@incodetech/core 0.0.0-dev-20260911-aec162f0 → 0.0.0-dev-20260914-8aef7789

package/dist/{idCaptureStateMachine-Cp2_revF.esm.js → idCaptureStateMachine-D3pqfK2Z.esm.js}

@@ -1,28 +1,32 @@
-import { l as BrowserStorageProvider } from "./setup-BHJ3-fhX.esm.js";
+import { l as BrowserStorageProvider } from "./setup-CfNAVG-d.esm.js";
+import { r as WasmUtilProvider } from "./safeStorage-1O9k0ulP.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { s as exposeExperimentOnce } from "./feature-management-B6CtmH1O.esm.js";
-import { n as revokeObjectURL } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
+import { s as exposeExperimentOnce } from "./feature-management-BEqf3Sr3.esm.js";
+import { n as revokeObjectURL, t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
 import { r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { c as trueSightHintTransition, l as trueSightLog, r as noteTrueSightCaptureActivity } from "./trueSightService-DLzYznkh.esm.js";
+import { c as trueSightHintTransition, l as trueSightLog, m as isTrueSightTesting, r as noteTrueSightCaptureActivity } from "./trueSightService-TqmmYye3.esm.js";
 import { n as eventModuleNames, s as recordExperimentAssignmentOnce } from "./events-ijlbX_Wx.esm.js";
-import { t as getDisableIpify } from "./sessionInitializer-CEycxhm4.esm.js";
+import { t as getDisableIpify } from "./sessionInitializer-CUpgbHzs.esm.js";
 import { t as endpoints } from "./endpoints-D3B9mUHh.esm.js";
 import { t as addDeviceStats } from "./stats-DkK-f8JT.esm.js";
 import { a as isIOS, s as isIPad, t as isAndroid, u as isMacOsSafari } from "./platform-DkcRc9JV.esm.js";
-import "./session-C2THUsQZ.esm.js";
+import "./session-m9j27bHm.esm.js";
 import { c as not, i as assign, l as raise, n as enqueueActions, o as and, r as sendTo, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
 import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
 import { n as getUrlSearchParam, t as buildUrlWithSearchParams } from "./urlUtils-D6phjq1-.esm.js";
-import { n as invokeRequestPermissionActor, t as checkPermission } from "./permissionServices-f7nBnW5P.esm.js";
-import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
-import { t as IncodeCanvas } from "./canvas-E1zGkel4.esm.js";
+import { r as getCameraReacquisitionConstraints } from "./camera-sIa9ceW2.esm.js";
+import { n as invokeRequestPermissionActor, t as checkPermission } from "./permissionServices-7lzEiOsO.esm.js";
+import { i as imageFileToDataUrl, n as runProtectedAttempt, o as flagIdManualReview, r as cameraCycleProvider, s as PROTECTED_CAPTURE_TARGET, t as createCameraCycleOwnership } from "./createCameraCycleOwnership-DQ5-F2oW.esm.js";
+import { t as IncodeCanvas } from "./canvas-BxFzWTt-.esm.js";
+import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-o1JLtewE.esm.js";
 import { a as StreamCanvasProcessingSession } from "./recordingsRepository-CCWy13M-.esm.js";
+import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
 import { t as getBrowser } from "./getBrowser-Cbe1C4Tn.esm.js";
 import { n as getWindowDimensions } from "./getDeviceClass-CeBiEayS.esm.js";
-import { t as StreamCanvasCapture } from "./StreamCanvasCapture-D2XcXCZ4.esm.js";
-import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-DxbvOoZJ.esm.js";
-import { r as flagIdManualReview, t as imageFileToDataUrl } from "./imageFile-CLaua6xO.esm.js";
-import { _ as CAPTURE_OPTIMIZING, c as startRecordingSession, d as uploadIdImage, f as uploadManualIdFile, g as resolveIdCaptureThresholds, i as pauseRecordingForAttempt, l as stopRecording, m as ID_ERROR_CODES, o as prepareRecordingForCameraRetry, p as validateUploadResponse, r as initializeIdCapture, s as processId, t as addBarcode, u as stopStream, v as OPTIMIZING_WATCHDOG_MARGIN_MS, y as getIdCameraStream } from "./idCaptureServices-fzIhBqAK.esm.js";
+import { n as runVirtualCameraCheck, t as frameSources } from "./virtualCameraCheck-WOloJ-do.esm.js";
+import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider } from "./idCaptureDefaults-C66YvkgN.esm.js";
+import { S as getIdCameraStream, _ as ID_ERROR_CODES, a as getRealQualityValue, b as CAPTURE_OPTIMIZING, d as startRecordingSession, f as stopRecording, g as validateUploadResponse, h as uploadManualIdFile, i as finalizeRecordingSession, l as prepareRecordingForCameraRetry, m as uploadIdImage, o as initializeIdCapture, p as stopStream, r as disposeRecordingSession, t as addBarcode, u as processId, x as OPTIMIZING_WATCHDOG_MARGIN_MS, y as resolveIdCaptureThresholds } from "./idCaptureServices-UXYCBZPK.esm.js";
+import { t as StreamCanvasCapture } from "./StreamCanvasCapture-C9jtgBdT.esm.js";
 //#region src/modules/id/digitalUpload/digitalUploadErrors.ts
 const TERMINAL_FAIL_REASONS = /* @__PURE__ */ new Set(["DIGITAL_ID_REQUESTED_BUT_OTHER_PROVIDED", "ID_TYPE_UNACCEPTABLE"]);
 function isKnownFailReason(reason) {
@@ -955,8 +959,6 @@ const isPermissionDeniedErrorGuard = ({ event }) => {
 	return false;
 };
 const isPermissionBlockedGuard = ({ context }) => context.permissionResult === "denied" || context.permissionResult === "refresh";
-const hasStreamGuard = ({ context }) => context.stream !== void 0;
-const hasInitializedCameraGuard = ({ context }) => context.stream !== void 0 && context.provider !== void 0;
 const hasAttemptsRemainingGuard = ({ context }) => context.attemptsRemaining > 0;
 const hasCapturedImageGuard = ({ context }) => {
 	return context.provider?.getCapturedCanvas() !== null;
@@ -964,17 +966,6 @@ const hasCapturedImageGuard = ({ context }) => {
 const hasCandidateFrameGuard = ({ event }) => {
 	return event.type === "DETECTION_OPTIMIZING" && Boolean(event.candidateCanvas);
 };
-/**
-* IDC-05: whether WASM's commit arrived while the optimizing phase was still
-* spending its dwell, and is therefore parked in `optimizing.holding` waiting
-* for the release.
-*
-* Gates the phase's own `SWITCH_TO_MANUAL_CAPTURE` / `MANUAL_CAPTURE` handlers:
-* while a commit is parked those escapes end the dwell early instead of leaving
-* the phase, so WASM's committed frame is honored rather than dropped on the way
-* out. False leaves both events to the arm parent, the documented escape hatch.
-*/
-const hasStashedCommitGuard = ({ context }) => context.stashedCommit !== void 0;
 const hasUploadValidationErrorGuard = ({ context }) => {
 	if (!context.uploadResponse) return false;
 	return validateUploadResponse(context.uploadResponse, {
@@ -1353,412 +1344,133 @@ function computeIdCaptureOutput(context) {
 	};
 }
 //#endregion
-//#region src/modules/digital-id-redirect/digitalIdRedirectServices.ts
-function withQuery(path, params) {
-	if (!params) return path;
-	const search = new URLSearchParams();
-	if (params.country) search.set("country", params.country);
-	if (params.region) search.set("region", params.region);
-	const qs = search.toString();
-	return qs ? `${path}?${qs}` : path;
-}
-/** GET the provider catalog. Ordering is applied FE-side by the module. */
-async function listProviders(params, signal) {
-	const url = withQuery(endpoints.digitalIdProviders, params);
-	const res = await api.get(url, { signal });
-	if (!res.ok) throw new Error(`GET ${url} failed: ${res.status} ${res.statusText}`);
-	return res.data ?? [];
-}
-/**
-* Append the onboarding `uuid` to `returnUrl` when absent, so the return leg can
-* re-attach the (onboarding-scoped) verification. Idempotent (skips when a `uuid`
-* is already present) and non-fatal (returns the URL unchanged on any failure).
-* Exported for unit testing.
-*/
-async function ensureReturnUrlUuid(returnUrl, signal) {
-	try {
-		if (getUrlSearchParam(returnUrl, "uuid")) return returnUrl;
-		const res = await api.get(endpoints.onboardingUrl, { signal });
-		const onboardingUrl = res.ok ? res.data?.url : void 0;
-		const uuid = onboardingUrl ? getUrlSearchParam(onboardingUrl, "uuid") : null;
-		if (!uuid) return returnUrl;
-		return buildUrlWithSearchParams(returnUrl, { uuid });
-	} catch (error) {
-		console.warn("[DigitalIdRedirect] ensureReturnUrlUuid failed, proceeding without uuid:", error);
-		return returnUrl;
-	}
-}
-/**
-* Create a verification. On success the caller must full-page-redirect to
-* `flowData.launchUrl`. NOTE: this is the billable moment for iDIN/FTN — each
-* call (incl. every retry) is a new session and a new billing event.
-*
-* The `redirectUrl` is first passed through `ensureReturnUrlUuid` so a bare
-* launch gets a resumable `uuid` before the bank round-trip. This reuses the
-* current session token (no extra `/omni/start`) and only fetches when the URL
-* lacks a `uuid`.
-*/
-async function createVerification(params, signal) {
-	const redirectUrl = await ensureReturnUrlUuid(params.redirectUrl, signal);
-	const res = await api.post(endpoints.digitalIdVerifications, {
-		...params,
-		redirectUrl
-	}, { signal });
-	if (!res.ok) throw new Error(`POST ${endpoints.digitalIdVerifications} failed: ${res.status} ${res.statusText}`);
-	return res.data;
-}
-/**
-* Submit the provider's return params. The contract wants them wrapped as a
-* JSON *string* under `walletResponse` (success serialized as "true"/"false").
-*/
-async function submitWalletResponse(verificationId, params, signal) {
-	const url = `${endpoints.digitalIdVerifications}/${verificationId}/response`;
-	const body = { walletResponse: JSON.stringify({
-		sessionId: params.sessionId,
-		resultsAccessKey: params.resultsAccessKey,
-		success: String(params.success)
-	}) };
-	const res = await api.post(url, body, { signal });
-	if (!res.ok) throw new Error(`POST ${url} failed: ${res.status} ${res.statusText}`);
-	return res.data;
-}
-/** Poll fallback — used when the user does not return or results are delayed. */
-async function getVerificationStatus(verificationId, signal) {
-	const url = `${endpoints.digitalIdVerifications}/${verificationId}/status`;
-	const res = await api.get(url, { signal });
-	if (!res.ok) throw new Error(`GET ${url} failed: ${res.status} ${res.statusText}`);
-	return res.data;
+//#region src/modules/id/idDetectionNotificationController.ts
+const NOTIFICATION_DURATION_MS = 500;
+function isReportedIdSideWrong(currentMode, reportedSide) {
+	if (!reportedSide) return false;
+	const detectedSide = reportedSide.toLowerCase();
+	if (detectedSide === "wrong") return true;
+	const isBackDetected = detectedSide.includes("back") && !detectedSide.includes("front");
+	const isFrontDetected = detectedSide.includes("front") && !detectedSide.includes("back");
+	return currentMode === "front" && isBackDetected || currentMode === "back" && isFrontDetected;
 }
 /**
-* Refresh an expiring `launchUrl` (maps to `flowData.expiresAt`). Do NOT create
-* a new verification for this — that would be a new billing event.
+* Coalesces noisy per-frame quality callbacks into stable presentation state.
+* Repeating the current status extends its display window without re-emitting
+* it, while a different status waits until that window closes.
 */
-async function refreshVerification(verificationId, signal) {
-	const url = `${endpoints.digitalIdVerifications}/${verificationId}/refresh`;
-	const res = await api.post(url, {}, { signal });
-	if (!res.ok) throw new Error(`POST ${url} failed: ${res.status} ${res.statusText}`);
-	return res.data;
+function createIdDetectionNotificationController(input) {
+	const timer = BrowserTimerProvider.getInstance();
+	let timeout = null;
+	let currentStatus = null;
+	const scheduleReset = () => {
+		timeout = timer.setTimeout(() => {
+			timeout = null;
+			currentStatus = null;
+			input.send("detecting");
+		}, NOTIFICATION_DURATION_MS);
+	};
+	const clear = () => {
+		if (timeout) timer.clearTimeout(timeout);
+		timeout = null;
+		currentStatus = null;
+	};
+	const show = (status) => {
+		if (input.isSuppressed()) return;
+		if (timeout) {
+			if (currentStatus !== status) return;
+			timer.clearTimeout(timeout);
+			scheduleReset();
+			return;
+		}
+		currentStatus = status;
+		input.onStatusShown?.(status);
+		input.send(status);
+		scheduleReset();
+	};
+	return {
+		show,
+		clear
+	};
 }
 //#endregion
-//#region src/modules/digital-id-redirect/digitalIdRedirectStorage.ts
+//#region src/modules/id/idCaptureActors.ts
+const checkPermissionActor = fromPromise(async () => {
+	return checkPermission();
+});
+async function requestIdCapturePermission(input) {
+	if (!isAndroid() || getBrowser() !== "firefox") return invokeRequestPermissionActor(input);
+	if (input.requestMotionPermission) {
+		const motionResult = await invokeRequestPermissionActor({
+			...input,
+			permissionResult: "granted"
+		});
+		if (motionResult !== "granted") return motionResult;
+	}
+	const { stream, constraints, fallbackLevel } = await getIdCameraStream();
+	if (!input.acceptStream?.({
+		stream,
+		constraints,
+		fallbackLevel
+	})) stopStream(stream);
+	return {
+		permissionResult: "granted",
+		cameraFallbackLevel: fallbackLevel
+	};
+}
+const requestPermissionActor = fromPromise(async ({ input }) => {
+	return requestIdCapturePermission(input);
+});
+fromPromise(async ({ input }) => {
+	return initializeIdCapture(input);
+});
+const DEFAULT_ID_CAPTURE_GEOMETRY = {
+	areaDown: 25e3,
+	areaUp: 55e3,
+	areaIOSPassportUp: 3e4,
+	areaIOSPassportDown: 2e4,
+	widthIOSUp: 160,
+	widthIOSDown: 85,
+	widthDown: 110,
+	widthUp: 205
+};
 /**
-* Cross-redirect handoff. The full-page redirect out to the provider tears down
-* the SPA, so the pending verification must be persisted BEFORE navigating and
-* read back on the return leg. Only the non-sensitive `verificationId` +
-* `providerId` live here — the session credential is the host's concern
-* (re-bootstrapped from `url_uuid`) and is NEVER persisted by this module.
+* Applies the canonical ID workflow configuration to either the legacy
+* host-fed pipeline or the protected camera-cycle workflow.
 *
-* Backed by whatever `IStorageCapability` is injected (default localStorage).
-* sessionStorage would be preferable (auto-clears on tab close) — swap the
-* capability when a sessionStorage-backed provider exists. A single fixed key
-* is used, so a stale record from an abandoned redirect is overwritten by the
-* next one and is only ever read on the host's return route.
-*
-* TODO(follow-up): add a staleness TTL once an injected time capability lands
-* (Core forbids `Date.now()` directly — `no-browser-api-in-core`).
+* Keeping geometry, thresholds, settings, model selection, callbacks, and
+* barcode setup here prevents the two frame-transport architectures from
+* drifting while the protected path is rolled out.
