@incodetech/core 2.1.1 → 2.2.0-rc.0

package/dist/trueSightService-6dTpiaTh.esm.js

@@ -0,0 +1,1894 @@
+import { a as setWebApiHttpTransport, i as initializeWasmWebClient, o as setupWasmConnection, r as executeWasmRequest, t as WasmWebClientError } from "./wasmWebClient-DM8lkb0z.esm.js";
+import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
+import { i as isApiConfigured, n as getApi, o as setClient, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
+import { S as subscribeEvent, n as eventModuleNames } from "./events-CxfNJVZW.esm.js";
+import { t as endpoints } from "./endpoints-CCzL3XD_.esm.js";
+//#region ../infra/src/http/createApi.ts
+var FetchHttpError = class extends Error {
+	constructor(status, statusText, url, method, headers, data) {
+		super(`HTTP ${status} ${statusText}`);
+		this.ok = false;
+		this.status = status;
+		this.statusText = statusText;
+		this.url = url;
+		this.method = method;
+		this.headers = headers;
+		this.data = data;
+		this.name = "FetchHttpError";
+	}
+};
+const buildQueryString$1 = (query) => {
+	if (!query) return "";
+	const params = new URLSearchParams();
+	Object.entries(query).forEach(([key, value]) => {
+		if (value !== void 0 && value !== null) params.append(key, String(value));
+	});
+	const str = params.toString();
+	return str ? `?${str}` : "";
+};
+const buildUrl$1 = (baseURL, url, query) => {
+	const queryString = buildQueryString$1(query);
+	if (url.startsWith("http://") || url.startsWith("https://")) return `${url}${queryString}`;
+	return `${baseURL.endsWith("/") ? baseURL.slice(0, -1) : baseURL}${url.startsWith("/") ? url : `/${url}`}${queryString}`;
+};
+const prepareBody$1 = (body) => {
+	if (body === null || body === void 0) return null;
+	if (body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer) return body;
+	if (typeof body === "object") return JSON.stringify(body);
+	return String(body);
+};
+const parseResponse = async (response, parseType) => {
+	if (parseType === "response") return response;
+	if (parseType === "blob") return await response.blob();
+	if (parseType === "arrayBuffer") return await response.arrayBuffer();
+	if (parseType === "text") return await response.text();
+	const contentType = response.headers.get("content-type") ?? "";
+	if (parseType === "json" || contentType.includes("application/json")) {
+		const raw = await response.text();
+		if (raw.length === 0) return "";
+		try {
+			return JSON.parse(raw);
+		} catch {
+			return raw;
+		}
+	}
+	return await response.text();
+};
+const requestWithXHR = (fullUrl, method, mergedHeaders, requestBody, timeout, signal, onUploadProgress) => {
+	return new Promise((resolve, reject) => {
+		const xhr = new XMLHttpRequest();
+		xhr.open(method, fullUrl, true);
+		Object.entries(mergedHeaders).forEach(([key, value]) => {
+			xhr.setRequestHeader(key, value);
+		});
+		xhr.timeout = timeout;
+		xhr.upload.onprogress = (event) => {
+			if (event.lengthComputable) {
+				const percentComplete = event.loaded / event.total * 100;
+				onUploadProgress(Math.round(percentComplete));
+			}
+		};
+		xhr.onload = () => {
+			const responseHeaders = {};
+			xhr.getAllResponseHeaders().split("\r\n").forEach((line) => {
+				const parts = line.split(": ");
+				if (parts.length === 2) responseHeaders[parts[0].toLowerCase()] = parts[1];
+			});
+			let data;
+			try {
+				if ((xhr.getResponseHeader("content-type") ?? "").includes("application/json")) data = JSON.parse(xhr.responseText);
+				else data = xhr.responseText;
+			} catch {
+				data = xhr.responseText;
+			}
+			if (xhr.status >= 200 && xhr.status < 300) resolve({
+				ok: true,
+				status: xhr.status,
+				statusText: xhr.statusText,
+				url: fullUrl,
+				headers: responseHeaders,
+				data
+			});
+			else reject(new FetchHttpError(xhr.status, xhr.statusText, fullUrl, method, responseHeaders, data));
+		};
+		xhr.onerror = () => {
+			reject(new FetchHttpError(0, "Network Error", fullUrl, method, {}, null));
+		};
+		xhr.ontimeout = () => {
+			reject(new FetchHttpError(0, "Request timeout", fullUrl, method, {}, null));
+		};
+		if (signal) signal.addEventListener("abort", () => {
+			xhr.abort();
+			reject(new FetchHttpError(0, "Request aborted", fullUrl, method, {}, null));
+		});
+		xhr.send(requestBody);
+	});
+};
+const createApi = (config) => {
+	const headers = {
+		"Content-Type": "application/json",
+		Accept: "application/json",
+		"api-version": "1.0",
+		...config.customHeaders ?? {}
+	};
+	const defaults = {
+		baseURL: config.apiURL,
+		headers
+	};
+	const client = {
+		defaults,
+		async request(requestConfig) {
+			const { method = "GET", url, headers = {}, query, params, body, signal, timeout: timeoutOverride, parse, onUploadProgress, keepalive } = requestConfig;
+			const fullUrl = buildUrl$1(defaults.baseURL, url, params ?? query);
+			const mergedHeaders = {
+				...defaults.headers,
+				...headers
+			};
+			const requestBody = prepareBody$1(body);
+			const timeout = timeoutOverride ?? config.timeout;
+			let finalHeaders = mergedHeaders;
+			if (requestBody === null && (method === "POST" || method === "PUT" || method === "PATCH")) {
+				const { "Content-Type": _, ...headersWithoutContentType } = mergedHeaders;
+				finalHeaders = headersWithoutContentType;
+			}
+			if (onUploadProgress) {
+				if (requestBody !== null && typeof ReadableStream !== "undefined" && requestBody instanceof ReadableStream) throw new Error("Upload progress tracking is not supported for ReadableStream bodies");
+				return requestWithXHR(fullUrl, method, finalHeaders, requestBody, timeout ?? 0, signal, onUploadProgress);
+			}
+			const controller = new AbortController();
+			if (signal) if (signal.aborted) controller.abort();
+			else signal.addEventListener("abort", () => controller.abort(), { once: true });
+			const abortSignal = controller.signal;
+			const timeoutId = timeout === void 0 ? void 0 : setTimeout(() => controller.abort(), timeout);
+			try {
+				const response = await fetch(fullUrl, {
+					method,
+					headers: finalHeaders,
+					body: requestBody,
+					signal: abortSignal,
+					keepalive
+				});
+				if (timeoutId) clearTimeout(timeoutId);
+				const responseHeaders = {};
+				response.headers.forEach((value, key) => {
