@incodetech/core 2.1.0-rc.2 → 2.1.0-rc.4

package/dist/personhood.esm.js

@@ -0,0 +1,1500 @@
+import { t as WasmUtilProvider } from "./WasmUtilProvider-ADG54T6M.esm.js";
+import { t as BrowserTimerProvider } from "./BrowserTimerProvider-CHloo0eQ.esm.js";
+import { t as api } from "./api-DsbUi7TO.esm.js";
+import { a as createApi_default, t as getStoredHttpConfig } from "./clientLifecycle-Ct7h9uxx.esm.js";
+import { n as eventModuleNames } from "./events-1wxZ97yf.esm.js";
+import { t as endpoints } from "./endpoints-CwrFQfW7.esm.js";
+import "./stats-BVy52wLy.esm.js";
+import { n as isBrowserSimulation, o as BrowserEnvironmentProvider } from "./browserSimulation-DFpmweuc.esm.js";
+import { n as getFingerprintEnabled, u as getDeviceFingerprintInfo } from "./sessionInitializer-CzPdr0Q1.esm.js";
+import { t as getThumbmarkId } from "./thumbmarkAdapter-CVyiGp0-.esm.js";
+import "./platform-BoeUeUrV.esm.js";
+import "./tri-CFBjqf5E.esm.js";
+import { a as fromPromise, i as fromCallback, l as createManager, r as assign, s as createActor, t as setup } from "./xstate.esm-nY3M5UYm.esm.js";
+import "./MotionSensorProvider-BkHKMCPE.esm.js";
+import { i as requestPermission, t as checkPermission } from "./permissionServices-D9lmzFYc.esm.js";
+import { a as stopCameraStream, r as requestCameraAccess } from "./camera-B0yWS33x.esm.js";
+import { t as BrowserStorageProvider } from "./BrowserStorageProvider-CBXGCHnK.esm.js";
+import { b as FaceDetectionProvider, f as stopStream, l as startDetection, s as initializeDeepsightSession } from "./onDeviceFaceResults-BdfKrQrf.esm.js";
+import { t as sleep } from "./ITimerCapability-G7lQg-be.esm.js";
+import "./canvas-DsJa51yU.esm.js";
+import "./backCameraStream-POavVKz4.esm.js";
+import "./video-DXf5H9rY.esm.js";
+import "./getDeviceClass-BdgmyOOu.esm.js";
+import "./deepsightService-BsLpJT8o.esm.js";
+import "./getDeviceClass-QxbJwsOO.esm.js";
+import "./types-Db2ooXIu.esm.js";
+import { t as StreamCanvasCapture } from "./StreamCanvasCapture-CRk7c7u7.esm.js";
+
+//#region ../infra/src/crypto/randomUUID.ts
+/**
+* Cryptographically-strong UUID v4 (RFC 4122).
+*
+* Lives in infra (L0) so Core (L1) can mint secure identifiers without touching
+* the `crypto` browser API directly — Core delegates here, keeping it free of
+* browser globals (enforced by the `no-browser-api-in-core` lint rule). Backed
+* by `crypto.randomUUID`, available in every browser the SDK targets.
+*/
+function randomUUID() {
+	return crypto.randomUUID();
+}
+
+//#endregion
+//#region src/modules/personhood/personhoodServices.ts
+/**
+* Config used for the passive liveness pass. Deliberately stripped down from
+* selfie: no recording, no validation rituals, no headwear/mask checks — we
+* want the lowest-friction path to a single head-pose-tracked liveness shot.
+*/
+const PERSONHOOD_FACE_CAPTURE_CONFIG = {
+	showTutorial: false,
+	showPreview: false,
+	assistedOnboarding: false,
+	enableFaceRecording: false,
+	autoCaptureTimeout: 8e3,
+	captureAttempts: 2,
+	validateLenses: false,
+	validateFaceMask: false,
+	validateHeadCover: false,
+	validateClosedEyes: false,
+	validateBrightness: false,
+	deepsightLiveness: "SINGLE_FRAME",
+	ds: false
+};
+const PERSONHOOD_CAMERA_CONSTRAINTS = {
+	video: {
+		facingMode: "user",
+		height: { ideal: 480 },
+		width: { ideal: 640 }
+	},
+	audio: false
+};
+/**
+* Boots the Deepsight session used to back-stop the on-device liveness check.
+* Independent of `initializePersonhoodCamera` so the two can proceed in
+* parallel during the permission / collect-signals phase.
+*/
+async function initializePersonhoodDeepsight(params) {
+	return initializeDeepsightSession({
+		storage: params.storage,
+		ds: false
+	});
+}
+/**
+* Boots the camera stream and WASM face-detection pipeline as fast as
+* possible after the user grants permission. Optimized for low latency
+* between "permission granted" and "avatar begins tracking":
+*
+*  1. WASM model loading and `getUserMedia` run **in parallel** — they're
+*     independent I/O and were previously sequential, which stacked
+*     50-500ms of avoidable latency.
+*  2. Deepsight PRC warmup (anti-spoof pipeline priming) is fired as a
+*     **background task** after the real stream is open. It's not needed
+*     for face detection or pose tracking — only for the post-capture
+*     `analyzeFrame` step. `analyzeLiveness` degrades gracefully if PRC
+*     hasn't finished in time.
+*
+* Earlier versions opened a second hidden camera stream for PRC warmup
+* BEFORE opening the real one, which on Safari/Firefox serialized the
+* two `getUserMedia` calls and added visible lag before the avatar came
+* alive.
+*/
+async function initializePersonhoodCamera(params) {
+	const provider = new FaceDetectionProvider();
+	const [initResult, streamResult] = await Promise.allSettled([provider.initialize({ autocaptureInterval: PERSONHOOD_FACE_CAPTURE_CONFIG.autoCaptureTimeout * 1e3 }), requestCameraAccess(PERSONHOOD_CAMERA_CONSTRAINTS)]);
+	if (streamResult.status === "rejected") {
+		if (initResult.status === "fulfilled") provider.dispose();
+		throw streamResult.reason;
+	}
+	const stream = streamResult.value;
+	if (initResult.status === "rejected") {
+		stopCameraStream(stream);
+		throw initResult.reason;
+	}
+	provider.setChecksEnabled({
+		lenses: false,
+		mask: false,
+		closedEyes: false,
+		headWear: false,
+		occlusion: false
+	});
+	if (params.deepsightService) params.deepsightService.performPrcCheck({ constraints: PERSONHOOD_CAMERA_CONSTRAINTS }).catch(() => {});
+	return {
+		stream,
+		provider
+	};
+}
+/**
+* Wraps the existing face-capture detection loop for the Personhood flow.
+*
+* - Drops the captured canvas (we never upload the raw frame).
+* - Forwards per-frame `onFaceData` into `onPose` so the avatar can mirror
+*   the user's head in real time.
