@incodetech/core 0.0.0-dev-20260727-4e22043f → 0.0.0-dev-20260727-6d540cf0

package/dist/PrivacyLensProvider-DA3rp6sf.esm.js

@@ -0,0 +1,727 @@
+import { t as createHiddenVideoElement } from "./video-BtSWtHy1.esm.js";
+import { a as createFramePacer, i as publishAvatarStats, n as createStatsWindow, r as isAvatarStatsEnabled, t as createAvatarStatsReporter } from "./avatarStats-BIB3SREM.esm.js";
+//#region ../infra/src/avatar/privacy-lens/privacyLensShaders.ts
+/** Starting point; tuned live via the privacy-lens demo sliders. */
+const PRIVACY_LENS_DEFAULTS = {
+	frost: .55,
+	sandblast: .28,
+	grainSize: .5,
+	brightness: 1.12,
+	shadowLift: .12,
+	warmth: .5,
+	sun: .71,
+	sunSpeed: .26
+};
+const PRIVACY_LENS_VERT = `
+attribute vec2 aPos;
+varying vec2 vUv;
+void main() {
+  vUv = aPos * 0.5 + 0.5;
+  gl_Position = vec4(aPos, 0.0, 1.0);
+}`;
+const GOLDEN_ANGLE = 2.399963;
+/** GLSL float literal (toFixed always keeps the `.` GLSL ES 1.00 requires). */
+const f = (x) => x.toFixed(7);
+const PRIVACY_LENS_FRAG = `
+// The grain hash (h21 below) feeds large gl_FragCoord-derived values through
+// sin()*43758.5 — that overflows mediump's range on many mobile GPUs and
+// collapses the grain to a flat artifact. Use highp where available (all WebGL2
+// and most WebGL1 devices); fall back to mediump on the rare device without it.
+#ifdef GL_FRAGMENT_PRECISION_HIGH
+precision highp float;
+#else
+precision mediump float;
+#endif
+varying vec2 vUv;
+uniform sampler2D uVideo;
+uniform vec2 uRes;        // canvas pixel size (square)
+uniform vec2 uVideoRes;   // decoded video pixel size
+uniform float uTime;      // seconds (sun drift only)
+uniform float uFrost;
+uniform float uSandblast;
+uniform float uGrainSize;
+uniform float uWarmth;
+uniform float uBright;
+uniform float uShadow;
+uniform float uSun;
+uniform float uSunSpeed;
+
+// Static per-cell hash — NO time term, so the grain is a fixed matte surface.
+float h21(vec2 p) {
+  return fract(sin(dot(p, vec2(127.1, 311.7))) * 43758.5453123);
+}
+
+// Cover-fit the (non-square) video into the square output, centre-cropped, so
+// faces are never stretched. Also flips V: the texture is uploaded without
+// UNPACK_FLIP_Y_WEBGL (see PrivacyLensProvider), so row 0 is the TOP of the
+// frame; the flip is symmetric around 0.5, so it composes with the cover crop.
+vec2 coverUv(vec2 uv) {
+  float va = uVideoRes.x / max(uVideoRes.y, 1.0);
+  vec2 o = uv;
+  if (va > 1.0) o.x = (uv.x - 0.5) / va + 0.5;   // landscape: crop sides
+  else          o.y = (uv.y - 0.5) * va + 0.5;    // portrait: crop top/bottom
+  return vec2(o.x, 1.0 - o.y);
+}
+
+void main() {
+  vec2 uv = vUv;
+  vec2 base = coverUv(uv);
+  float aspect = uRes.y / max(uRes.x, 1.0);
+
+  // Per-fragment static seed, clustered into grain cells. Small cells = ultra
+  // fine sandblast (effectively invisible pattern); larger = coarser frosting.
+  vec2 cell = floor(gl_FragCoord.xy / max(uGrainSize, 0.5));
+  float rnd = h21(cell);
+  float baseAngle = rnd * 6.2831853;
+
+  // Stochastic sandblasted scatter: an even golden-angle disk, but each pixel
+  // cell rotates + jitters the kernel differently → a fine matte grain rather
+  // than a smooth blur. The video moves UNDER this fixed glass grain. Taps are
+  // unrolled with baked constants; the per-cell rotation is the single
+  // cos/sin pair below (see TAPS_GLSL).