 */
-const PENDING_KEY = "incode.digitalIdRedirect.pending";
-async function persistPendingRedirect(storage, entry) {
-	await storage.set(PENDING_KEY, {
-		verificationId: entry.verificationId,
-		providerId: entry.providerId
+function configureIdCaptureProvider(input) {
+	const windowDimensions = getWindowDimensions(input.frameSize.width, input.frameSize.height);
+	input.provider.setGeometry({
+		...input.config.geometry ?? DEFAULT_ID_CAPTURE_GEOMETRY,
+		windowOuterWidth: windowDimensions.outerWidth,
+		windowOuterHeight: windowDimensions.outerHeight,
+		windowInnerWidth: windowDimensions.innerWidth,
+		windowInnerHeight: windowDimensions.innerHeight
 	});
+	const idType = input.currentMode === "back" ? "BackId" : input.currentMode === "passport" ? "Passport" : "FrontId";
+	input.provider.setSettings({
+		isFixedMask: input.config.settings?.isFixedMask ?? false,
+		isIPhone14OrHigher: input.config.settings?.isIPhone14OrHigher ?? false,
+		idType,
+		blurCheckEnabled: input.config.settings?.blurCheckEnabled ?? false,
+		glareCheckEnabled: input.config.settings?.glareCheckEnabled ?? false,
+		faceQualityCheckEnabled: input.config.settings?.faceQualityCheckEnabled ?? true,
+		iouCheckEnabled: input.config.settings?.iouCheckEnabled ?? true,
+		fpsLimitEnabled: input.config.settings?.fpsLimitEnabled ?? false
+	});
+	input.provider.setThresholds(resolveIdCaptureThresholds(input.config));
+	input.provider.setModelType(input.config.modelVersion ?? "v2");
+	input.provider.setCallbacks(input.callbacks);
+	const barcodeCaptureEnabled = input.config.usSmartCapture === true && input.currentMode === "back";
+	input.provider.setBarcodeCaptureEnabled(barcodeCaptureEnabled);
+	input.provider.setBarcodeAutoCaptureOnDecode(false);
+	if (barcodeCaptureEnabled) input.provider.setBarcodeEnhancementModel().catch(() => {});
 }
-async function readPendingRedirect(storage) {
-	const pending = await storage.get(PENDING_KEY);
-	return pending?.verificationId && pending?.providerId ? pending : null;
-}
-async function clearPendingRedirect(storage) {
-	await storage.remove(PENDING_KEY);
-}
-//#endregion
-//#region src/modules/digital-id-redirect/digitalIdRedirectStateMachine.ts
-const POLL_INTERVAL_MS = 1500;
-const MAX_POLL_ATTEMPTS = 20;
-const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
-	"COMPLETED",
-	"FAILED",
-	"EXPIRED",
-	"CANCELLED"
-]);
-function isTerminal(status) {
-	return TERMINAL_STATUSES.has(status);
-}
-const digitalIdRedirectMachine = setup({
-	types: {
-		context: {},
-		events: {},
-		input: {},
-		output: {}
-	},
-	actors: {
-		listProviders: fromPromise(async ({ input, signal }) => listProviders(input ? { country: input.country } : void 0, signal)),
-		createVerification: fromPromise(async ({ input, signal }) => createVerification(input, signal)),
-		submitWalletResponse: fromPromise(async ({ input, signal }) => submitWalletResponse(input.verificationId, input.params, signal)),
-		refreshVerification: fromPromise(async ({ input, signal }) => refreshVerification(input.verificationId, signal)),
-		pollStatus: fromCallback(({ sendBack, input }) => {
-			const timer = BrowserTimerProvider.getInstance();
-			const interval = timer.setInterval(async () => {
-				try {
-					const v = await getVerificationStatus(input.verificationId);
-					if (isTerminal(v.status)) sendBack({
-						type: "POLL_RESULT",
-						verification: v
-					});
-				} catch (error) {
-					console.warn("[DigitalIdRedirect] status poll failed:", error);
-				}
-			}, POLL_INTERVAL_MS);
-			return () => timer.clearInterval(interval);
-		}),
-		persistPending: fromPromise(async ({ input }) => {
-			await persistPendingRedirect(input.storage, {
-				verificationId: input.verificationId,
-				providerId: input.providerId
-			});
-		})
-	},
-	actions: {
-		setProviders: assign(({ event }) => ({ providers: event.output })),
-		setSelectedProvider: assign(({ event }) => ({ selectedProvider: event.providerId })),
-		setVerification: assign(({ event }) => {
-			const v = event.output;
-			return {
-				verificationId: v.verificationId,
-				launchUrl: v.flowData?.launchUrl ?? void 0,
-				expiresAt: v.flowData?.expiresAt ?? void 0,
-				status: v.status,
-				failureReason: v.failureReason ?? void 0,
-				portraitPresent: v.portraitPresent ?? false
-			};
-		}),
-		setVerificationFromEvent: assign(({ event }) => {
-			const v = event.verification;
-			return {
-				status: v.status,
-				failureReason: v.failureReason ?? void 0,
-				portraitPresent: v.portraitPresent ?? false
-			};
-		}),
-		setError: assign(({ event }) => ({ error: String(event.error ?? "Unknown error") })),
-		clearResume: assign(() => ({
-			returnParams: void 0,
-			verificationId: void 0,
-			failureReason: void 0,
-			status: void 0,
-			error: void 0
-		}))
-	},
-	guards: {
-		hasPresetProvider: ({ context }) => Boolean(context.config.provider),
-		autoStartPreset: ({ context }) => context.autoStart && Boolean(context.config.provider),
-		autoStartCatalog: ({ context }) => context.autoStart && !context.config.provider,
-		isResuming: ({ context }) => Boolean(context.returnParams),
-		returnSucceeded: ({ context }) => context.returnParams?.success === true,
-		submittedTerminalOk: ({ event }) => event.output.status === "COMPLETED",
-		submittedFailed: ({ event }) => {
-			const s = event.output.status;
-			return s === "FAILED" || s === "EXPIRED" || s === "CANCELLED";
-		},
-		polledOk: ({ event }) => event.verification.status === "COMPLETED"
-	}
-}).createMachine({
-	id: "digitalIdRedirect",
-	initial: "idle",
-	context: ({ input }) => ({
-		config: input.config,
-		storage: input.storage,
-		returnUrl: input.config.returnUrl ?? "",
-		providers: [],
-		selectedProvider: input.config.provider,
-		verificationId: input.resume?.verificationId,
-		launchUrl: void 0,
-		expiresAt: void 0,
-		status: void 0,
-		failureReason: void 0,
-		portraitPresent: false,
-		returnParams: input.resume?.returnParams,
-		error: void 0,
-		autoStart: input.autoStart ?? false
-	}),
-	output: ({ context }) => context.status === "COMPLETED" ? {
-		status: "COMPLETED",
-		providerId: context.selectedProvider ?? context.config.provider ?? "",
-		portraitPresent: context.portraitPresent
-	} : { status: "DISMISSED" },
-	states: {
-		idle: {
-			always: [
-				{
-					guard: "isResuming",
-					target: "submitting"
-				},
-				{
-					guard: "autoStartPreset",
-					target: "creating"
-				},
-				{
-					guard: "autoStartCatalog",
-					target: "loadingProviders"
-				}
-			],
-			on: { LOAD: [{
-				guard: "hasPresetProvider",
-				target: "creating"
-			}, { target: "loadingProviders" }] }
-		},
-		loadingProviders: { invoke: {
-			src: "listProviders",
-			input: ({ context }) => ({ country: context.config.country }),
-			onDone: {
-				target: "choosingProvider",
-				actions: "setProviders"
-			},
-			onError: {
-				target: "error",
-				actions: "setError"
-			}
-		} },
-		choosingProvider: { on: { SELECT_PROVIDER: {
-			target: "creating",
-			actions: "setSelectedProvider"
-		} } },
-		creating: { invoke: {
-			src: "createVerification",
-			input: ({ context }) => ({
-				providerId: context.selectedProvider ?? "",
-				redirectUrl: context.returnUrl
-			}),
-			onDone: {
-				target: "persisting",
-				actions: "setVerification"
-			},
-			onError: {
-				target: "error",
-				actions: "setError"
-			}
-		} },
-		persisting: { invoke: {
-			src: "persistPending",
-			input: ({ context }) => ({
-				storage: context.storage,
-				verificationId: context.verificationId ?? "",
-				providerId: context.selectedProvider ?? ""
-			}),
-			onDone: { target: "readyToRedirect" },
-			onError: { target: "readyToRedirect" }
-		} },
-		readyToRedirect: { on: { REFRESH: { target: "refreshing" } } },
-		refreshing: { invoke: {
-			src: "refreshVerification",
-			input: ({ context }) => ({ verificationId: context.verificationId ?? "" }),
-			onDone: {
-				target: "readyToRedirect",
-				actions: "setVerification"
-			},
-			onError: {
-				target: "error",
-				actions: "setError"
-			}
-		} },
-		submitting: { invoke: {
-			src: "submitWalletResponse",
-			input: ({ context }) => ({
-				verificationId: context.verificationId ?? "",
-				params: context.returnParams
-			}),
-			onDone: [
-				{
-					guard: "submittedTerminalOk",
-					target: "succeeded",
-					actions: "setVerification"
-				},
-				{
-					guard: "submittedFailed",
-					target: "failed",
-					actions: "setVerification"
-				},
-				{
-					target: "polling",
-					actions: "setVerification"
-				}
-			],
-			onError: {
-				target: "error",
-				actions: "setError"
-			}
-		} },
-		polling: {
-			invoke: {
-				src: "pollStatus",
-				input: ({ context }) => ({ verificationId: context.verificationId ?? "" })
-			},
-			on: { POLL_RESULT: [{
-				guard: "polledOk",
-				target: "succeeded",
-				actions: "setVerificationFromEvent"
-			}, {
-				target: "failed",
-				actions: "setVerificationFromEvent"
-			}] },
-			after: { [POLL_INTERVAL_MS * MAX_POLL_ATTEMPTS]: {
-				target: "failed",
-				actions: assign({ failureReason: () => "SESSION_EXPIRED" })
-			} }
-		},
-		succeeded: { on: { CONTINUE: { target: "finished" } } },
-		finished: { type: "final" },
-		failed: { on: {
-			RETRY: [{
-				guard: "hasPresetProvider",
-				target: "creating"
-			}, { target: "choosingProvider" }],
-			USE_ANOTHER_METHOD: { target: "closed" },
-			CLOSE: { target: "closed" }
-		} },
-		error: { on: {
-			RETRY: [{
-				guard: "hasPresetProvider",
-				target: "creating",
-				actions: "clearResume"
-			}, {
-				target: "choosingProvider",
-				actions: "clearResume"
-			}],
-			USE_ANOTHER_METHOD: { target: "closed" },
-			CLOSE: { target: "closed" }
-		} },
-		closed: { type: "final" }
-	}
-});
-//#endregion
-//#region src/modules/id/idCaptureActors.ts
-const checkPermissionActor = fromPromise(async () => {
-	return checkPermission();
-});
-async function requestIdCapturePermission(input) {
-	if (!isAndroid() || getBrowser() !== "firefox") return invokeRequestPermissionActor(input);
-	if (input.requestMotionPermission) {
-		const motionResult = await invokeRequestPermissionActor({
-			...input,
-			permissionResult: "granted"
-		});
-		if (motionResult !== "granted") return motionResult;
-	}
-	const { stream, fallbackLevel } = await getIdCameraStream();
-	return {
-		permissionResult: "granted",
-		stream,
-		cameraFallbackLevel: fallbackLevel
-	};
-}
-const requestPermissionActor = fromPromise(async ({ input }) => {
-	return requestIdCapturePermission(input);
-});
-const initializeCameraActor = fromPromise(async ({ input }) => {
-	return initializeIdCapture(input);
-});
-const runDetectionActor = fromCallback(({ input, sendBack }) => {
+fromCallback(({ input, sendBack }) => {
 	if (!input.frameCapturer || !input.provider) {
 		sendBack({
 			type: "DETECTION_UPDATE",
@@ -1772,7 +1484,6 @@ const runDetectionActor = fromCallback(({ input, sendBack }) => {
 	let storedQualityElements = {};
 	let isCapturing = false;
 	const timer = BrowserTimerProvider.getInstance();
-	let notificationTimeout = null;
 	let optimizingBoundaryTimeout = null;
 	/**
 	* IDC-05 latch for the boundary clock: whether a boundary is currently
@@ -1780,24 +1491,8 @@ const runDetectionActor = fromCallback(({ input, sendBack }) => {
 	* the clock's only T0; nothing in WASM enforces that it fires once per window.
 	*/
 	let isOptimizingBoundaryArmed = false;
-	let currentNotificationStatus = null;
 	let lastReportedSide = null;
-	const NOTIFICATION_DURATION_MS = 500;
-	const isReportedSideWrong = () => {
-		if (!lastReportedSide) return false;
-		const detectedSide = lastReportedSide.toLowerCase();
-		if (detectedSide === "wrong") return true;
-		const isBackDetected = detectedSide.includes("back") && !detectedSide.includes("front");
-		const isFrontDetected = detectedSide.includes("front") && !detectedSide.includes("back");
-		return input.currentMode === "front" && isBackDetected || input.currentMode === "back" && isFrontDetected;
-	};
-	const clearNotificationTimeout = () => {
-		if (notificationTimeout) {
-			timer.clearTimeout(notificationTimeout);
-			notificationTimeout = null;
-			currentNotificationStatus = null;
-		}
-	};
+	const isReportedSideWrong = () => isReportedIdSideWrong(input.currentMode, lastReportedSide);
 	const clearOptimizingBoundary = () => {
 		if (optimizingBoundaryTimeout) {
 			timer.clearTimeout(optimizingBoundaryTimeout);
@@ -1842,173 +1537,130 @@ const runDetectionActor = fromCallback(({ input, sendBack }) => {
 			candidateCanvas
 		});
 	};
-	const sendNotification = (status) => {
-		if (isReportedSideWrong()) return;
-		if (notificationTimeout && currentNotificationStatus !== status) return;
-		if (notificationTimeout && currentNotificationStatus === status) timer.clearTimeout(notificationTimeout);
-		currentNotificationStatus = status;
-		trueSightHintTransition("module.id-capture", "idScan", status);
-		sendBack({
+	const notifications = createIdDetectionNotificationController({
+		send: (status) => sendBack({
 			type: "DETECTION_UPDATE",
 			status
-		});
-		notificationTimeout = timer.setTimeout(() => {
-			notificationTimeout = null;
-			currentNotificationStatus = null;
-			sendBack({
-				type: "DETECTION_UPDATE",
-				status: "detecting"
-			});
-		}, NOTIFICATION_DURATION_MS);
-	};
-	const canvas = input.frameCapturer.getLatestCanvas();
-	const windowDimensions = getWindowDimensions(canvas?.width() ?? 1280, canvas?.height() ?? 720);
-	const DEFAULT_GEOMETRY = {
-		areaDown: 25e3,
-		areaUp: 55e3,
-		areaIOSPassportUp: 3e4,
-		areaIOSPassportDown: 2e4,
-		widthIOSUp: 160,
-		widthIOSDown: 85,
-		widthDown: 110,
-		widthUp: 205
-	};
-	if (input.config.geometry) provider.setGeometry({
-		...input.config.geometry,
-		windowOuterWidth: windowDimensions.outerWidth,
-		windowOuterHeight: windowDimensions.outerHeight,
-		windowInnerWidth: windowDimensions.innerWidth,
-		windowInnerHeight: windowDimensions.innerHeight
-	});
-	else provider.setGeometry({
-		...DEFAULT_GEOMETRY,
-		windowOuterWidth: windowDimensions.outerWidth,
-		windowOuterHeight: windowDimensions.outerHeight,
-		windowInnerWidth: windowDimensions.innerWidth,
-		windowInnerHeight: windowDimensions.innerHeight
-	});
-	const idType = input.currentMode === "back" ? "BackId" : input.currentMode === "passport" ? "Passport" : "FrontId";
-	provider.setSettings({
-		isFixedMask: input.config.settings?.isFixedMask ?? false,
-		isIPhone14OrHigher: input.config.settings?.isIPhone14OrHigher ?? false,
-		idType,
-		blurCheckEnabled: input.config.settings?.blurCheckEnabled ?? false,
-		glareCheckEnabled: input.config.settings?.glareCheckEnabled ?? false,
-		faceQualityCheckEnabled: input.config.settings?.faceQualityCheckEnabled ?? true,
-		iouCheckEnabled: input.config.settings?.iouCheckEnabled ?? true,
-		fpsLimitEnabled: input.config.settings?.fpsLimitEnabled ?? false
+		}),
+		isSuppressed: isReportedSideWrong,
+		onStatusShown: (status) => trueSightHintTransition("module.id-capture", "idScan", status)
 	});
-	provider.setThresholds(resolveIdCaptureThresholds(input.config));
-	const modelType = input.config.modelVersion ?? "v2";
-	provider.setModelType(modelType);
-	provider.setCallbacks({
-		onFarAway: () => {
-			if (!isCapturing) sendNotification("farAway");
-		},
-		onDetectionStarted: () => {},
-		onMaskChange: (_show, _mask, _top, orientation) => {
-			sendBack({
-				type: "ORIENTATION_CHANGE",
-				orientation
-			});
-		},
-		onBlur: () => {
-			if (!isCapturing) sendNotification("blur");
-		},
-		onGlare: () => {
-			if (!isCapturing) sendNotification("glare");
+	const canvas = input.frameCapturer.getLatestCanvas();
+	const canvasWidth = canvas?.width() ?? 1280;
+	const canvasHeight = canvas?.height() ?? 720;
+	configureIdCaptureProvider({
+		provider,
+		config: input.config,
+		currentMode: input.currentMode,
+		frameSize: {
+			width: canvasWidth,
+			height: canvasHeight
 		},
-		onIdNotDetected: () => {
-			if (!isCapturing) {
-				trueSightHintTransition("module.id-capture", "idScan", "idNotDetected");
+		callbacks: {
+			onFarAway: () => {
+				if (!isCapturing) notifications.show("farAway");
+			},
+			onDetectionStarted: () => {},
+			onMaskChange: (_show, _mask, _top, orientation) => {
 				sendBack({
-					type: "DETECTION_UPDATE",
-					status: "idNotDetected"
+					type: "ORIENTATION_CHANGE",
+					orientation
 				});
-			}
-		},
-		onSwitchToManualCapture: () => {
-			isCapturing = false;
-			clearOptimizingBoundary();
-			sendBack({ type: "SWITCH_TO_MANUAL_CAPTURE" });
-		},
-		onCapturing: () => {
-			clearNotificationTimeout();
-			lastReportedSide = null;
-			isCapturing = true;