+*/
+const AUTO_COMPLETE_DEADLINE_MS = 4e3;
+function runPersonhoodDetection(params) {
+	let forcedCaptureFired = false;
+	const timer = BrowserTimerProvider.getInstance();
+	let autoCompleteTimer = null;
+	let autoCompleteArmed = false;
+	const cancelAutoComplete = () => {
+		if (autoCompleteTimer !== null) {
+			timer.clearTimeout(autoCompleteTimer);
+			autoCompleteTimer = null;
+		}
+	};
+	const fireForceCapture = () => {
+		if (forcedCaptureFired) return;
+		forcedCaptureFired = true;
+		cancelAutoComplete();
+		params.provider.forceCapture();
+	};
+	const armAutoComplete = () => {
+		if (autoCompleteArmed) return;
+		autoCompleteArmed = true;
+		if (!params.autoComplete) return;
+		autoCompleteTimer = timer.setTimeout(() => {
+			autoCompleteTimer = null;
+			fireForceCapture();
+		}, AUTO_COMPLETE_DEADLINE_MS);
+	};
+	const innerResult = startDetection({
+		config: PERSONHOOD_FACE_CAPTURE_CONFIG,
+		capturer: params.capturer,
+		provider: params.provider,
+		onUpdate: params.onStatus,
+		onFrame: () => armAutoComplete(),
+		onPose: (face, frameSize) => {
+			let faceSizeRatio;
+			if (frameSize && frameSize.width > 0 && frameSize.height > 0 && face.rect.width > 0 && face.rect.height > 0) faceSizeRatio = Math.sqrt(face.rect.width * face.rect.height) / Math.min(frameSize.width, frameSize.height);
+			params.onPose({
+				pitch: face.pitch,
+				yaw: face.yaw,
+				roll: face.roll,
+				faceSizeRatio
+			});
+		},
+		onSuccess: (canvas) => {
+			cancelAutoComplete();
+			params.onSuccess(canvas);
+		}
+	});
+	return {
+		cleanup: () => {
+			cancelAutoComplete();
+			innerResult.cleanup();
+		},
+		reset: innerResult.reset
+	};
+}
+/**
+* Runs the Deepsight pipeline against the stream + captured frame and pairs
+* the result with the locally-observed pose motion. All work happens on the
+* device — no network round-trip.
+*
+* The returned `LivenessOutcome` is fed into {@link produceLocalVerdict}:
+* - `virtualCamera: true` → hard reject (OBS/ManyCam)
+* - `analysisStatus !== 'PASS'` → reject with `spoof_suspected`
+* - `yawRange + pitchRange < MIN_POSE_MOTION_DEG` → reject with `no_motion`
+*/
+async function analyzeLiveness(params) {
+	let virtualCamera = false;
+	let analysisStatus = "";
+	let motionStatus = "";
+	let metadata = "";
+	let pipelineState = "";
+	const deepsight = params.deepsightService;
+	if (deepsight) {
+		try {
+			const videoTrack = params.stream?.getVideoTracks()[0];
+			if (videoTrack) virtualCamera = await deepsight.checkVirtualCamera(videoTrack);
+		} catch {}
+		try {
+			await deepsight.performVirtualCameraCheck(params.token ?? null, "SELFIE");
+		} catch {}
+		try {
+			const imageData = params.capturedImage?.getImageData();
+			if (imageData) await deepsight.analyzeFrame(imageData);
+		} catch {}
+		try {
+			analysisStatus = deepsight.getAnalysisStatus();
+			motionStatus = deepsight.getMotionStatus();
+			pipelineState = deepsight.getPipelineState();
+			metadata = deepsight.getMetadata();
+		} catch {}
+	}
+	return {
+		virtualCamera,
+		analysisStatus,
+		motionStatus,
+		yawRange: params.yawRange,
+		pitchRange: params.pitchRange,
+		metadata,
+		pipelineState
+	};
+}
+/**
+* Minimum combined yaw+pitch range (in degrees) required across the
+* detection window to clear the no-motion guard. A static photo or a
+* face with no head movement will fall below this.
+*/
+const MIN_POSE_MOTION_DEG = 4;
+/**
+* Upper bound of motion (degrees) that adds confidence — beyond this,
+* additional head movement doesn't increase our belief that there's a
+* human (and may just be noise from a moving phone).
+*/
+const MAX_POSE_MOTION_FOR_BONUS_DEG = 50;
+/**
+* Ceiling for on-device verdicts. Intentionally below 1.0 — nothing short
+* of a signed server round-trip should claim perfect confidence, and the
+* ceiling is strictly below what a server verdict would return so the two
+* paths are distinguishable to integrators.
+*/
+const LOCAL_CONFIDENCE_CEILING = .95;
+/**
+* Default pass threshold when `PersonhoodConfig.threshold` is omitted. Single
+* source of truth — keep `PersonhoodConfig.threshold`'s JSDoc and PERSONHOOD.md
+* in sync with this value. (A clean local pass without strong head motion lands
+* around here, so this is the effective on-device gate.)
+*/
+const DEFAULT_PERSONHOOD_THRESHOLD = .75;
+/**
+* Produces a verdict entirely on-device using an **additive** confidence
+* model. Each positive signal contributes a measurable amount to the score;
+* penalties subtract. This means clean passes vary — a user who swings
+* through a full head turn scores higher than one who barely moves — which
+* is useful for integrators that want to tune their own thresholds.
+*
+* Positive signals (contribute up to +0.95):
+* - Successful detection                      → +0.25
+* - Pose motion (linear from min to max)      → up to +0.25
+* - Clean device signals (no automation)      → +0.05
+* - Deepsight analysis: no explicit spoof     → +0.05
+* - Deepsight motion status == PASS           → +0.05
+* - Baseline presence                         → +0.30
+*
+* Penalties (hard rejects or large deductions):
+* - `navigator.webdriver` true                → -0.9
+* - Automation markers                        → -0.9
+* - Headless hints                            → -0.3
+* - Virtual camera detected                   → -0.9
+* - Explicit spoof/injection in analysis      → -0.4
+* - No head motion (below MIN_POSE_MOTION)    → -0.5
+* - Detection didn't reach 'success'          → -0.2
+*/
+function produceLocalVerdict(params) {
+	const threshold = params.threshold ?? DEFAULT_PERSONHOOD_THRESHOLD;
+	const reasons = [];
+	let confidence = .4;
+	if (params.detectionOutcome === "success") confidence += .25;
+	else {
+		reasons.push(`detection:${params.detectionOutcome}`);
+		confidence -= .2;
+	}
+	if (params.liveness) {
+		const motion = params.liveness.yawRange + params.liveness.pitchRange;
+		if (motion < MIN_POSE_MOTION_DEG) {
+			reasons.push("no_motion");
+			confidence -= .5;
+		} else {
+			const span = MAX_POSE_MOTION_FOR_BONUS_DEG - MIN_POSE_MOTION_DEG;
+			const motionRatio = Math.min(1, Math.max(0, (motion - MIN_POSE_MOTION_DEG) / span));
+			confidence += .25 * motionRatio;
+		}
+		if (!hasExplicitSpoofSignal(params.liveness.analysisStatus)) confidence += .05;
+		else {
+			reasons.push("spoof_suspected");
+			confidence -= .4;
+		}
+		if (isMotionStatusPass(params.liveness.motionStatus)) confidence += .05;
+	}
+	if (!(params.signals.webdriver || params.signals.emulator || params.signals.headlessHints.length > 0)) confidence += .05;
+	if (params.signals.webdriver) {
+		reasons.push("webdriver");
+		confidence -= .9;
+	}
+	if (params.signals.emulator) {
+		reasons.push("emulator");
+		confidence -= .9;
+	}
+	const SUBSUMED_HINTS = new Set(["navigator.webdriver", "automation-marker"]);
+	if (params.signals.headlessHints.filter((hint) => !SUBSUMED_HINTS.has(hint)).length > 0) {
+		reasons.push("headless");
+		confidence -= .3;
+	}
+	if (params.liveness?.virtualCamera) {
+		reasons.push("virtual_camera");
+		confidence -= .9;
+	}
+	confidence = Math.min(LOCAL_CONFIDENCE_CEILING, Math.max(0, confidence));
+	confidence = Math.round(confidence * 1e3) / 1e3;
+	if (confidence < threshold && reasons.length === 0) reasons.push("low_confidence");
+	const human = confidence >= threshold && reasons.length === 0;
+	return {
+		human,
+		confidence,
+		evidenceId: generateEvidenceId(params.siteKey),
+		reason: human ? void 0 : reasons.join(","),
+		signals: params.signals,
+		liveness: params.liveness,
+		spoofCheckResults: buildSpoofCheckResults({
+			signals: params.signals,
+			liveness: params.liveness,
+			detectionOutcome: params.detectionOutcome
+		})
+	};
+}
+function isMotionStatusPass(status) {
+	return status.trim().toUpperCase() === "PASS";
+}
+/**
+* Tests whether the Deepsight analysis status contains an explicit spoof /
+* injection / fail signal.