+  float cb = cos(baseAngle);
+  float sb = sin(baseAngle);
+  float j; float r; vec2 off;
+  vec3 col = vec3(0.0);
+${Array.from({ length: 12 }, (_, i) => {
+	const fi = i + .5;
+	const ux = Math.cos(fi * GOLDEN_ANGLE);
+	const uy = Math.sin(fi * GOLDEN_ANGLE);
+	const rad = Math.sqrt(fi / 12);
+	return `  j = h21(cell + vec2(${f(fi * 7.13)}, ${f(fi * 3.71)}));
+  r = uFrost * 0.06 * ${f(rad)} + (j - 0.5) * uSandblast * 0.03;
+  off = vec2(cb * ${f(ux)} - sb * ${f(uy)}, sb * ${f(ux)} + cb * ${f(uy)}) * r;
+  off.x *= aspect;
+  col += texture2D(uVideo, base + off).rgb;`;
+}).join("\n")}
+  col /= ${f(12)};
+
+  // Airy + warm grade (luminous frosted glass, not murky).
+  col = col + uShadow * (1.0 - col);
+  col *= uBright;
+  vec3 warm = vec3(1.0, 0.92, 0.80);
+  col = mix(col, col * warm + vec3(0.03, 0.015, 0.0), uWarmth);
+
+  // Drifting sun: a broad soft glow + a fine STATIC sparkle (per-cell) that
+  // catches the ground-glass grain only where the light falls — not all-over.
+  vec2 sun = vec2(0.34 + 0.16 * sin(uTime * uSunSpeed),
+                  0.26 + 0.10 * cos(uTime * uSunSpeed * 0.8));
+  float glow = smoothstep(0.7, 0.0, distance(uv, sun));
+  vec3 sunCol = vec3(1.0, 0.96, 0.88);
+  col += sunCol * glow * (0.20 + (rnd - 0.5) * 0.18 * uSandblast) * uSun;
+
+  gl_FragColor = vec4(clamp(col, 0.0, 1.0), 1.0);
+}`;
+//#endregion
+//#region ../infra/src/avatar/privacy-lens/privacyLensGlCore.ts
+/**
+* Builds the lens GL pipeline on `canvas`. Throws if WebGL is unavailable or
+* the program fails to compile/link (callers fall back / surface the error).
+* SELF-CONTAINED — see the module doc before editing.
+*/
+function createPrivacyLensGl(canvas, vertSrc, fragSrc, renderSize) {
+	canvas.width = renderSize;
+	canvas.height = renderSize;
+	const gl = canvas.getContext("webgl", {
+		alpha: false,
+		antialias: false,
+		premultipliedAlpha: false,
+		preserveDrawingBuffer: false
+	}) ?? canvas.getContext("experimental-webgl");
+	if (!gl) throw new Error("privacy-lens: WebGL is not available");
+	const compile = (type, src) => {
+		const shader = gl.createShader(type);
+		if (!shader) throw new Error("privacy-lens: createShader failed");
+		gl.shaderSource(shader, src);
+		gl.compileShader(shader);
+		if (!gl.getShaderParameter(shader, gl.COMPILE_STATUS)) {
+			const log = gl.getShaderInfoLog(shader);
+			gl.deleteShader(shader);
+			throw new Error(`privacy-lens: shader compile failed: ${log}`);
+		}
+		return shader;
+	};
+	const vs = compile(gl.VERTEX_SHADER, vertSrc);
+	const fs = compile(gl.FRAGMENT_SHADER, fragSrc);
+	const program = gl.createProgram();
+	if (!program) throw new Error("privacy-lens: createProgram failed");
+	gl.attachShader(program, vs);
+	gl.attachShader(program, fs);
+	gl.linkProgram(program);
+	gl.deleteShader(vs);
+	gl.deleteShader(fs);
+	if (!gl.getProgramParameter(program, gl.LINK_STATUS)) {
+		const log = gl.getProgramInfoLog(program);
+		gl.deleteProgram(program);
+		throw new Error(`privacy-lens: program link failed: ${log}`);
+	}
+	gl.useProgram(program);
+	const quad = gl.createBuffer();
