@incodetech/core 0.0.0-dev-20260828-b9d1a451 → 0.0.0-dev-20260831-e0b1ec3e

package/dist/{idCaptureStateMachine-D4G28qF9.esm.js → idCaptureStateMachine-BHQiU_qh.esm.js}

@@ -1,28 +1,28 @@
 import { t as BrowserStorageProvider } from "./BrowserStorageProvider-DC___749.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { s as exposeExperimentOnce } from "./feature-management-DH59Seq9.esm.js";
+import { s as exposeExperimentOnce } from "./feature-management-BGp5JXEs.esm.js";
 import { n as revokeObjectURL } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
 import { r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { c as trueSightHintTransition, l as trueSightLog, r as noteTrueSightCaptureActivity } from "./trueSightService-BZMNBMxd.esm.js";
+import { c as trueSightHintTransition, l as trueSightLog, r as noteTrueSightCaptureActivity } from "./trueSightService-QiGjDkBK.esm.js";
 import { n as eventModuleNames, s as recordExperimentAssignmentOnce } from "./events-ijlbX_Wx.esm.js";
-import { t as getDisableIpify } from "./sessionInitializer-DM0BhcNp.esm.js";
-import { t as endpoints } from "./endpoints-BnZlELpm.esm.js";
-import "./trueSight-BUPXVCDt.esm.js";
-import { t as addDeviceStats } from "./stats-CfKJ7B8k.esm.js";
-import { t as isAndroid } from "./platform-BtKmqD_U.esm.js";
-import "./session-D4Q1GV5k.esm.js";
+import { t as getDisableIpify } from "./sessionInitializer-CqQyhPfm.esm.js";
+import { t as endpoints } from "./endpoints-CXZYMaDj.esm.js";
+import "./trueSight-BzKA0pUI.esm.js";
+import { t as addDeviceStats } from "./stats-CI6TkL3K.esm.js";
+import { a as isIOS, s as isIPad, t as isAndroid, u as isMacOsSafari } from "./platform-DkcRc9JV.esm.js";
+import "./session-BQth2eww.esm.js";
 import { c as not, i as assign, l as raise, n as enqueueActions, o as and, r as sendTo, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
-import { n as invokeRequestPermissionActor, t as checkPermission } from "./permissionServices-QCFFUVkj.esm.js";
+import { n as invokeRequestPermissionActor, t as checkPermission } from "./permissionServices-D209jzcE.esm.js";
 import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
 import { t as IncodeCanvas } from "./canvas-E1zGkel4.esm.js";
-import { a as StreamCanvasProcessingSession } from "./recordingsRepository-KTZA-U7u.esm.js";
+import { a as StreamCanvasProcessingSession } from "./recordingsRepository-BF82zFip.esm.js";
 import { t as getBrowser } from "./getBrowser-Cbe1C4Tn.esm.js";
 import { n as getWindowDimensions } from "./getDeviceClass-CeBiEayS.esm.js";
 import { t as StreamCanvasCapture } from "./StreamCanvasCapture-D2XcXCZ4.esm.js";
-import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-DKnCqOsF.esm.js";
-import { r as flagIdManualReview, t as imageFileToDataUrl } from "./imageFile-BheSny5p.esm.js";
-import { _ as getIdCameraStream, a as processId, c as stopStream, d as validateUploadResponse, f as ID_ERROR_CODES, g as OPTIMIZING_WATCHDOG_MARGIN_MS, h as CAPTURE_OPTIMIZING, l as uploadIdImage, m as resolveIdCaptureThresholds, o as startRecordingSession, r as initializeIdCapture, s as stopRecording, t as addBarcode, u as uploadManualIdFile } from "./idCaptureServices-Bm7ddfni.esm.js";
+import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-tw0DA6fF.esm.js";
+import { r as flagIdManualReview, t as imageFileToDataUrl } from "./imageFile-DPRoXt59.esm.js";
+import { _ as getIdCameraStream, a as processId, c as stopStream, d as validateUploadResponse, f as ID_ERROR_CODES, g as OPTIMIZING_WATCHDOG_MARGIN_MS, h as CAPTURE_OPTIMIZING, l as uploadIdImage, m as resolveIdCaptureThresholds, o as startRecordingSession, r as initializeIdCapture, s as stopRecording, t as addBarcode, u as uploadManualIdFile } from "./idCaptureServices-eA84vRnx.esm.js";
 //#region src/modules/id/digitalUpload/digitalUploadErrors.ts
 const TERMINAL_FAIL_REASONS = /* @__PURE__ */ new Set(["DIGITAL_ID_REQUESTED_BUT_OTHER_PROVIDED", "ID_TYPE_UNACCEPTABLE"]);
 function isKnownFailReason(reason) {
@@ -309,6 +309,222 @@ const digitalUploadMachine = setup({
 	}
 });
 //#endregion
+//#region src/modules/id/deviceWallet/deviceWalletServices.ts
+/** Both wallet endpoint families are versioned via header, not path. */
+const API_VERSION_HEADERS = { "api-version": "1.0" };
+/**
+* Fetches the wallet request payload for the platform and wraps it in the
+* Digital Credentials API request shape.