+					responseHeaders[key] = value;
+				});
+				const data = await parseResponse(response, parse);
+				if (!response.ok) throw new FetchHttpError(response.status, response.statusText, fullUrl, method, responseHeaders, data);
+				return {
+					ok: true,
+					status: response.status,
+					statusText: response.statusText,
+					url: fullUrl,
+					headers: responseHeaders,
+					data
+				};
+			} catch (error) {
+				if (timeoutId) clearTimeout(timeoutId);
+				if (error instanceof FetchHttpError) throw error;
+				if (error instanceof Error && error.name === "AbortError") throw new FetchHttpError(0, "Request timeout", fullUrl, method, {}, null);
+				throw error;
+			}
+		},
+		get(url, config) {
+			return client.request({
+				...config,
+				url,
+				method: "GET"
+			});
+		},
+		post(url, body, config) {
+			return client.request({
+				...config,
+				url,
+				body,
+				method: "POST"
+			});
+		},
+		put(url, body, config) {
+			return client.request({
+				...config,
+				url,
+				body,
+				method: "PUT"
+			});
+		},
+		patch(url, body, config) {
+			return client.request({
+				...config,
+				url,
+				body,
+				method: "PATCH"
+			});
+		},
+		delete(url, config) {
+			return client.request({
+				...config,
+				url,
+				method: "DELETE"
+			});
+		},
+		head(url, config) {
+			return client.request({
+				...config,
+				url,
+				method: "HEAD"
+			});
+		},
+		options(url, config) {
+			return client.request({
+				...config,
+				url,
+				method: "OPTIONS"
+			});
+		},
+		setHeader(name, value) {
+			defaults.headers[name] = value;
+		}
+	};
+	return client;
+};
+//#endregion
+//#region ../infra/src/http/createWasmApi.ts
+const WASM_TIMEOUT_CEILING_MS = 36e5;
+const RSA_OAEP_SHA256_SCHEME = "RSA/NONE/OAEPWITHSHA-256ANDMGF1PADDING";
+/**
+* Builds the base set of HTTP headers that the WASM WebClient sends on every
+* request (including the internal `/e2ee/key/v2` and `/e2ee/key` handshake
+* calls).
+*/
+function buildWasmDefaultHeaders(customHeaders) {
+	return {
+		"Content-Type": "application/json",
+		Accept: "application/json",
+		"api-version": "1.0",
+		...customHeaders ?? {}
+	};
+}
+var WasmHttpError = class extends Error {
+	constructor(status, statusText, url, method, headers, data) {
+		super(`HTTP ${status} ${statusText}`);
+		this.ok = false;
+		this.status = status;
+		this.statusText = statusText;
+		this.url = url;
+		this.method = method;
+		this.headers = headers;
+		this.data = data;
+		this.name = "WasmHttpError";
+	}
+};
+const HTTP_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+const buildQueryString = (query) => {
+	if (!query) return "";
+	const params = new URLSearchParams();
+	Object.entries(query).forEach(([key, value]) => {
+		if (value !== void 0 && value !== null) params.append(key, String(value));
+	});
+	const str = params.toString();
+	return str ? `?${str}` : "";
+};
+const buildUrl = (baseURL, url, query) => {
+	const queryString = buildQueryString(query);
+	if (url.startsWith("http://") || url.startsWith("https://")) return `${url}${queryString}`;
+	return `${baseURL.endsWith("/") ? baseURL.slice(0, -1) : baseURL}${url.startsWith("/") ? url : `/${url}`}${queryString}`;
+};
+const prepareBody = (body) => {
+	if (body === null || body === void 0) return void 0;
+	if (body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer || body instanceof Uint8Array || typeof body === "string") return body;
+	if (typeof body === "object") return body;
+	return String(body);
+};
+const normalizeMethod = (method) => {
+	const upper = method.toUpperCase();
+	if (!HTTP_METHODS.has(upper)) throw new Error(`Unsupported HTTP method for WASM client: ${method}`);
+	return upper;
+};
+const getErrorStatus = (error) => {
+	if (error instanceof WasmWebClientError) return error.statusCode;
+	if (typeof error === "object" && error !== null) {
+		const record = error;
+		if (typeof record.statusCode === "number") return record.statusCode;
+		if (typeof record.status === "number") return record.status;
+	}
+	return 0;
+};
+const getErrorData = (error) => {
+	if (error instanceof WasmWebClientError) return error.response?.data ?? null;
+	return null;
+};
+const getErrorMessage = (error) => {
+	if (error instanceof Error) return error.message;
+	return "WasmWebClient request failed";
+};
+const withAbortSignal = async (promise, signal, error) => {
+	if (!signal) return await promise;
+	if (signal.aborted) throw error;
+	return await new Promise((resolve, reject) => {
+		const onAbort = () => reject(error);
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then(resolve, reject).finally(() => {
+			signal.removeEventListener("abort", onAbort);
+		});
+	});
+};
+const createWasmApi = async (config) => {
+	const headers = buildWasmDefaultHeaders(config.customHeaders);
+	const isEncryptionEnabled = config.isEncryptionEnabled ?? (() => false);
+	const useSha256 = config.mgf1 === "sha256";
+	await initializeWasmWebClient(config.wasm.wasmPath, config.wasm.wasmSimdPath ?? config.wasm.wasmPath, config.wasm.glueCodePath, config.wasm.glueCodeSimdPath ?? "", config.wasm.useSimd ?? true);
+	await setupWasmConnection(config.apiURL, "", config.encryptionEnabled ?? false, headers, useSha256);
+	const defaults = {
+		baseURL: config.apiURL,
+		headers
+	};
+	const client = {
+		defaults,
+		async request(requestConfig) {
+			const { method = "GET", url, headers: requestHeaders = {}, query, params, body, signal, timeout: timeoutOverride, onUploadProgress, ie = false } = requestConfig;
+			const upperMethod = normalizeMethod(method);
+			const requestParams = params ?? query;
+			const fullUrl = buildUrl(defaults.baseURL, url, requestParams);
+			const needsSchemeHeader = ie || useSha256 && isEncryptionEnabled();
+			const mergedHeaders = {
+				...defaults.headers,
+				...needsSchemeHeader ? { "X-RSA-Encryption-Scheme": RSA_OAEP_SHA256_SCHEME } : {},
+				...requestHeaders
+			};
+			const requestBody = prepareBody(body);
+			const timeout = timeoutOverride ?? config.timeout ?? WASM_TIMEOUT_CEILING_MS;
+			const wasmProgress = onUploadProgress ? (progress) => {
+				if (progress.total > 0) onUploadProgress(Math.round(progress.loaded / progress.total * 100));
+			} : void 0;