+	gl.bindBuffer(gl.ARRAY_BUFFER, quad);
+	gl.bufferData(gl.ARRAY_BUFFER, new Float32Array([
+		-1,
+		-1,
+		1,
+		-1,
+		-1,
+		1,
+		1,
+		1
+	]), gl.STATIC_DRAW);
+	const aPos = gl.getAttribLocation(program, "aPos");
+	gl.enableVertexAttribArray(aPos);
+	gl.vertexAttribPointer(aPos, 2, gl.FLOAT, false, 0, 0);
+	const videoTex = gl.createTexture();
+	if (!videoTex) throw new Error("privacy-lens: createTexture failed");
+	gl.bindTexture(gl.TEXTURE_2D, videoTex);
+	gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_S, gl.CLAMP_TO_EDGE);
+	gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_T, gl.CLAMP_TO_EDGE);
+	gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR);
+	gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR);
+	const uniformNames = [
+		"uVideo",
+		"uRes",
+		"uVideoRes",
+		"uTime",
+		"uFrost",
+		"uSandblast",
+		"uGrainSize",
+		"uWarmth",
+		"uBright",
+		"uShadow",
+		"uSun",
+		"uSunSpeed"
+	];
+	const uniforms = {};
+	for (let i = 0; i < uniformNames.length; i += 1) uniforms[uniformNames[i]] = gl.getUniformLocation(program, uniformNames[i]);
+	gl.uniform1i(uniforms.uVideo, 0);
+	if (uniforms.uRes) gl.uniform2f(uniforms.uRes, renderSize, renderSize);
+	gl.viewport(0, 0, renderSize, renderSize);
+	gl.clearColor(.88, .86, .83, 1);
+	let texWidth = 0;
+	let texHeight = 0;
+	let disposed = false;
+	const setF = (name, value) => {
+		const loc = uniforms[name];
+		if (loc) gl.uniform1f(loc, value);
+	};
+	return {
+		clear() {
+			if (disposed) return;
+			gl.clear(gl.COLOR_BUFFER_BIT);
+		},
+		render(source, srcWidth, srcHeight, timeSec, params, measure) {
+			if (disposed) return null;
+			const t0 = measure ? performance.now() : 0;
+			gl.activeTexture(gl.TEXTURE0);
+			gl.bindTexture(gl.TEXTURE_2D, videoTex);
+			if (srcWidth !== texWidth || srcHeight !== texHeight) {
+				texWidth = srcWidth;
+				texHeight = srcHeight;
+				gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, texWidth, texHeight, 0, gl.RGBA, gl.UNSIGNED_BYTE, null);
+				if (uniforms.uVideoRes) gl.uniform2f(uniforms.uVideoRes, texWidth, texHeight);
+			}
+			gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, gl.RGBA, gl.UNSIGNED_BYTE, source);
+			const t1 = measure ? performance.now() : 0;
+			setF("uTime", timeSec);
+			setF("uFrost", params.frost);
+			setF("uSandblast", params.sandblast);
+			setF("uGrainSize", params.grainSize);
+			setF("uWarmth", params.warmth);
+			setF("uBright", params.brightness);
+			setF("uShadow", params.shadowLift);
+			setF("uSun", params.sun);
+			setF("uSunSpeed", params.sunSpeed);
+			gl.drawArrays(gl.TRIANGLE_STRIP, 0, 4);
+			if (!measure) return null;
+			const t2 = performance.now();
+			return {
+				uploadMs: t1 - t0,
+				drawMs: t2 - t1
+			};
+		},
+		dispose() {
+			if (disposed) return;
+			disposed = true;
+			gl.deleteProgram(program);
+			gl.deleteBuffer(quad);
+			gl.deleteTexture(videoTex);
+			gl.getExtension("WEBGL_lose_context")?.loseContext();
+		}
+	};
+}
+//#endregion
+//#region ../infra/src/avatar/privacy-lens/privacyLensWorker.ts
+/**
+* Worker mode for the privacy lens (ENG-49806 Plan B).