+*
+* The WASM's `getCheck()` returns a pipeline-state blob intended primarily
+* for backend consumption — the server is what turns the blob into a
+* pass/fail. In phase 0 (no session, no backend round-trip) we intentionally
+* only treat the output as a negative signal when it contains an explicit
+* failure token; everything else is indeterminate and we defer to the
+* other local checks (virtual camera + pose motion + device signals).
+*
+* Without this, every clean capture in a session-less dev demo was
+* erroneously flagged as spoof_suspected because the WASM didn't emit
+* literally "PASS".
+*/
+function hasExplicitSpoofSignal(status) {
+	const normalized = status.toUpperCase();
+	return normalized.includes("FAIL") || normalized.includes("SPOOF") || normalized.includes("INJECTION");
+}
+/**
+* Requests a server-side verdict when the browser can't run the on-device
+* liveness pass (no camera, blocked permission, incompatible browser). The
+* same API surface is returned to the widget so integrators see a single
+* universal `{ human, confidence, evidence_id }` shape.
+*
+* The confidence returned by this path is intentionally capped below the
+* on-device ceiling — with no camera we can only score device / behavioural
+* signals, which are weaker evidence of humanness.
+*/
+async function requestServerFallbackVerdict(params) {
+	if (params.mockFallback) return mockServerFallback(params);
+	try {
+		const res = await api.post(endpoints.personhoodServerFallback, {
+			siteKey: params.siteKey,
+			signals: params.signals,
+			reason: params.reason
+		}, { signal: params.signal });
+		if (!res.ok) throw new Error(`POST ${endpoints.personhoodServerFallback} failed: ${res.status} ${res.statusText}`);
+		return res.data;
+	} catch (error) {
+		if (isApiNotConfigured(error)) return mockServerFallback(params);
+		throw error;
+	}
+}
+async function mockServerFallback(params) {
+	await sleep(200);
+	const blocked = params.signals.webdriver || params.signals.emulator || params.signals.headlessHints.length > 0;
+	const spoofCheckResults = buildSpoofCheckResults({
+		signals: params.signals,
+		liveness: void 0,
+		detectionOutcome: "error"
+	});
+	if (blocked) return {
+		human: false,
+		confidence: .1,
+		evidenceId: generateEvidenceId(params.siteKey),
+		reason: "automation_markers",
+		signals: params.signals,
+		spoofCheckResults
+	};
+	return {
+		human: true,
+		confidence: .72,
+		evidenceId: generateEvidenceId(params.siteKey),
+		reason: `fallback:${params.reason}`,
+		signals: params.signals,
+		spoofCheckResults
+	};
+}
+/**
+* Pulls a token string out of `/omni/personhood/token`'s response,
+* regardless of which envelope the backend uses. The Incode service
+* surface has historically returned tokens under several keys
+* (`token`, `interviewToken`, `sessionToken`, `access_token`, raw
+* `id`) and a few endpoints return the bare string in the body.
+* Trying each in order and returning the first non-empty value
+* means we don't have to second-guess the contract — when the
+* backend changes shape, the diagnostic log of `res.data` in the
+* caller still surfaces the raw response.
+*/
+function extractTokenFromResponse(data) {
+	if (typeof data === "string" && data.length > 0) return data;
+	if (data && typeof data === "object") {
+		const obj = data;
+		const candidates = [
+			obj.token,
+			obj.interviewToken,
+			obj.sessionToken,
+			obj.access_token,
+			obj.accessToken,
+			obj.id,
+			obj.data?.token,
+			obj.data?.interviewToken
+		];
+		for (const candidate of candidates) if (typeof candidate === "string" && candidate.length > 0) return candidate;
+	}
+}
+/**
+* Pulls the verify endpoint's authoritative pass/fail boolean out
+* of its response, regardless of envelope. Current backend
+* contract: `{ "isHuman": boolean }`. Older / forward-compat
+* shapes also tried so a server-side rename doesn't silently break
+* the client. Returns `undefined` only when no recognizable field
+* is present — caller treats that as "trust the local verdict".
+*/
+function extractIsHumanFromResponse(data) {
+	if (typeof data === "boolean") return data;
+	if (data && typeof data === "object") {
+		const obj = data;
+		const candidates = [
+			obj.isHuman,
+			obj.human,
+			obj.passed,
+			obj.data?.isHuman,
+			obj.data?.human,
+			obj.result?.isHuman
+		];
+		for (const candidate of candidates) if (typeof candidate === "boolean") return candidate;
+	}
+}
+/**
+* Mints the personhood `Authorization: Bearer` token via the OAuth2
+* client-credentials grant against {@link endpoints.personhoodOAuthToken}
+* (`POST /omni/oauth2/token`, `application/x-www-form-urlencoded`,
+* `grant_type=client_credentials&scope=openid`). Returns the
+* `access_token` (a signed JWT); the caller (state machine `fetchToken`
+* actor) lands it in actor context where downstream services receive it
+* as an explicit input. No module-level slot — concurrent personhood
+* instances stay isolated, and `actor.stop()` cleans up implicitly.
+*
+* Mock path returns a `mock-token-*` string after a short delay so
+* `mockVerify=true` flows complete without a configured backend.
+*
+* Replaces the removed `GET /omni/personhood/token` (ENG-45783).