-			trueSightHintTransition("module.id-capture", "idScan", "capturing");
-			sendBack({
-				type: "DETECTION_UPDATE",
-				status: "capturing"
-			});
-			scheduleOptimizingBoundary();
-		},
-		onBestFrame: (blur, glare, orientation) => {
-			if (currentCanvas) {
-				bestCanvas = currentCanvas.clone();
-				storedQualityElements = {
-					glare,
-					sharpness: blur
-				};
-			}
-			if (orientation === "horizontal" || orientation === "vertical") sendBack({
-				type: "ORIENTATION_CHANGE",
-				orientation
-			});
-		},
-		onCapture: () => {
-			isCapturing = false;
-			if (isOptimizingBoundaryArmed) {
+			},
+			onBlur: () => {
+				if (!isCapturing) notifications.show("blur");
+			},
+			onGlare: () => {
+				if (!isCapturing) notifications.show("glare");
+			},
+			onIdNotDetected: () => {
+				if (!isCapturing) {
+					trueSightHintTransition("module.id-capture", "idScan", "idNotDetected");
+					sendBack({
+						type: "DETECTION_UPDATE",
+						status: "idNotDetected"
+					});
+				}
+			},
+			onSwitchToManualCapture: () => {
+				isCapturing = false;
 				clearOptimizingBoundary();
-				enterOptimizing();
-			}
-			if (!bestCanvas) {
-				const clonedCanvas = currentCanvas?.clone();
-				if (clonedCanvas) sendBack({
-					type: "DETECTION_SUCCESS",
-					canvas: clonedCanvas,
-					qualityElements: {}
+				sendBack({ type: "SWITCH_TO_MANUAL_CAPTURE" });
+			},
+			onCapturing: () => {
+				notifications.clear();
+				lastReportedSide = null;
+				isCapturing = true;
+				trueSightHintTransition("module.id-capture", "idScan", "capturing");
+				sendBack({
+					type: "DETECTION_UPDATE",
+					status: "capturing"
+				});
+				scheduleOptimizingBoundary();
+			},
+			onBestFrame: (blur, glare, orientation) => {
+				if (currentCanvas) {
+					bestCanvas = currentCanvas.clone();
+					storedQualityElements = {
+						glare,
+						sharpness: blur
+					};
+				}
+				if (orientation === "horizontal" || orientation === "vertical") sendBack({
+					type: "ORIENTATION_CHANGE",
+					orientation
+				});
+			},
+			onCapture: () => {
+				isCapturing = false;
+				if (isOptimizingBoundaryArmed) {
+					clearOptimizingBoundary();
+					enterOptimizing();
+				}
+				if (!bestCanvas) {
+					const clonedCanvas = currentCanvas?.clone();
+					if (clonedCanvas) sendBack({
+						type: "DETECTION_SUCCESS",
+						canvas: clonedCanvas,
+						qualityElements: {}
+					});
+					return;
+				}
+				sendBack({
+					type: "DETECTION_SUCCESS",
+					canvas: bestCanvas,
+					qualityElements: storedQualityElements
+				});
+			},
+			onIdTypeChange: (idType) => {
+				sendBack({
+					type: "ID_TYPE_CHANGE",
+					idType
+				});
+			},
+			onIdSideChange: (side) => {
+				if (isCapturing) return;
+				lastReportedSide = side;
+				if (isReportedSideWrong()) notifications.clear();
+				sendBack({
+					type: "ID_SIDE_CHANGE",
+					side
+				});
+			},
+			onCapturingCounterValueChange: (value) => {
+				sendBack({
+					type: "COUNTER_VALUE_CHANGE",
+					value
+				});
+			},
+			onBarcodeDecoded: (decoded) => {
+				sendBack({
+					type: "BARCODE_DECODED",
+					decoded
 				});
-				return;
 			}
-			sendBack({
-				type: "DETECTION_SUCCESS",
-				canvas: bestCanvas,
-				qualityElements: storedQualityElements
-			});
-		},
-		onIdTypeChange: (idType) => {
-			sendBack({
-				type: "ID_TYPE_CHANGE",
-				idType
-			});
-		},
-		onIdSideChange: (side) => {
-			if (isCapturing) return;
-			lastReportedSide = side;
-			if (isReportedSideWrong()) clearNotificationTimeout();
-			sendBack({
-				type: "ID_SIDE_CHANGE",
-				side
-			});
-		},
-		onCapturingCounterValueChange: (value) => {
-			sendBack({
-				type: "COUNTER_VALUE_CHANGE",
-				value
-			});
-		},
-		onBarcodeDecoded: (decoded) => {
-			sendBack({
-				type: "BARCODE_DECODED",
-				decoded
-			});
 		}
 	});
-	const barcodeCaptureEnabled = input.config.usSmartCapture === true && input.currentMode === "back";
-	provider.setBarcodeCaptureEnabled(barcodeCaptureEnabled);
-	provider.setBarcodeAutoCaptureOnDecode(false);
-	if (barcodeCaptureEnabled) provider.setBarcodeEnhancementModel().catch(() => {});
 	sendBack({
 		type: "DETECTION_UPDATE",
 		status: "detecting"
@@ -2021,11 +1673,7 @@ const runDetectionActor = fromCallback(({ input, sendBack }) => {
 				await provider.processFrame(frame);
 			},
 			reset: () => {
-				if (notificationTimeout) {
-					timer.clearTimeout(notificationTimeout);
-					notificationTimeout = null;
-					currentNotificationStatus = null;
-				}
+				notifications.clear();
 				clearOptimizingBoundary();
 				currentCanvas = null;
 				bestCanvas = null;
@@ -2044,7 +1692,7 @@ const runDetectionActor = fromCallback(({ input, sendBack }) => {
 		}
 	});
 	return () => {
-		clearNotificationTimeout();
+		notifications.clear();
 		clearOptimizingBoundary();
 		session?.dispose();
 		noteTrueSightCaptureActivity(false);
@@ -2057,7 +1705,7 @@ const uploadProgressTickerActor = fromCallback(({ sendBack }) => {
 	}, 400);
 	return () => timer.clearInterval(interval);
 });
-const uploadIdImageActor = fromPromise(async ({ input, signal }) => {
+fromPromise(async ({ input, signal }) => {
 	const image = input.canvas.getBase64Image();
 	if (!image) throw new Error(ID_ERROR_CODES.UPLOAD_ERROR);
 	let metadata;
@@ -2121,7 +1769,7 @@ const submitBarcodeActor = fromPromise(async ({ input, signal }) => {
 	}), input.minDurationMs ? sleep(input.minDurationMs) : Promise.resolve()]);
 	return response;
 });
-const startRecordingActor = fromPromise(async ({ input }) => {
+fromPromise(async ({ input }) => {
 	if (!input.stream) return;
 	const type = input.currentMode === "back" ? "backId" : "frontId";
 	return startRecordingSession({
@@ -2131,16 +1779,16 @@ const startRecordingActor = fromPromise(async ({ input }) => {
 		type
 	});
 });
-const initializeDeepsightSessionActor = fromPromise(async ({ input }) => {
+fromPromise(async ({ input }) => {
 	if (!input.dependencies) return;
-	const { loadDeepsightSession } = await import("./deepsightLoader-Dwr1zKFa.esm.js");
+	const { loadDeepsightSession } = await import("./deepsightLoader-Dhz9T_KJ.esm.js");
 	return loadDeepsightSession({
 		ds: input.ds,
 		storage: input.dependencies.storage,
 		disableIpify: input.disableIpify
 	});
 });
-const checkVirtualCameraActor = fromPromise(async ({ input }) => {
+fromPromise(async ({ input }) => {
 	if (!input.deepsightService || !input.stream) return false;
 	const videoTrack = input.stream.getVideoTracks()[0];
 	if (!videoTrack) return false;
@@ -2155,9 +1803,6 @@ function performStopMediaStream(context) {
 function performDisposeProvider(context) {
 	context.provider?.dispose?.();
 }
-function performCleanupDeepsight(context) {
-	context.deepsightService?.cleanup();
-}
 function performResetForBackCapture(context) {
 	context.frameCapturer?.dispose();
 	if (context.stream) stopStream(context.stream);
@@ -2168,9 +1813,6 @@ function performResetForFrontCapture(context) {
 	if (context.stream) stopStream(context.stream);
 	context.provider?.reset();
 }
-function performResetDetection(context) {
-	context.resetDetection?.();
-}
 function performReportCaptureOptimizingAssignment(context) {
 	if (context.config.supportsOptimizingStatus !== true) return;
 	const assignment = exposeExperimentOnce(CAPTURE_OPTIMIZING);
@@ -2180,15 +1822,9 @@ function performReportCaptureOptimizingAssignment(context) {
 function performStopMediaRecording(context) {
 	if (context.recordingSession) stopRecording(context.recordingSession);
 }
-function performPauseRecordingForAttempt(context) {
-	if (context.recordingSession) pauseRecordingForAttempt(context.recordingSession);
-}
 function performPrepareRecordingForCameraRetry(context) {
 	if (context.recordingSession) prepareRecordingForCameraRetry(context.recordingSession);
 }
-function getStreamFromEvent(event) {
-	if ("output" in event) return event.output.stream;
-}
 function getPermissionResultFromEvent(event) {
 	if (!("output" in event)) return;
 	const { output } = event;
@@ -2198,24 +1834,9 @@ function getPermissionResultFromEvent(event) {
 		if (result === "granted" || result === "denied" || result === "prompt") return result;
 	}
 }
-function getProviderFromEvent(event) {
-	if ("output" in event) return event.output.provider;
-}
-function getCaptureResolutionFromEvent(event) {
-	if ("output" in event) return event.output.captureResolution;
-}
 function getCameraFallbackLevelFromEvent(event) {
 	if ("output" in event) return event.output.cameraFallbackLevel;
 }
-function getUsingBackCameraFromEvent(event) {
-	if ("output" in event) return event.output.usingBackCamera;
-}
-function getFrameCapturerFromEvent(event) {
-	if ("output" in event) {
-		const output = event.output;
-		if (output.stream) return new StreamCanvasCapture(output.stream);
-	}
-}
 function getResetContextValues(context) {
 	context.provider?.reset();
 	const currentMode = context.config.onlyBack ? "back" : !context.config.enableId && context.config.enablePassport ? "passport" : context.config.usSmartCapture ? "back" : "front";
@@ -2274,19 +1895,6 @@ function getUploadValidationError(context) {
 		skipGlareBack: context.uploadResponse.skipGlareBack
 	})?.errorKey ?? ID_ERROR_CODES.SERVER;
 }
-function storeCapturedCanvasInProviderLogic(context, event) {
-	let canvas = null;
-	if ("canvas" in event && event.canvas) canvas = event.canvas;
-	else canvas = context.frameCapturer?.getLatestCanvas() ?? null;
-	if (!canvas || !context.provider) return;
-	const canvasWidth = canvas.width();
-	const canvasHeight = canvas.height();
-	if (!canvasWidth || !canvasHeight) return;
-	const originalCanvas = canvas;
-	const frameRect = resolveCaptureFrameRect(context, canvasWidth, canvasHeight);
-	const transformedCanvas = context.provider.transformPerspective(originalCanvas, frameRect);
-	context.provider.setCapturedCanvases(originalCanvas, transformedCanvas);
-}
 /**
 * JPEG quality for the IDC-05 optimizing phase's display-only still.
 *
@@ -2426,10 +2034,10 @@ function getStoreCapturedImageValues(context, event) {
 *
 * Revokes any previous URL rather than leaking one per retry.
 */
-function getCandidateFrameValues(context, event) {
+function getCandidateFrameValues(context, event, provider = context.provider) {
 	if (event.type !== "DETECTION_OPTIMIZING" || !event.candidateCanvas) return { candidateImageUrl: context.candidateImageUrl };
 	const candidateCanvas = event.candidateCanvas;
-	const canvas = cropCanvasForPreview(context, candidateCanvas);
+	const canvas = cropCanvasForPreview(context, candidateCanvas, provider);
 	canvas.updateBlob(CANDIDATE_FRAME_JPEG_QUALITY);
 	const url = canvas.getBlobData()?.url;
 	if (!url) {
@@ -2464,12 +2072,12 @@ function releasePreviewCanvases(source, preview, { shouldReleasePreview }) {
 	if (shouldReleasePreview) preview.release();
 	source.release();
 }
-function cropCanvasForPreview(context, canvas) {
+function cropCanvasForPreview(context, canvas, provider = context.provider) {
 	const canvasWidth = canvas.width();
 	const canvasHeight = canvas.height();
-	if (!context.provider || !canvasWidth || !canvasHeight) return canvas;
+	if (!provider || !canvasWidth || !canvasHeight) return canvas;
 	const frameRect = resolveCaptureFrameRect(context, canvasWidth, canvasHeight);
-	return context.provider.transformPerspective(canvas, frameRect);
+	return provider.transformPerspective(canvas, frameRect);
 }
 /**
 * Drops the IDC-05 best-so-far still at every attempt/side boundary. Unlike
@@ -2491,6 +2099,7 @@ function getDetectionStatusFromUpdate(context, event) {
 	if (event.type === "DETECTION_UPDATE") {
 		const newStatus = event.status;
 		const currentStatus = context.detectionStatus;
+		if (currentStatus === "capturing" && newStatus !== "offline") return currentStatus;
 		if (currentStatus === "wrongSide") {
 			if (!(newStatus === "capturing" || newStatus === "manualCapture" || newStatus === "offline")) return currentStatus;
 			return newStatus;
@@ -2550,8 +2159,1353 @@ function getBarcodeResponseValues(context, event) {
 			isDocumentExpired: output?.isDocumentExpired,
 			success: output?.success
 		},
-		skipProcessId: output?.idValidationCompleted === true || context.skipProcessId
-	};
+		skipProcessId: output?.idValidationCompleted === true || context.skipProcessId
+	};
+}
+//#endregion
+//#region src/modules/id/idCaptureDiagnostics.ts
+const ID_CAMERA_DIAGNOSTIC_PREFIX = "[Incode ID camera]";
+function finiteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function stringValue(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function readFocusRequest(constraints) {
+	const sets = [constraints, ...constraints.advanced ?? []];
+	const requestedFocusMode = sets.map((set) => stringValue(set.focusMode)).find((value) => value !== void 0);
+	const requestedFocusDistance = sets.map((set) => finiteNumber(set.focusDistance)).find((value) => value !== void 0);
+	return {
+		focusRequested: requestedFocusMode !== void 0 || requestedFocusDistance !== void 0,
+		requestedFocusMode,
+		requestedFocusDistance
+	};
+}
+/**
+* Returns an intentionally narrow, non-identifying camera diagnostic view.
+* Device IDs and labels must never be added here.
+*/
+function getIdCameraTrackDiagnosticFields(track) {
+	if (!track) return {};
+	let settings = {};
+	let constraints = {};
+	try {
+		settings = track.getSettings();
+	} catch {}
+	try {
+		constraints = track.getConstraints();
+	} catch {}
+	return {
+		width: finiteNumber(settings.width),
+		height: finiteNumber(settings.height),
+		frameRate: finiteNumber(settings.frameRate),
+		facingMode: stringValue(settings.facingMode),
+		readyState: track.readyState,
+		muted: track.muted,
+		devicePinned: settings.deviceId !== void 0,
+		...readFocusRequest(constraints),
+		appliedFocusMode: stringValue(settings.focusMode),
+		appliedFocusDistance: finiteNumber(settings.focusDistance)
+	};
+}
+/**
+* Emits a bounded diagnostic line only in SDK testing mode (devMode or a
+* recognized non-production API host). The payload is primitive-only so the
+* browser console cannot retain live media or native-backed objects.
+*/
+function logIdCameraDiagnostic(event, fields) {
+	if (!isTrueSightTesting()) return;
+	console.debug(`${ID_CAMERA_DIAGNOSTIC_PREFIX} ${event} ${JSON.stringify(fields)}`);
+}
+//#endregion
+//#region src/modules/id/idMetadataPreparationCoordinator.ts
+function cleanup(service) {
+	try {
+		service.cleanup();
+	} catch {}
+}
+function createIdMetadataPreparationCoordinator(load = async (input) => (await import("./deepsightLoader-Dhz9T_KJ.esm.js")).loadDeepsightSession(input)) {
+	let disposed = false;
+	let preparation;
+	let service;
+	const prepare = (input) => {
+		if (disposed) return Promise.reject(/* @__PURE__ */ new Error("ID metadata coordinator is disposed"));
+		preparation ??= (async () => {
+			const prepared = await load(input);
+			if (disposed) {
+				cleanup(prepared);
+				throw new Error("ID metadata coordinator is disposed");
+			}
+			service = prepared;
+			return prepared;
+		})();
+		return preparation;
+	};
+	return {
+		start(input) {
+			prepare(input).catch(() => void 0);
+		},
+		prepare,
+		dispose() {
+			if (disposed) return;
+			disposed = true;
+			preparation = void 0;
+			const prepared = service;
+			service = void 0;
+			if (prepared) cleanup(prepared);
+		}
+	};
+}
+//#endregion
+//#region src/modules/id/idProtectedCapture.ts
+const ID_PROTECTED_CAPTURE_CONTROLLER = Symbol("idProtectedCaptureController");
+function attachIdProtectedCaptureController(owner, controller) {
+	const target = owner;
+	const existing = target[ID_PROTECTED_CAPTURE_CONTROLLER];
+	if (existing) {
+		if (existing !== controller) {
+			existing.dispose();
+			target[ID_PROTECTED_CAPTURE_CONTROLLER] = controller;
+		}
+		return controller;
+	}
+	Object.defineProperty(target, ID_PROTECTED_CAPTURE_CONTROLLER, {
+		configurable: false,
+		enumerable: false,
+		value: controller,
+		writable: true
+	});
+	return controller;
+}
+function getIdProtectedCaptureController(owner) {
+	const controller = findIdProtectedCaptureController(owner);
+	if (!controller) throw new Error("ID protected capture controller is unavailable");
+	return controller;
+}
+function findIdProtectedCaptureController(owner) {
+	return owner[ID_PROTECTED_CAPTURE_CONTROLLER];
+}
+function streamResolution(stream) {
+	const track = stream.getVideoTracks()[0];
+	const settings = track && typeof track.getSettings === "function" ? track.getSettings() : void 0;
+	return typeof settings?.width === "number" && typeof settings.height === "number" ? `${settings.width}x${settings.height}` : void 0;
+}
+function streamUsesBackCamera(stream) {
+	const track = stream.getVideoTracks()[0];