+			const abortError = new WasmHttpError(0, "Request aborted", fullUrl, upperMethod, {}, null);
+			if (signal?.aborted) throw abortError;
+			try {
+				const response = await withAbortSignal(executeWasmRequest(upperMethod, url, requestBody, mergedHeaders, requestParams, timeout, wasmProgress, ie), signal, abortError);
+				if (response.status < 200 || response.status >= 300) throw new WasmHttpError(response.status, "", fullUrl, upperMethod, {}, response.data);
+				return {
+					ok: true,
+					status: response.status,
+					statusText: "",
+					url: fullUrl,
+					headers: {},
+					data: response.data
+				};
+			} catch (error) {
+				if (error instanceof WasmHttpError) throw error;
+				throw new WasmHttpError(getErrorStatus(error), getErrorMessage(error), fullUrl, upperMethod, {}, getErrorData(error));
+			}
+		},
+		get(url, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				method: "GET"
+			});
+		},
+		post(url, body, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				body,
+				method: "POST"
+			});
+		},
+		put(url, body, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				body,
+				method: "PUT"
+			});
+		},
+		patch(url, body, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				body,
+				method: "PATCH"
+			});
+		},
+		delete(url, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				method: "DELETE"
+			});
+		},
+		head() {
+			return Promise.reject(/* @__PURE__ */ new Error("HEAD is not supported by the WASM HTTP client"));
+		},
+		options() {
+			return Promise.reject(/* @__PURE__ */ new Error("OPTIONS is not supported by the WASM HTTP client"));
+		},
+		setHeader(name, value) {
+			defaults.headers[name] = value;
+		}
+	};
+	return client;
+};
+//#endregion
+//#region src/internal/http/clientLifecycle.ts
+/**
+* Wraps the active HttpClient as a transport for the C++ `WebApi` host
+* adapter. Lets the on-device face-results POST flow through the same
+* `httpClient.request()` pipeline as every other endpoint — header
+* injection, encryption-state handling, default headers, timeout — instead
+* of bypassing it via `executeWasmRequest` directly.
+*/
+function bindWebApiTransport(client) {
+	return async (url, body, config) => {
+		const response = await client.request({
+			method: "POST",
+			url,
+			body,
+			headers: config.headers,
+			params: config.params,
+			timeout: config.timeout,
+			ie: config.ie
+		});
+		return {
+			data: response.data,
+			status: response.status
+		};
+	};
+}
+function installClient(client) {
+	setClient(client);
+	setWebApiHttpTransport(bindWebApiTransport(client));
+}
+let storedHttpConfig;
+/** Reads the current HTTP-client config (or `undefined` if none installed). */
+function getStoredHttpConfig() {
+	return storedHttpConfig;
+}
+/** Whether encryption is currently active on the installed HTTP client. */
+function isHttpEncrypted() {
+	return storedHttpConfig?.encryption.enabled ?? false;
+}
+/** Clears all HTTP-client state. Called by `reset()`. */
+function resetHttpClientState() {
+	storedHttpConfig = void 0;
+	setWebApiHttpTransport(null);
+}
+/**
+* Builds (or replaces) the HTTP client when `setup()` receives an `apiURL`.
+* Picks `createWasmApi` when `effectiveWasm` is set, otherwise plain
+* `createApi`. Wraps the call in handshake-failure context when encryption
+* is requested.
+*/
+async function installFreshHttpClient(apiURL, options, effectiveWasm, encryption) {
+	installClient(effectiveWasm ? await withHandshakeFailureContext(encryption.enabled, () => createWasmApi({
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout,
+		wasm: effectiveWasm,
+		encryptionEnabled: encryption.enabled,
+		mgf1: encryption.mgf1,
+		isEncryptionEnabled: isHttpEncrypted
+	})) : createApi({
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout
+	}));
+	storedHttpConfig = {
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout,
+		isWasm: Boolean(effectiveWasm),
+		encryption
+	};
+}
+/**
+* Replaces the active HTTP client with the WASM-backed one. Used internally
+* by lazy-loading UI components (`<incode-flow>`, `<incode-workflow>`) when
+* WASM finishes warming up.
+*
+* No-op when no apiURL was previously configured, or when the active client
+* is already WASM-backed. The encryption state (enabled + MGF1 scheme) is
+* preserved across the swap — this is *not* a user-facing encryption change.
+*
+* @internal NOT a public API. Application code should use
+*   `setup({ wasm: {...} })` instead.
+*/
+async function upgradeToWasmHttpClient(resolved) {
+	const stored = storedHttpConfig;
+	if (!stored || stored.isWasm) return;
+	installClient(await createWasmApi({
+		apiURL: stored.apiURL,
+		customHeaders: stored.customHeaders,
+		timeout: stored.timeout,
+		wasm: resolved,
+		encryptionEnabled: stored.encryption.enabled,
+		mgf1: stored.encryption.mgf1,
+		isEncryptionEnabled: isHttpEncrypted
+	}));
+	storedHttpConfig = {
+		...stored,
+		isWasm: true
+	};
+}
+/**
+* When `wantsEncryption` is true, wraps a call that triggers the in-binary
+* RSA/AES handshake so its rejection surfaces as a single, descriptive error
+* with the original error preserved as `cause`. Pass-through otherwise.
+*/
+async function withHandshakeFailureContext(wantsEncryption, fn) {
+	if (!wantsEncryption) return fn();
+	try {
+		return await fn();
+	} catch (cause) {
+		const error = /* @__PURE__ */ new Error("Failed to establish encrypted transport. The /e2ee/key handshake did not complete. Verify the apiURL is reachable and that the environment supports E2EE.");
+		error.cause = cause;
+		throw error;
+	}
+}
+/** Dirty-timer half of the interrupted-snapshot rebuild debounce (module boundaries + timer). */
+const SNAPSHOT_DIRTY_INTERVAL_MS = 15e3;
+/** Hard cap per log message, UTF-8 bytes (contract). */
+const MESSAGE_MAX_BYTES = 8 * 1024;
+const TRUESIGHT_SDK_ID = "IncdOnboarding";
+/** localStorage key prefix for persisted sealed snapshots (A3: one slot per session). */
+const PENDING_STORAGE_KEY_PREFIX = "incode.truesight.pending.";
+//#endregion
+//#region src/internal/trueSight/sanitize.ts
+/**
+* Deny-by-default message scrubber — runs at INGESTION (inside the log buffer's
+* `append`), so the buffer, every persisted snapshot, and every upload are
+* already clean; there is no code path around it (ENG-48677 plan §1.2).