+*/
+async function fetchPersonhoodAuthToken(params = {}) {
+	if (params.mockVerify) {
+		await sleep(50);
+		return `mock-token-${randomUUID()}`;
+	}
+	const form = {
+		grant_type: "client_credentials",
+		scope: "openid"
+	};
+	if (params.clientId) form.client_id = params.clientId;
+	if (params.clientSecret) form.client_secret = params.clientSecret;
+	const body = new URLSearchParams(form).toString();
+	const authPath = params.authBaseUrl ? endpoints.personhoodOAuthTokenDirect : endpoints.personhoodOAuthToken;
+	const reqConfig = {
+		signal: params.signal,
+		headers: { "Content-Type": "application/x-www-form-urlencoded" }
+	};
+	try {
+		let res;
+		if (params.authBaseUrl) res = await createApi_default({
+			apiURL: params.authBaseUrl,
+			customHeaders: getStoredHttpConfig()?.customHeaders
+		}).post(authPath, body, reqConfig);
+		else res = await api.post(authPath, body, reqConfig);
+		if (!res.ok) throw new Error(`POST ${authPath} failed: ${res.status} ${res.statusText}`);
+		const token = extractTokenFromResponse(res.data);
+		if (!token) throw new Error(`POST ${authPath} returned no access_token`);
+		return token;
+	} catch (error) {
+		if (isApiNotConfigured(error)) return fetchPersonhoodAuthToken({
+			...params,
+			mockVerify: true
+		});
+		throw error;
+	}
+}
+/**
+* Builds the full per-check breakdown that lands on
+* {@link PersonhoodVerdict.spoofCheckResults} and in the verify
+* POST body. One entry per check the SDK ran, with a stable id, a
+* `passed | failed | unknown` outcome, and (on failure) a short
+* tag the server can pattern-match on.
+*
+* This is the single source of truth for "what did the on-device
+* pipeline check?" — both {@link produceLocalVerdict} and the
+* verify POST consume it. Adding a new check here automatically
+* surfaces it to integrators and to the backend without touching
+* the state machine or the verify wire format.
+*
+* Conservative defaults: when a pipeline didn't run (no liveness
+* outcome / Deepsight not initialized), the dependent checks are
+* reported as `unknown`. This lets the server distinguish "we
+* tested and the user passed" from "we couldn't test", which is a
+* meaningful gradient for risk scoring.
+*/
+function buildSpoofCheckResults(params) {
+	const results = [];
+	const { signals, liveness, detectionOutcome } = params;
+	if (detectionOutcome === "success") results.push({
+		check: "faceDetection",
+		result: "passed"
+	});
+	else results.push({
+		check: "faceDetection",
+		result: "failed",
+		reason: `detection:${detectionOutcome}`
+	});
+	if (liveness) {
+		if (liveness.analysisStatus === "PASS") results.push({
+			check: "physicalAttack",
+			result: "passed"
+		});
+		else if (hasExplicitSpoofSignal(liveness.analysisStatus)) results.push({
+			check: "physicalAttack",
+			result: "failed",
+			reason: liveness.analysisStatus || "spoof_suspected"
+		});
+		else results.push({
+			check: "physicalAttack",
+			result: "unknown"
+		});
+		results.push({
+			check: "virtualCamera",
+			result: liveness.virtualCamera ? "failed" : "passed",
+			...liveness.virtualCamera ? { reason: "virtual_camera" } : {}
+		});
+		if (liveness.motionStatus === "PASS") results.push({
+			check: "motionLiveness",
+			result: "passed"
+		});
+		else if (liveness.motionStatus === "FAIL") results.push({
+			check: "motionLiveness",
+			result: "failed",
+			reason: "no_motion"
+		});
+		else results.push({
+			check: "motionLiveness",
+			result: "unknown"
+		});
+		if (liveness.yawRange + liveness.pitchRange >= MIN_POSE_MOTION_DEG) results.push({
+			check: "headMotion",
+			result: "passed"
+		});
+		else results.push({
+			check: "headMotion",
+			result: "failed",
+			reason: "no_motion"
+		});
+	} else {
+		results.push({
+			check: "physicalAttack",
+			result: "unknown"
+		});
+		results.push({
+			check: "virtualCamera",
+			result: "unknown"
+		});
+		results.push({
+			check: "motionLiveness",
+			result: "unknown"
+		});
+		results.push({
+			check: "headMotion",
+			result: "unknown"
+		});
+	}
+	results.push({
+		check: "webdriver",
+		result: signals.webdriver ? "failed" : "passed",
+		...signals.webdriver ? { reason: "webdriver" } : {}
+	});
+	results.push({
+		check: "emulator",
+		result: signals.emulator ? "failed" : "passed",
+		...signals.emulator ? { reason: "emulator" } : {}
+	});
+	const independentHeadlessHints = signals.headlessHints.filter((hint) => hint !== "navigator.webdriver" && hint !== "automation-marker");
+	results.push({
+		check: "headlessBrowser",
+		result: independentHeadlessHints.length > 0 ? "failed" : "passed",
+		...independentHeadlessHints.length > 0 ? { reason: independentHeadlessHints.join(",") } : {}
+	});
+	return results;
+}
+/**
+* Trims the rich client-side {@link SpoofCheckResult} array down to the wire
+* shape the verify POST expects: `check` + `result` only (the `reason` field is
+* dropped — not part of the contract). Entry order is preserved so the server
+* sees them in detection-pipeline order (face → physical → virtual → motion →
+* head → automation). `unknown` results are passed through as-is —
+* `SpoofCheckResultWire.result` is `'passed' | 'failed' | 'unknown'`. (Whether
+* the backend should instead receive only `passed | failed` is an open
+* server-contract question, tracked with the wider verify-contract work.)
+*/
+function toWireSpoofCheckResults(results) {
+	const wire = [];
+	for (const entry of results) wire.push({
+		check: entry.check,
+		result: entry.result
+	});
+	return wire;
+}
+/**
+* On-device verify hop — POST `/omni/personhood/verify` with the
+* Deepsight metadata + derived `spoofCheckResults`. The personhood
+* Bearer token (passed in via `params.token`, minted by the OAuth2
+* client-credentials hop and threaded through actor context) is
+* attached as `Authorization: Bearer <token>`.
+*
+* When the server returns a recognizable `isHuman` boolean, that
+* value becomes the authoritative pass/fail on the returned
+* verdict. Otherwise (HTTP error, missing field, network blip,
+* SDK not configured) we fall back to the local on-device verdict
+* the caller passed in — keeping the widget functional in flaky
+* conditions. `mockVerify: true` short-circuits to the fallback
+* verdict without hitting the network.