+	if (!track) return;
+	const settings = typeof track.getSettings === "function" ? track.getSettings() : {};
+	const constrainedFacingMode = typeof track.getConstraints === "function" ? track.getConstraints().facingMode : void 0;
+	const facingMode = settings.facingMode ?? (typeof constrainedFacingMode === "string" ? constrainedFacingMode : void 0);
+	if (facingMode === "environment") return true;
+	if (facingMode === "user") return false;
+	const label = typeof track.label === "string" ? track.label.toLowerCase() : "";
+	if (label.includes("back") || label.includes("rear")) return true;
+	if (label.includes("front") || label.includes("user")) return false;
+}
+function createIdProtectedCaptureController(dependencies = {}) {
+	const metadataCoordinator = createIdMetadataPreparationCoordinator(dependencies.loadMetadata);
+	let disposed = false;
+	let visible = true;
+	let preAcquired;
+	let preAcquirePromise;
+	let preAcquireGeneration = 0;
+	let provider;
+	let displayStream;
+	let frameCapturer;
+	let captureResolution;
+	let cameraFallbackLevel;
+	let usingBackCamera;
+	let previewImageUrl;
+	let pendingPreviewCanvas;
+	let attemptGeneration = 0;
+	let autoCaptureFrame;
+	let committed = false;
+	let uploadResponse;
+	let cycleOwnership;
+	let attemptContext;
+	let attemptSend;
+	let diagnosticAttempt;
+	const logDiagnostic = (event, fields = {}) => {
+		if (!diagnosticAttempt) return;
+		logIdCameraDiagnostic(event, {
+			attempt: diagnosticAttempt.attempt,
+			side: diagnosticAttempt.side,
+			elapsedMs: Math.round(getTimestamp() - diagnosticAttempt.startedAt),
+			...fields
+		});
+	};
+	const releasePresentationFrame = (frame) => {
+		frame.width = 1;
+		frame.height = 1;
+	};
+	const releasePreAcquired = () => {
+		if (preAcquired) {
+			stopStream(preAcquired.stream);
+			preAcquired = void 0;
+		}
+	};
+	const acceptPreAcquired = (value) => {
+		if (disposed) {
+			stopStream(value.stream);
+			return false;
+		}
+		releasePreAcquired();
+		preAcquired = value;
+		captureResolution = streamResolution(value.stream);
+		cameraFallbackLevel = value.fallbackLevel;
+		usingBackCamera = streamUsesBackCamera(value.stream);
+		return true;
+	};
+	const preAcquire = () => {
+		if (disposed) return Promise.reject(/* @__PURE__ */ new Error("ID protected capture controller is disposed"));
+		if (preAcquired) return Promise.resolve();
+		if (preAcquirePromise) return preAcquirePromise;
+		const generation = preAcquireGeneration;
+		const pending = (async () => {
+			const value = await (dependencies.acquireCamera ?? getIdCameraStream)();
+			if (disposed || generation !== preAcquireGeneration) {
+				stopStream(value.stream);
+				if (disposed) throw new Error("ID protected capture controller is disposed");
+				return;
+			}
+			acceptPreAcquired(value);
+		})();
+		preAcquirePromise = pending;
+		pending.then(() => {
+			if (preAcquirePromise === pending) preAcquirePromise = void 0;
+		}, () => {
+			if (preAcquirePromise === pending) preAcquirePromise = void 0;
+		});
+		return pending;
+	};
+	const replaceDisplayStream = (stream) => {
+		frameCapturer?.dispose();
+		frameCapturer = void 0;
+		if (displayStream && displayStream !== stream) stopStream(displayStream);
+		displayStream = stream;
+		frameCapturer = new StreamCanvasCapture(stream, { continuous: false });
+		captureResolution = streamResolution(stream);
+		usingBackCamera = streamUsesBackCamera(stream) ?? usingBackCamera;
+	};
+	const clearAttempt = () => {
+		if (diagnosticAttempt) logDiagnostic("attempt-release", { committed });
+		attemptGeneration += 1;
+		frameCapturer?.dispose();
+		frameCapturer = void 0;
+		if (displayStream) stopStream(displayStream);
+		displayStream = void 0;
+		provider?.dispose?.();
+		provider = void 0;
+		captureResolution = void 0;
+		usingBackCamera = void 0;
+		previewImageUrl = void 0;
+		pendingPreviewCanvas?.dispose();
+		pendingPreviewCanvas = void 0;
+		if (autoCaptureFrame) {
+			releasePresentationFrame(autoCaptureFrame);
+			autoCaptureFrame = void 0;
+		}
+		committed = false;
+		uploadResponse = void 0;
+		attemptContext = void 0;
+		attemptSend = void 0;
+		diagnosticAttempt = void 0;
+		cycleOwnership?.releaseByController();
+		cycleOwnership = void 0;
+	};
+	const storeCommit = (previewElement) => {
+		previewImageUrl = void 0;
+		pendingPreviewCanvas?.dispose();
+		pendingPreviewCanvas = void 0;
+		const generation = attemptGeneration;
+		try {
+			const original = new IncodeCanvas(previewElement);
+			let presentation = original;
+			if (attemptContext) try {
+				presentation = cropCanvasForPreview(attemptContext, original, provider);
+			} catch {}
+			try {
+				provider?.setCapturedCanvases(original, presentation);
+			} catch {}
+			pendingPreviewCanvas = presentation;
+			presentation.updateBlobAsync(1).then((blobData) => {
+				if (disposed || attemptGeneration !== generation || pendingPreviewCanvas !== presentation) {
+					presentation.dispose();
+					return;
+				}
+				if (!blobData) {
+					pendingPreviewCanvas = void 0;
+					return;
+				}
+				previewImageUrl = blobData.url;
+				attemptSend?.({ type: "PROTECTED_PREVIEW_READY" });
+			}).catch(() => {
+				if (pendingPreviewCanvas === presentation) pendingPreviewCanvas = void 0;
+				presentation.dispose();
+			});
+		} finally {
+			releasePresentationFrame(previewElement);
+			committed = true;
+		}
+	};
+	const controller = {
+		get disposed() {
+			return disposed;
+		},
+		beginAttempt(context, send) {
+			if (disposed) throw new Error("ID protected capture controller is disposed");
+			clearAttempt();
+			diagnosticAttempt = {
+				attempt: ++protectedIdAttemptSequence,
+				side: context.currentMode === "back" ? "back" : "front",
+				startedAt: getTimestamp()
+			};
+			attemptContext = context;
+			attemptSend = send;
+			provider = (dependencies.createProvider ?? createProtectedIdProvider)(context.config);
+			cycleOwnership = createCameraCycleOwnership(cameraCycleProvider);
+			logDiagnostic("attempt-start", { aggregationMs: context.config?.thresholds?.framesAggregationInterval ?? DEFAULT_ID_CAPTURE_THRESHOLDS.framesAggregationInterval });
+		},
+		startMetadataPreparation(context) {
+			const storage = context.dependencies?.storage;
+			if (!storage) return;
+			metadataCoordinator.start({
+				ds: context.config.ds,
+				storage,
+				disableIpify: context.disableIpify
+			});
+		},
+		prepareMetadata(context) {
+			const storage = context.dependencies?.storage;
+			if (!storage) return Promise.reject(/* @__PURE__ */ new Error("ID metadata storage is unavailable"));
+			return metadataCoordinator.prepare({
+				ds: context.config.ds,
+				storage,
+				disableIpify: context.disableIpify
+			});
+		},
+		clearAttempt,
+		dispose() {
+			if (disposed) return;
+			disposed = true;
+			preAcquireGeneration += 1;
+			metadataCoordinator.dispose();
+			releasePreAcquired();
+			clearAttempt();
+		},
+		preAcquire,
+		setVisible(nextVisible) {
+			visible = nextVisible;
+		},
+		isVisible() {
+			return visible;
+		},
+		storePreAcquiredStream(value) {
+			preAcquireGeneration += 1;
+			return acceptPreAcquired(value);
+		},
+		takePreAcquiredStream() {
+			const value = preAcquired;
+			preAcquired = void 0;
+			if (value) cameraFallbackLevel = value.fallbackLevel;
+			return value;
+		},
+		getProvider() {
+			return provider;
+		},
+		getCycleOwnership() {
+			if (!cycleOwnership) throw new Error("Protected ID cycle ownership is unavailable");
+			return cycleOwnership;
+		},
+		getProjection() {
+			return {
+				stream: displayStream,
+				captureResolution,
+				cameraFallbackLevel,
+				usingBackCamera
+			};
+		},
+		getDiagnosticAttempt() {
+			return diagnosticAttempt;
+		},
+		getPresentationCanvas() {
+			return frameCapturer?.getLatestCanvas() ?? null;
+		},
+		storeAutoCaptureFrame(canvas) {
+			if (disposed) {
+				if (canvas) releasePresentationFrame(canvas);
+				return;
+			}
+			if (autoCaptureFrame && autoCaptureFrame !== canvas) releasePresentationFrame(autoCaptureFrame);
+			autoCaptureFrame = canvas ?? void 0;
+		},
+		hasAutoCaptureFrame() {
+			return autoCaptureFrame !== void 0;
+		},
+		takeAutoCaptureFrame() {
+			const frame = autoCaptureFrame;
+			autoCaptureFrame = void 0;
+			return frame ?? null;
+		},
+		takeCommitPreviewImageUrl() {
+			const value = previewImageUrl;
+			previewImageUrl = void 0;
+			pendingPreviewCanvas = void 0;
+			return value;
+		},
+		hasCommit() {
+			return committed;
+		},
+		takeUploadResponse() {
+			const value = uploadResponse;
+			uploadResponse = void 0;
+			return value;
+		},
+		buildCaptureOnlyUpload(context, onProgress) {
+			const canvas = provider?.getOriginalCapturedCanvas();
+			if (!canvas) throw new Error(ID_ERROR_CODES.UPLOAD_ERROR);
+			const type = context.currentMode === "back" ? "back" : "front";
+			return {
+				canvas,
+				type,
+				qualityElements: context.qualityElements,
+				onProgress,
+				deepsightService: void 0,
+				stream: displayStream,
+				isSecondId: context.config.isSecondId ?? false,
+				onlyFront: type === "front" && (context.config.onlyFront ?? false),
+				ageAssurance: context.config.ageAssurance,
+				dependencies: context.dependencies,
+				captureResolution,
+				cameraFallbackLevel,
+				extractIdFace: context.config.extractIdFace,
+				croppedCanvas: provider?.getCapturedCanvas() ?? null
+			};
+		},
+		runAttempt(sendBack, receive) {
+			if (!attemptContext || !attemptSend) throw new Error("Protected ID attempt is unavailable");
+			return (dependencies.runAttempt ?? runProtectedAttempt)({
+				input: createProtectedIdAttemptInput({
+					context: attemptContext,
+					controller,
+					send: attemptSend
+				}),
+				sendBack,
+				receive
+			});
+		},
+		async deliverCaptureOnly(signal) {
+			if (!dependencies.finalizeCaptureOnly || !attemptContext || !attemptSend) throw new Error(ID_ERROR_CODES.UPLOAD_ERROR);
+			return dependencies.finalizeCaptureOnly(controller.buildCaptureOnlyUpload(attemptContext, (progress) => {
+				attemptSend?.({
+					type: "UPLOAD_PROGRESS",
+					progress
+				});
+			}), signal);
+		},
+		resourceSink: {
+			ready(stream) {
+				if (disposed) {
+					stopStream(stream);
+					return;
+				}
+				replaceDisplayStream(stream);
+				logDiagnostic("protected-camera-ready", {
+					...getIdCameraTrackDiagnosticFields(stream.getVideoTracks()[0]),
+					fallbackLevel: cameraFallbackLevel
+				});
+			},
+			autoCommitted: storeCommit,
+			manualCommitted: storeCommit,
+			finalized(_recording, stream) {
+				if (!stream || disposed) {
+					logDiagnostic("attempt-finalized");
+					return;
+				}
+				replaceDisplayStream(stream);
+				logDiagnostic("attempt-finalized");
+			},
+			uploadDone(result) {
+				if (result.kind === "id") {
+					uploadResponse = protectedIdResultToCaptureResponse(result);
+					logDiagnostic("upload-complete", {
+						classification: result.classification,
+						readability: result.readability
+					});
+				}
+			}
+		}
+	};
+	return controller;
+}
+function createProtectedIdAttemptActor(ownedController) {
+	return fromCallback(({ sendBack, receive }) => {
+		let controller = ownedController;
+		let attemptReceiver;
+		let cleanup;
+		receive((command) => {
+			if (command.type === "BIND_PROTECTED_ID_CONTROLLER") {
+				controller ??= command.controller;
+				return;
+			}
+			if (command.type === "START_PROTECTED_ID_ATTEMPT") {
+				if (!controller || cleanup) return;
+				cleanup = controller.runAttempt(sendBack, (listener) => {
+					attemptReceiver = listener;
+				});
+				return;
+			}
+			attemptReceiver?.(command);
+		});
+		return () => cleanup?.();
+	});
+}
+function createProtectedIdControllerLifetimeActor(ownedController) {
+	return fromCallback(({ receive, sendBack }) => {
+		let active = true;
+		let controller = ownedController;
+		let preAcquireOwner;
+		let preAcquirePending = false;
+		receive((command) => {
+			if (command.type === "BIND_PROTECTED_ID_CONTROLLER") {
+				controller ??= command.controller;
+				return;
+			}
+			const owner = controller;
+			if (!owner || preAcquirePending && preAcquireOwner === owner) return;
+			preAcquireOwner = owner;
+			preAcquirePending = true;
+			owner.preAcquire().then(() => {
+				if (active && controller === owner) sendBack({ type: "PROTECTED_PRE_ACQUIRE_DONE" });
+				if (preAcquireOwner === owner) preAcquirePending = false;
+			}, (error) => {
+				if (active && controller === owner) sendBack({
+					type: "PROTECTED_PRE_ACQUIRE_FAILED",
+					error
+				});
+				if (preAcquireOwner === owner) preAcquirePending = false;
+			});
+		});
+		return () => {
+			active = false;
+			controller?.dispose();
+		};
+	});
+}
+function createIdCaptureOnlyDeliveryActor(ownedController) {
+	return fromCallback(({ input, sendBack, receive }) => {
+		if (input.mode !== "captureOnly") return;
+		const abortController = new AbortController();
+		let controller = ownedController;
+		let started = false;
+		const start = () => {
+			if (!controller || started) return;
+			started = true;
+			controller.deliverCaptureOnly(abortController.signal).then((output) => {
+				if (!abortController.signal.aborted) sendBack({
+					type: "CAPTURE_ONLY_DELIVERY_DONE",
+					output
+				});
+			}, (error) => {
+				if (!abortController.signal.aborted) sendBack({
+					type: "CAPTURE_ONLY_DELIVERY_FAILED",
+					error
+				});
+			});
+		};
+		receive((command) => {
+			controller ??= command.controller;
+			start();
+		});
+		start();
+		return () => abortController.abort();
+	});
+}
+let protectedIdAttemptSequence = 0;
+function resolveProtectedIdWorkflow(config) {
+	if (config.modelVersion === "v3" || config.usSmartCapture === true) return 7;
+	if (config.settings?.faceQualityCheckEnabled === true) return 8;
+	if (config.settings?.faceQualityCheckEnabled === false) return 6;
+	if (config.modelVersion === "v1") return 6;
+	return 0;
+}
+function resolveProtectedIdTarget(config, currentMode) {
+	const back = currentMode === "back";
+	if (config.isSecondId === true) return back ? PROTECTED_CAPTURE_TARGET.backSecondId : PROTECTED_CAPTURE_TARGET.frontSecondId;
+	return back ? PROTECTED_CAPTURE_TARGET.backId : PROTECTED_CAPTURE_TARGET.frontId;
+}
+function createProtectedIdProvider(config) {
+	const workflow = resolveProtectedIdWorkflow(config);
+	return workflow === 0 ? new IdCaptureProvider() : new IdCaptureProvider(workflow);
+}
+function createProtectedIdRecorderHooks(input) {
+	let session;
+	const enabled = input.enabled !== false && input.config.enableIdRecording === true;
+	return {
+		mode: enabled ? "finalizeBeforePoc" : "none",
+		async start(stream) {
+			if (!enabled) return;
+			session = await startRecordingSession({
+				config: input.config,
+				stream,
+				type: input.currentMode === "back" ? "backId" : "frontId"
+			});
+		},
+		async prepareForPoc() {
+			if (!session) return {};
+			const currentSession = session;
+			session = void 0;
+			return finalizeRecordingSession(currentSession);
+		},
+		async resumeAfterPoc() {},
+		pauseForBackground() {},
+		async resumeFromBackground() {},
+		dispose() {
+			input.disposeCaptureCallbacks();
+			if (!session) return;
+			disposeRecordingSession(session);
+			session = void 0;
+		}
+	};
+}
+function createProtectedIdCallbackSession(input) {
+	const timer = BrowserTimerProvider.getInstance();
+	let optimizingBoundary = null;
+	let countdownTimers = [];
+	let qualityElements;
+	let isCapturing = false;
+	let lastReportedSide = null;
+	let blurSignals = 0;
+	let bestFrameSignals = 0;
+	let bestBlur;
+	const logDiagnostic = (event, fields = {}) => {
+		const attempt = input.controller.getDiagnosticAttempt();
+		if (!attempt) return;
+		logIdCameraDiagnostic(event, {
+			attempt: attempt.attempt,
+			side: attempt.side,
+			elapsedMs: Math.round(getTimestamp() - attempt.startedAt),
+			...fields
+		});
+	};
+	const clearOptimizingBoundary = () => {
+		if (optimizingBoundary) {
+			timer.clearTimeout(optimizingBoundary);
+			optimizingBoundary = null;
+		}
+	};
+	const clearCountdown = () => {
+		for (const countdownTimer of countdownTimers) timer.clearTimeout(countdownTimer);
+		countdownTimers = [];
+	};
+	const startCountdown = () => {
+		clearCountdown();
+		const stepMs = (input.context.config.thresholds?.framesAggregationInterval ?? DEFAULT_ID_CAPTURE_THRESHOLDS.framesAggregationInterval) / 3;
+		input.send({
+			type: "COUNTER_VALUE_CHANGE",
+			value: 3
+		});
+		countdownTimers = [
+			2,
+			1,
+			0
+		].map((value, index) => timer.setTimeout(() => input.send({
+			type: "COUNTER_VALUE_CHANGE",
+			value
+		}), stepMs * (index + 1)));
+	};
+	const setDetectionStatus = (status) => {
+		input.send({