+*
+* Ordered pipeline. Two deliberate deviations from the plan's original rule
+* order, both from the P1-A adversarial review (2026-07-23, recorded in the
+* plan's Operating-decisions section):
+* - Inputs are pre-clamped to 2× the message cap BEFORE any regex runs — the
+*   unanchored patterns are quadratic on pathological non-matching runs
+*   (measured ~4.5 s on a 100 KB run), so regex cost must be bounded first.
+*   The final 8 KB cap still runs last.
+* - The base64-blob rule runs BEFORE the digit-run rule — a digit run inside a
+*   blob would otherwise split it into sub-64-char fragments that escape
+*   redaction.
+*
+* The regex table ships in the P1-A PR description for privacy sign-off (see
+* .agents/guides/privacy.md). Known hardening backlog (D4, Phase 4): formatted
+* phone numbers, unicode digits/emails, fuzz/property tests.
+*/
+/** Three dot-joined base64url segments — JWT/JWS shape. */
+const JWT_PATTERN = /\b[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g;
+/**
+* Credential-ish key with a `:`/`=` value (quoted, `Bearer …`, or bare token).
+* The key may carry prefixes (`access_token`, `x-api-key`, `sessionToken`) —
+* a plain \b boundary would miss `_token` since `_` is a word character.
+*/
+const CREDENTIAL_KV_PATTERN = /([\w-]*(?:token|api[-_]?key|authorization|auth|secret|password|passwd))\s*[:=]\s*("[^"]*"|'[^']*'|(?:Bearer\s+)?[^\s,;&]+)/gi;
+/** Userinfo credentials in an absolute URL (`https://user:pass@host/…`). */
+const URL_USERINFO_PATTERN = /(\bhttps?:\/\/)[^\s/@]*(?::[^\s/@]*)?@/gi;
+/** Query string / fragment of an absolute URL — kills signed URLs. */
+const URL_TAIL_PATTERN = /(https?:\/\/[^\s?#]+)[?#][^\s]*/g;
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+/** base64-ish blobs (media, keys) — 64+ chars of the base64/base64url alphabet. */
+const BASE64_BLOB_PATTERN = /[-A-Za-z0-9+/_]{64,}={0,2}/g;
+/** Runs of 8+ digits — phones, CURP, document numbers. */
+const DIGIT_RUN_PATTERN = /\d{8,}/g;
+const TRUNCATION_SUFFIX = "…[truncated]";
+/** Regex-cost bound: clamp raw input before any pattern runs (see header note). */
+const REGEX_INPUT_MAX_BYTES = MESSAGE_MAX_BYTES * 2;
+function sanitizeMessage(message) {
+	return truncateUtf8(truncateUtf8(message, REGEX_INPUT_MAX_BYTES).replace(JWT_PATTERN, "[jwt]").replace(CREDENTIAL_KV_PATTERN, "$1=[redacted]").replace(URL_USERINFO_PATTERN, "$1[redacted]@").replace(URL_TAIL_PATTERN, "$1").replace(EMAIL_PATTERN, "[email]").replace(BASE64_BLOB_PATTERN, (match) => `[blob:${match.length}]`).replace(DIGIT_RUN_PATTERN, "[digits]"), MESSAGE_MAX_BYTES);
+}
+/**
+* UTF-8 byte length without TextEncoder (banned browser global in L1 —
+* see the no-browser-api-in-core lint rule). Counts by code point.
+*/
+function utf8ByteLength(value) {
+	let bytes = 0;
+	for (const char of value) bytes += codePointByteLength(char);
+	return bytes;
+}
+function codePointByteLength(char) {
+	const codePoint = char.codePointAt(0) ?? 0;
+	if (codePoint < 128) return 1;
+	if (codePoint < 2048) return 2;
+	if (codePoint < 65536) return 3;
+	return 4;
+}
+/** Cuts on a code-point boundary so no surrogate half ever reaches the wire. */
+function truncateUtf8(value, maxBytes) {
+	if (utf8ByteLength(value) <= maxBytes) return value;
+	const budget = maxBytes - utf8ByteLength(TRUNCATION_SUFFIX);
+	let bytes = 0;
+	let result = "";
+	for (const char of value) {
+		const charBytes = codePointByteLength(char);
+		if (bytes + charBytes > budget) break;
+		bytes += charBytes;
+		result += char;
+	}
+	return result + TRUNCATION_SUFFIX;
+}
+const EVICTION_ORDER = [
+	"verbose",
+	"debug",
+	"info"
+];
+function createLogBuffer(options = {}) {
+	const flushThresholdBytes = options.flushThresholdBytes ?? 6e5;
+	const maxEntries = options.maxEntries ?? 5e3;
+	const { onOverflow } = options;
+	const entries = [];
+	let mode = onOverflow ? "flush" : "evict";
+	let nextIndex = 0;
+	let bytes = 0;
+	let dropped = 0;
+	let overflowPending = false;
+	function entryCost(entry) {
+		return utf8ByteLength(entry.message) + utf8ByteLength(entry.subsystem) + 120;
+	}
+	function removeAt(position) {
+		const [removed] = entries.splice(position, 1);
+		bytes -= entryCost(removed);
+		dropped += 1;
+	}
+	/** Lowest level first (oldest within it); warning+ only as the last resort. */
+	function evictOne() {
+		for (const level of EVICTION_ORDER) {
+			const position = entries.findIndex((entry) => entry.level === level);
+			if (position !== -1) {
+				removeAt(position);
+				return;
+			}
+		}
+		removeAt(0);
+	}
+	function copyOf(entry) {
+		return { ...entry };
+	}
+	return {
+		append(level, subsystem, category, message) {
+			const entry = {
+				index: nextIndex,
+				timestampMs: getTimestamp(),
+				level,
+				subsystem,
+				category,
+				message: sanitizeMessage(message)
+			};
+			nextIndex += 1;
+			entries.push(entry);
+			bytes += entryCost(entry);
+			if (mode === "flush" && onOverflow) {
+				if (!overflowPending && bytes >= flushThresholdBytes) {
+					overflowPending = true;
+					onOverflow(entries.map(copyOf));
+				}
+			} else while (bytes > flushThresholdBytes && entries.length > 1) evictOne();
+			while (entries.length > maxEntries) evictOne();
+		},
+		snapshot() {
+			return entries.map(copyOf);
+		},
+		sliceSince(index) {
+			return entries.filter((entry) => entry.index > index).map(copyOf);
+		},
+		markFlushed(uptoIndex) {
+			let removedBytes = 0;
+			let keepFrom = 0;
+			while (keepFrom < entries.length && entries[keepFrom].index <= uptoIndex) {
+				removedBytes += entryCost(entries[keepFrom]);
+				keepFrom += 1;
+			}
+			entries.splice(0, keepFrom);
+			bytes -= removedBytes;
+			overflowPending = false;
+		},
+		setOverflowMode(next) {
+			mode = next;
+		},
+		get droppedCount() {
+			return dropped;
+		},
+		get byteEstimate() {
+			return bytes;
+		}
+	};
+}
+//#endregion
+//#region ../infra/src/crypto/randomUUID.ts
+/**
+* Cryptographically-strong UUID v4 (RFC 4122).