+*/
+async function verifyPersonhoodOnDevice(params) {
+	if (params.mockVerify) {
+		await sleep(50);
+		return params.fallbackVerdict;
+	}
+	try {
+		const personhoodToken = params.token;
+		const res = await api.post(endpoints.personhoodOnDeviceVerify, {
+			metadata: params.metadata,
+			spoofCheckResults: toWireSpoofCheckResults(params.spoofCheckResults)
+		}, {
+			signal: params.signal,
+			...personhoodToken ? { headers: { Authorization: `Bearer ${personhoodToken}` } } : {}
+		});
+		if (!res.ok) throw new Error(`POST ${endpoints.personhoodOnDeviceVerify} failed: ${res.status} ${res.statusText}`);
+		const serverData = res.data;
+		const serverIsHuman = extractIsHumanFromResponse(serverData);
+		if (typeof serverIsHuman !== "boolean") return params.fallbackVerdict;
+		const finalReason = serverIsHuman ? void 0 : params.fallbackVerdict.reason ?? "server_rejected";
+		return {
+			...params.fallbackVerdict,
+			human: serverIsHuman,
+			confidence: serverIsHuman ? .95 : .05,
+			reason: finalReason
+		};
+	} catch {
+		return params.fallbackVerdict;
+	}
+}
+function isApiNotConfigured(error) {
+	return error instanceof Error && error.message.includes("SDK not configured");
+}
+function generateEvidenceId(siteKey) {
+	return `ph_${(siteKey || "site").replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 12)}_${randomUUID().replace(/-/g, "")}`;
+}
+
+//#endregion
+//#region src/modules/personhood/personhoodSignals.ts
+/**
+* Returns a placeholder {@link DeviceBehavioralSignals} for the
+* narrow set of code paths that need to operate before the real
+* `collectDeviceBehavioralSignals()` has resolved (or where it
+* errored out and the parallel `signals` branch landed in `done`
+* with `context.signals` still undefined). Single source of truth
+* — every call site that previously inlined this literal now
+* imports from here.
+*/
+function emptySignals() {
+	return {
+		deviceFingerprint: "",
+		userAgentClass: "unknown",
+		emulator: false,
+		webdriver: false,
+		headlessHints: []
+	};
+}
+/**
+* Collects the device + behavioural bundle returned alongside the human
+* verdict. Intentionally offline-only (no IP geolookup) so a Personhood check
+* does not pay the latency of an external call in the hot path.
+*
+* The bundle is **opaque to the SDK** — the integrator uses these signals for
+* their own dedup/risk logic. Personhood itself does NOT re-identify the human.
+*
+* `deviceFingerprint` is gated by `setup({ fingerprint })` (default enabled)
+* — mirrors how `deepsightLoader` resolves `disableFingerprint` from the same
+* flag. When disabled, the Thumbmark call is skipped and `deviceFingerprint`
+* is `''`.
+*/
+async function collectDeviceBehavioralSignals() {
+	const browserEnv = new BrowserEnvironmentProvider();
+	const [deviceFingerprint, deviceInfo] = await Promise.all([getFingerprintEnabled() ? safeGetFingerprint() : Promise.resolve(""), safeGetDeviceInfo()]);
+	const webdriver = Boolean(browserEnv.getNavigatorProperty("webdriver"));
+	const emulator = isBrowserSimulation(browserEnv);
+	const headlessHints = [];
+	if (webdriver) headlessHints.push("navigator.webdriver");
+	if (emulator) headlessHints.push("automation-marker");
+	const plugins = browserEnv.getNavigatorProperty("plugins");
+	const userAgent = browserEnv.getNavigatorProperty("userAgent")?.toLowerCase();
+	if (plugins && typeof plugins.length === "number" && plugins.length === 0 && userAgent?.includes("headless")) headlessHints.push("headless-user-agent");
+	return {
+		deviceFingerprint,
+		userAgentClass: formatUserAgentClass(deviceInfo),
+		emulator,
+		webdriver,
+		headlessHints
+	};
+}
+function formatUserAgentClass(info) {
+	if (!info) return "unknown";
+	const parts = [
+		info.browser?.name,
+		info.browser?.version,
+		info.os?.name,
+		info.os?.version,
+		info.device?.model
+	].filter((part) => typeof part === "string" && part.length > 0);
+	return parts.length > 0 ? parts.join(" / ") : "unknown";
+}
+async function safeGetFingerprint() {
+	try {
+		return await getThumbmarkId();
+	} catch {
+		return "";
+	}
+}
+async function safeGetDeviceInfo() {
+	try {
+		return await getDeviceFingerprintInfo();
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region src/modules/personhood/types.ts
+const PERSONHOOD_ERROR_CODES = {
+	CAMERA_DENIED: "CAMERA_DENIED",
+	DETECTION_FAILED: "DETECTION_FAILED",
+	AUTH_TOKEN_FAILED: "AUTH_TOKEN_FAILED",
+	VERIFY_FAILED: "VERIFY_FAILED",
+	INJECTION_SUSPECTED: "INJECTION_SUSPECTED",
+	EMULATOR_DETECTED: "EMULATOR_DETECTED",
+	TIMEOUT: "TIMEOUT",
+	UNKNOWN: "UNKNOWN"
+};
+
+//#endregion
+//#region src/modules/personhood/personhoodStateMachine.ts
+const _personhoodMachine = setup({
+	types: {
+		context: {},
+		events: {},
+		input: {}
+	},
+	actors: {
+		checkPermission: fromPromise(async () => {
+			return checkPermission();
+		}),
+		requestPermission: fromPromise(async () => {
+			return requestPermission({ requestMotion: false });
+		}),
+		initializeCamera: fromPromise(async ({ input }) => {
+			return initializePersonhoodCamera({ deepsightService: input.deepsightService });
+		}),
+		initializeDeepsight: fromPromise(async ({ input }) => {
+			return initializePersonhoodDeepsight({ storage: input.dependencies.storage });
+		}),
+		collectSignals: fromPromise(async () => {
+			return collectDeviceBehavioralSignals();
+		}),
+		analyzeLiveness: fromPromise(async ({ input }) => {
+			return analyzeLiveness(input);
+		}),
+		runDetection: fromCallback(({ input, sendBack }) => {
+			let yawMin = Infinity;
+			let yawMax = -Infinity;
+			let pitchMin = Infinity;
+			let pitchMax = -Infinity;
+			const { cleanup, reset } = runPersonhoodDetection({
+				provider: input.provider,
+				capturer: input.frameCapturer,
+				autoComplete: input.autoComplete,
+				onStatus: (status) => sendBack({
+					type: "DETECTION_UPDATE",
+					status
+				}),
+				onPose: (pose) => {
+					if (pose.yaw < yawMin) yawMin = pose.yaw;
+					if (pose.yaw > yawMax) yawMax = pose.yaw;
+					if (pose.pitch < pitchMin) pitchMin = pose.pitch;
+					if (pose.pitch > pitchMax) pitchMax = pose.pitch;
+				},
+				onSuccess: (canvas) => {
+					sendBack({
+						type: "DETECTION_SUCCESS",
+						canvas,
+						yawRange: yawMax > yawMin ? yawMax - yawMin : 0,
+						pitchRange: pitchMax > pitchMin ? pitchMax - pitchMin : 0
+					});
+				}
+			});
+			sendBack({
+				type: "DETECTION_RESET_READY",
+				reset
+			});
+			return cleanup;
+		}),
+		produceLocalVerdict: fromPromise(async ({ input }) => {