+*
+* Apple: POST with an empty body → `{ deviceRequest, encryptionInfo }`,
+* presented with protocol `org-iso-mdoc`.
+* Google: GET → the whole backend-built OIDC4VP/DCQL object (opaque here),
+* presented with protocol `openid4vp-v1-unsigned`.
+*/
+async function requestWalletData(platform, signal) {
+	if (platform === "ios") {
+		const res = await api.post(endpoints.deviceWalletAppleRequest, {}, {
+			headers: API_VERSION_HEADERS,
+			signal
+		});
+		if (!res.ok) throw new Error(`POST ${endpoints.deviceWalletAppleRequest} failed: ${res.status}`);
+		const data = res.data;
+		return {
+			protocol: "org-iso-mdoc",
+			data: {
+				deviceRequest: data.deviceRequest,
+				encryptionInfo: data.encryptionInfo
+			}
+		};
+	}
+	const res = await api.get(endpoints.deviceWalletGoogleRequest, {
+		headers: API_VERSION_HEADERS,
+		signal
+	});
+	if (!res.ok) throw new Error(`GET ${endpoints.deviceWalletGoogleRequest} failed: ${res.status}`);
+	return {
+		protocol: "openid4vp-v1-unsigned",
+		data: res.data
+	};
+}
+/**
+* Forwards the opaque wallet response for backend decryption. The body key
+* differs per platform (`deviceResponse` for Apple, `identityToken` — a JWE —
+* for Google); decryption is entirely server-side.
+*/
+async function decryptWalletResponse(platform, walletResponse, signal) {
+	const url = platform === "ios" ? endpoints.deviceWalletAppleDecrypt : endpoints.deviceWalletGoogleDecrypt;
+	const body = platform === "ios" ? { deviceResponse: walletResponse } : { identityToken: walletResponse };
+	const res = await api.post(url, body, {
+		headers: API_VERSION_HEADERS,
+		signal
+	});
+	if (!res.ok) throw new Error(`POST ${url} failed: ${res.status}`);
+	return res.data;
+}
+const defaultDeviceWalletServices = {
+	requestWalletData,
+	decryptWalletResponse
+};
+//#endregion
+//#region src/modules/id/deviceWallet/deviceWalletStateMachine.ts
+const requestWalletDataActor = fromPromise(async ({ input, signal }) => input.services.requestWalletData(input.platform, signal));
+const presentCredentialActor = fromPromise(async ({ input, signal }) => input.credentials.get(input.walletRequest, { signal }));
+const decryptWalletActor = fromPromise(async ({ input, signal }) => input.services.decryptWalletResponse(input.platform, input.walletResponse, signal));
+const getCredentialResponseFromEvent = (event) => {
+	if (!("output" in event)) return;
+	return event.output?.response;
+};
+const deviceWalletMachine = setup({
+	types: {
+		context: {},
+		events: {},
+		input: {},
+		output: {}
+	},
+	actors: {
+		requestWalletData: requestWalletDataActor,
+		presentCredential: presentCredentialActor,
+		decryptWallet: decryptWalletActor
+	},
+	actions: {
+		storeWalletRequest: assign(({ event }) => {
+			if (!("output" in event)) return {};
+			return { walletRequest: event.output };
+		}),
+		storeCredentialResponse: assign(({ event }) => ({ walletResponse: getCredentialResponseFromEvent(event) })),
+		storeDecryptResponse: assign(({ event }) => {
+			if (!("output" in event)) return {};
+			return { response: event.output };
+		}),
+		setNoCredentialFailReason: assign(() => ({ failReason: "NO_CREDENTIAL" })),
+		setWalletErrorFailReason: assign(() => ({ failReason: "WALLET_ERROR" })),
+		setUnsupportedPlatformFailReason: assign(() => ({ failReason: "UNSUPPORTED_PLATFORM" })),
+		clearTransientState: assign(() => ({
+			walletRequest: void 0,
+			walletResponse: void 0,
+			response: void 0,
+			failReason: null
+		}))