+*
+* Lives in infra (L0) so Core (L1) can mint secure identifiers without touching
+* the `crypto` browser API directly — Core delegates here, keeping it free of
+* browser globals (enforced by the `no-browser-api-in-core` lint rule). Backed
+* by `crypto.randomUUID`, available in every browser the SDK targets.
+*/
+function randomUUID() {
+	return crypto.randomUUID();
+}
+//#endregion
+//#region ../infra/src/time/epochMsToIsoString.ts
+/**
+* Converts an epoch-milliseconds timestamp to a full ISO-8601 UTC string
+* (e.g. `2026-07-23T09:41:00.000Z`).
+*
+* Lives in Infra (L0) so Core can format wire timestamps without touching the
+* `Date` global directly — banned in Core by the `no-browser-api-in-core` lint
+* rule — mirroring the `crypto/randomUUID.ts` free-function precedent.
+* (`DateFormattingProvider.utcToIsoDateString` is date-only and not suitable.)
+*/
+function epochMsToIsoString(epochMs) {
+	return new Date(epochMs).toISOString();
+}
+//#endregion
+//#region src/internal/version/sdkVersion.ts
+const SDK_VERSION = "2.2.0-rc.0";
+//#endregion
+//#region src/internal/trueSight/recordBuilder.ts
+/**
+* Assembles the exact plaintext contract record — the ONLY place a diagnostics
+* payload is shaped. Pure: same function serves final records, interrupted
+* snapshots, and future incremental slices (ENG-48677 plan §1.1).
+*
+* Deny-by-default is structural here: every field is an explicit literal —
+* nothing is spread from internal state, so no unexpected field can ever leak
+* into an upload.
+*
+* Hard gates enforced:
+* - empty/missing `sessionId` or `startedAt` → returns `null` (upload skipped —
+*   expected for sessions that die before `/omni/start`).
+* - `failureReason` present if-and-only-if `outcome === 'failure'` (defaults to
+*   `'unknown'` when a failure arrives without one, rather than dropping the record).
+* - fresh record `id` per build; `endedAt` stamped at build time.
+*/
+function buildDiagnosticsRecord(meta, logs, outcome, failureReason, recordId) {
+	if (!meta.sessionId || meta.startedAtMs === null) return null;
+	const flowType = meta.flowType ?? deriveFlowTypeFromSurface(meta.integrationType);
+	if (flowType === null) return null;
+	return {
+		schemaVersion: "1.0",
+		id: recordId ?? randomUUID(),
+		session: {
+			sessionId: meta.sessionId,
+			sdkId: TRUESIGHT_SDK_ID,
+			sdkVersion: SDK_VERSION,
+			platform: "web",
+			sdkMode: null,
+			browser: meta.browser,
+			osVersion: meta.osVersion,
+			osLanguage: meta.osLanguage,
+			sdkLanguage: meta.sdkLanguage,
+			integrationType: meta.integrationType,
+			flowType,
+			flowId: meta.flowId,
+			workflowId: meta.workflowId,
+			outcome,
+			...outcome === "failure" ? { failureReason: failureReason ?? "unknown" } : {},
+			startedAt: epochMsToIsoString(meta.startedAtMs),
+			endedAt: epochMsToIsoString(getTimestamp()),
+			testing: meta.testing,
+			e2eEncryptionEnabled: meta.e2eEncryptionEnabled,
+			configurationId: meta.hasConfigurationId,
+			externalCustomerId: meta.hasExternalCustomerId,
+			hasProvidedSessionId: meta.hasProvidedSessionId,
+			token: meta.hasToken,
+			externalToken: meta.hasExternalToken
+		},
+		logs: logs.map(toContractEntry)
+	};
+}
+/**
+* Wire `flowType` when no orchestrator was OBSERVED (an observed one — set by
+* the bridge on any flow event — always wins). Stage ingest requires a
+* non-null enum (probe 2026-07-23: null/omitted/off-enum all 400), so the
+* entry surface decides, and the mapping is deliberately exhaustive:
+*
+* - `startWorkflow`  → 'workflow'  (Webflows engine entered, died pre-ready)
+* - `startFlow`      → 'flow'      (flow/orchestrated manager, died pre-ready)
+* - `startOnboarding`→ 'flow'      (self-loading UI wraps the flow engine)
+* - `startOnboardingSection` → null → the BUILD ABORTS (record withheld):
+*   a standalone session has no truthful flowType, and mislabeling it as a
+*   flow session is worse than skipping the upload. Withheld until the
+*   DECIDED BE ask ships (`flowType:"standalone"`, not nullable) — then this
+*   branch returns 'standalone' and standalone diagnostics start flowing,
+*   coordinated with the BE deploy since off-enum values 400 today.
