into `flow`/`workflow`.
   *
   * Also blanks the `fingerprintHash` field of the Deepsight metadata bundle
   * collected during face capture (selfie/authentication/id/personhood) — the
   * descriptive device fields and `webglFingerprint` are unaffected.
   *
   * When `false`, also enables WASM on-device mode: the native WASM module
   * skips its own full fingerprint collection and keeps only the
   * device-detection DTO. Applied immediately and honored by every
   * subsequent WASM warmup (setup-time or lazy, e.g. triggered later by
   * `<incode-flow>`/`<incode-workflow>`).
   *
   * Default: `true` (fingerprint submission enabled).
   */
  fingerprint?: boolean;
  /**
   * Controls Flow-backed standalone module configuration.
   * - Omit or `{}`: supplied config is used verbatim; omitted config resolves
   *   from Flow when the module mounts.
   * - `{ preload: true }`: await Flow prefetch during setup without changing
   *   how supplied config is handled.
   * - `{ mergeConfig: true }`: merge supplied partial config over Flow config
   *   when the module mounts.
   * - `false`: never resolve standalone module config from Flow.
   */
  flow?: FlowSetup;
  /**
   * Disables the browser devtools detector for local development. When `true`,
   * the detector is **not** started, so devtools no longer gets repeatedly
   * paused on the detector's `debugger` statements.
   *
   * Leave this `false` (default) in production: the detector feeds an
   * anti-fraud signal and should stay on for real users.
   *
   * Note: WASM console logging is controlled separately via `wasm.showLogs`
   * (off by default).
   */
  devMode?: boolean;
  /**
   * Transactional Risk Intelligence (TRI) telemetry configuration.
   *
   * TRI starts during `setup()` only when **both** `token` and `apiURL` are
   * present in the supplied config object. Omitting `tri`, or providing `tri`
   * without either required field, is the implicit opt-out — no warning is
   * emitted and no collectors are started.
   *
   * `setup()` emits a `[TRI]` console warning when `tri` is provided as an
   * object but a required field is missing:
   * - `token` absent — add `tri.token` (a short-lived SDK token obtained from
   *   `createTRISession`; never pass the organization API key directly).
   * - `apiURL` absent — add `tri.apiURL` (the TRI ingest endpoint URL).
   *
   * `autostart` controls whether `setup()` also calls `startTRI` after
   * `setupTRI`. Omit it (or pass `true`) for the default boot-time start.
   * Pass `autostart: false` when you need to defer collection — for example,
   * until after a consent gate — `setup()` will still resolve the config and
   * call `setupTRI` so the SDK is ready; call `startTRI()` yourself when
   * collection should begin.
   */
  tri?: TransactionalRiskIntelligenceSetupConfig;
  /**
   * TrueSight diagnostics — Incode-internal SDK-health telemetry
   * (engineering-only dashboard, not customer analytics). During a session
   * the SDK buffers sanitized, structured diagnostic breadcrumbs (module
   * outcomes, error codes, timings — never PII, never captured images) and,
   * at the session terminal, uploads ONE encrypted record to the Incode
   * diagnostics backend. Used by Incode to debug customer-reported capture
   * issues. Fire-and-forget and fail-open: it adds no retries, no blocking
   * work, and can never affect the host flow.
   *
   * - `enabled` — set `false` to opt out entirely (no collection, no
   *   subscriptions, no upload). Default: `true` (native SDK parity). Also
   *   subject to a server-side kill-switch; an explicit server `false` stops
   *   collection remotely regardless of this option.
   *
   * Decided by the first `setup()` call of the SDK lifecycle; later `setup()`
   * calls cannot re-enable or disable it mid-session. Call `reset()` to start
   * a new lifecycle with a different value.
   */
  trueSight?: {
    enabled?: boolean;
  };
  /**
   * Enables feature management. Loaded during `setup()` as a separate dynamic chunk,
   * never part of the main `@incodetech/core` bundle.
   *
   * Uses no customer API key: identity starts with the client SDK's
   * auto-generated StableID plus the deployment tier from `environment`
   * below (plus `clientExperimentId`, when supplied), and is enriched over
   * the session lifecycle with `hashed_onboarding_id` (once the session
   * initializes), `flow_id` (from the flow response), or `workflow_id` (from
   * the workflow configuration). The applicable enrichments are awaited
   * before the first module renders. Read gates/experiments via
   * `@incodetech/core/feature-management`.