+*
+* Under a saturated main thread (the synchronous WASM detection pipeline can
+* occupy it back-to-back on throttled/low-tier devices) a main-thread lens is
+* starved to single-digit fps regardless of how cheap its frame is — measured
+* at 1.6-3 fps with 0ms upload/draw. The fix is to take the main thread out of
+* the frame path entirely: camera track → `MediaStreamTrackProcessor` →
+* `VideoFrame` stream → worker → OffscreenCanvas WebGL. The main thread only
+* bridges dev-tuning params and stats at 4 Hz.
+*
+* Support: Chromium 94+ (Chrome/Edge/Android WebView/Samsung Internet) — the
+* low-tier Android target segment. Safari/Firefox and strict-CSP hosts that
+* block blob workers fail the probe or the Worker constructor and fall back to
+* the main-thread path automatically (`PrivacyLensProvider`).
+*
+* Packaging: the worker script is assembled AT RUNTIME from
+* `Function.prototype.toString()` of the shared, self-contained functions
+* (`createPrivacyLensGl`, `createFramePacer`, `createStatsWindow`,
+* `privacyLensWorkerMain`) plus JSON-injected shader sources and stats/pacer
+* constants, and loaded via a Blob URL. No separate worker chunk to ship —
+* bundler-agnostic for npm and CDN consumers alike. The serialized functions
+* must therefore never close over module-level values.
+*/
+/**
+* Whether the worker path is available in this environment. All three probes
+* must hold; anything missing (Safari's worker-only MSTP shape, Firefox, old
+* WebView) routes to the main-thread fallback.
+*/
+function canUsePrivacyLensWorker() {
+	const g = globalThis;
+	if (typeof g.MediaStreamTrackProcessor !== "function" || typeof g.Worker !== "function" || typeof g.HTMLCanvasElement !== "function") return false;
+	return "transferControlToOffscreen" in g.HTMLCanvasElement.prototype;
+}
+/** Constructs a MediaStreamTrackProcessor (Chromium main-thread shape). */
+function createTrackProcessor(track) {
+	const Ctor = globalThis.MediaStreamTrackProcessor;
+	if (!Ctor) throw new Error("MediaStreamTrackProcessor unavailable");
+	return new Ctor({ track });
+}
+/**
+* The worker's entire logic. SELF-CONTAINED (serialized via toString into the
+* blob): everything it needs arrives via `deps` / messages; no module refs.
+* Frame loop: sequential read → pace → render → close. MSTP buffers at most
+* one frame internally, so reads always yield the freshest frame and closing
+* every frame promptly keeps the camera's frame pool healthy — an unclosed
+* VideoFrame can stall the CAPTURE pipeline, which the lens must never do.