+			type: "DETECTION_UPDATE",
+			status
+		});
+	};
+	const notifications = createIdDetectionNotificationController({
+		send: setDetectionStatus,
+		isSuppressed: () => isReportedIdSideWrong(input.context.currentMode, lastReportedSide)
+	});
+	return {
+		callbacks: {
+			onFarAway: () => {
+				if (!isCapturing) notifications.show("farAway");
+			},
+			onDetectionStarted: () => {},
+			onMaskChange: (_show, _mask, _top, orientation) => {
+				input.send({
+					type: "ORIENTATION_CHANGE",
+					orientation
+				});
+			},
+			onBlur: () => {
+				blurSignals += 1;
+				if (!isCapturing) notifications.show("blur");
+			},
+			onGlare: () => {
+				if (!isCapturing) notifications.show("glare");
+			},
+			onIdNotDetected: () => {
+				if (!isCapturing) setDetectionStatus("idNotDetected");
+			},
+			onSwitchToManualCapture: () => {
+				isCapturing = false;
+				notifications.clear();
+				clearOptimizingBoundary();
+				clearCountdown();
+				input.send({ type: input.controller.hasCommit() ? "PROTECTED_RELEASE_STASHED_COMMIT" : "SWITCH_TO_MANUAL_CAPTURE" });
+			},
+			onCapturing: () => {
+				const wasCapturing = isCapturing;
+				notifications.clear();
+				lastReportedSide = null;
+				isCapturing = true;
+				setDetectionStatus("capturing");
+				if (!wasCapturing) logDiagnostic("capture-window", {
+					aggregationMs: input.context.config.thresholds?.framesAggregationInterval ?? DEFAULT_ID_CAPTURE_THRESHOLDS.framesAggregationInterval,
+					blurSignals
+				});
+				if (!wasCapturing && input.context.captureFeedbackMode === "countdown") startCountdown();
+				if (input.context.captureFeedbackMode === "optimizing" && input.context.config.supportsOptimizingStatus === true && input.context.captureWindowMs != null) {
+					clearOptimizingBoundary();
+					optimizingBoundary = timer.setTimeout(() => {
+						optimizingBoundary = null;
+						const presentation = input.controller.getPresentationCanvas();
+						if (presentation) {
+							presentation.release();
+							input.send({ type: "PROTECTED_OPTIMIZING" });
+						}
+					}, input.context.captureWindowMs);
+				}
+			},
+			onBestFrame: (blur, glare, orientation) => {
+				bestFrameSignals += 1;
+				bestBlur = bestBlur === void 0 ? blur : Math.min(bestBlur, blur);
+				qualityElements = {
+					glare,
+					sharpness: blur
+				};
+				if (orientation === "horizontal" || orientation === "vertical") input.send({
+					type: "ORIENTATION_CHANGE",
+					orientation
+				});
+			},
+			onCapture: (canvas) => {
+				isCapturing = false;
+				clearOptimizingBoundary();
+				clearCountdown();
+				logDiagnostic("capture-selected", {
+					blurSignals,
+					bestFrameSignals,
+					bestBlur,
+					selectedBlur: qualityElements?.sharpness,
+					selectedGlare: qualityElements?.glare
+				});
+				input.controller.storeAutoCaptureFrame(canvas);
+				input.send({
+					type: "PROTECTED_AUTO_CAPTURE",
+					qualityElements
+				});
+			},
+			onIdTypeChange: (idType) => {
+				input.send({
+					type: "ID_TYPE_CHANGE",
+					idType
+				});
+			},
+			onIdSideChange: (side) => {
+				if (isCapturing) return;
+				lastReportedSide = side;
+				if (isReportedIdSideWrong(input.context.currentMode, lastReportedSide)) notifications.clear();
+				input.send({
+					type: "ID_SIDE_CHANGE",
+					side
+				});
+			},
+			onCapturingCounterValueChange: () => {},
+			onBarcodeDecoded: (decoded) => {
+				input.send({
+					type: "BARCODE_DECODED",
+					decoded
+				});
+			}
+		},
+		dispose: () => {
+			notifications.clear();
+			clearOptimizingBoundary();
+			clearCountdown();
+		}
+	};
+}
+function createProtectedIdAttemptInput(input) {
+	const { context, controller } = input;
+	const provider = controller.getProvider();
+	if (!provider) throw new Error("Protected ID provider is unavailable");
+	const workflow = resolveProtectedIdWorkflow(context.config);
+	const target = resolveProtectedIdTarget(context.config, context.currentMode);
+	const callbackSession = createProtectedIdCallbackSession(input);
+	let wasmUtil;
+	const preAcquired = controller.takePreAcquiredStream();
+	let selectedVideoTrack = preAcquired?.stream.getVideoTracks()[0];
+	const constraints = getCameraReacquisitionConstraints(selectedVideoTrack, preAcquired?.constraints);
+	const captureOnly = "onCapture" in context.config && typeof context.config.onCapture === "function";
+	const diagnosticAttempt = controller.getDiagnosticAttempt();
+	const isAttemptActive = () => !controller.disposed && controller.getProvider() === provider && controller.getDiagnosticAttempt() === diagnosticAttempt;
+	const logSelectedCamera = (stream, fallbackLevel, reacquisitionConstraints, preAcquiredStream) => {
+		if (!diagnosticAttempt) return;
+		logIdCameraDiagnostic("selected-camera", {
+			attempt: diagnosticAttempt.attempt,
+			side: diagnosticAttempt.side,
+			elapsedMs: Math.round(getTimestamp() - diagnosticAttempt.startedAt),
+			...getIdCameraTrackDiagnosticFields(stream.getVideoTracks()[0]),
+			preAcquired: preAcquiredStream,
+			fallbackLevel,
+			workflow: String(workflow),
+			devicePinned: reacquisitionConstraints?.deviceId !== void 0
+		});
+	};
+	if (preAcquired) logSelectedCamera(preAcquired.stream, preAcquired.fallbackLevel, constraints, true);
+	return {
+		attemptId: `protected-id-${diagnosticAttempt?.attempt ?? ++protectedIdAttemptSequence}`,
+		target,
+		workflow,
+		streamSource: preAcquired ? {
+			kind: "preAcquired",
+			stream: preAcquired.stream,
+			constraints
+		} : {
+			kind: "acquire",
+			async acquire() {
+				await controller.preAcquire();
+				const adopted = controller.takePreAcquiredStream();
+				if (!adopted) throw new Error("Protected ID stream acquisition was cancelled");
+				selectedVideoTrack = adopted.stream.getVideoTracks()[0];
+				const reacquisitionConstraints = getCameraReacquisitionConstraints(selectedVideoTrack, adopted.constraints);
+				logSelectedCamera(adopted.stream, adopted.fallbackLevel, reacquisitionConstraints, false);
+				return {
+					stream: adopted.stream,
+					constraints: reacquisitionConstraints
+				};
+			}
+		},
+		initiallyBackgrounded: !controller.isVisible(),
+		resourceSink: controller.resourceSink,
+		capturePresentationFrame: () => controller.takeAutoCaptureFrame(),
+		cycle: cameraCycleProvider,
+		cycleOwnership: controller.getCycleOwnership(),
+		recorder: createProtectedIdRecorderHooks({
+			config: context.config,
+			currentMode: context.currentMode,
+			disposeCaptureCallbacks: callbackSession.dispose,
+			enabled: !captureOnly
+		}),
+		releaseUnadoptedStream: stopStream,
+		beforeAdopt: captureOnly ? void 0 : async (stream) => {
+			const track = stream.getVideoTracks()[0];
+			if (!track) throw new Error("Protected ID camera has no selected video track");
+			const metadata = await controller.prepareMetadata(context);
+			if (!isAttemptActive()) return;
+			await metadata.checkVirtualCamera(track);
+		},
+		onStartupTiming(timing) {
+			if (!diagnosticAttempt) return;
+			logIdCameraDiagnostic("camera-startup", {
+				attempt: diagnosticAttempt.attempt,
+				side: diagnosticAttempt.side,
+				elapsedMs: Math.round(getTimestamp() - diagnosticAttempt.startedAt),
+				...timing
+			});
+		},
+		async configureWorkflow() {
+			await provider.initialize({});
+			configureIdCaptureProvider({
+				provider,
+				config: context.config,
+				currentMode: context.currentMode,
+				frameSize: cameraCycleProvider.getCaptureSize(),
+				callbacks: callbackSession.callbacks
+			});
+		},
+		async runPrc() {
+			if (!isAttemptActive()) return;
+			wasmUtil = await (input.getWasmUtil ?? WasmUtilProvider.getInstance)();
+			if (!isAttemptActive()) return;
+			await wasmUtil.prc();
+		},
+		async runPoc() {
+			if (captureOnly) return;
+			if (!isAttemptActive()) return;
+			if (!wasmUtil) wasmUtil = await (input.getWasmUtil ?? WasmUtilProvider.getInstance)();
+			if (!isAttemptActive()) return;
+			await (input.runPocCheck ?? runVirtualCameraCheck)({
+				wasmUtil,
+				source: context.currentMode === "back" ? frameSources.back : frameSources.front,
+				token: (input.getSessionToken ?? getToken)()
+			});
+			if (!isAttemptActive()) return;
+			const metadata = await controller.prepareMetadata(context);
+			if (isAttemptActive()) {
+				try {
+					await metadata.finalizeProtectedCaptureMetadata();
+				} catch {
+					if (isAttemptActive()) trueSightLog("warning", "deepsight", "idScan", "protected capture metadata finalization failed");
+				}
+				if (!isAttemptActive()) return;
+				try {
+					const analysisStatus = metadata.getAnalysisStatus();
+					const motionStatus = metadata.getMotionStatus();
+					const isBack = context.currentMode === "back";
+					addDeviceStats({
+						frontIdStatsAnalysisStatus: isBack ? "" : analysisStatus,
+						backIdStatsAnalysisStatus: isBack ? analysisStatus : "",
+						selfieStatsAnalysisStatus: "",
+						motionStatus
+					});
+				} catch {}
+				try {
+					const logs = metadata.getPipelineState();
+					if (!isAttemptActive()) return;
+					const projection = controller.getProjection();
+					context.dependencies?.trackCaptureAttemptFinished?.({
+						logs,
+						resolution: projection.captureResolution,
+						fallbackLevel: projection.cameraFallbackLevel
+					});
+				} catch {
+					if (isAttemptActive()) trueSightLog("warning", "deepsight", "idScan", "protected capture diagnostics failed");
+				}
+			}
+		}
+	};
+}
+function protectedIdResultToCaptureResponse(result) {
+	const regulationType = result.regulationType === "US" || result.regulationType === "Worldwide" || result.regulationType === "Other" || result.regulationType === "US_Illinois" || result.regulationType === "US_Texas" || result.regulationType === "US_California" || result.regulationType === "US_Washington" ? result.regulationType : void 0;
+	return {
+		sharpness: result.sharpness ?? 0,
+		correctSharpness: result.sharpness != null && result.sharpness >= 10,
+		glare: result.glare ?? 0,
+		correctGlare: result.glare != null && result.glare >= 10,
+		horizontalResolution: 0,
+		classification: result.classification === true,
+		readability: result.readability === true,
+		typeOfId: result.typeOfId ?? "",
+		issueYear: 0,
+		issueName: "",
+		sessionStatus: result.sessionStatus ?? "",
+		countryCode: result.countryCode ?? "",
+		skipBackIdCapture: result.skipBackIdCapture,
+		skipGlareFront: result.skipGlareFront,
+		skipGlareBack: result.skipGlareBack,
+		acceptedDocuments: result.acceptedDocuments ? [...result.acceptedDocuments] : void 0,
+		forceFrontIdCapture: result.forceFrontIdCapture,
+		idValidationCompleted: result.idValidationCompleted,
+		showMandatoryConsent: result.showMandatoryConsent,
+		regulationType,
+		failReason: result.failReason,
+		side: result.side,
+		idQualityAttemptApproved: result.idQualityAttemptApproved,
+		isDocumentExpired: result.isDocumentExpired,
+		success: result.success
+	};
+}
+function getProtectedIdUploadRequest(context, sessionToken = getToken()) {
+	const target = resolveProtectedIdTarget(context.config, context.currentMode);
+	const front = context.currentMode !== "back";
+	const params = {};
+	if (front && context.config.onlyFront === true) params.onlyFront = true;
+	if (front && context.config.extractIdFace === false) params.extractIdFace = false;
+	const sharpness = context.qualityElements?.sharpness;
+	if (sharpness !== void 0 && sharpness !== 0 && Number.isFinite(sharpness)) params.sharpness = getRealQualityValue(sharpness);
+	const config = {
+		...sessionToken ? { headers: { "X-Incode-Hardware-Id": sessionToken } } : {},
+		...Object.keys(params).length > 0 ? { params } : {}
+	};
+	return Object.keys(config).length > 0 ? {
+		target,
+		config
+	} : { target };
+}
+//#endregion
+//#region src/modules/digital-id-redirect/digitalIdRedirectServices.ts
+function withQuery(path, params) {
+	if (!params) return path;
+	const search = new URLSearchParams();
+	if (params.country) search.set("country", params.country);
+	if (params.region) search.set("region", params.region);
+	const qs = search.toString();
+	return qs ? `${path}?${qs}` : path;
+}
+/** GET the provider catalog. Ordering is applied FE-side by the module. */
+async function listProviders(params, signal) {
+	const url = withQuery(endpoints.digitalIdProviders, params);
+	const res = await api.get(url, { signal });
+	if (!res.ok) throw new Error(`GET ${url} failed: ${res.status} ${res.statusText}`);
+	return res.data ?? [];
+}
+/**
+* Append the onboarding `uuid` to `returnUrl` when absent, so the return leg can
+* re-attach the (onboarding-scoped) verification. Idempotent (skips when a `uuid`
+* is already present) and non-fatal (returns the URL unchanged on any failure).
+* Exported for unit testing.
+*/
+async function ensureReturnUrlUuid(returnUrl, signal) {
+	try {
+		if (getUrlSearchParam(returnUrl, "uuid")) return returnUrl;
+		const res = await api.get(endpoints.onboardingUrl, { signal });
+		const onboardingUrl = res.ok ? res.data?.url : void 0;
+		const uuid = onboardingUrl ? getUrlSearchParam(onboardingUrl, "uuid") : null;
+		if (!uuid) return returnUrl;
+		return buildUrlWithSearchParams(returnUrl, { uuid });
+	} catch (error) {
+		console.warn("[DigitalIdRedirect] ensureReturnUrlUuid failed, proceeding without uuid:", error);
+		return returnUrl;
+	}
+}
+/**
+* Create a verification. On success the caller must full-page-redirect to
+* `flowData.launchUrl`. NOTE: this is the billable moment for iDIN/FTN — each
+* call (incl. every retry) is a new session and a new billing event.
+*
+* The `redirectUrl` is first passed through `ensureReturnUrlUuid` so a bare
+* launch gets a resumable `uuid` before the bank round-trip. This reuses the
+* current session token (no extra `/omni/start`) and only fetches when the URL
+* lacks a `uuid`.
+*/
+async function createVerification(params, signal) {
+	const redirectUrl = await ensureReturnUrlUuid(params.redirectUrl, signal);
+	const res = await api.post(endpoints.digitalIdVerifications, {
+		...params,
+		redirectUrl
+	}, { signal });
+	if (!res.ok) throw new Error(`POST ${endpoints.digitalIdVerifications} failed: ${res.status} ${res.statusText}`);
+	return res.data;
+}
+/**
+* Submit the provider's return params. The contract wants them wrapped as a
+* JSON *string* under `walletResponse` (success serialized as "true"/"false").
+*/
+async function submitWalletResponse(verificationId, params, signal) {
+	const url = `${endpoints.digitalIdVerifications}/${verificationId}/response`;
+	const body = { walletResponse: JSON.stringify({
+		sessionId: params.sessionId,
+		resultsAccessKey: params.resultsAccessKey,
+		success: String(params.success)
+	}) };
+	const res = await api.post(url, body, { signal });
+	if (!res.ok) throw new Error(`POST ${url} failed: ${res.status} ${res.statusText}`);
+	return res.data;
+}
+/** Poll fallback — used when the user does not return or results are delayed. */
+async function getVerificationStatus(verificationId, signal) {
+	const url = `${endpoints.digitalIdVerifications}/${verificationId}/status`;
+	const res = await api.get(url, { signal });
+	if (!res.ok) throw new Error(`GET ${url} failed: ${res.status} ${res.statusText}`);
+	return res.data;
+}
+/**
+* Refresh an expiring `launchUrl` (maps to `flowData.expiresAt`). Do NOT create
+* a new verification for this — that would be a new billing event.
+*/
+async function refreshVerification(verificationId, signal) {
+	const url = `${endpoints.digitalIdVerifications}/${verificationId}/refresh`;
+	const res = await api.post(url, {}, { signal });
+	if (!res.ok) throw new Error(`POST ${url} failed: ${res.status} ${res.statusText}`);
+	return res.data;
+}
+//#endregion
+//#region src/modules/digital-id-redirect/digitalIdRedirectStorage.ts
+/**
+* Cross-redirect handoff. The full-page redirect out to the provider tears down
+* the SPA, so the pending verification must be persisted BEFORE navigating and
+* read back on the return leg. Only the non-sensitive `verificationId` +
+* `providerId` live here — the session credential is the host's concern
+* (re-bootstrapped from `url_uuid`) and is NEVER persisted by this module.
+*
+* Backed by whatever `IStorageCapability` is injected (default localStorage).
+* sessionStorage would be preferable (auto-clears on tab close) — swap the
+* capability when a sessionStorage-backed provider exists. A single fixed key
+* is used, so a stale record from an abandoned redirect is overwritten by the
+* next one and is only ever read on the host's return route.
+*
+* TODO(follow-up): add a staleness TTL once an injected time capability lands
+* (Core forbids `Date.now()` directly — `no-browser-api-in-core`).