+	},
+	guards: {
+		hasCredentialsApi: ({ context }) => context.credentials.isAvailable(),
+		hasCredential: ({ event }) => Boolean(getCredentialResponseFromEvent(event))
+	}
+}).createMachine({
+	id: "deviceWallet",
+	initial: "decideStart",
+	context: ({ input }) => ({
+		platform: input.platform,
+		credentials: input.credentials,
+		services: input.services ?? defaultDeviceWalletServices,
+		walletRequest: void 0,
+		walletResponse: void 0,
+		response: void 0,
+		failReason: null,
+		resultType: null
+	}),
+	output: ({ context }) => context.resultType === "success" && context.response ? {
+		result: "success",
+		decision: context.response.decision,
+		response: context.response
+	} : { result: "dismissed" },
+	states: {
+		decideStart: { always: [{
+			guard: "hasCredentialsApi",
+			target: "requesting"
+		}, {
+			target: "failed",
+			actions: ["setUnsupportedPlatformFailReason"]
+		}] },
+		requesting: { invoke: {
+			id: "requestWalletData",
+			src: "requestWalletData",
+			input: ({ context }) => ({
+				platform: context.platform,
+				services: context.services
+			}),
+			onDone: {
+				target: "presenting",
+				actions: ["storeWalletRequest"]
+			},
+			onError: {
+				target: "failed",
+				actions: ["setWalletErrorFailReason"]
+			}
+		} },
+		presenting: { invoke: {
+			id: "presentCredential",
+			src: "presentCredential",
+			input: ({ context }) => ({
+				credentials: context.credentials,
+				walletRequest: context.walletRequest
+			}),
+			onDone: [{
+				guard: "hasCredential",
+				target: "decrypting",
+				actions: ["storeCredentialResponse"]
+			}, {
+				target: "failed",
+				actions: ["setNoCredentialFailReason"]
+			}],
+			onError: {
+				target: "failed",
+				actions: ["setWalletErrorFailReason"]
+			}
+		} },
+		decrypting: { invoke: {
+			id: "decryptWallet",
+			src: "decryptWallet",
+			input: ({ context }) => ({
+				platform: context.platform,
+				walletResponse: context.walletResponse,
+				services: context.services
+			}),
+			onDone: {
+				target: "finished",
+				actions: ["storeDecryptResponse"]
+			},
+			onError: {
+				target: "failed",
+				actions: ["setWalletErrorFailReason"]
+			}
+		} },
+		failed: { on: {
+			RETRY: {
+				target: "decideStart",
+				actions: ["clearTransientState"]
+			},
+			USE_ANOTHER_METHOD: { target: "closed" }
+		} },
+		finished: {
+			type: "final",
+			entry: assign({ resultType: "success" })
+		},
+		closed: {
+			type: "final",
+			entry: assign({ resultType: "dismissed" })
+		}
+	}
+});
+//#endregion
+//#region src/modules/id/deviceWallet/deviceWalletPlatform.ts
+/**
+* Maps an explicit provider override or the current user agent to the wallet
+* platform (ported from V1 `resolveWalletPlatform`, minus the Credentials API
+* capability check — that lives on `IDigitalCredentialsCapability.isAvailable()`
+* and is consulted by the digital-ID funnel before this module is invoked).
+*
+* Auto-detection: iOS/iPadOS and macOS Safari → Apple Wallet (web); Android
+* and every other desktop/unknown browser (incl. macOS Chrome) → Google
+* Wallet, which is the only wallet reachable there.
+*/
+function resolveWalletPlatform(provider) {
+	if (provider === "apple_web") return "ios";
+	if (provider === "google") return "android";
+	return isIOS() || isMacOsSafari() || isIPad() ? "ios" : "android";
+}
+//#endregion
 //#region src/modules/id/manualUpload/manualUploadErrors.ts
 /**
 * i18n keys for manual-upload user-facing error copy.