+*/
+function privacyLensWorkerMain(scope, deps) {
+	let gl = null;
+	let pacer = null;
+	let reader = null;
+	let params = null;
+	let statsEnabled = false;
+	let stopped = false;
+	let stats = null;
+	const pump = async () => {
+		const startTime = performance.now();
+		while (!stopped && reader && gl && pacer && params) {
+			let result;
+			try {
+				result = await reader.read();
+			} catch {
+				break;
+			}
+			if (result.done) break;
+			const frame = result.value;
+			try {
+				const now = performance.now();
+				if (!pacer.shouldRender(now)) {
+					if (statsEnabled) stats?.noteDropped();
+					continue;
+				}
+				const timing = gl.render(frame, frame.displayWidth, frame.displayHeight, (now - startTime) / 1e3, params, statsEnabled);
+				if (statsEnabled) stats?.noteRendered(now, timing?.uploadMs, timing?.drawMs);
+			} catch {} finally {
+				frame.close();
+			}
+		}
+	};
+	scope.onmessage = (event) => {
+		const msg = event.data;
+		if (msg.type === "start") {
+			try {
+				gl = deps.createGl(msg.canvas, deps.vertSrc, deps.fragSrc, deps.renderSize);
+				gl.clear();
+			} catch (error) {
+				scope.postMessage({
+					type: "fatal",
+					message: String(error)
+				});
+				return;
+			}
+			params = msg.params;
+			statsEnabled = msg.statsEnabled;
+			stats = deps.createStats({
+				variant: "privacy-lens",
+				mode: "worker",
+				publishIntervalMs: deps.publishIntervalMs,
+				gapWindow: deps.gapWindow,
+				publish: (snapshot) => scope.postMessage({
+					type: "stats",
+					snapshot
+				})
+			});
+			pacer = deps.createPacer(msg.maxFps, deps.frameToleranceMs);
+			reader = msg.readable.getReader();
+			scope.postMessage({ type: "started" });
+			pump();
+		} else if (msg.type === "params") params = msg.params;
+		else if (msg.type === "statsEnabled") statsEnabled = msg.value;
+		else if (msg.type === "stop") {
+			stopped = true;
+			try {
+				reader?.cancel();
+			} catch {}
+			gl?.dispose();
+			gl = null;
+			scope.postMessage({ type: "stopped" });
+		}
+	};
+}
+/**
+* Dev/build transforms that inject module-level references into function bodies.
+* These pass `new Function(src)` (syntactically valid) but throw a
+* `ReferenceError` at worker boot because the injected identifier
+* (`$RefreshSig$`, `cov_xxx()`, …) doesn't exist in the worker scope — silently
+* downgrading everyone to the slow main-thread path via the fatal→fallback net.
+* The vite config excludes `packages/infra` from prefresh for this reason; this
+* list is the runtime backstop for any other instrumenter (coverage, SSR, a
+* consumer's bundler) that the config can't reach.
+*/
+const WORKER_SOURCE_SENTINELS = [
+	{
+		name: "prefresh / react-refresh",
+		pattern: /\$Refresh(Sig|Reg)\$/
+	},
+	{
+		name: "istanbul coverage",
+		pattern: /\bcov_[0-9a-zA-Z]+\(/
+	},
+	{
+		name: "vite SSR transform",
+		pattern: /__vite_ssr_/
+	}
+];
+/**
+* Returns the name of the instrumenter that corrupted the serialized worker
+* source, or null if the source is clean. Callers log loudly and fall back to
+* the main-thread lens rather than booting a worker that will `ReferenceError`.
+*/
+function detectWorkerSourceInstrumentation(source) {
+	for (const sentinel of WORKER_SOURCE_SENTINELS) if (sentinel.pattern.test(source)) return sentinel.name;
+	return null;
+}
+/**
+* Assembles the worker script from the serialized shared functions + injected
+* shader sources and stats/pacer constants. Everything referenced must be
+* self-contained (see module doc); the shaders and the numeric constants
+* (`PUBLISH_INTERVAL_MS`, `GAP_WINDOW`, `FRAME_PACER_TOLERANCE_MS`) are injected
+* as literals so the worker never depends on this module's scope.
+*/
+function buildPrivacyLensWorkerSource(options) {
+	if (!Number.isFinite(options.renderSize)) throw new Error(`privacy-lens: renderSize must be finite, got ${String(options.renderSize)}`);
+	return [
+		"\"use strict\";",
+		`const createGl = ${createPrivacyLensGl.toString()};`,
+		`const createPacer = ${createFramePacer.toString()};`,
+		`const createStats = ${createStatsWindow.toString()};`,
+		`const workerMain = ${privacyLensWorkerMain.toString()};`,
+		`workerMain(self, {
+  createGl,
+  createPacer,
+  createStats,
+  vertSrc: ${JSON.stringify(options.vertSrc)},
+  fragSrc: ${JSON.stringify(options.fragSrc)},
+  renderSize: ${JSON.stringify(options.renderSize)},
+  publishIntervalMs: ${JSON.stringify(500)},
+  gapWindow: ${JSON.stringify(128)},
+  frameToleranceMs: ${JSON.stringify(8)},
+});`
+	].join("\n");
+}
+//#endregion
+//#region ../infra/src/avatar/privacy-lens/PrivacyLensProvider.ts
+/**
+* Privacy-lens avatar — sandblasted-glass effect over the **real** selfie video.