+*/
+const PENDING_KEY = "incode.digitalIdRedirect.pending";
+async function persistPendingRedirect(storage, entry) {
+	await storage.set(PENDING_KEY, {
+		verificationId: entry.verificationId,
+		providerId: entry.providerId
+	});
+}
+async function readPendingRedirect(storage) {
+	const pending = await storage.get(PENDING_KEY);
+	return pending?.verificationId && pending?.providerId ? pending : null;
+}
+async function clearPendingRedirect(storage) {
+	await storage.remove(PENDING_KEY);
+}
+//#endregion
+//#region src/modules/digital-id-redirect/digitalIdRedirectStateMachine.ts
+const POLL_INTERVAL_MS = 1500;
+const MAX_POLL_ATTEMPTS = 20;
+const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+	"COMPLETED",
+	"FAILED",
+	"EXPIRED",
+	"CANCELLED"
+]);
+function isTerminal(status) {
+	return TERMINAL_STATUSES.has(status);
+}
+const digitalIdRedirectMachine = setup({
+	types: {
+		context: {},
+		events: {},
+		input: {},
+		output: {}
+	},
+	actors: {
+		listProviders: fromPromise(async ({ input, signal }) => listProviders(input ? { country: input.country } : void 0, signal)),
+		createVerification: fromPromise(async ({ input, signal }) => createVerification(input, signal)),
+		submitWalletResponse: fromPromise(async ({ input, signal }) => submitWalletResponse(input.verificationId, input.params, signal)),
+		refreshVerification: fromPromise(async ({ input, signal }) => refreshVerification(input.verificationId, signal)),
+		pollStatus: fromCallback(({ sendBack, input }) => {
+			const timer = BrowserTimerProvider.getInstance();
+			const interval = timer.setInterval(async () => {
+				try {
+					const v = await getVerificationStatus(input.verificationId);
+					if (isTerminal(v.status)) sendBack({
+						type: "POLL_RESULT",
+						verification: v
+					});
+				} catch (error) {
+					console.warn("[DigitalIdRedirect] status poll failed:", error);
+				}
+			}, POLL_INTERVAL_MS);
+			return () => timer.clearInterval(interval);
+		}),
+		persistPending: fromPromise(async ({ input }) => {
+			await persistPendingRedirect(input.storage, {
+				verificationId: input.verificationId,
+				providerId: input.providerId
+			});
+		})
+	},
+	actions: {
+		setProviders: assign(({ event }) => ({ providers: event.output })),
+		setSelectedProvider: assign(({ event }) => ({ selectedProvider: event.providerId })),
+		setVerification: assign(({ event }) => {
+			const v = event.output;
+			return {
+				verificationId: v.verificationId,
+				launchUrl: v.flowData?.launchUrl ?? void 0,
+				expiresAt: v.flowData?.expiresAt ?? void 0,
+				status: v.status,
+				failureReason: v.failureReason ?? void 0,
+				portraitPresent: v.portraitPresent ?? false
+			};
+		}),
+		setVerificationFromEvent: assign(({ event }) => {
+			const v = event.verification;
+			return {
+				status: v.status,
+				failureReason: v.failureReason ?? void 0,
+				portraitPresent: v.portraitPresent ?? false
+			};
+		}),
+		setError: assign(({ event }) => ({ error: String(event.error ?? "Unknown error") })),
+		clearResume: assign(() => ({
+			returnParams: void 0,
+			verificationId: void 0,
+			failureReason: void 0,
+			status: void 0,
+			error: void 0
+		}))
+	},
+	guards: {
+		hasPresetProvider: ({ context }) => Boolean(context.config.provider),
+		autoStartPreset: ({ context }) => context.autoStart && Boolean(context.config.provider),
+		autoStartCatalog: ({ context }) => context.autoStart && !context.config.provider,
+		isResuming: ({ context }) => Boolean(context.returnParams),
+		returnSucceeded: ({ context }) => context.returnParams?.success === true,
+		submittedTerminalOk: ({ event }) => event.output.status === "COMPLETED",
+		submittedFailed: ({ event }) => {
+			const s = event.output.status;
+			return s === "FAILED" || s === "EXPIRED" || s === "CANCELLED";
+		},
+		polledOk: ({ event }) => event.verification.status === "COMPLETED"
+	}
+}).createMachine({
+	id: "digitalIdRedirect",
+	initial: "idle",
+	context: ({ input }) => ({
+		config: input.config,
+		storage: input.storage,
+		returnUrl: input.config.returnUrl ?? "",
+		providers: [],
+		selectedProvider: input.config.provider,
+		verificationId: input.resume?.verificationId,
+		launchUrl: void 0,
+		expiresAt: void 0,
+		status: void 0,
+		failureReason: void 0,
+		portraitPresent: false,
+		returnParams: input.resume?.returnParams,
+		error: void 0,
+		autoStart: input.autoStart ?? false
+	}),
+	output: ({ context }) => context.status === "COMPLETED" ? {
+		status: "COMPLETED",
+		providerId: context.selectedProvider ?? context.config.provider ?? "",
+		portraitPresent: context.portraitPresent
+	} : { status: "DISMISSED" },
+	states: {
+		idle: {
+			always: [
+				{
+					guard: "isResuming",
+					target: "submitting"
+				},
+				{
+					guard: "autoStartPreset",
+					target: "creating"
+				},
+				{
+					guard: "autoStartCatalog",
+					target: "loadingProviders"
+				}
+			],
+			on: { LOAD: [{
+				guard: "hasPresetProvider",
+				target: "creating"
+			}, { target: "loadingProviders" }] }
+		},
+		loadingProviders: { invoke: {
+			src: "listProviders",
+			input: ({ context }) => ({ country: context.config.country }),
+			onDone: {
+				target: "choosingProvider",
+				actions: "setProviders"
+			},
+			onError: {
+				target: "error",
+				actions: "setError"
+			}
+		} },
+		choosingProvider: { on: { SELECT_PROVIDER: {
+			target: "creating",
+			actions: "setSelectedProvider"
+		} } },
+		creating: { invoke: {
+			src: "createVerification",
+			input: ({ context }) => ({
+				providerId: context.selectedProvider ?? "",
+				redirectUrl: context.returnUrl
+			}),
+			onDone: {
+				target: "persisting",
+				actions: "setVerification"
+			},
+			onError: {
+				target: "error",
+				actions: "setError"
+			}
+		} },
+		persisting: { invoke: {
+			src: "persistPending",
+			input: ({ context }) => ({
+				storage: context.storage,
+				verificationId: context.verificationId ?? "",
+				providerId: context.selectedProvider ?? ""
+			}),
+			onDone: { target: "readyToRedirect" },
+			onError: { target: "readyToRedirect" }
+		} },
+		readyToRedirect: { on: { REFRESH: { target: "refreshing" } } },
+		refreshing: { invoke: {
+			src: "refreshVerification",
+			input: ({ context }) => ({ verificationId: context.verificationId ?? "" }),
+			onDone: {
+				target: "readyToRedirect",
+				actions: "setVerification"
+			},
+			onError: {
+				target: "error",
+				actions: "setError"
+			}
+		} },
+		submitting: { invoke: {
+			src: "submitWalletResponse",
+			input: ({ context }) => ({
+				verificationId: context.verificationId ?? "",
+				params: context.returnParams
+			}),
+			onDone: [
+				{
+					guard: "submittedTerminalOk",
+					target: "succeeded",
+					actions: "setVerification"
+				},
+				{
+					guard: "submittedFailed",
+					target: "failed",
+					actions: "setVerification"
+				},
+				{
+					target: "polling",
+					actions: "setVerification"
+				}
+			],
+			onError: {
+				target: "error",
+				actions: "setError"
+			}
+		} },
+		polling: {
+			invoke: {
+				src: "pollStatus",
+				input: ({ context }) => ({ verificationId: context.verificationId ?? "" })
+			},
+			on: { POLL_RESULT: [{
+				guard: "polledOk",
+				target: "succeeded",
+				actions: "setVerificationFromEvent"
+			}, {
+				target: "failed",
+				actions: "setVerificationFromEvent"
+			}] },
+			after: { [POLL_INTERVAL_MS * MAX_POLL_ATTEMPTS]: {
+				target: "failed",
+				actions: assign({ failureReason: () => "SESSION_EXPIRED" })
+			} }
+		},
+		succeeded: { on: { CONTINUE: { target: "finished" } } },
+		finished: { type: "final" },
+		failed: { on: {
+			RETRY: [{
+				guard: "hasPresetProvider",
+				target: "creating"
+			}, { target: "choosingProvider" }],
+			USE_ANOTHER_METHOD: { target: "closed" },
+			CLOSE: { target: "closed" }
+		} },
+		error: { on: {
+			RETRY: [{
+				guard: "hasPresetProvider",
+				target: "creating",
+				actions: "clearResume"
+			}, {
+				target: "choosingProvider",
+				actions: "clearResume"
+			}],
+			USE_ANOTHER_METHOD: { target: "closed" },
+			CLOSE: { target: "closed" }
+		} },
+		closed: { type: "final" }
+	}
+});
+//#endregion
+//#region src/modules/id/idCaptureDependencies.ts
+function resolveIdCaptureDependencies(dependencies) {
+	return dependencies ?? { storage: new BrowserStorageProvider() };
 }
 //#endregion
 //#region src/modules/id/idCaptureStateMachine.ts
@@ -2580,6 +3534,15 @@ function getIdErrorCodeFromUnknown(error) {
 		return Object.values(ID_ERROR_CODES).find((value) => message.includes(value));
 	}
 }
+function asPublicIdEvent(event) {
+	return event;
+}
+function isCaptureOnlyConfig(config) {
+	return "onCapture" in config && typeof config.onCapture === "function";
+}
+function protectedFailure(event) {
+	return event.type === "PROTECTED_ATTEMPT_FAILED" ? event : null;
+}
 const idCaptureMachine = setup({
 	types: {
 		context: {},
@@ -2590,15 +3553,12 @@ const idCaptureMachine = setup({
 	actors: {
 		checkPermission: checkPermissionActor,
 		requestPermission: requestPermissionActor,
-		initializeCamera: initializeCameraActor,
-		runDetection: runDetectionActor,
-		uploadIdImage: uploadIdImageActor,
+		protectedAttempt: createProtectedIdAttemptActor(),
+		protectedControllerLifetime: createProtectedIdControllerLifetimeActor(),
+		captureOnlyDelivery: createIdCaptureOnlyDeliveryActor(),
 		uploadProgressTicker: uploadProgressTickerActor,
 		processId: processIdActor,
 		submitBarcode: submitBarcodeActor,
-		startRecording: startRecordingActor,
-		initializeDeepsightSession: initializeDeepsightSessionActor,
-		checkVirtualCamera: checkVirtualCameraActor,
 		manualUploadMachine,
 		digitalUploadMachine,
 		digitalIdRedirectMachine,
@@ -2611,6 +3571,108 @@ const idCaptureMachine = setup({
 		})
 	},
 	actions: {
+		attachProtectedController: assign(({ self }) => {
+			attachIdProtectedCaptureController(self, createIdProtectedCaptureController());
+			return {};
+		}),
+		startProtectedMetadataPreparation: ({ context, self }) => {
+			if (!isCaptureOnlyConfig(context.config)) getIdProtectedCaptureController(self).startMetadataPreparation(context);
+		},
+		bindProtectedControllerLifetime: sendTo("protectedControllerLifetime", ({ self }) => ({
+			type: "BIND_PROTECTED_ID_CONTROLLER",
+			controller: getIdProtectedCaptureController(self)
+		})),
+		preAcquireProtectedCamera: sendTo("protectedControllerLifetime", { type: "PRE_ACQUIRE" }),
+		initializeProtectedProvider: assign(({ context, self }) => {
+			getIdProtectedCaptureController(self).beginAttempt(context, (event) => self.send(event));
+			return {
+				stream: void 0,
+				provider: void 0,
+				frameCapturer: void 0
+			};
+		}),
+		bindProtectedAttempt: sendTo("protectedAttempt", ({ self }) => ({
+			type: "BIND_PROTECTED_ID_CONTROLLER",
+			controller: getIdProtectedCaptureController(self)
+		})),
+		startProtectedAttempt: sendTo("protectedAttempt", { type: "START_PROTECTED_ID_ATTEMPT" }),
+		setProtectedAttemptReady: assign(({ self, event }) => {
+			if (event.type !== "PROTECTED_ATTEMPT_READY_SIGNAL") return {};
+			const projection = getIdProtectedCaptureController(self).getProjection();
+			return {
+				stream: void 0,
+				frameCapturer: void 0,
+				captureResolution: projection.captureResolution,
+				cameraFallbackLevel: projection.cameraFallbackLevel,
+				usingBackCamera: projection.usingBackCamera
+			};
+		}),
+		requestProtectedAutoCommit: enqueueActions(({ self, enqueue }) => {
+			if (!getIdProtectedCaptureController(self).hasAutoCaptureFrame()) {
+				enqueue(raise({ type: "PROTECTED_PRESENTATION_FAILED" }));
+				return;
+			}
+			enqueue(sendTo("protectedAttempt", { type: "AUTO_CAPTURE" }));
+		}),
+		requestProtectedManualCommit: sendTo("protectedAttempt", { type: "MANUAL_CAPTURE" }),
+		finalizeProtectedAttempt: sendTo("protectedAttempt", { type: "FINALIZE" }),
+		requestProtectedUpload: enqueueActions(({ context, enqueue }) => {
+			if (isCaptureOnlyConfig(context.config)) return;
+			enqueue(sendTo("protectedAttempt", {
+				type: "UPLOAD_PROTECTED",
+				request: getProtectedIdUploadRequest(context)
+			}));
+		}),
+		bindCaptureOnlyDelivery: sendTo("captureOnlyDelivery", ({ self }) => ({
+			type: "BIND_ID_CAPTURE_ONLY_DELIVERY",
+			controller: getIdProtectedCaptureController(self)
+		})),
+		releaseProtectedForClose: sendTo("protectedAttempt", {
+			type: "RELEASE",
+			reason: "close"
+		}),
+		releaseProtectedForRetry: sendTo("protectedAttempt", {
+			type: "RELEASE",
+			reason: "retry"
+		}),
+		forwardProtectedBackground: sendTo("protectedAttempt", { type: "BACKGROUND" }),
+		forwardProtectedForeground: sendTo("protectedAttempt", { type: "FOREGROUND" }),
+		storeProtectedAutoQuality: assign(({ event }) => event.type === "PROTECTED_AUTO_CAPTURE" ? { qualityElements: event.qualityElements } : {}),
+		storeProtectedCommit: assign(({ context, event }) => {
+			if (event.type !== "PROTECTED_AUTO_COMMITTED_SIGNAL" && event.type !== "PROTECTED_MANUAL_COMMITTED_SIGNAL") return {};
+			const side = context.currentMode === "back" ? "back" : "front";
+			return { capturedImages: {
+				...context.capturedImages,
+				[side]: { imageBase64: "" }
+			} };
+		}),
+		storeProtectedPreview: assign(({ context, self, event }) => {
+			if (event.type !== "PROTECTED_PREVIEW_READY") return {};
+			return { previewImageUrl: getIdProtectedCaptureController(self).takeCommitPreviewImageUrl() ?? context.previewImageUrl };
+		}),
+		storeProtectedCandidate: assign(({ context, self }) => {
+			const controller = getIdProtectedCaptureController(self);
+			const candidateCanvas = controller.getPresentationCanvas();
+			return candidateCanvas ? getCandidateFrameValues(context, {
+				type: "DETECTION_OPTIMIZING",
+				candidateCanvas
+			}, controller.getProvider()) : {};
+		}),
+		storeProtectedUploadResponse: assign(({ context, self, event }) => {
+			if (event.type !== "PROTECTED_UPLOAD_DONE_SIGNAL") return {};
+			const uploadResponse = getIdProtectedCaptureController(self).takeUploadResponse();
+			if (!uploadResponse) return {};
+			return {
+				uploadResponse,
+				uploadProgress: 100,
+				skipProcessId: uploadResponse.idValidationCompleted === true || context.skipProcessId
+			};
+		}),
+		setProtectedFailure: assign(({ context, event }) => ({ error: protectedFailure(event)?.failure.code ?? context.error })),
+		setProtectedUploadFailure: assign(({ context }) => ({
+			uploadError: ID_ERROR_CODES.UPLOAD_ERROR,
+			attemptsRemaining: context.attemptsRemaining - 1
+		})),
 		stopMediaStream: assign(({ context }) => {
 			performStopMediaStream(context);
 			return {
@@ -2618,12 +3680,12 @@ const idCaptureMachine = setup({
 				frameCapturer: void 0
 			};
 		}),
+		clearProtectedAttempt: ({ self }) => {
+			getIdProtectedCaptureController(self).clearAttempt();
+		},
 		disposeProvider: ({ context }) => {
 			performDisposeProvider(context);
 		},
-		cleanupDeepsight: ({ context }) => {
-			performCleanupDeepsight(context);
-		},
 		flagIdManualReview: () => {
 			flagIdManualReview();
 		},
@@ -2707,19 +3769,9 @@ const idCaptureMachine = setup({
 				attemptsRemaining: context.config.captureAttempts
 			};
 		}),
-		setStreamAndCapturer: assign({
-			stream: ({ event }) => getStreamFromEvent(event),
-			provider: ({ event }) => getProviderFromEvent(event),
-			frameCapturer: ({ event }) => getFrameCapturerFromEvent(event),
-			captureResolution: ({ event }) => getCaptureResolutionFromEvent(event),
-			cameraFallbackLevel: ({ event }) => getCameraFallbackLevelFromEvent(event),
-			usingBackCamera: ({ event }) => getUsingBackCameraFromEvent(event)
-		}),
 		setPermissionResultAndStream: assign({
 			permissionResult: ({ context, event }) => getPermissionResultFromEvent(event) ?? context.permissionResult,
-			stream: ({ context, event }) => getStreamFromEvent(event) ?? context.stream,
-			cameraFallbackLevel: ({ context, event }) => getCameraFallbackLevelFromEvent(event) ?? context.cameraFallbackLevel,
-			usingBackCamera: ({ context, event }) => getUsingBackCameraFromEvent(event) ?? context.usingBackCamera
+			cameraFallbackLevel: ({ context, event }) => getCameraFallbackLevelFromEvent(asPublicIdEvent(event)) ?? context.cameraFallbackLevel
 		}),
 		trackTutorialId: () => {},
 		trackContinue: () => {},
@@ -2728,21 +3780,14 @@ const idCaptureMachine = setup({
 			performReportCaptureOptimizingAssignment(context);
 		},
 		preloadRecordingProvider: ({ context }) => {
+			if (isCaptureOnlyConfig(context.config)) return;
 			context.config;
 		},
 		resetContext: assign(({ context }) => getResetContextValues(context)),
-		resetDetection: ({ context }) => {
-			performResetDetection(context);
-		},
+		resetDetection: () => {},
 		captureImage: assign({ qualityElements: ({ event }) => {
 			if ("qualityElements" in event) return event.qualityElements;
 		} }),
-		storeCapturedCanvasInProvider: ({ context, event }) => {
-			storeCapturedCanvasInProviderLogic(context, event);
-		},
-		captureLatestFrame: ({ context }) => {
-			context.frameCapturer?.getLatestCanvas();
-		},
 		clearUploadFailure: assign(({ context }) => getClearUploadFailureValues(context)),
 		clearStreamForRetry: assign(({ context }) => {
 			performPrepareRecordingForCameraRetry(context);
@@ -2762,33 +3807,19 @@ const idCaptureMachine = setup({
 		stopMediaRecording: ({ context }) => {
 			performStopMediaRecording(context);
 		},
-		pauseRecordingForAttempt: ({ context }) => {
-			performPauseRecordingForAttempt(context);
-		},
-		discardFailedRecordingSession: assign(({ context }) => {
-			performStopMediaRecording(context);
-			return { recordingSession: void 0 };
-		}),
 		clearRecordingSession: assign({ recordingSession: () => void 0 }),
 		setSelectedDocument: assign({ selectedDocumentType: ({ event }) => {
 			if ("documentType" in event) return event.documentType;
 		} }),
-		setCurrentMode: assign({ currentMode: ({ event, context }) => getCurrentModeFromEvent(context, event) }),
-		storeCapturedImage: assign(({ context, event }) => getStoreCapturedImageValues(context, event)),
-		setCandidateFrame: assign(({ context, event }) => getCandidateFrameValues(context, event)),
+		setCurrentMode: assign({ currentMode: ({ event, context }) => getCurrentModeFromEvent(context, asPublicIdEvent(event)) }),
+		storeCapturedImage: assign(({ context, event }) => getStoreCapturedImageValues(context, asPublicIdEvent(event))),
+		setCandidateFrame: assign(({ context, event }) => getCandidateFrameValues(context, asPublicIdEvent(event))),
 		/**
 		* IDC-05: parks WASM's commit while the optimizing phase spends the rest of
 		* its dwell. The frame travels in context only for that stretch —
 		* `releaseStashedCommit` re-raises it and `getClearOptimizingValues` drops it
 		* on every other exit from the phase.
 		*/
-		stashCommittedFrame: assign({ stashedCommit: ({ event }) => {
-			const commit = event;
-			return {
-				canvas: commit.canvas,
-				qualityElements: commit.qualityElements
-			};
-		} }),
 		/**
 		* IDC-05: hands a parked commit back to the machine as the very event that
 		* would have carried it, so `capturing`'s entry actions stay event-driven.
@@ -2797,15 +3828,16 @@ const idCaptureMachine = setup({
 		* entering event has no canvas — a timer transition into `capturing` would
 		* stage a live frame for upload instead of the one WASM committed.