+			return produceLocalVerdict({
+				siteKey: input.config.siteKey,
+				threshold: input.config.threshold,
+				signals: input.signals,
+				detectionOutcome: input.detectionStatus,
+				liveness: input.liveness
+			});
+		}),
+		requestServerFallback: fromPromise(async ({ input, signal }) => {
+			return requestServerFallbackVerdict({
+				siteKey: input.config.siteKey,
+				signals: input.signals,
+				reason: input.reason,
+				mockFallback: input.config.mockVerify,
+				signal
+			});
+		}),
+		fetchToken: fromPromise(async ({ input, signal }) => {
+			return fetchPersonhoodAuthToken({
+				clientId: input.config.clientId,
+				clientSecret: input.config.clientSecret,
+				authBaseUrl: input.config.authBaseUrl,
+				mockVerify: input.config.mockVerify,
+				signal
+			});
+		}),
+		verifyOnDevice: fromPromise(async ({ input, signal }) => {
+			return verifyPersonhoodOnDevice({
+				metadata: input.liveness?.metadata ?? "",
+				spoofCheckResults: input.localVerdict.spoofCheckResults,
+				fallbackVerdict: input.localVerdict,
+				mockVerify: input.config.mockVerify,
+				token: input.token,
+				signal
+			});
+		})
+	},
+	actions: {
+		setStreamAndProvider: assign(({ event }) => {
+			const output = event.output;
+			return {
+				stream: output.stream,
+				provider: output.provider,
+				frameCapturer: new StreamCanvasCapture(output.stream)
+			};
+		}),
+		setDetectionStatus: assign({ detectionStatus: ({ event }) => event.status }),
+		setCapturedImageAndRangeFromEvent: assign(({ event }) => {
+			const e = event;
+			return {
+				capturedImage: e.canvas,
+				yawRange: e.yawRange,
+				pitchRange: e.pitchRange
+			};
+		}),
+		setDeepsightServiceFromEvent: assign({ deepsightService: ({ event }) => event.output }),
+		setLivenessOutcomeFromEvent: assign({ livenessOutcome: ({ event }) => event.output }),
+		setResetDetection: assign({ resetDetection: ({ event }) => event.reset }),
+		setSignalsFromEvent: assign({ signals: ({ event }) => event.output }),
+		setTokenFromEvent: assign({ token: ({ event }) => event.output }),
+		setLocalVerdictFromEvent: assign({ localVerdict: ({ event }) => event.output }),
+		setVerdictFromEvent: assign({ verdict: ({ event }) => event.output }),
+		setPermissionResultFromEvent: assign({ permissionResult: ({ event }) => event.output }),
+		setPermissionDenied: assign({
+			permissionResult: () => "denied",
+			error: () => ({ code: PERSONHOOD_ERROR_CODES.CAMERA_DENIED })
+		}),
+		setDetectionError: assign({ error: () => ({ code: PERSONHOOD_ERROR_CODES.DETECTION_FAILED }) }),
+		setFallbackReasonNoCamera: assign({ fallbackReason: () => "no_camera" }),
+		setTokenError: assign({ error: ({ event }) => ({
+			code: PERSONHOOD_ERROR_CODES.AUTH_TOKEN_FAILED,
+			message: String(event.error ?? "auth token fetch failed")
+		}) }),
+		setVerifyError: assign({ error: ({ event }) => ({
+			code: PERSONHOOD_ERROR_CODES.VERIFY_FAILED,
+			message: String(event.error ?? "verify failed")
+		}) }),
+		setLocalVerdictError: assign({ error: ({ event }) => ({
+			code: PERSONHOOD_ERROR_CODES.UNKNOWN,
+			message: String(event.error ?? "local verdict synthesis failed")
+		}) }),
+		setVerdictToLocal: assign({ verdict: ({ context }) => context.localVerdict }),
+		stopMediaStream: assign(({ context }) => {
+			context.frameCapturer?.dispose();
+			if (context.stream) stopStream(context.stream);
+			context.provider?.dispose();
+			context.deepsightService?.cleanup();
+			return {
+				stream: void 0,
+				provider: void 0,
+				frameCapturer: void 0
+			};
+		}),
+		resetContext: assign({
+			permissionResult: () => void 0,
+			stream: () => void 0,
+			provider: () => void 0,
+			frameCapturer: () => void 0,
+			deepsightService: () => void 0,
+			detectionStatus: () => "idle",
+			yawRange: () => 0,
+			pitchRange: () => 0,
+			capturedImage: () => void 0,
+			livenessOutcome: () => void 0,
+			signals: () => void 0,
+			fallbackReason: () => void 0,
+			token: () => void 0,
+			localVerdict: () => void 0,
+			verdict: () => void 0,
+			error: () => void 0,
+			resetDetection: () => void 0
+		}),
+		emitSignal: ({ context, event }) => {
+			const listener = context.config.onSignal;
+			if (!listener) return;
+			if (event.type === "DETECTION_UPDATE") listener({
+				type: "detection",
+				payload: event.status
+			});
+		}
+	},
+	guards: {
+		hasShowTutorial: ({ context }) => context.config.showTutorial === true,
+		isPermissionGranted: ({ event }) => {
+			if ("output" in event) return event.output === "granted";
+			return false;
+		},
+		isPermissionDenied: ({ event }) => {
+			if ("output" in event) return event.output === "denied";
+			return false;
+		},
+		hasTokenError: ({ context }) => context.error?.code === PERSONHOOD_ERROR_CODES.AUTH_TOKEN_FAILED,
+		isDetectionError: ({ event }) => event.status === "error"
+	}
+}).createMachine({
+	id: "personhood",
+	initial: "idle",
+	context: ({ input }) => ({
+		config: input.config,
+		dependencies: input.dependencies,
+		permissionResult: void 0,
+		fallbackReason: void 0,
+		stream: void 0,
+		provider: void 0,
+		frameCapturer: void 0,
+		deepsightService: void 0,
+		detectionStatus: "idle",
+		yawRange: 0,
+		pitchRange: 0,
+		capturedImage: void 0,
+		livenessOutcome: void 0,
+		signals: void 0,
+		token: void 0,
+		localVerdict: void 0,
+		verdict: void 0,
+		error: void 0,
+		resetDetection: void 0
+	}),
+	on: { QUIT: { target: "#personhood.closed" } },
+	states: {
+		idle: { on: { LOAD: [{
+			target: "tutorial",
+			guard: "hasShowTutorial"
+		}, { target: "collectingSignals" }] } },
+		tutorial: { on: { NEXT_STEP: { target: "collectingSignals" } } },
+		collectingSignals: {
+			type: "parallel",
+			states: {
+				signals: {
+					initial: "running",
+					states: {
+						running: { invoke: {
+							id: "collectSignals",
+							src: "collectSignals",
+							onDone: {
+								target: "done",
+								actions: "setSignalsFromEvent"
+							},
+							onError: { target: "done" }
+						} },
+						done: { type: "final" }
+					}
+				},
+				deepsight: {
+					initial: "running",
+					states: {
+						running: { invoke: {
+							id: "initializeDeepsight",
+							src: "initializeDeepsight",
+							input: ({ context }) => ({ dependencies: context.dependencies }),
+							onDone: {
+								target: "done",
+								actions: "setDeepsightServiceFromEvent"
+							},
+							onError: { target: "done" }
+						} },
+						done: { type: "final" }
+					}
+				},
+				token: {