   *
   * Boot is awaited as part of `setup()` and never throws. Session, flow, and
   * workflow loaders then await their identity enrichments before the first
   * module renders, so evaluations never use a stale identity.
   *
   * Accepts:
   * - `true` (default) or omitted — enabled, no `clientExperimentId` or
   *   privacy flags.
   * - `false` — full opt-out: no chunk is fetched and no
   *   feature-management network traffic occurs. Reads from
   *   `@incodetech/core/feature-management` still work when disabled; they
   *   simply resolve to their documented defaults (gates `false`,
   *   experiments fall back, dynamic configs `null`).
   * - `{ clientExperimentId?, disableStableId?, disablePersistence? }` —
   *   enabled with the given identity/privacy configuration.
   *
   * **Only the first `setup()` call that enables feature management may
   * initialize it.** Every later enabled `setup()` call logs a `console.error`
   * and is ignored, regardless of whether its values match. For multi-step
   * boot, call `setup()` once and activate the token later with
   * `initializeSession({ token })`. Call `reset()` before starting a new SDK
   * lifecycle.
   *
   * Default: `true`.
   */
  featureManagement?: boolean | FeatureManagementSetupOptions;
  /**
   * Coarse deployment tier for feature-management (Statsig) targeting: one of
   * `'development'`, `'staging'`, or `'production'`. No finer granularity.
   * Default: `'production'`.
   *
   * Used by the first enabled feature-management initialization only — see
   * `featureManagement` above.
   *
   * No effect when `featureManagement` is `false`.
   *
   * @example
   * ```ts
   * await setup({ apiURL, environment: 'staging' });
   * ```
   */
  environment?: EnvironmentTier;
};
/**
 * The `videoSelfie` option for {@link SetupOptions}.
 */
type VideoSelfieSetupOptions = {
  /**
   * Base URL (origin) of the dedicated video-selfie-service that handles the
   * Video Selfie module's multipart video upload. The service authenticates
   * with the same session token as the main API — no extra credentials
   * needed. Only the Video Selfie module's recording upload uses this;
   * nothing else is affected.
   *
   * Testing/special-env override: in production the main `apiURL` serves the
   * upload paths too (the service mesh routes `/v1/video-upload/*` to the
   * video-selfie-service), so this should normally stay unset. Set it only
   * where that routing doesn't exist — e.g. stage, or a self-hosted
   * environment that exposes the service on its own origin.
   */
  apiURL?: string;
};
/**
 * Object form of the `featureManagement` option for {@link SetupOptions}.
 * The boolean shorthand (`featureManagement: true`) is equivalent to `{}`.
 */
type FeatureManagementSetupOptions = {
  /**
   * Integrator-scoped randomization/targeting unit, registered as
   * the `client_experiment_id` custom ID during initialization.
   * Agreed with your Incode representative — use it to
   * target or bucket gates/experiments for a specific integrator (e.g. a
   * pilot rollout), independent of the per-user/per-session identity built
   * up from StableID, `hashed_onboarding_id`, `flow_id`, and `workflow_id`.
   */
  clientExperimentId?: string;
  /**
   * Prevents the feature-management from generating a StableID for this
   * user at all. The strongest privacy control: with no StableID and
   * no other randomization-unit ID yet known, evaluations
   * resolve to control/default until `hashed_onboarding_id`, `flow_id`, or
   * `workflow_id` arrives later in the session. Default: `false` (StableID
   * enabled).
   */
  disableStableId?: boolean;
  /**
   * Prevents the feature-management from persisting any state
   * (including the StableID) to local storage (`disableStorage`) — identity
   * is in-memory only for the lifetime of the page and is never linkable
   * across page loads. Trades away feature-management's local bootstrap cache, so
   * every session re-fetches on boot. Default: `false` (persistence
   * enabled).
   */
  disablePersistence?: boolean;
  /**
   * Arbitrary attributes attached to the feature-management user for
   * targeting rules and analytics. Unlike `clientExperimentId`, these are not randomization units
   * — they don't bucket experiments, but gate/experiment targeting conditions can read
   * them, and they annotate exposure/event logs.