+* **Self-contained** (see FACE_AVATAR.md → Isolation and ownership). No MediaPipe, no landmarks, no
+* three/VRM, no npm deps, no textures but the live video — just a raw-WebGL
+* fragment shader run on the video each frame (see `privacyLensShaders.ts`,
+* `privacyLensGlCore.ts`).
+*
+* Two render transports (ENG-49806):
+*  - **Worker mode (preferred, Chromium 94+):** camera track (cloned) →
+*    `MediaStreamTrackProcessor` → VideoFrame stream → worker → OffscreenCanvas.
+*    The main thread is NOT in the frame path, so the lens stays smooth even
+*    when the synchronous WASM detection pipeline saturates the main thread
+*    (measured: main-thread lens starves to ~1.6-3fps under low-tier CPU
+*    throttle with 0ms upload/draw — scheduling, not work, is the bottleneck).
+*  - **Main-thread mode (fallback):** hidden decode `<video>` + rVFC/rAF loop,
+*    for Safari/Firefox/old WebView and strict-CSP hosts that block blob
+*    workers.
+*
+* Implements `IFaceAvatarCapability` (the generic `start/getCanvas/stop`
+* contract) so it rides the existing concealment seam
+* (`selfieConcealmentOption: 'OPTION_SILHOUETTE'`). Cosmetic-only: the
+* authoritative pipeline still runs on the real frames; the worker consumes a
+* CLONED track so lens lifecycle can never affect capture. Mirroring is the
+* UI's job (CSS), like every other provider — the shader renders forward.
+*/
+const DEFAULT_MAX_FPS = 30;
+const RENDER_SIZE = 512;
+/** Worker must boot + init GL within this budget, else fall back. */
+const WORKER_START_TIMEOUT_MS = 5e3;
+/** Cadence of the main→worker dev-params/stats-flag bridge. */
+const PARAM_BRIDGE_INTERVAL_MS = 250;
+/** Grace period for the worker to ack 'stop' before hard termination. */
+const WORKER_STOP_GRACE_MS = 500;
+const asRvfc = (video) => {
+	const v = video;
+	return typeof v.requestVideoFrameCallback === "function" && typeof v.cancelVideoFrameCallback === "function" ? v : null;
+};
+const readParams = () => {
+	if (typeof window === "undefined") return PRIVACY_LENS_DEFAULTS;
+	const override = window.__incodePrivacyLensParams;
+	return override ? {
+		...PRIVACY_LENS_DEFAULTS,
+		...override
+	} : PRIVACY_LENS_DEFAULTS;
+};
+var PrivacyLensProvider = class PrivacyLensProvider {
+	constructor() {
+		this.glCore = null;
+		this.videoHandle = null;
+		this.rafId = null;
+		this.rvfcHandle = null;
+		this.usingRvfc = false;
+		this.stopped = false;
+		this.pacer = createFramePacer(DEFAULT_MAX_FPS);
+		this.stats = createAvatarStatsReporter("privacy-lens", "main");
+		this.startTime = 0;
+		this.lastVideoTime = -1;
+		this.worker = null;
+		this.clonedTrack = null;
+		this.paramBridgeId = null;
+		this.lastBridgedParams = "";
+		this.lastBridgedStatsEnabled = false;
+		this.loop = (now) => {
+			if (this.stopped) return;
+			this.scheduleNextFrame();
+			const glCore = this.glCore;
+			const video = this.videoHandle?.element;
+			if (!glCore) return;
+			if (!video || video.readyState < 2 || !video.videoWidth) {
+				glCore.clear();
+				return;
+			}
+			if (!this.usingRvfc) {
+				if (video.currentTime === this.lastVideoTime) return;
+				this.lastVideoTime = video.currentTime;
+			}
+			if (!this.pacer.shouldRender(now)) {
+				this.stats.frameDropped();
+				return;
+			}
+			const measure = isAvatarStatsEnabled();