@@ -831,6 +1047,12 @@ const hasNoDocumentTypesAvailableGuard = ({ context }) => context.availableDocum
 const isManualIdUploadSelectedGuard = ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "manualIdUpload";
 const isDigitalIdUploadSelectedGuard = ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "digitalIdUpload";
 const isDigitalIdRedirectSelectedGuard = ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "digitalIdRedirect";
+/** The Digital ID (device wallet) chooser tile was picked. */
+const isDigitalIdSelectedGuard = ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "digitalId";
+/** Funnel resolution stored by `resolveDigitalIdRoute` picked the native wallet. */
+const digitalIdRouteIsWalletGuard = ({ context }) => context.digitalIdRoute?.kind === "incodeWallet";
+/** Funnel resolution picked the Trinsic web-redirect fallback. */
+const digitalIdRouteIsTrinsicGuard = ({ context }) => context.digitalIdRoute?.kind === "trinsicRedirect";
 const isUploadExpiredGuard = ({ context }) => context.uploadResponse?.isDocumentExpired === true;
 /**
 * True when *this* expired upload will exhaust the same-side expired budget.
@@ -913,26 +1135,106 @@ const isBackModeInMultiSideFlowGuard = ({ context }) => context.currentMode ===
 const wasExpiredRedirectedGuard = ({ context }) => context.expiredRedirected === true;
 const hasManualCaptureTriggeredGuard = ({ context }) => context.manualCaptureTriggered;
 //#endregion
-//#region src/modules/id/idCaptureHelpers.ts
+//#region src/modules/id/digitalIdRegistry.ts
 /**
 * True when a digital-ID method uses a full-page web-redirect flow (Trinsic
 * iDIN/FTN). Accepts both the module `FlowType` value (`REDIRECT`) and the
-* backend value (`WEB_REDIRECT`).
+* backend value (`WEB_REDIRECT`). (Lives here rather than in
+* `idCaptureHelpers` to keep the registry free of circular imports; the
+* helpers re-export it.)
 */
 function isRedirectFlowType(flowType) {
 	return flowType === "REDIRECT" || flowType === "WEB_REDIRECT";
 }
+const DIGITAL_ID_REGISTRY = {
+	mDL: [{
+		kind: "incodeWallet",
+		documentType: "digitalId",
+		configFlag: "deviceWallet"
+	}, {
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_mdl_placeholder",
+		method: "MDL"
+	}],
+	iDIN: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_netherlands_idin",
+		method: "IDIN"
+	}],
+	FTN: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_finnish_trust_network",
+		method: "FTN"
+	}]
+};
+const DIGITAL_ID_DOCUMENT_TYPES = Object.keys(DIGITAL_ID_REGISTRY);
 /**
-* Persisted method name → catalog provider id, for the web-redirect schemes the
-* SDK supports (iDIN live; FTN mapped for when it unblocks BE-side). The backend
-* flow config carries the method name + `type` but not `provider`/`flowType`, so
-* the SDK maps them here (mirrors the dashboard `CATALOG_ID_TO_PERSISTED_METHOD`).
-* Phase 1: hardcoded; later this could be sourced from the `/providers` catalog.
+* Tolerant view over `config.digitalIds`: accepts both the mapped array
+* (`IdCaptureDigitalIdMethod[]`) and the raw backend object
+* (`{ enabled, methods: [...] }`). Extracted from the old
+* `getDigitalIdRedirectMethod` cast so every consumer parses it the same way.
 */
-const REDIRECT_PROVIDER_BY_METHOD = {
-	IDIN: "trinsic_netherlands_idin",
-	FTN: "trinsic_finnish_trust_network"
-};
+function normalizeDigitalIdMethods(config) {
+	const raw = config.digitalIds;
+	return Array.isArray(raw) ? raw : raw?.methods ?? [];
+}
+/** Whether a funnel entry is activated by config + platform capabilities. */
+function isEntryActive(entry, config, platform) {
+	if (entry.kind === "incodeWallet") return config[entry.configFlag] === true && platform.credentialsAvailable;
+	return findConfiguredMethod(entry, config) !== void 0;
+}
+/**
+* The configured `digitalIds` method matching a Trinsic funnel entry — by
+* persisted method name, or (mapped shape) by provider id on a redirect
+* flowType. Mirrors the old first-match semantics; `methods[].enabled` is
+* deliberately still not consulted (pre-existing behavior).