   *
   * Set once at boot; enriching later is not currently supported here.
   * Avoid putting PII or secrets in these values — they reach the
   * feature-management backend's logs as-is.
   *
   * `sdkVersion` is a reserved key — the SDK always sets it to its own
   * published version, overwriting any value you supply here.
   */
  custom?: Record<string, unknown>;
  /**
   * Version of the *host application* embedding the SDK (e.g. the
   * onboarding web app), mapped to Statsig's first-class `appVersion` user
   * field. This unlocks native version-comparator targeting (`>=`,
   * `between`, ...) in the Statsig console, independent of the SDK's own
   * version (always sent as `custom.sdkVersion`). Leave unset unless you
   * are the host application and want to target by your own release.
   */
  appVersion?: string;
  /**
   * Which auto-collected feature-management user fields to blank out before
   * sending them to the provider. Covers every field the underlying SDK
   * collects except `custom`/`customIDs` (already caller-controlled above).
   * `ip` and `country` are redacted by default; pass `false` for either to
   * send it, or `true` for any other field to redact it too.
   */
  redactedUserInfo?: FeatureManagementRedactedUserInfo;
};
/**
 * Initializes the SDK with the provided configuration.
 * Must be called before using any SDK functionality.
 *
 * WASM loads only when `options.wasm` is provided as an object.
 *
 * `setup` is boot — it provisions the HTTP client, the optional E2EE
 * handshake, WASM warmup, and the analytics batcher. The session token is a
 * separate concern: hand it off via `initializeSession({ token })` from
 * `@incodetech/core/session`, or pass it inline as `setup({ apiURL, token })`
 * (a convenience that delegates to `initializeSession` for you).
 *
 * @param options - Configuration options for the SDK
 *
 * @example Boot first, activate the session later (preferred)
 * ```ts
 * import { setup } from '@incodetech/core';
 * import { createSession, initializeSession } from '@incodetech/core/session';
 *
 * await setup({ apiURL: 'https://api.incode.com' });
 * const session = await createSession(apiKey, { configurationId });
 * await initializeSession({ token: session.token });
 * ```
 *
 * @example One-shot convenience
 * ```ts
 * await setup({ apiURL: 'https://api.incode.com', token: 'session-token' });
 * ```
 *
 * @example Explicitly disable WASM
 * ```ts
 * await setup({ apiURL: 'https://api.incode.com', wasm: false });
 * ```
 *
 * @example Use CDN defaults for paths and preload only one pipeline
 * ```ts
 * await setup({
 *   apiURL: 'https://api.incode.com',
 *   wasm: { pipelines: ['selfie'] },
 * });
 * ```
 *
 * @example Self-hosted WASM (pin a version folder on your CDN)
 * ```ts
 * await setup({
 *   apiURL: 'https://api.incode.com',
 *   wasm: {
 *     basePath: 'https://my-cdn.example.com/ml-wasm-kit-release/v2.13.21',
 *   },
 * });
 * ```
 *
 * @example Partial override: only models path, rest from CDN
 * ```ts
 * await setup({
 *   apiURL: 'https://api.incode.com',
 *   wasm: { modelsBasePath: 'https://my-cdn/models' },
 * });
 * ```
 *
 * @example Sessionless setup (all API actors overridden via .provide())
 * ```ts
 * await setup({
 *   wasm: {
 *     wasmPath: '/wasm/ml-wasm.wasm',
 *     glueCodePath: '/wasm/ml-wasm.js',
 *     pipelines: ['selfie'],
 *   },
 * });
 * ```
 *
 * @example Enable end-to-end encryption at boot (defaults to MGF1 = SHA-1)
 * ```ts
 * // `/0` lets the server read the API key from the session JWT.