+			const timing = glCore.render(video, video.videoWidth, video.videoHeight, (now - this.startTime) / 1e3, readParams(), measure);
+			if (measure) this.stats.frameRendered(now, timing?.uploadMs, timing?.drawMs);
+		};
+		this.canvas = PrivacyLensProvider.createCanvas();
+	}
+	static createCanvas() {
+		const canvas = document.createElement("canvas");
+		canvas.width = RENDER_SIZE;
+		canvas.height = RENDER_SIZE;
+		return canvas;
+	}
+	getCanvas() {
+		return this.canvas;
+	}
+	async start(stream, options = {}) {
+		const maxFps = options.maxFps ?? DEFAULT_MAX_FPS;
+		this.pacer = createFramePacer(maxFps);
+		if (await this.tryStartWorker(stream, maxFps)) return;
+		if (this.stopped) return;
+		this.startMainThread(stream);
+	}
+	/**
+	* Worker transport: clone the track, feed it to a MediaStreamTrackProcessor,
+	* boot a blob worker, transfer the readable + the canvas, and wait for the
+	* 'started' handshake. Any failure (unsupported browser, CSP-blocked blob
+	* worker, GL init failure in the worker) tears down and returns false so the
+	* main-thread path takes over. Never throws.
+	*/
+	async tryStartWorker(stream, maxFps) {
+		if (!canUsePrivacyLensWorker()) return false;
+		const sourceTrack = stream.getVideoTracks()[0];
+		if (!sourceTrack) return false;
+		let track = null;
+		let processor;
+		try {
+			track = sourceTrack.clone();
+			processor = createTrackProcessor(track);
+		} catch {
+			track?.stop();
+			return false;
+		}
+		const source = buildPrivacyLensWorkerSource({
+			vertSrc: PRIVACY_LENS_VERT,
+			fragSrc: PRIVACY_LENS_FRAG,
+			renderSize: RENDER_SIZE
+		});
+		const instrumenter = detectWorkerSourceInstrumentation(source);
+		if (instrumenter) {
+			console.error(`[privacy-lens] render worker source was instrumented by "${instrumenter}" and cannot run in a worker; using the slower main-thread lens. Exclude packages/infra from that transform (see docs/features/FACE_AVATAR.md → Worker transport).`);
+			track.stop();
+			return false;
+		}
+		let worker = null;
+		let blobUrl = null;
+		try {
+			blobUrl = URL.createObjectURL(new Blob([source], { type: "text/javascript" }));
+			worker = new Worker(blobUrl);
+		} catch {
+			if (blobUrl) URL.revokeObjectURL(blobUrl);
+			track.stop();
+			return false;
+		}
+		let started;
+		try {
+			const offscreen = this.canvas.transferControlToOffscreen();
+			const startedWorker = worker;
+			started = await new Promise((resolve) => {
+				const timer = setTimeout(() => resolve(false), WORKER_START_TIMEOUT_MS);
+				startedWorker.onmessage = (event) => {
+					if (event.data?.type === "started") {
+						clearTimeout(timer);
+						resolve(true);
+					} else if (event.data?.type === "fatal") {
+						clearTimeout(timer);
+						resolve(false);
+					}
+				};
+				startedWorker.onerror = () => {
+					clearTimeout(timer);
+					resolve(false);
+				};
+				startedWorker.postMessage({
+					type: "start",
+					canvas: offscreen,
+					readable: processor.readable,
+					maxFps,
+					params: readParams(),
+					statsEnabled: isAvatarStatsEnabled()
+				}, [offscreen, processor.readable]);
+			});
+		} catch {
+			worker.terminate();
+			URL.revokeObjectURL(blobUrl);
+			track.stop();
+			if (!this.stopped) this.canvas = PrivacyLensProvider.createCanvas();
+			return false;
+		}
+		URL.revokeObjectURL(blobUrl);
+		if (!started || this.stopped) {
+			worker.terminate();
+			track.stop();