+*/
+function deriveFlowTypeFromSurface(integrationType) {
+	switch (integrationType) {
+		case "startWorkflow": return "workflow";
+		case "startFlow":
+		case "startOnboarding": return "flow";
+		case "startOnboardingSection": return null;
+	}
+}
+function toContractEntry(entry) {
+	return {
+		index: entry.index,
+		timestamp: epochMsToIsoString(entry.timestampMs),
+		level: entry.level,
+		thread: "main",
+		message: entry.message,
+		subsystem: entry.subsystem,
+		category: entry.category
+	};
+}
+//#endregion
+//#region src/internal/trueSight/sessionMetadata.ts
+/**
+* Hosts that match this pattern are non-prod by heuristic. Known failure modes
+* (customer CNAMEs, devMode left on in prod) are documented for the planned
+* P1 team review — see plan §Operating decisions (B6).
+*/
+const NON_PROD_HOST_PATTERN = /stage|demo|saas-dev|localhost/i;
+function createInitialState() {
+	return {
+		sessionId: null,
+		startedAtMs: null,
+		browser: null,
+		osVersion: null,
+		osLanguage: null,
+		sdkLanguage: "en-US",
+		integrationType: "startOnboardingSection",
+		flowType: null,
+		flowId: null,
+		workflowId: null,
+		testing: false,
+		devModeSignal: void 0,
+		apiUrlSignal: void 0,
+		hasConfigurationId: false,
+		hasExternalCustomerId: false,
+		hasProvidedSessionId: false,
+		hasExternalToken: false
+	};
+}
+let state = createInitialState();
+let sources = {};
+function stampStartedAtOnce() {
+	if (state.startedAtMs === null) state.startedAtMs = getTimestamp();
+}
+/** Tap for `createSession` — sessionId comes from the returned `interviewId`. */
+function noteSessionCreated(session, options = {}) {
+	if (session.interviewId) state.sessionId = session.interviewId;
+	stampStartedAtOnce();
+	state.sdkLanguage = options.language ?? state.sdkLanguage;
+	state.hasConfigurationId = state.hasConfigurationId || options.configurationId !== void 0;
+	state.hasExternalCustomerId = state.hasExternalCustomerId || options.externalCustomerId !== void 0;
+	state.hasProvidedSessionId = state.hasProvidedSessionId || options.interviewId !== void 0;
+}
+/**
+* Fallback sessionId for host-minted-token integrations that never called
+* `createSession`: `Features.sessionIdentifier` — used only when no
+* `interviewId` was observed.
+*/
+function noteFeatureConfig(features) {
+	if (!state.sessionId && features.sessionIdentifier) {
+		state.sessionId = features.sessionIdentifier;
+		stampStartedAtOnce();
+	}
+}
+/**
+* Entry-surface discriminator. `startOnboardingSection` is the default (weakest
+* signal — standalone module managers); richer surfaces upgrade it and are never
+* downgraded back.
+*/
+function noteIntegrationSurface(integrationType) {
+	if (integrationType === "startOnboardingSection") return;
+	state.integrationType = integrationType;
+}
+function noteEnvironment(environment) {
+	state.browser = environment.browser ?? state.browser;
+	state.osVersion = environment.osVersion ?? state.osVersion;
+	state.osLanguage = environment.osLanguage ?? state.osLanguage;
+}
+/**
+* WRITE-ONCE orchestrator identity (determinism guarantee for debugging):
+* a session is a flow or a workflow from its first orchestrator observation
+* and can never flip mid-session — a record labeled `flow` must always point
+* at a real flow. First non-null value wins for each of flowType/flowId/
+* workflowId; later calls are ignored (the service logs a self-health line
+* when a CONFLICTING orchestrator kind shows up).
+*/
+function noteFlowContext(context) {
+	state.flowType = state.flowType ?? context.flowType;
+	state.flowId = state.flowId ?? context.flowId ?? null;
+	state.workflowId = state.workflowId ?? context.workflowId ?? null;
+}
+/**
+* `testing` heuristic: devMode OR non-prod API host pattern. Always a boolean —
+* the contract requires the field present on every record. Signals MERGE across
+* calls (a later apiUrl-only call must not erase an earlier devMode signal);
+* `testing` is recomputed from the merged pair.
+*/
+function noteTestingSignals(signals) {
+	state.devModeSignal = signals.devMode ?? state.devModeSignal;
+	state.apiUrlSignal = signals.apiUrl ?? state.apiUrlSignal;
+	state.testing = state.devModeSignal === true || state.apiUrlSignal !== void 0 && NON_PROD_HOST_PATTERN.test(state.apiUrlSignal);
+}
+/**
+* Live read of the merged testing signal (devMode OR non-prod host). Used to
+* gate host-console self-health noise so production host pages stay quiet while
+* staging/dev keeps the console signal (the record always captures it either
+* way via `trueSightLog`). Same signal the overflow-flush staging gate uses.
+*/
+function isTrueSightTesting() {
+	return state.testing;
+}
+/**
+* Tap for `initializeSession({ token })` with a host-minted token — records
+* only the presence fact ("this token came from outside the SDK"), never the
+* token itself.
+*/
+function noteExternalTokenProvided() {
+	state.hasExternalToken = true;
+}
+/**
+* Wiring tap for every `initializeSession({ token })`: a token activated
+* before any `createSession` was observed on this page is host-minted, i.e.
+* external. (The exact `token`/`externalToken` web-semantics are a pending
+* Phase 0 contract ask — this inference is the interim mapping.)
+*/
+function noteTokenActivated() {
+	if (state.sessionId === null) noteExternalTokenProvided();
+}
+function configureTrueSightMetadataSources(next) {
+	sources = next;
+}
+/** Explicit literal — the metadata half handed to the record builder. */
+function buildSessionMetadata() {
+	return {
+		sessionId: state.sessionId,
+		startedAtMs: state.startedAtMs,
+		browser: state.browser,
+		osVersion: state.osVersion,
+		osLanguage: state.osLanguage,
+		sdkLanguage: state.sdkLanguage,
+		integrationType: state.integrationType,
+		flowType: state.flowType,
+		flowId: state.flowId,
+		workflowId: state.workflowId,
+		testing: state.testing,
+		e2eEncryptionEnabled: readE2eEncryptionEnabled(),
+		hasConfigurationId: state.hasConfigurationId,
+		hasExternalCustomerId: state.hasExternalCustomerId,
+		hasProvidedSessionId: state.hasProvidedSessionId,
+		hasToken: readHasToken(),
+		hasExternalToken: state.hasExternalToken
+	};
+}
+/** Fail-open: diagnostics must never throw into the host flow. */
+function readE2eEncryptionEnabled() {
+	try {
+		return sources.getE2eEncryptionEnabled?.() ?? false;
+	} catch {
+		return false;
+	}
+}
+/** Fail-open, like readE2eEncryptionEnabled. */
+function readHasToken() {
+	try {
+		return sources.getHasToken?.() ?? false;
+	} catch {
+		return false;
+	}
+}
+function resetTrueSightMetadata() {
+	state = createInitialState();
+	sources = {};
+}
+//#endregion
+//#region src/internal/trueSight/pendingEnvelopeStore.ts
+/** Index slot listing sessionIds with pending entries (no enumeration API). */
+const PENDING_INDEX_KEY = `${PENDING_STORAGE_KEY_PREFIX}index`;
+function slotKey(sessionId) {
+	return `${PENDING_STORAGE_KEY_PREFIX}${sessionId}`;
+}
+/**
+* Adds the session to the pending index. Called once at collection start —
+* long before any page-hide — so the hide path never needs the index
+* read-modify-write and stays a single synchronous-effective write.