+					initial: "running",
+					states: {
+						running: { invoke: {
+							id: "fetchToken",
+							src: "fetchToken",
+							input: ({ context }) => ({ config: context.config }),
+							onDone: {
+								target: "done",
+								actions: "setTokenFromEvent"
+							},
+							onError: {
+								target: "done",
+								actions: "setTokenError"
+							}
+						} },
+						done: { type: "final" }
+					}
+				}
+			},
+			onDone: [{
+				target: "error",
+				guard: "hasTokenError"
+			}, { target: "checkingPermission" }]
+		},
+		checkingPermission: { invoke: {
+			id: "checkPermission",
+			src: "checkPermission",
+			onDone: [
+				{
+					target: "capture",
+					guard: "isPermissionGranted",
+					actions: "setPermissionResultFromEvent"
+				},
+				{
+					target: "permissions.denied",
+					guard: "isPermissionDenied",
+					actions: "setPermissionResultFromEvent"
+				},
+				{
+					target: "permissions",
+					actions: "setPermissionResultFromEvent"
+				}
+			]
+		} },
+		permissions: {
+			initial: "idle",
+			states: {
+				idle: { on: {
+					REQUEST_PERMISSION: "requesting",
+					GO_TO_LEARN_MORE: "learnMore"
+				} },
+				learnMore: { on: {
+					BACK: "idle",
+					REQUEST_PERMISSION: "requesting"
+				} },
+				requesting: { invoke: {
+					id: "requestPermission",
+					src: "requestPermission",
+					onDone: [
+						{
+							target: "#personhood.capture",
+							guard: "isPermissionGranted",
+							actions: "setPermissionResultFromEvent"
+						},
+						{
+							target: "denied",
+							guard: "isPermissionDenied",
+							actions: "setPermissionResultFromEvent"
+						},
+						{
+							target: "idle",
+							actions: "setPermissionResultFromEvent"
+						}
+					],
+					onError: {
+						target: "denied",
+						actions: "setPermissionDenied"
+					}
+				} },
+				denied: {
+					entry: "setPermissionDenied",
+					on: { USE_FALLBACK: { target: "#personhood.serverFallback" } }
+				}
+			},
+			on: { USE_FALLBACK: { target: "#personhood.serverFallback" } }
+		},
+		capture: {
+			initial: "initializing",
+			states: {
+				initializing: { invoke: {
+					id: "initializeCamera",
+					src: "initializeCamera",
+					input: ({ context }) => ({ deepsightService: context.deepsightService }),
+					onDone: {
+						target: "detecting",
+						actions: "setStreamAndProvider"
+					},
+					onError: {
+						target: "#personhood.serverFallback",
+						actions: "setFallbackReasonNoCamera"
+					}
+				} },
+				detecting: {
+					invoke: {
+						id: "runDetection",
+						src: "runDetection",
+						input: ({ context }) => ({
+							provider: context.provider,
+							frameCapturer: context.frameCapturer,
+							autoComplete: context.config.autoComplete
+						}),
+						onError: {
+							target: "#personhood.error",
+							actions: "setDetectionError"
+						}
+					},
+					on: {
+						DETECTION_UPDATE: [{
+							guard: "isDetectionError",
+							target: "#personhood.error",
+							actions: [
+								"setDetectionStatus",
+								"setDetectionError",
+								"emitSignal"
+							]
+						}, { actions: ["setDetectionStatus", "emitSignal"] }],
+						DETECTION_RESET_READY: { actions: "setResetDetection" },
+						DETECTION_SUCCESS: {
+							target: "#personhood.analyzing",
+							actions: "setCapturedImageAndRangeFromEvent"
+						}
+					}
+				}
+			}
+		},
+		analyzing: {
+			exit: "stopMediaStream",
+			invoke: {
+				id: "analyzeLiveness",
+				src: "analyzeLiveness",
+				input: ({ context }) => ({
+					deepsightService: context.deepsightService,
+					stream: context.stream,
+					capturedImage: context.capturedImage,
+					yawRange: context.yawRange,
+					pitchRange: context.pitchRange,
+					token: context.token
+				}),
+				onDone: {
+					target: "processing",
+					actions: "setLivenessOutcomeFromEvent"
+				},
+				onError: { target: "processing" }
+			}
+		},
+		processing: { invoke: {
+			id: "produceLocalVerdict",
+			src: "produceLocalVerdict",
+			input: ({ context }) => ({
+				config: context.config,
+				signals: context.signals ?? emptySignals(),
+				detectionStatus: context.detectionStatus,
+				liveness: context.livenessOutcome
+			}),
+			onDone: {
+				target: "verifyingOnServer",
+				actions: "setLocalVerdictFromEvent"
+			},
+			onError: {
+				target: "error",
+				actions: "setLocalVerdictError"
+			}
+		} },
+		verifyingOnServer: { invoke: {
+			id: "verifyOnDevice",
+			src: "verifyOnDevice",
+			input: ({ context }) => ({
+				config: context.config,
+				liveness: context.livenessOutcome,
+				localVerdict: context.localVerdict,
+				token: context.token
+			}),
+			onDone: {
+				target: "finished",
+				actions: "setVerdictFromEvent"
+			},
+			onError: {
+				target: "finished",
+				actions: "setVerdictToLocal"
+			}
+		} },
+		serverFallback: { invoke: {
+			id: "requestServerFallback",
+			src: "requestServerFallback",
+			input: ({ context }) => ({
+				config: context.config,
+				signals: context.signals ?? emptySignals(),
+				reason: context.fallbackReason ?? "permission_denied"
+			}),
+			onDone: {
+				target: "finished",
+				actions: "setVerdictFromEvent"
+			},
+			onError: {
+				target: "error",
+				actions: "setVerifyError"
+			}
+		} },
+		finished: { type: "final" },
+		closed: {
+			entry: "stopMediaStream",
+			type: "final"
+		},
+		error: {
+			entry: "stopMediaStream",
+			on: { RESET: {
+				target: "idle",
+				actions: "resetContext"
+			} }
+		}
+	}
+});
+/**
+* Public machine value. Typed as `AnyStateMachine` for declaration file
+* portability — mirrors the convention used by `selfieMachine` and the
+* other Core modules. Type safety is enforced by the `setup()` config
+* above, not by the exported binding.
+*/
+const personhoodMachine = _personhoodMachine;
+
+//#endregion
+//#region src/modules/personhood/personhoodActor.ts
+/**
+* Production-default {@link PersonhoodDependencies}. Browser storage +
+* the singleton WASM util. Single source of truth for what the actor
+* and the manager wire up when the caller doesn't provide their own;
+* tests and the extensibility layer pass `dependencies` explicitly.
+*/
+function getDefaultPersonhoodDependencies() {
+	return {
+		storage: new BrowserStorageProvider(),
+		getWasmUtil: () => WasmUtilProvider.getInstance()
+	};
+}
+/**
+* Creates and starts a Personhood XState actor. Defaults to the production
+* browser storage + WASM providers; passing `dependencies` lets tests and the
+* extensibility layer swap them for fakes.