 		*/
-		releaseStashedCommit: enqueueActions(({ context, enqueue }) => {
-			const stashed = context.stashedCommit;
-			if (!stashed) return;
+		releaseStashedCommit: enqueueActions(({ self, enqueue }) => {
+			if (!getIdProtectedCaptureController(self).hasCommit()) return;
 			enqueue(raise({
-				type: "DETECTION_SUCCESS",
-				canvas: stashed.canvas,
-				qualityElements: stashed.qualityElements
+				type: "PROTECTED_AUTO_COMMITTED_SIGNAL",
+				attemptId: "stashed-protected-id-commit"
 			}));
 		}),
+		releaseStashedCommitIfPresent: enqueueActions(({ self, enqueue }) => {
+			if (getIdProtectedCaptureController(self).hasCommit()) enqueue(raise({ type: "PROTECTED_RELEASE_STASHED_COMMIT" }));
+		}),
 		/**
 		* IDC-05: releases everything the optimizing phase allocated — the parked
 		* commit AND the frozen still's blob URL. Bound to `optimizing.exit`, so it
@@ -2822,7 +3854,7 @@ const idCaptureMachine = setup({
 		* resolves to nothing (see `getStoreCapturedImageValues`).
 		*/
 		clearOptimizingPhase: assign(({ context }) => getClearOptimizingValues(context)),
-		storeBarcodeResponse: assign(({ context, event }) => getBarcodeResponseValues(context, event)),
+		storeBarcodeResponse: assign(({ context, event }) => getBarcodeResponseValues(context, asPublicIdEvent(event))),
 		storeDecodedBarcode: assign({ decodedBarcode: ({ event }) => event.decoded }),
 		setBarcodeFastPathAttempted: assign({ barcodeFastPathAttempted: true }),
 		markBarcodeFastPathCaptured: assign({
@@ -2830,7 +3862,7 @@ const idCaptureMachine = setup({
 			previewImageUrl: void 0
 		}),
 		clearBarcodeFastPathCaptured: assign({ barcodeFastPathCaptured: false }),
-		setDetectionStatus: assign({ detectionStatus: ({ event, context }) => getDetectionStatusFromUpdate(context, event) }),
+		setDetectionStatus: assign({ detectionStatus: ({ event, context }) => getDetectionStatusFromUpdate(context, asPublicIdEvent(event)) }),
 		setCounterValue: assign({ counterValue: ({ event }) => {
 			if ("value" in event) return event.value;
 			return 0;
@@ -2928,20 +3960,26 @@ const idCaptureMachine = setup({
 		clearExpiredFromUpload: assign({ expiredFromUpload: () => false })
 	},
 	guards: {
+		isCaptureOnlyDelivery: ({ context }) => isCaptureOnlyConfig(context.config),
+		isProtectedUploadFailure: ({ event }) => protectedFailure(event)?.failure.stage === "upload",
+		isProtectedManualRefusal: ({ event }) => protectedFailure(event)?.failure.stage === "manualCommit",
 		hasShowTutorial: hasShowTutorialGuard,
 		hasAgeAssurance: hasAgeAssuranceGuard,
 		hasShowDocumentChooser: hasShowDocumentChooserGuard,
-		isPermissionGranted: isPermissionGrantedGuard,
-		isReadyForCapture: isReadyForCaptureGuard,
-		needsMotionPrimeOnly: needsMotionPrimeOnlyGuard,
-		isPermissionDeniedError: isPermissionDeniedErrorGuard,
+		isPermissionGranted: ({ event }) => isPermissionGrantedGuard({ event: asPublicIdEvent(event) }),
+		isReadyForCapture: ({ context, event }) => isReadyForCaptureGuard({
+			context,
+			event: asPublicIdEvent(event)
+		}),
+		needsMotionPrimeOnly: ({ context, event }) => needsMotionPrimeOnlyGuard({
+			context,
+			event: asPublicIdEvent(event)
+		}),
+		isPermissionDeniedError: ({ event }) => isPermissionDeniedErrorGuard({ event: asPublicIdEvent(event) }),
 		isPermissionBlocked: isPermissionBlockedGuard,
-		hasStream: hasStreamGuard,
-		hasInitializedCamera: hasInitializedCameraGuard,
 		hasAttemptsRemaining: hasAttemptsRemainingGuard,
 		hasCapturedImage: hasCapturedImageGuard,
-		hasCandidateFrame: hasCandidateFrameGuard,
-		hasStashedCommit: hasStashedCommitGuard,
+		hasCandidateFrame: ({ event }) => hasCandidateFrameGuard({ event: asPublicIdEvent(event) }),
 		hasUploadValidationError: hasUploadValidationErrorGuard,
 		isFrontMode: isFrontModeGuard,
 		shouldContinueToBack: shouldContinueToBackGuard,
@@ -2954,10 +3992,10 @@ const idCaptureMachine = setup({
 		needsDeepsightInit: needsDeepsightInitGuard,
 		hasOnlyManualUploadAvailable: hasOnlyManualUploadAvailableGuard,
 		hasNoDocumentTypesAvailable: hasNoDocumentTypesAvailableGuard,
-		isManualIdUploadSelected: isManualIdUploadSelectedGuard,
-		isDigitalIdUploadSelected: isDigitalIdUploadSelectedGuard,
-		isDigitalIdRedirectSelected: isDigitalIdRedirectSelectedGuard,
-		isDigitalIdSelected: isDigitalIdSelectedGuard,
+		isManualIdUploadSelected: ({ event }) => isManualIdUploadSelectedGuard({ event: asPublicIdEvent(event) }),
+		isDigitalIdUploadSelected: ({ event }) => isDigitalIdUploadSelectedGuard({ event: asPublicIdEvent(event) }),
+		isDigitalIdRedirectSelected: ({ event }) => isDigitalIdRedirectSelectedGuard({ event: asPublicIdEvent(event) }),
+		isDigitalIdSelected: ({ event }) => isDigitalIdSelectedGuard({ event: asPublicIdEvent(event) }),
 		digitalIdRouteIsWallet: digitalIdRouteIsWalletGuard,
 		digitalIdRouteIsTrinsic: digitalIdRouteIsTrinsicGuard,
 		isUploadExpired: isUploadExpiredGuard,
@@ -2967,7 +4005,10 @@ const idCaptureMachine = setup({
 		wasExpiredFromUpload: wasExpiredFromUploadGuard,
 		shouldSkipProcessId: shouldSkipProcessIdGuard,
 		shouldSubmitBarcode: shouldSubmitBarcodeGuard,
-		canRunBarcodeFastPath: canRunBarcodeFastPathGuard,
+		canRunBarcodeFastPath: ({ context, event }) => canRunBarcodeFastPathGuard({
+			context,
+			event: asPublicIdEvent(event)
+		}),
 		hasManualCaptureTriggered: hasManualCaptureTriggeredGuard,
 		isProcessingExpiredExhausted: isProcessingExpiredExhaustedGuard,
 		shouldProcessAfterExhaustion: shouldProcessAfterExhaustionGuard,
@@ -3016,7 +4057,13 @@ const idCaptureMachine = setup({
 	id: "idCapture",
 	initial: "idle",
 	output: ({ context }) => computeIdCaptureOutput(context),
-	context: ({ input }) => {
+	entry: ["attachProtectedController", "bindProtectedControllerLifetime"],
+	invoke: {
+		id: "protectedControllerLifetime",
+		src: "protectedControllerLifetime"
+	},
+	context: ({ input, self }) => {
+		attachIdProtectedCaptureController(self, createIdProtectedCaptureController());
 		const currentMode = input.config.onlyBack ? "back" : !input.config.enableId && input.config.enablePassport ? "passport" : input.config.usSmartCapture ? "back" : "front";
 		return {
 			config: input.config,
@@ -3069,7 +4116,7 @@ const idCaptureMachine = setup({
 			manualCaptureTriggered: false,
 			deepsightService: void 0,
 			analyticsProvider: input.analyticsProvider,
-			dependencies: input.dependencies,
+			dependencies: resolveIdCaptureDependencies(input.dependencies),
 			disableIpify: getDisableIpify(),
 			deepsightInitAttempted: false,
 			availableDocumentTypes: getAvailableDocumentTypes(input.config, { credentialsAvailable: input.dependencies?.credentials?.isAvailable() ?? false }),
@@ -3147,16 +4194,19 @@ const idCaptureMachine = setup({
 				actions: ["setSelectedDocument", "setCurrentMode"]
 			}
 		] } },
-		ageVerification: { on: { NEXT_STEP: [{
-			target: "tutorial",
-			guard: "hasShowTutorial",
-			actions: "trackContinue"
-		}, {
-			target: "loading",
-			actions: "trackContinue"
-		}] } },
+		ageVerification: {
+			entry: "startProtectedMetadataPreparation",
+			on: { NEXT_STEP: [{
+				target: "tutorial",
+				guard: "hasShowTutorial",
+				actions: "trackContinue"
+			}, {
+				target: "loading",
+				actions: "trackContinue"
+			}] }
+		},
 		loading: {
-			entry: "preloadRecordingProvider",
+			entry: ["startProtectedMetadataPreparation", "preloadRecordingProvider"],
 			type: "parallel",
 			states: {
 				permissionCheck: {
@@ -3178,30 +4228,8 @@ const idCaptureMachine = setup({
 					}
 				},
 				deepsightInit: {
-					initial: "initializing",
-					states: {
-						initializing: { invoke: {
-							id: "initDeepsightLoading",
-							src: "initializeDeepsightSession",
-							input: ({ context }) => ({
-								ds: context.config.ds,
-								dependencies: context.dependencies,
-								disableIpify: context.disableIpify
-							}),
-							onDone: {
-								target: "done",
-								actions: assign({
-									deepsightService: ({ event }) => event.output,
-									deepsightInitAttempted: () => true
-								})
-							},
-							onError: {
-								target: "done",
-								actions: [assign({ deepsightInitAttempted: () => true }), () => console.warn("Deepsight initialization failed")]
-							}
-						} },
-						done: { type: "final" }
-					}
+					initial: "done",
+					states: { done: { type: "final" } }
 				}
 			},
 			onDone: [{
@@ -3211,7 +4239,11 @@ const idCaptureMachine = setup({
 		},
 		tutorial: {
 			initial: "checkingPermission",
-			entry: ["trackTutorialId", "preloadRecordingProvider"],
+			entry: [
+				"startProtectedMetadataPreparation",
+				"trackTutorialId",
+				"preloadRecordingProvider"
+			],
 			states: {
 				checkingPermission: {
 					invoke: {
@@ -3241,50 +4273,22 @@ const idCaptureMachine = setup({
 					type: "parallel",
 					states: {
 						cameraInit: {
-							initial: "initializingDeepsight",
+							initial: "initializingStream",
 							states: {
-								initializingDeepsight: { invoke: {
-									id: "tutorialInitDeepsight",
-									src: "initializeDeepsightSession",
-									input: ({ context }) => ({
-										ds: context.config.ds,
-										dependencies: context.dependencies,
-										disableIpify: context.disableIpify
-									}),
-									onDone: {
-										target: "initializingStream",
-										actions: assign({
-											deepsightService: ({ event }) => event.output,
-											deepsightInitAttempted: () => true
-										})
-									},
-									onError: {
-										target: "initializingStream",
-										actions: [assign({ deepsightInitAttempted: () => true }), () => console.warn("Deepsight initialization failed in tutorial")]
+								initializingStream: {
+									entry: "preAcquireProtectedCamera",
+									on: {
+										PROTECTED_PRE_ACQUIRE_DONE: { target: "ready" },
+										PROTECTED_PRE_ACQUIRE_FAILED: [{
+											target: "#idCapture.tutorial.ready",
+											guard: "isPermissionDeniedError",
+											actions: assign({ permissionResult: () => "denied" })
+										}, {
+											target: "#idCapture.tutorial.ready",
+											actions: assign({ error: ({ event }) => String(event.error) })
+										}]
 									}
-								} },
-								initializingStream: { invoke: {
-									id: "tutorialInitCamera",
-									src: "initializeCamera",
-									input: ({ context }) => ({
-										config: context.config,
-										deepsightService: context.deepsightService
-									}),
-									onDone: {
-										target: "ready",
-										actions: "setStreamAndCapturer"
-									},
-									onError: [{
-										target: "#idCapture.tutorial.ready",
-										guard: "isPermissionDeniedError",
-										actions: assign({ permissionResult: () => {
-											return "denied";
-										} })
-									}, {
-										target: "#idCapture.tutorial.ready",
-										actions: assign({ error: ({ event }) => String(event.error) })
-									}]
-								} },
+								},
 								ready: { type: "final" }
 							}
 						},
@@ -3416,9 +4420,10 @@ const idCaptureMachine = setup({
 				requesting: { invoke: {
 					id: "requestPermission",
 					src: "requestPermission",
-					input: ({ context }) => ({
+					input: ({ context, self }) => ({
 						permissionResult: context.permissionResult === "refresh" ? void 0 : context.permissionResult,
-						requestMotionPermission: context.config.ds === true
+						requestMotionPermission: context.config.ds === true,
+						acceptStream: (value) => getIdProtectedCaptureController(self).storePreAcquiredStream(value)
 					}),
 					onDone: [
 						{
@@ -3443,63 +4448,64 @@ const idCaptureMachine = setup({
 		},
 		capture: {
 			initial: "checkingStream",
-			entry: ["trackCameraId", "preloadRecordingProvider"],
-			exit: ["stopMediaRecording", "clearRecordingSession"],
-			on: { SET_FRAME_RECT: { actions: "setFrameRect" } },
-			states: {
-				checkingStream: { always: [
+			entry: [
+				"trackCameraId",
+				"preloadRecordingProvider",
+				"initializeProtectedProvider",
+				"bindProtectedAttempt",
+				"startProtectedAttempt"
+			],
+			exit: [
+				"stopMediaRecording",
+				"clearRecordingSession",
+				"clearProtectedAttempt"
+			],
+			invoke: {
+				id: "protectedAttempt",
+				src: "protectedAttempt"
+			},
+			on: {
+				QUIT: { target: ".releasingForClose" },
+				BACKGROUND: { actions: "forwardProtectedBackground" },
+				FOREGROUND: { actions: "forwardProtectedForeground" },
+				PROTECTED_ATTEMPT_READY_SIGNAL: {
+					target: ".choosingDetectionStrategy",
+					actions: "setProtectedAttemptReady"
+				},
+				PROTECTED_ATTEMPT_FAILED: [
+					{ guard: "isProtectedManualRefusal" },
 					{
-						target: "initializingDeepsight",
-						guard: "needsDeepsightInit"
+						target: ".uploadError",
+						guard: "isProtectedUploadFailure",
+						actions: "setProtectedUploadFailure"
 					},
 					{
-						target: "choosingDetectionStrategy",
-						guard: "hasInitializedCamera"
-					},
-					{ target: "initializing" }
-				] },
-				initializingDeepsight: { invoke: {
-					id: "initDeepsightCapture",
-					src: "initializeDeepsightSession",
-					input: ({ context }) => ({
-						ds: context.config.ds,
-						dependencies: context.dependencies,
-						disableIpify: context.disableIpify
-					}),
-					onDone: {
-						target: "checkingStream",
-						actions: assign({
-							deepsightService: ({ event }) => event.output,
-							deepsightInitAttempted: () => true
-						})
-					},
-					onError: {
-						target: "checkingStream",
-						actions: [assign({ deepsightInitAttempted: () => true }), () => console.warn("Deepsight initialization failed in capture")]
-					}
-				} },
-				initializing: { invoke: {
-					id: "initializeCamera",
-					src: "initializeCamera",
-					input: ({ context }) => ({
-						config: context.config,
-						deepsightService: context.deepsightService,
-						stream: context.stream,
-						cameraFallbackLevel: context.cameraFallbackLevel
-					}),
-					onDone: {
-						target: "choosingDetectionStrategy",
-						actions: "setStreamAndCapturer"
-					},
-					onError: [{
-						target: "#idCapture.permissions",
-						guard: "isPermissionDeniedError",
-						actions: assign({ permissionResult: () => "denied" })
-					}, {
 						target: "#idCapture.error",
-						actions: assign({ error: ({ event }) => String(event.error) })
-					}]
-				} },
+						actions: "setProtectedFailure"
+					}
+				],
+				PROTECTED_PRESENTATION_FAILED: {
+					target: ".uploadError",
+					actions: "setProtectedUploadFailure"
+				},
+				PROTECTED_PREVIEW_READY: { actions: "storeProtectedPreview" },
+				SET_FRAME_RECT: { actions: "setFrameRect" }
+			},
+			states: {
+				releasingForClose: {
+					entry: "releaseProtectedForClose",
+					always: "#idCapture.closed"
+				},
+				releasingForRetry: {
+					entry: "releaseProtectedForRetry",
+					always: {
+						target: "#idCapture.capture",
+						reenter: true
+					}
+				},
+				checkingStream: { always: { target: "initializing" } },
+				initializingDeepsight: { always: { target: "initializing" } },
+				initializing: {},
 				choosingDetectionStrategy: {
 					entry: ["reportCaptureOptimizingAssignment"],
 					always: [{
@@ -3514,43 +4520,19 @@ const idCaptureMachine = setup({
 						actions: assign({ detectionStatus: () => "manualCapture" })
 					}],
 					entry: [assign({ detectionStatus: () => "detecting" })],
-					invoke: [{
-						id: "startRecording",
-						src: "startRecording",
-						input: ({ context }) => ({
-							config: context.config,
-							stream: context.stream,
-							existing: context.recordingSession,
-							currentMode: context.currentMode
-						}),
-						onDone: { actions: assign({ recordingSession: ({ context, event }) => {
-							return event.output ?? context.recordingSession;
-						} }) },
-						onError: { actions: "discardFailedRecordingSession" }
-					}, {
-						id: "runDetection",
-						src: "runDetection",
-						input: ({ context }) => ({
-							frameCapturer: context.frameCapturer,
-							provider: context.provider,
-							config: context.config,
-							currentMode: context.currentMode,
-							detectionArea: context.detectionArea ?? context.config.detectionArea
-						})
-					}],
 					on: {
 						DETECTION_UPDATE: { actions: "setDetectionStatus" },
-						DETECTION_RESET_READY: { actions: assign({ resetDetection: ({ event }) => event.reset }) },
-						DETECTION_SUCCESS: {
+						PROTECTED_AUTO_CAPTURE: { actions: ["storeProtectedAutoQuality", "requestProtectedAutoCommit"] },
+						PROTECTED_AUTO_COMMITTED_SIGNAL: {
 							target: "capturing",
-							actions: assign({ qualityElements: ({ event }) => event.qualityElements })
+							actions: "storeProtectedCommit"
 						},