+*/
+async function registerPendingSlot(sessionId, deps) {
+	try {
+		const index = await readIndex(deps.storage);
+		if (index.includes(sessionId)) return;
+		await deps.storage.set(PENDING_INDEX_KEY, [...index, sessionId]);
+	} catch {}
+}
+/**
+* Writes the sealed snapshot into the session's slot. `BrowserStorageProvider`
+* executes the underlying `localStorage.setItem` synchronously in the first
+* slice of the async call, which is what makes this safe to fire (void) from
+* a page-hide handler.
+*/
+async function writePendingEnvelope(sessionId, entry, deps) {
+	try {
+		await deps.storage.set(slotKey(sessionId), entry);
+	} catch {}
+}
+/** Removes the entry and its index membership (terminal upload dispatched). */
+async function clearPending(sessionId, deps) {
+	try {
+		await deps.storage.remove(slotKey(sessionId));
+		const index = await readIndex(deps.storage);
+		if (index.includes(sessionId)) await deps.storage.set(PENDING_INDEX_KEY, index.filter((candidate) => candidate !== sessionId));
+	} catch {}
+}
+/**
+* Next-load recovery, invoked from the first-token-observed hook (A1 — never
+* at `setup()`, which has no auth). For each foreign, old-enough entry: the
+* slot is cleared AT DISPATCH, then the envelope is posted fire-and-forget —
+* no 200-tracking, no retries (A2; a crash between clear and fire loses that
+* record, consistent with no-retry). Entries at/past the retention ceiling
+* are deleted unsent (A4). Never rejects; returns the A5 loss counters.
+*/
+async function recoverPendingEnvelopes(options) {
+	const { storage, post, currentSessionId } = options;
+	const now = options.now ?? getTimestamp;
+	const counters = {
+		recovered: 0,
+		gcExpired: 0
+	};
+	try {
+		const index = await readIndex(storage);
+		if (index.length === 0) return counters;
+		const keptInIndex = [];
+		for (const sessionId of index) {
+			if (sessionId === currentSessionId) {
+				keptInIndex.push(sessionId);
+				continue;
+			}
+			const entry = await readEntry(storage, sessionId);
+			if (entry === "missing") continue;
+			if (entry === "corrupt") {
+				counters.gcExpired += 1;
+				continue;
+			}
+			const age = now() - entry.persistedAt;
+			if (age >= 6048e5) {
+				counters.gcExpired += 1;
+				await storage.remove(slotKey(sessionId));
+				continue;
+			}
+			if (age < 12e4) {
+				keptInIndex.push(sessionId);
+				continue;
+			}
+			await storage.remove(slotKey(sessionId));
+			counters.recovered += 1;
+			post(endpoints.diagnosticsData, entry.envelope, {}).catch(() => {});
+		}
+		await storage.set(PENDING_INDEX_KEY, keptInIndex);
+	} catch {}
+	return counters;
+}
+async function readIndex(storage) {
+	const index = await storage.get(PENDING_INDEX_KEY);
+	if (!Array.isArray(index)) return [];
+	return index.filter((value) => typeof value === "string");
+}
+/** Reads one entry; malformed slots are pruned and reported as corrupt. */
+async function readEntry(storage, sessionId) {
+	try {
+		const value = await storage.get(slotKey(sessionId));
+		if (value === null) return "missing";
+		if (typeof value === "object" && value.v === 1 && typeof value.persistedAt === "number" && typeof value.envelope === "object") return value;
+		await storage.remove(slotKey(sessionId));
+		return "corrupt";
+	} catch {
+		try {
+			await storage.remove(slotKey(sessionId));
+		} catch {}
+		return "corrupt";
+	}
+}
+//#endregion
+//#region src/internal/featureConfig/featureConfigService.ts
+let cachedFeatures = null;
+/**
+* Checks if a feature is enabled in the feature config.
+*/
+function isFeatureEnabled(feature, features) {
+	return features?.find((f) => f.feature === feature)?.enabled ?? false;
+}
+/**
+* Fetches feature configuration from the backend.
+* Results are cached for the session lifetime.
+*/
+async function fetchFeatureConfig(signal) {
+	if (cachedFeatures) return cachedFeatures;
+	const response = await api.get(endpoints.featureConfig, { signal });
+	if (!response.ok) throw new Error(`Failed to fetch feature config: ${response.status} ${response.statusText}`);
+	cachedFeatures = response.data;
+	return cachedFeatures;
+}
+/**
+* Resets the cached feature config (useful for testing).
+*/
+function resetFeatureConfigCache() {
+	cachedFeatures = null;
+}
+//#endregion
+//#region src/internal/trueSight/eventBridge.ts
+/**
+* Canonical subsystem registry (plan §Subsystem registry): one stable
+* lowercase dotted string per SDK area. The raw `eventModuleNames` wire
+* values are inconsistent (`SELFIE`, `datasharingconsent`, `AdSign`…), four
+* keys collapse into `ID`, and `workflow` doubles as a module name — this
+* table is the single normalization point, snapshot-frozen in tests so the
+* dashboard facet stays bounded (~70 strings) forever.