+*/
+function createPersonhoodActor(options) {
+	const dependencies = options.dependencies ?? getDefaultPersonhoodDependencies();
+	return createActor(personhoodMachine, { input: {
+		config: options.config,
+		dependencies
+	} }).start();
+}
+
+//#endregion
+//#region src/modules/personhood/personhoodManager.ts
+/**
+* Personhood deliberately opts out of the SDK's manager-instrumentation
+* analytics pipeline. The widget runs as a self-contained modal/inline
+* captcha replacement, not as part of the broader onboarding funnel —
+* it doesn't share an onboarding session token (`/omni/start`) with
+* the rest of an integrator's flow, so the per-transition events the
+* default instrumentation would emit can't authenticate against
+* `/omni/interview-events`. Wiring them up only produced a cascade of
+* 403s in integrators' devtools (one preflight + one POST per
+* `screenOpened` / `elementClicked` / `captureAttemptFinished` /
+* `errorTriggered` transition), with no usable analytics signal on
+* the receiving end.
+*
+* `createManager()` requires the `instrumentation` option to be
+* present, so we pass a no-op that satisfies the contract without
+* firing any of the helpers. If a future use case calls for
+* personhood analytics (integrator opt-in, internal QA dashboard,
+* etc.) the right move is to re-enable `createManagerInstrumentation`
+* here gated on a config flag — not to remove this no-op.
+*/
+function createNoopInstrumentation() {
+	return {
+		moduleName: eventModuleNames.personhood,
+		onModuleOpened: () => void 0,
+		onModuleClosed: () => void 0,
+		getScreenName: () => void 0,
+		onScreenOpened: () => void 0,
+		onScreenClosed: () => void 0,
+		getErrorName: () => void 0,
+		getErrorPayload: () => void 0,
+		onErrorTriggered: () => void 0,
+		onElementClicked: () => void 0,
+		onCaptureAttemptFinished: () => void 0
+	};
+}
+function getPermissionSubState(snapshot) {
+	if (snapshot.matches({ permissions: "learnMore" })) return "learnMore";
+	if (snapshot.matches({ permissions: "requesting" })) return "requesting";
+	if (snapshot.matches({ permissions: "denied" })) return "denied";
+	return "idle";
+}
+function mapState(snapshot) {
+	const context = snapshot.context;
+	if (snapshot.matches("idle")) return { status: "idle" };
+	if (snapshot.matches("tutorial")) return { status: "tutorial" };
+	if (snapshot.matches("collectingSignals")) return {
+		status: "loading",
+		phase: "collectingSignals"
+	};
+	if (snapshot.matches("checkingPermission")) return {
+		status: "loading",
+		phase: "checkingPermission"
+	};
+	if (snapshot.matches("permissions")) return {
+		status: "permissions",
+		permissionStatus: getPermissionSubState(snapshot)
+	};
+	if (snapshot.matches({ capture: "initializing" })) return {
+		status: "capture",
+		captureStatus: "initializing",
+		detectionStatus: context.detectionStatus,
+		stream: context.stream
+	};
+	if (snapshot.matches("capture")) return {
+		status: "capture",
+		captureStatus: "detecting",
+		detectionStatus: context.detectionStatus,
+		stream: context.stream
+	};
+	if (snapshot.matches("analyzing")) return {
+		status: "processing",
+		source: "analyzing"
+	};
+	if (snapshot.matches("processing")) return {
+		status: "processing",
+		source: "local"
+	};
+	if (snapshot.matches("serverFallback")) return {
+		status: "processing",
+		source: "fallback"
+	};
+	if (snapshot.matches("verifyingOnServer")) return {
+		status: "processing",
+		source: "local"
+	};
+	if (snapshot.matches("finished")) return {
+		status: "finished",
+		verdict: context.verdict ?? {
+			human: false,
+			confidence: 0,
+			evidenceId: "missing",
+			signals: emptySignals(),
+			spoofCheckResults: []
+		}
+	};
+	if (snapshot.matches("closed")) return { status: "closed" };
+	if (snapshot.matches("error")) return {
+		status: "error",
+		error: context.error ?? { code: "UNKNOWN" }
+	};
+	return { status: "idle" };
+}
+function createApi({ actor, trackElementClicked }) {
+	return {
+		load() {
+			actor.send({ type: "LOAD" });
+		},
+		nextStep() {
+			trackElementClicked?.("nextStep");
+			actor.send({ type: "NEXT_STEP" });
+		},
+		requestPermission() {
+			trackElementClicked?.("requestPermission");
+			actor.send({ type: "REQUEST_PERMISSION" });
+		},
+		goToLearnMore() {
+			trackElementClicked?.("goToLearnMore");
+			actor.send({ type: "GO_TO_LEARN_MORE" });
+		},
+		back() {
+			trackElementClicked?.("back");
+			actor.send({ type: "BACK" });
+		},
+		close() {
+			trackElementClicked?.("close");
+			actor.send({ type: "QUIT" });
+		},
+		reset() {
+			actor.send({ type: "RESET" });
+		},
+		useFallback() {
+			trackElementClicked?.("useFallback");
+			actor.send({ type: "USE_FALLBACK" });
+		}
+	};
+}
+/**
+* Wraps a pre-built personhood actor in a manager. Internal helper
+* shared by {@link createPersonhoodManager} (drop-in widget path) and
+* {@link createPersonhoodManagerFromActor} (extensibility surface).
+* Centralizing the `createManager(...)` + instrumentation call avoids
+* two near-identical wrap blocks drifting apart.
+*/
+function wrapActor(actor) {
+	return createManager({
+		actor,
+		mapState,
+		createApi,
+		instrumentation: createNoopInstrumentation()
+	});
+}
+/**
+* Manager built from an externally-owned actor (extensibility path).
+*/
+function createPersonhoodManagerFromActor(actor) {
+	return wrapActor(actor);
+}
+/**
+* Creates a Personhood manager for the drop-in widget.
+*
+* The manager exposes:
+* - `state: PersonhoodState` via `getState()` / `subscribe()`
+* - Lifecycle controls: `load`, `nextStep`, `requestPermission`,
+*   `goToLearnMore`, `back`, `close`, `reset`, `useFallback`, `stop`
+*
+* Head-pose is intentionally **not** exposed as a stream. The SDK
+* extracts pose internally for the server-side `headMotion` spoof
+* check; UI consumers that need a frame-rate pose signal (avatar
+* mirroring, etc.) should run their own face-tracking pipeline
+* (e.g. MediaPipe FaceLandmarker) against `state.stream` instead.
+*
+* @example
+* ```ts
+* const manager = createPersonhoodManager({
+*   config: { siteKey: 'demo', mockVerify: true },
+* });
+* manager.subscribe((state) => {
+*   if (state.status === 'finished') {
+*     console.log('human?', state.verdict.human);
+*   }
+* });
+* manager.load();
+* ```
+*/
+function createPersonhoodManager(options) {
+	return wrapActor(createPersonhoodActor(options));
+}
+
+//#endregion
+export { PERSONHOOD_ERROR_CODES, createPersonhoodActor, createPersonhoodManager, createPersonhoodManagerFromActor, personhoodMachine };