+*/
+function findConfiguredMethod(entry, config) {
+	return normalizeDigitalIdMethods(config).find((method) => method.method?.toUpperCase() === entry.method || method.provider === entry.providerId && !!method.flowType && isRedirectFlowType(method.flowType));
+}
+/** Normalizes a raw configured method into the mapped shape for the child input. */
+function toMappedMethod(entry, method) {
+	if (method.flowType && isRedirectFlowType(method.flowType)) return method;
+	return {
+		method: method.method,
+		provider: entry.providerId,
+		flowType: "WEB_REDIRECT",
+		country: method.country ?? method.countries?.[0],
+		displayName: method.displayName
+	};
+}
+/**
+* Resolves the implementation that should fulfil a digital-ID document type:
+* the first funnel entry that is active under the given config and platform.
+* `undefined` when nothing can run it (the chooser then shows no tile for it).
+*/
+function resolveDigitalIdImplementation(docType, config, platform) {
+	for (const entry of DIGITAL_ID_REGISTRY[docType]) {
+		if (!isEntryActive(entry, config, platform)) continue;
+		if (entry.kind === "incodeWallet") return { kind: "incodeWallet" };
+		const method = findConfiguredMethod(entry, config);
+		return {
+			kind: "trinsicRedirect",
+			providerId: entry.providerId,
+			method: method ? toMappedMethod(entry, method) : void 0
+		};
+	}
+}
+//#endregion
+//#region src/modules/id/idCaptureHelpers.ts
+/**
+* Persisted method name → catalog provider id, derived from the digital-ID
+* registry's Trinsic entries (single source of truth — was a hardcoded map
+* here before the registry existed).
+*/
+const REDIRECT_PROVIDER_BY_METHOD = (() => {
+	const map = {};
+	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) for (const entry of DIGITAL_ID_REGISTRY[docType]) if (entry.kind === "trinsicRedirect") map[entry.method] = entry.providerId;
+	return map;
+})();
 /**
 * The first enabled web-redirect digital-ID method (iDIN-only for now), or
 * `undefined` when none is configured. Drives both the `digitalIdRedirect`
@@ -941,12 +1243,11 @@ const REDIRECT_PROVIDER_BY_METHOD = {
 * Accepts both the mapped array (`IdCaptureDigitalIdMethod[]`) and the raw
 * backend `configuration.digitalIds` object (`{ enabled, methods: [...] }`);
 * for the raw shape it derives `provider`/`flowType` from the persisted method
-* name (`IDIN` → `trinsic_netherlands_idin`, `WEB_REDIRECT`).
+* name via the digital-ID registry (`IDIN` → `trinsic_netherlands_idin`,
+* `WEB_REDIRECT`).
 */
 function getDigitalIdRedirectMethod(config) {
-	const raw = config.digitalIds;
-	const methods = Array.isArray(raw) ? raw : raw?.methods ?? [];
-	for (const method of methods) {
+	for (const method of normalizeDigitalIdMethods(config)) {
 		if (method.flowType && isRedirectFlowType(method.flowType)) return method;
 		const provider = method.method ? REDIRECT_PROVIDER_BY_METHOD[method.method.toUpperCase()] : void 0;
 		if (provider) return {
@@ -965,20 +1266,33 @@ const DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP = [
 	["enableId", "id"],
 	["enablePassport", "passport"],
 	["manualUploadIdCapture", "manualIdUpload"],
-	["digitalIdsUpload", "digitalIdUpload"],
-	["deviceWallet", "digitalId"]
+	["digitalIdsUpload", "digitalIdUpload"]
 ];
 /**
 * Returns the list of document types enabled by config for the chooser screen, in display order.
 * Used to populate chooser state so UI and headless consumers can render the correct options.
 *
+* Digital-ID document types (device wallet, Trinsic web-redirect) come from
+* the digital-ID registry funnel: each registry document type contributes the
+* tile of its first active implementation. A `deviceWallet: true` config on a
+* platform without the Credentials API therefore shows the Trinsic fallback
+* tile when one is configured — or no tile at all, instead of a dead-end one.
+*
 * @param config - ID capture configuration (from flow or init)
+* @param platform - Platform capabilities consulted by the digital-ID funnel.
+*   Defaults to no Credentials API for pure-node callers; the machine passes
+*   the real capability check.