+			if (!this.stopped) this.canvas = PrivacyLensProvider.createCanvas();
+			return this.stopped;
+		}
+		this.worker = worker;
+		this.clonedTrack = track;
+		this.lastBridgedParams = JSON.stringify(readParams());
+		this.lastBridgedStatsEnabled = isAvatarStatsEnabled();
+		worker.onmessage = (event) => {
+			const message = event.data;
+			if (message?.type === "stats") {
+				if (!this.stopped) publishAvatarStats(message.snapshot);
+			} else if (message?.type === "stopped") this.finalizeWorker();
+		};
+		worker.onerror = () => {
+			console.warn("[privacy-lens] render worker error — lens frozen (capture unaffected)");
+			if (this.paramBridgeId != null) {
+				clearInterval(this.paramBridgeId);
+				this.paramBridgeId = null;
+			}
+			this.finalizeWorker();
+		};
+		this.paramBridgeId = setInterval(() => {
+			if (!this.worker) return;
+			const params = readParams();
+			const serialized = JSON.stringify(params);
+			if (serialized !== this.lastBridgedParams) {
+				this.lastBridgedParams = serialized;
+				this.worker.postMessage({
+					type: "params",
+					params
+				});
+			}
+			const statsEnabled = isAvatarStatsEnabled();
+			if (statsEnabled !== this.lastBridgedStatsEnabled) {
+				this.lastBridgedStatsEnabled = statsEnabled;
+				this.worker.postMessage({
+					type: "statsEnabled",
+					value: statsEnabled
+				});
+			}
+		}, PARAM_BRIDGE_INTERVAL_MS);
+		return true;
+	}
+	/** Main-thread transport: hidden decode video + rVFC/rAF render loop. */
+	startMainThread(stream) {
+		this.videoHandle = createHiddenVideoElement(stream, { keepStreamAlive: true });
+		try {
+			this.glCore = createPrivacyLensGl(this.canvas, PRIVACY_LENS_VERT, PRIVACY_LENS_FRAG, RENDER_SIZE);
+			if (this.stopped) return;
+			this.startTime = performance.now();
+			const video = this.videoHandle.element;
+			this.usingRvfc = !!asRvfc(video);
+			this.scheduleNextFrame();
+		} catch (error) {
+			this.stop();
+			throw error;
+		}
+	}
+	stop() {
+		this.stopped = true;
+		this.stats.dispose();
+		if (this.paramBridgeId != null) {
+			clearInterval(this.paramBridgeId);
+			this.paramBridgeId = null;
+		}
+		if (this.worker) {
+			this.worker.postMessage({ type: "stop" });
+			const pending = this.worker;
+			setTimeout(() => {
+				if (this.worker === pending) this.finalizeWorker();
+			}, WORKER_STOP_GRACE_MS);
+		}
+		if (this.rafId != null) {
+			cancelAnimationFrame(this.rafId);
+			this.rafId = null;
+		}
+		const video = this.videoHandle?.element;
+		if (video && this.rvfcHandle != null) {
+			asRvfc(video)?.cancelVideoFrameCallback(this.rvfcHandle);
+			this.rvfcHandle = null;
+		}
+		this.glCore?.dispose();
+		this.glCore = null;
+		this.videoHandle?.dispose();
+		this.videoHandle = null;
+	}
+	finalizeWorker() {
+		this.worker?.terminate();
+		this.worker = null;
+		this.clonedTrack?.stop();
+		this.clonedTrack = null;
+	}
+	scheduleNextFrame() {
+		if (this.stopped) return;
+		const video = this.videoHandle?.element;
+		const rvfc = this.usingRvfc && video ? asRvfc(video) : null;
+		if (rvfc) this.rvfcHandle = rvfc.requestVideoFrameCallback(this.loop);
+		else this.rafId = requestAnimationFrame(this.loop);
+	}
+};
+/** Factory used by the avatar actor's provider selection (privacy-lens avatar). */
+function createProvider() {
+	return new PrivacyLensProvider();
+}
+//#endregion
+export { createProvider };