 						BARCODE_DECODED: [{
-							target: "capturingBarcode",
+							target: "submittingBarcodePreCapture",
 							guard: "canRunBarcodeFastPath",
 							actions: ["storeDecodedBarcode", "setBarcodeFastPathAttempted"]
 						}, { actions: "storeDecodedBarcode" }],
-						MANUAL_CAPTURE: { target: "capturingManual" },
+						MANUAL_CAPTURE: {},
 						SWITCH_TO_MANUAL_CAPTURE: {
 							target: "manualCaptureWaiting",
 							actions: assign({
@@ -3583,40 +4565,15 @@ const idCaptureMachine = setup({
 						guard: "hasManualCaptureTriggered",
 						actions: assign({ detectionStatus: () => "manualCapture" })
 					}],
-					invoke: [{
-						id: "startRecording",
-						src: "startRecording",
-						input: ({ context }) => ({
-							config: context.config,
-							stream: context.stream,
-							existing: context.recordingSession,
-							currentMode: context.currentMode
-						}),
-						onDone: { actions: assign({ recordingSession: ({ context, event }) => {
-							return event.output ?? context.recordingSession;
-						} }) },
-						onError: { actions: "discardFailedRecordingSession" }
-					}, {
-						id: "runDetection",
-						src: "runDetection",
-						input: ({ context }) => ({
-							frameCapturer: context.frameCapturer,
-							provider: context.provider,
-							config: context.config,
-							currentMode: context.currentMode,
-							detectionArea: context.detectionArea ?? context.config.detectionArea,
-							optimizingAfterMs: context.captureWindowMs
-						})
-					}],
 					on: {
-						DETECTION_SUCCESS: {
+						PROTECTED_AUTO_CAPTURE: { actions: ["storeProtectedAutoQuality", "requestProtectedAutoCommit"] },
+						PROTECTED_AUTO_COMMITTED_SIGNAL: {
 							target: "capturing",
-							actions: assign({ qualityElements: ({ event }) => event.qualityElements })
+							actions: "storeProtectedCommit"
 						},
-						DETECTION_RESET_READY: { actions: assign({ resetDetection: ({ event }) => event.reset }) },
 						ID_TYPE_CHANGE: { actions: "setIdType" },
 						ORIENTATION_CHANGE: { actions: "setOrientation" },
-						MANUAL_CAPTURE: { target: "#idCapture.capture.capturingManual" },
+						MANUAL_CAPTURE: {},
 						SWITCH_TO_MANUAL_CAPTURE: {
 							target: "#idCapture.capture.manualCaptureWaiting",
 							actions: assign({
@@ -3631,34 +4588,28 @@ const idCaptureMachine = setup({
 							DETECTION_UPDATE: { actions: "setDetectionStatus" },
 							ID_SIDE_CHANGE: { actions: assign({ detectionStatus: ({ context, event }) => getDetectionStatusFromSideChange(context, event.side) }) },
 							BARCODE_DECODED: [{
-								target: "#idCapture.capture.capturingBarcode",
+								target: "#idCapture.capture.submittingBarcodePreCapture",
 								guard: "canRunBarcodeFastPath",
 								actions: ["storeDecodedBarcode", "setBarcodeFastPathAttempted"]
 							}, { actions: "storeDecodedBarcode" }],
-							DETECTION_OPTIMIZING: {
+							PROTECTED_OPTIMIZING: {
 								target: "optimizing",
-								guard: "hasCandidateFrame",
-								actions: "setCandidateFrame"
+								actions: "storeProtectedCandidate"
 							}
 						} },
 						optimizing: {
 							exit: "clearOptimizingPhase",
 							on: {
 								BARCODE_DECODED: { actions: "storeDecodedBarcode" },
-								SWITCH_TO_MANUAL_CAPTURE: {
-									guard: "hasStashedCommit",
-									target: "#idCapture.capture.detectingWithOptimization.optimizing.released"
-								},
-								MANUAL_CAPTURE: {
-									guard: "hasStashedCommit",
-									target: "#idCapture.capture.detectingWithOptimization.optimizing.released"
-								}
+								SWITCH_TO_MANUAL_CAPTURE: { actions: "releaseStashedCommitIfPresent" },
+								MANUAL_CAPTURE: { actions: "releaseStashedCommitIfPresent" },
+								PROTECTED_RELEASE_STASHED_COMMIT: { target: "#idCapture.capture.detectingWithOptimization.optimizing.released" }
 							},
 							initial: "holding",
 							states: {
 								holding: {
 									after: { optimizingDwell: { target: "released" } },
-									on: { DETECTION_SUCCESS: { actions: "stashCommittedFrame" } }
+									on: { PROTECTED_AUTO_COMMITTED_SIGNAL: {} }
 								},
 								released: {
 									entry: "releaseStashedCommit",
@@ -3671,34 +4622,23 @@ const idCaptureMachine = setup({
 						}
 					}
 				},
-				manualCaptureWaiting: {
-					invoke: {
-						id: "startRecording",
-						src: "startRecording",
-						input: ({ context }) => ({
-							config: context.config,
-							stream: context.stream,
-							existing: context.recordingSession,
-							currentMode: context.currentMode
-						}),
-						onDone: { actions: assign({ recordingSession: ({ context, event }) => {
-							return event.output ?? context.recordingSession;
-						} }) },
-						onError: { actions: "discardFailedRecordingSession" }
-					},
-					on: { MANUAL_CAPTURE: { target: "capturingManual" } }
-				},
+				manualCaptureWaiting: { on: {
+					MANUAL_CAPTURE: { actions: "requestProtectedManualCommit" },
+					PROTECTED_MANUAL_COMMITTED_SIGNAL: {
+						target: "capturingManual",
+						actions: "storeProtectedCommit"
+					}
+				} },
 				capturing: {
-					entry: [
-						"captureImage",
-						"storeCapturedCanvasInProvider",
-						"storeCapturedImage",
-						"pauseRecordingForAttempt"
-					],
-					always: [
+					entry: "finalizeProtectedAttempt",
+					on: { PROTECTED_ATTEMPT_FINALIZED_SIGNAL: [
 						{
 							target: "submittingBarcode",
-							guard: and(["hasCapturedImage", "shouldSubmitBarcode"])
+							guard: "shouldSubmitBarcode"
+						},
+						{
+							target: "uploading",
+							guard: not("isCaptureOnlyDelivery")
 						},
 						{
 							target: "uploading",
@@ -3706,12 +4646,9 @@ const idCaptureMachine = setup({
 						},
 						{
 							target: "uploadError",
-							actions: assign(({ context }) => ({
-								uploadError: ID_ERROR_CODES.UPLOAD_ERROR,
-								attemptsRemaining: context.attemptsRemaining - 1
-							}))
+							actions: "setProtectedUploadFailure"
 						}
-					]
+					] }
 				},
 				submittingBarcode: { invoke: {
 					id: "submitBarcode",
@@ -3727,15 +4664,7 @@ const idCaptureMachine = setup({
 					},
 					onError: { target: "uploading" }
 				} },
-				capturingBarcode: {
-					entry: [
-						"captureImage",
-						"storeCapturedCanvasInProvider",
-						"storeCapturedImage",
-						"pauseRecordingForAttempt"
-					],
-					always: [{ target: "submittingBarcodePreCapture" }]
-				},
+				capturingBarcode: { always: [{ target: "submittingBarcodePreCapture" }] },
 				submittingBarcodePreCapture: { invoke: {
 					id: "submitBarcode",
 					src: "submitBarcode",
@@ -3752,13 +4681,8 @@ const idCaptureMachine = setup({
 					onError: { target: "choosingDetectionStrategy" }
 				} },
 				capturingManual: {
-					entry: [
-						"captureLatestFrame",
-						"storeCapturedCanvasInProvider",
-						"storeCapturedImage",
-						"pauseRecordingForAttempt"
-					],
-					always: [
+					entry: "finalizeProtectedAttempt",
+					on: { PROTECTED_ATTEMPT_FINALIZED_SIGNAL: [
 						{
 							target: "optimizingHold",
 							guard: and([
@@ -3767,6 +4691,10 @@ const idCaptureMachine = setup({
 								"supportsOptimizingStatus"
 							])
 						},
+						{
+							target: "uploading",
+							guard: not("isCaptureOnlyDelivery")
+						},
 						{
 							target: "uploading",
 							guard: "hasCapturedImage"
@@ -3778,44 +4706,35 @@ const idCaptureMachine = setup({
 								attemptsRemaining: context.attemptsRemaining - 1
 							}))
 						}
-					]
+					] }
 				},
 				optimizingHold: { after: { optimizingDwell: { target: "uploading" } } },
 				uploading: {
-					entry: assign({ uploadProgress: () => 0 }),
+					entry: [
+						assign({ uploadProgress: () => 1 }),
+						"requestProtectedUpload",
+						"bindCaptureOnlyDelivery"
+					],
 					invoke: [{
 						id: "uploadProgressTicker",
 						src: "uploadProgressTicker"
 					}, {
-						id: "uploadIdImage",
-						src: "uploadIdImage",
-						input: ({ context, self }) => {
-							const canvas = context.provider?.getOriginalCapturedCanvas();
-							if (!canvas) throw new Error(ID_ERROR_CODES.UPLOAD_ERROR);
-							const type = context.currentMode === "back" ? "back" : "front";
-							return {
-								canvas,
-								type,
-								qualityElements: context.qualityElements,
-								onProgress: (progress) => {
-									self.send({
-										type: "UPLOAD_PROGRESS",
-										progress
-									});
-								},
-								deepsightService: context.deepsightService,
-								stream: context.stream,
-								isSecondId: context.config.isSecondId ?? false,
-								onlyFront: type === "front" && (context.config.onlyFront ?? false),
-								ageAssurance: context.config.ageAssurance,
-								dependencies: context.dependencies,
-								captureResolution: context.captureResolution,
-								cameraFallbackLevel: context.cameraFallbackLevel,
-								extractIdFace: context.config.extractIdFace,
-								croppedCanvas: context.provider?.getCapturedCanvas() ?? null
-							};
-						},
-						onDone: {
+						id: "captureOnlyDelivery",
+						src: "captureOnlyDelivery",
+						input: ({ context }) => {
+							if (!isCaptureOnlyConfig(context.config)) return { mode: "protected" };
+							return { mode: "captureOnly" };
+						}
+					}],
+					after: { [UPLOAD_TIMEOUT_MS]: {
+						target: "uploadError",
+						actions: assign(({ context }) => ({
+							uploadError: ID_ERROR_CODES.UPLOAD_ERROR,
+							attemptsRemaining: context.attemptsRemaining - 1
+						}))
+					} },
+					on: {
+						CAPTURE_ONLY_DELIVERY_DONE: {
 							target: "uploadCompleted",
 							actions: [assign({
 								uploadResponse: ({ event }) => event.output,
@@ -3823,22 +4742,17 @@ const idCaptureMachine = setup({
 								skipProcessId: ({ context, event }) => event.output.idValidationCompleted === true || context.skipProcessId
 							}), "storeCapturedImage"]
 						},
-						onError: {
+						CAPTURE_ONLY_DELIVERY_FAILED: {
 							target: "uploadError",
 							actions: assign(({ context, event }) => ({
 								uploadError: getIdErrorCodeFromUnknown(event.error) ?? ID_ERROR_CODES.UPLOAD_ERROR,
 								attemptsRemaining: context.attemptsRemaining - 1
 							}))
-						}
-					}],
-					after: { [UPLOAD_TIMEOUT_MS]: {
-						target: "uploadError",
-						actions: assign(({ context }) => ({
-							uploadError: ID_ERROR_CODES.UPLOAD_ERROR,
-							attemptsRemaining: context.attemptsRemaining - 1
-						}))
-					} },
-					on: {
+						},
+						PROTECTED_UPLOAD_DONE_SIGNAL: {
+							target: "uploadCompleted",
+							actions: "storeProtectedUploadResponse"
+						},
 						UPLOAD_PROGRESS: { actions: assign({ uploadProgress: ({ context, event }) => Math.max(context.uploadProgress ?? 0, Math.round(event.progress / 100 * 80)) }) },
 						UPLOAD_PROGRESS_TICK: { actions: assign({ uploadProgress: ({ context }) => Math.min(95, (context.uploadProgress ?? 0) + 1) }) }
 					}
@@ -3881,7 +4795,7 @@ const idCaptureMachine = setup({
 				] },
 				uploadError: { on: { CONTINUE_FROM_ERROR: [
 					{
-						target: "checkingStream",
+						target: "releasingForRetry",
 						guard: "hasAttemptsRemaining",
 						actions: [
 							"resetDetection",
@@ -3905,7 +4819,6 @@ const idCaptureMachine = setup({
 					}
 				] } },
 				success: {
-					entry: ["stopMediaRecording", "clearRecordingSession"],
 					exit: "clearBarcodeFastPathCaptured",
 					on: { NEXT_STEP: [
 						{
@@ -3946,28 +4859,8 @@ const idCaptureMachine = setup({
 				cameraInit: {
 					initial: "checking",
 					states: {
-						checking: { always: [{
-							target: "ready",
-							guard: "hasStream"
-						}, { target: "initializingStream" }] },
-						initializingStream: { invoke: {
-							id: "frontFinishedInitCamera",
-							src: "initializeCamera",
-							input: ({ context }) => ({
-								config: context.config,
-								deepsightService: context.deepsightService
-							}),
-							onDone: {
-								target: "ready",
-								actions: "setStreamAndCapturer"
-							},
-							onError: {
-								target: "ready",
-								actions: () => {
-									console.warn("Camera initialization failed during flip transition");
-								}
-							}
-						} },
+						checking: { always: "ready" },
+						initializingStream: { always: "ready" },
 						ready: { type: "final" }
 					}
 				},
@@ -3983,10 +4876,6 @@ const idCaptureMachine = setup({
 				}
 			},
 			onDone: [{
-				target: "#idCapture.capture.choosingDetectionStrategy",
-				guard: "hasStream",
-				actions: "clearFlipPreview"
-			}, {
 				target: "#idCapture.capture",
 				actions: "clearFlipPreview"
 			}]
@@ -3998,28 +4887,8 @@ const idCaptureMachine = setup({
 				cameraInit: {
 					initial: "checking",
 					states: {
-						checking: { always: [{
-							target: "ready",
-							guard: "hasStream"
-						}, { target: "initializingStream" }] },
-						initializingStream: { invoke: {
-							id: "backFinishedInitCamera",
-							src: "initializeCamera",
-							input: ({ context }) => ({
-								config: context.config,
-								deepsightService: context.deepsightService
-							}),
-							onDone: {
-								target: "ready",
-								actions: "setStreamAndCapturer"
-							},
-							onError: {
-								target: "ready",
-								actions: () => {
-									console.warn("Camera initialization failed during flip transition");
-								}
-							}
-						} },
+						checking: { always: "ready" },
+						initializingStream: { always: "ready" },
 						ready: { type: "final" }
 					}
 				},
@@ -4035,10 +4904,6 @@ const idCaptureMachine = setup({
 				}
 			},
 			onDone: [{
-				target: "#idCapture.capture.choosingDetectionStrategy",
-				guard: "hasStream",
-				actions: "clearFlipPreview"
-			}, {
 				target: "#idCapture.capture",
 				actions: "clearFlipPreview"
 			}]
@@ -4140,25 +5005,16 @@ const idCaptureMachine = setup({
 			entry: [
 				"stopMediaRecording",
 				"stopMediaStream",
-				"disposeProvider",
-				"cleanupDeepsight"
+				"disposeProvider"
 			],
 			type: "final"
 		},
 		closed: {
-			entry: [
-				"stopMediaStream",
-				"disposeProvider",
-				"cleanupDeepsight"
-			],
+			entry: ["stopMediaStream", "disposeProvider"],
 			type: "final"
 		},
 		error: {
-			entry: [
-				"stopMediaStream",
-				"disposeProvider",
-				"cleanupDeepsight"
-			],
+			entry: ["stopMediaStream", "disposeProvider"],
 			on: { RESET: {
 				target: "idle",
 				actions: "resetContext"
@@ -4242,7 +5098,7 @@ const idCaptureMachine = setup({
 			invoke: {
 				id: "readPendingDigitalIdRedirect",
 				src: "readPendingDigitalIdRedirect",
-				input: ({ context }) => ({ storage: context.dependencies?.storage ?? new BrowserStorageProvider() }),
+				input: ({ context }) => ({ storage: resolveIdCaptureDependencies(context.dependencies).storage }),
 				onDone: [
 					{
 						guard: "hasPendingDigitalIdRedirect",
@@ -4276,7 +5132,7 @@ const idCaptureMachine = setup({
 							returnUrl: context.config.digitalIdReturnUrl,
 							country: method?.country
 						},
-						storage: context.dependencies?.storage ?? new BrowserStorageProvider(),
+						storage: resolveIdCaptureDependencies(context.dependencies).storage,
 						autoStart: true,
 						resume: resuming ? {
 							verificationId: context.digitalIdResumeVerificationId,
@@ -4362,5 +5218,21 @@ const idCaptureMachine = setup({
 		}
 	}
 });
+/**
+* Composes the protected children around one controller without placing that
+* authority in any actor input or public machine context.
+*/
+function provideIdProtectedCaptureController(machine, controller) {
+	return machine.provide({
+		actors: {
+			protectedAttempt: createProtectedIdAttemptActor(controller),
+			protectedControllerLifetime: createProtectedIdControllerLifetimeActor(controller)
+		},
+		actions: { attachProtectedController: assign(({ self }) => {
+			attachIdProtectedCaptureController(self, controller);
+			return {};
+		}) }
+	});
+}
 //#endregion
-export { isRedirectFlowType as a, MANUAL_UPLOAD_MAX_FILE_SIZE_BYTES as c, DIGITAL_ID_REGISTRY as i, MANUAL_UPLOAD_MAX_RETRIES as l, getManualUploadTabs as n, resolveDigitalIdImplementation as o, DIGITAL_ID_DOCUMENT_TYPES as r, MANUAL_UPLOAD_EXHAUSTION_FORWARD_MS as s, idCaptureMachine as t, resolveWalletPlatform as u };
+export { createIdProtectedCaptureController as a, DIGITAL_ID_DOCUMENT_TYPES as c, resolveDigitalIdImplementation as d, MANUAL_UPLOAD_EXHAUSTION_FORWARD_MS as f, resolveWalletPlatform as h, createIdCaptureOnlyDeliveryActor as i, DIGITAL_ID_REGISTRY as l, MANUAL_UPLOAD_MAX_RETRIES as m, provideIdProtectedCaptureController as n, findIdProtectedCaptureController as o, MANUAL_UPLOAD_MAX_FILE_SIZE_BYTES as p, attachIdProtectedCaptureController as r, getManualUploadTabs as s, idCaptureMachine as t, isRedirectFlowType as u };