 * @returns Array of IdDocumentType values that should be shown in the document type chooser
 */
-function getAvailableDocumentTypes(config) {
+function getAvailableDocumentTypes(config, platform = { credentialsAvailable: false }) {
 	const adjustedDocumentTypes = [];
 	for (const [configProperty, adjustedType] of DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP) if (config[configProperty]) adjustedDocumentTypes.push(adjustedType);
-	if (getDigitalIdRedirectMethod(config)) adjustedDocumentTypes.push("digitalIdRedirect");
+	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) {
+		const route = resolveDigitalIdImplementation(docType, config, platform);
+		if (!route) continue;
+		const documentType = route.kind === "incodeWallet" ? "digitalId" : "digitalIdRedirect";
+		if (!adjustedDocumentTypes.includes(documentType)) adjustedDocumentTypes.push(documentType);
+	}
 	return adjustedDocumentTypes;
 }
 /**
@@ -1772,7 +2086,7 @@ const startRecordingActor = fromPromise(async ({ input }) => {
 });
 const initializeDeepsightSessionActor = fromPromise(async ({ input }) => {
 	if (!input.dependencies) return;
-	const { loadDeepsightSession } = await import("./deepsightLoader-DcLVxmv0.esm.js");
+	const { loadDeepsightSession } = await import("./deepsightLoader-DdgzfNqc.esm.js");
 	return loadDeepsightSession({
 		ds: input.ds,
 		storage: input.dependencies.storage,
@@ -2188,6 +2502,18 @@ function getBarcodeResponseValues(context, event) {
 //#endregion
 //#region src/modules/id/idCaptureStateMachine.ts
 /**
+* Null-object stand-in when no credentials capability was injected (the
+* composition root, `createIdCaptureActor`, always injects one — this covers
+* direct machine construction only). Reports unavailable, so the wallet tile
+* never surfaces and the child fails defensively with UNSUPPORTED_PLATFORM.
+* Kept here instead of `?? new BrowserProvider()` fallbacks: Core never
+* constructs concrete providers, and an injected mock is never bypassed.
+*/
+const unavailableDigitalCredentials = {
+	isAvailable: () => false,
+	get: () => Promise.reject(/* @__PURE__ */ new Error("No digital-credentials capability injected"))
+};
+/**
 * Shown/logged when an ID capture module has no accepted documents and no
 * other capture option enabled — there is nothing to capture (ENG-43983).
 */
@@ -2222,6 +2548,7 @@ const idCaptureMachine = setup({
 		manualUploadMachine,
 		digitalUploadMachine,
 		digitalIdRedirectMachine,
+		deviceWalletMachine,
 		readPendingDigitalIdRedirect: fromPromise(async ({ input }) => {
 			const pending = await readPendingRedirect(input.storage);
 			if (!pending) return null;
@@ -2496,6 +2823,29 @@ const idCaptureMachine = setup({
 			};
 		}),
 		/**
+		* Runs the digital-ID funnel for the Digital ID chooser tile: native
+		* device wallet when `deviceWallet` is on and the platform exposes the
+		* Credentials API, else the configured Trinsic fallback for the same
+		* document type. Stored on context so `digitalIdRouting` can branch and
+		* the Trinsic leg can preset its provider. Resolution is synchronous —
+		* it runs inside the tile click's `send()`, preserving the transient
+		* user activation `navigator.credentials.get()` needs on iOS Safari.
+		*/
+		resolveDigitalIdRoute: assign(({ context }) => ({ digitalIdRoute: resolveDigitalIdImplementation("mDL", context.config, { credentialsAvailable: context.dependencies?.credentials?.isAvailable() ?? false }) })),
+		/**
+		* Records a completed device-wallet (mDL) handshake from the child's
+		* `onDone` output. Wallet credentials are single-side; the verified
+		* attributes (incl. the portrait) land in the session server-side, so —
+		* unlike a portrait-less redirect — the downstream Face Match is kept.
+		*/
+		storeDeviceWalletResult: assign(({ event }) => {
+			const output = event.output;
+			return {
+				isDeviceWallet: true,
+				deviceWalletDecision: output?.result === "success" ? output.decision : void 0
+			};
+		}),
+		/**
 		* Return leg: stash the storage-recovered `verificationId` + `providerId`
 		* (from the `readPendingDigitalIdRedirect` actor) so the `digitalIdRedirect`
 		* child can be invoked in resume mode.