 * await setup({
 *   apiURL: 'https://your-e2ee-api.incodesmile.com/0',
 *   encryption: true,
 * });
 * ```
 *
 * @example Enable encryption with the SHA-256 MGF1 padding
 * ```ts
 * await setup({
 *   apiURL: 'https://your-e2ee-api.incodesmile.com/0',
 *   encryption: { mgf1: 'sha256' },
 * });
 * ```
 *
 * @example E2EE without the `/0` suffix — pass the API key explicitly
 * ```ts
 * await setup({
 *   apiURL: 'https://your-e2ee-api.incodesmile.com',
 *   encryption: true,
 *   customHeaders: { 'x-api-key': process.env.INCODE_API_KEY },
 * });
 * ```
 * @example Disable third-party IP lookup
 * ```ts
 * await setup({
 *   apiURL: 'https://api.incode.com',
 *   ipLookup: false,
 * });
 * ```
 *
 * @example Local development: silence the devtools detector and surface WASM logs
 * ```ts
 * await setup({
 *   apiURL: 'https://api.incode.com',
 *   wasm: { showLogs: true }, // WASM logs are off by default
 *   devMode: true, // skip the devtools detector (don't ship this in prod)
 * });
 * ```
 * @example Enable TRI — exchange the API key for an SDK token first, then pass it to setup
 * ```ts
 * const session = await createTRISession(process.env.INCODE_API_KEY, {
 *   apiURL: process.env.INCODE_TRI_API_URL,
 * });
 *
 * await setup({
 *   apiURL: 'https://api.incode.com',
 *   tri: { token: session.token, apiURL: process.env.INCODE_TRI_API_URL },
 * });
 * ```
 *
 * @example Defer TRI collection until after a consent gate
 * ```ts
 * // Boot without starting collectors:
 * await setup({
 *   apiURL: 'https://api.incode.com',
 *   tri: { token: session.token, apiURL: process.env.INCODE_TRI_API_URL, autostart: false },
 * });
 *
 * // somewhere else in the code
 * await startTRI();
 * ```
 */
declare function setup(options: SetupOptions): Promise<void>;
/**
 * Sets the WASM configuration without performing warmup.
 * Useful when WASM warmup is handled separately (e.g., conditionally based on flow).
 *
 * @param config - WASM configuration to store
 */
declare function setWasmConfig(config: WasmConfig): void;
/**
 * Initializes WasmUtilProvider with the stored WASM configuration.
 * Should be called after warmupWasm() completes when using conditional warmup.
 * This ensures image encryption works properly.
 *
 * @param config - Optional WASM configuration. If not provided, uses the stored config from setWasmConfig().
 * @throws Error if no config is provided and none is stored
 */
declare function initializeWasmUtil(config?: WasmConfig): Promise<void>;
/**
 * Warms additional WASM pipelines on demand, reusing the WASM config stored by
 * `setup({ wasm })` / `setWasmConfig`. Used for module-level lazy loading — e.g.
 * the video-selfie tutorial preloads its `videoSelfie`/`videoSelfieId` pipelines
 * while the user reads, so detection is ready the moment recording starts.
 *
 * `warmupWasm` is idempotent: already-loaded pipelines are skipped and missing
 * ones are merged into the running instance. No-op when WASM was never
 * configured or `pipelines` is empty.
 *
 * @param pipelines - The pipelines to ensure are loaded.
 */
declare function ensureWasmPipelines(pipelines: readonly WasmPipeline[]): Promise<void>;
/**
 * Replaces the active HTTP client with the WASM-backed one. Used internally
 * by lazy-loading UI components (`<incode-flow>`, `<incode-workflow>`) when
 * WASM finishes warming up.
 *
 * No-op when no apiURL was originally configured, or when the active client is
 * already the WASM one.
 *
 * @internal NOT a public API. Application code should use
 *   `setup({ wasm: {...} })` instead — that path is the supported way to opt
 *   into the WASM HTTP client.
 *
 * @param config - Optional WASM configuration. Defaults to the config stored via `setWasmConfig`.
 */
declare function upgradeToWasmHttpClient(config?: WasmConfig): Promise<void>;
/**
 * Checks if the SDK has been configured.
 *
 * @returns true if setup() has been called, false otherwise
 */
declare function isConfigured(): boolean;
/**
 * Resets the SDK configuration. Useful for testing.
 */
declare function reset(): void;
//#endregion
export { isConfigured as a, setup as c, initializeWasmUtil as i, upgradeToWasmHttpClient as l, WasmConfig as n, reset as o, ensureWasmPipelines as r, setWasmConfig as s, SetupOptions as t };