@@ -2544,6 +2894,9 @@ const idCaptureMachine = setup({
 		isManualIdUploadSelected: isManualIdUploadSelectedGuard,
 		isDigitalIdUploadSelected: isDigitalIdUploadSelectedGuard,
 		isDigitalIdRedirectSelected: isDigitalIdRedirectSelectedGuard,
+		isDigitalIdSelected: isDigitalIdSelectedGuard,
+		digitalIdRouteIsWallet: digitalIdRouteIsWalletGuard,
+		digitalIdRouteIsTrinsic: digitalIdRouteIsTrinsicGuard,
 		isUploadExpired: isUploadExpiredGuard,
 		isExpiredAttemptsExhausted: isExpiredAttemptsExhaustedGuard,
 		isNotPassportMode: isNotPassportModeGuard,
@@ -2562,6 +2915,7 @@ const idCaptureMachine = setup({
 		isDigitalUploadExhausted: ({ event }) => event.output?.result === "exhausted",
 		isDigitalUploadSuccessful: ({ event }) => event.output?.result === "success",
 		isDigitalIdRedirectCompleted: ({ event }) => event.output?.status === "COMPLETED",
+		isDeviceWalletSuccessful: ({ event }) => event.output?.result === "success",
 		hasDigitalIdReturn: ({ context }) => context.digitalIdReturnParams !== void 0,
 		hasPendingDigitalIdRedirect: ({ event }) => event.output != null
 	},
@@ -2631,6 +2985,9 @@ const idCaptureMachine = setup({
 			isDigitalUpload: false,
 			isDigitalIdRedirect: false,
 			portraitPresent: false,
+			digitalIdRoute: void 0,
+			isDeviceWallet: false,
+			deviceWalletDecision: void 0,
 			digitalIdReturnParams: input.config.digitalIdReturn?.returnParams,
 			digitalIdResumeVerificationId: void 0,
 			digitalIdResumeProviderId: void 0,
@@ -2652,7 +3009,7 @@ const idCaptureMachine = setup({
 			dependencies: input.dependencies,
 			disableIpify: getDisableIpify(),
 			deepsightInitAttempted: false,
-			availableDocumentTypes: getAvailableDocumentTypes(input.config),
+			availableDocumentTypes: getAvailableDocumentTypes(input.config, { credentialsAvailable: input.dependencies?.credentials?.isAvailable() ?? false }),
 			captureResolution: void 0,
 			cameraFallbackLevel: void 0,
 			usingBackCamera: void 0
@@ -2692,6 +3049,11 @@ const idCaptureMachine = setup({
 			{ target: "loading" }
 		] } },
 		chooser: { on: { SELECT_DOCUMENT: [
+			{
+				target: "digitalIdRouting",
+				guard: "isDigitalIdSelected",
+				actions: ["setSelectedDocument", "resolveDigitalIdRoute"]
+			},
 			{
 				target: "digitalIdRedirect",
 				guard: "isDigitalIdRedirectSelected",
@@ -3779,9 +4141,10 @@ const idCaptureMachine = setup({
 				input: ({ context }) => {
 					const method = getDigitalIdRedirectMethod(context.config);
 					const resuming = context.digitalIdReturnParams !== void 0 && context.digitalIdResumeVerificationId !== void 0;
+					const routedProvider = context.digitalIdRoute?.kind === "trinsicRedirect" ? context.digitalIdRoute.providerId : void 0;
 					return {
 						config: {
-							provider: context.digitalIdResumeProviderId ?? method?.provider,
+							provider: context.digitalIdResumeProviderId ?? routedProvider ?? method?.provider,
 							returnUrl: context.config.digitalIdReturnUrl,
 							country: method?.country
 						},
@@ -3818,8 +4181,58 @@ const idCaptureMachine = setup({
 				DIGITAL_ID_REDIRECT_CONTINUE: { actions: sendTo("digitalIdRedirect", { type: "CONTINUE" }) },
 				DIGITAL_ID_REDIRECT_REFRESH: { actions: sendTo("digitalIdRedirect", { type: "REFRESH" }) }
 			}
+		},
+		digitalIdRouting: { always: [
+			{
+				guard: "digitalIdRouteIsWallet",
+				target: "deviceWallet"
+			},
+			{
+				guard: "digitalIdRouteIsTrinsic",
+				target: "digitalIdRedirect"
+			},
+			{
+				target: "chooser",
+				guard: "hasShowDocumentChooser"
+			},
+			{
+				target: "#idCapture.error",
+				actions: assign({ error: () => "No digital-ID implementation available for the selected document type" })
+			}
+		] },
+		deviceWallet: {
+			invoke: {
+				id: "deviceWallet",
+				src: "deviceWalletMachine",
+				input: ({ context }) => ({
+					platform: resolveWalletPlatform(),
+					credentials: context.dependencies?.credentials ?? unavailableDigitalCredentials
+				}),
+				onSnapshot: { actions: () => {} },
+				onDone: [
+					{
+						guard: "isDeviceWalletSuccessful",
+						target: "#idCapture.finished",
+						actions: ["storeDeviceWalletResult"]
+					},
+					{
+						target: "chooser",
+						guard: "hasShowDocumentChooser"
+					},
+					{ target: "closed" }
+				],
+				onError: {
+					target: "#idCapture.error",
+					actions: assign({ error: ({ event }) => String(event.error) })
+				}
+			},
+			on: {
+				QUIT: { target: "closed" },
+				DEVICE_WALLET_RETRY: { actions: sendTo("deviceWallet", { type: "RETRY" }) },
+				DEVICE_WALLET_USE_ANOTHER_METHOD: { actions: sendTo("deviceWallet", { type: "USE_ANOTHER_METHOD" }) }
+			}
 		}
 	}
 });
 //#endregion
-export { MANUAL_UPLOAD_MAX_RETRIES as a, MANUAL_UPLOAD_MAX_FILE_SIZE_BYTES as i, getManualUploadTabs as n, MANUAL_UPLOAD_EXHAUSTION_FORWARD_MS as r, idCaptureMachine as t };
+export { isRedirectFlowType as a, MANUAL_UPLOAD_MAX_FILE_SIZE_BYTES as c, DIGITAL_ID_REGISTRY as i, MANUAL_UPLOAD_MAX_RETRIES as l, getManualUploadTabs as n, resolveDigitalIdImplementation as o, DIGITAL_ID_DOCUMENT_TYPES as r, MANUAL_UPLOAD_EXHAUSTION_FORWARD_MS as s, idCaptureMachine as t, resolveWalletPlatform as u };

package/dist/{idOcrManager-D3W_gJCw.esm.js → idOcrManager-BgZ19BTC.esm.js}

@@ -1,6 +1,6 @@
 import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-ijlbX_Wx.esm.js";
 import { s as createActor, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
-import { t as idOcrStateMachine } from "./idOcrStateMachine-BC7HT3LZ.esm.js";
+import { t as idOcrStateMachine } from "./idOcrStateMachine-7XoaRHAP.esm.js";
 //#region src/modules/id-ocr/idOcrActor.ts
 function createIdOcrActor(options) {
 	return createActor(idOcrStateMachine, { input: { config: options.config } }).start();

package/dist/{idOcrStateMachine-BC7HT3LZ.esm.js → idOcrStateMachine-7XoaRHAP.esm.js}

@@ -1,6 +1,6 @@
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
 import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-BnZlELpm.esm.js";
+import { t as endpoints } from "./endpoints-CXZYMaDj.esm.js";
 import { i as assign, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
 import { t as validateCPF } from "./cpf-BIADjddF.esm.js";

package/dist/{idVerificationManager-BP_qxCyL.esm.js → idVerificationManager-CcnzNq2Y.esm.js}

@@ -1,6 +1,6 @@
 import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-ijlbX_Wx.esm.js";
 import { s as createActor, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
-import { t as idVerificationMachine } from "./idVerificationStateMachine-D5pZC498.esm.js";
+import { t as idVerificationMachine } from "./idVerificationStateMachine-COvxom5O.esm.js";
 //#region src/modules/id-verification/idVerificationActor.ts
 function createIdVerificationActor(options) {
 	return createActor(idVerificationMachine, { input: { config: options.config } }).start();

package/dist/{idVerificationStateMachine-D5pZC498.esm.js → idVerificationStateMachine-COvxom5O.esm.js}

@@ -1,5 +1,5 @@
 import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { t as endpoints } from "./endpoints-BnZlELpm.esm.js";
+import { t as endpoints } from "./endpoints-CXZYMaDj.esm.js";
 import { t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
 //#region src/modules/id-verification/idVerificationServices.ts