+*/
+const MODULE_SUBSYSTEMS = {
+	[eventModuleNames.selfie]: "module.selfie",
+	[eventModuleNames.faceCapture]: "module.face-capture",
+	[eventModuleNames.authentication]: "module.authentication",
+	[eventModuleNames.authFace]: "module.auth-face",
+	[eventModuleNames.mlConsent]: "module.ml-consent",
+	[eventModuleNames.combinedConsent]: "module.combined-consent",
+	[eventModuleNames.curpValidation]: "module.curp",
+	[eventModuleNames.faceMatch]: "module.face-match",
+	[eventModuleNames.qr]: "module.qr",
+	[eventModuleNames.videoSelfie]: "module.video-selfie",
+	[eventModuleNames.id]: "module.id",
+	[eventModuleNames.idCapture]: "module.id-capture",
+	[eventModuleNames.idVerification]: "module.id-verification",
+	[eventModuleNames.idOcr]: "module.id-ocr",
+	[eventModuleNames.document]: "module.document-capture",
+	[eventModuleNames.creditCard]: "module.credit-card-front",
+	[eventModuleNames.creditCardBack]: "module.credit-card-back",
+	[eventModuleNames.conference]: "module.conference",
+	[eventModuleNames.otp]: "module.otp",
+	[eventModuleNames.signature]: "module.e-sign",
+	[eventModuleNames.ekyc]: "module.e-kyc",
+	[eventModuleNames.watchlist]: "module.watchlist",
+	[eventModuleNames.globalWatchList]: "module.global-watchlist",
+	[eventModuleNames.customWatchList]: "module.custom-watchlist",
+	[eventModuleNames.email]: "module.email",
+	[eventModuleNames.phone]: "module.phone-number",
+	[eventModuleNames.instantVerifyEmail]: "module.instant-verify-email",
+	[eventModuleNames.instantVerifyConsent]: "module.instant-verify-consent",
+	[eventModuleNames.forms]: "module.forms",
+	[eventModuleNames.customModule]: "module.custom-module",
+	[eventModuleNames.geolocation]: "module.geolocation",
+	[eventModuleNames.ekyb]: "module.e-kyb",
+	[eventModuleNames.identityReuse]: "module.identity-reuse",
+	[eventModuleNames.antifraud]: "module.antifraud",
+	[eventModuleNames.aeSignature]: "module.ae-signature",
+	[eventModuleNames.qeSignature]: "module.qe-signature",
+	[eventModuleNames.crossDocumentDataMatch]: "module.cross-document-data-match",
+	[eventModuleNames.customFields]: "module.custom-fields",
+	[eventModuleNames.fieldComparison]: "module.field-comparison",
+	[eventModuleNames.personhood]: "module.personhood",
+	[eventModuleNames.watchlistForBusiness]: "module.watchlist-for-business",
+	[eventModuleNames.trustGraph]: "module.trust-graph",
+	[eventModuleNames.certificateIssuance]: "module.certificate-issuance",
+	[eventModuleNames.governmentValidation]: "module.government-validation",
+	[eventModuleNames.documentUpload]: "module.document-upload",
+	[eventModuleNames.home]: "module.home",
+	[eventModuleNames.workflow]: "module.workflow",
+	[eventModuleNames.fiscalQr]: "module.fiscal-qr"
+};
+const CUSTOM_SUBSYSTEM_MAX_CHARS = 40;
+/**
+* Canonical `module.<kebab>` for a raw wire module name. Unknown/integrator-
+* custom names get a sanitized lowercase fallback (capped) — custom SDK 2
+* integrations get real per-module detail, not a lumped `other`.
+*/
+function normalizeSubsystem(rawModule) {
+	if (rawModule === void 0) return "module.unknown";
+	const canonical = MODULE_SUBSYSTEMS[rawModule];
+	if (canonical !== void 0) return canonical;
+	const sanitized = rawModule.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, CUSTOM_SUBSYSTEM_MAX_CHARS).replace(/-+$/g, "");
+	return `module.${sanitized === "" ? "unknown" : sanitized}`;
+}
+const ID_SCAN_MODULES = /* @__PURE__ */ new Set([
+	eventModuleNames.id,
+	eventModuleNames.idCapture,
+	eventModuleNames.idVerification,
+	eventModuleNames.idOcr,
+	eventModuleNames.document,
+	eventModuleNames.documentUpload,
+	eventModuleNames.creditCard,
+	eventModuleNames.creditCardBack,
+	eventModuleNames.curpValidation
+]);
+const FACE_SCAN_MODULES = /* @__PURE__ */ new Set([
+	eventModuleNames.selfie,
+	eventModuleNames.faceCapture,
+	eventModuleNames.authentication,
+	eventModuleNames.authFace,
+	eventModuleNames.faceMatch,
+	eventModuleNames.videoSelfie,
+	eventModuleNames.personhood
+]);
+const ORCHESTRATION_MODULES = /* @__PURE__ */ new Set([eventModuleNames.home, eventModuleNames.workflow]);
+/**
+* Coarse category for HTTP-failure entries, from the endpoint path (event
+* map row 23: "by endpoint"). A conservative token heuristic — the category
+* is coarse by contract, so near-misses fall to `other`, never to a wrong
+* scan bucket.
+*/
+function categoryForEndpoint(endpoint) {
+	if (/face|selfie|video|speech|personhood|authenticate|recordings/.test(endpoint)) return "faceScan";
+	if (/front-id|back-id|second-id|process\/id|images|barcode|ocr|document|curp|cfdi|address-statement/.test(endpoint)) return "idScan";
+	if (/start|flow|workflow|feature-config|onboarding|finish-status/.test(endpoint)) return "orchestration";
+	return "other";
+}
+/** Coarse contract category from the RAW `event.module` value (plan rule). */
+function categoryForModule(rawModule) {
+	if (rawModule === void 0) return "other";
+	if (ID_SCAN_MODULES.has(rawModule)) return "idScan";
+	if (FACE_SCAN_MODULES.has(rawModule)) return "faceScan";
+	if (ORCHESTRATION_MODULES.has(rawModule)) return "orchestration";
+	return "other";
+}
+/** `verb key=value` line: undefined values drop their pair entirely. */
+function formatLine(verb, pairs = []) {
+	const parts = [verb];
+	for (const [key, value] of pairs) if (value !== void 0 && value !== null && value !== "") parts.push(`${key}=${String(value)}`);
+	return parts.join(" ");
+}
+/**
+* Analytics event → contract log tuple, or `null` for codes the taxonomy
+* does not cover (deny-by-default: nothing rides into the record unreviewed).
+* Levels/subsystems/categories per the plan's event map rows 5–6 and 16–20.
+*/
+function mapAnalyticsEventToLog(event) {
+	const payload = event.payload ?? {};
+	const subsystem = normalizeSubsystem(event.module);
+	const category = categoryForModule(event.module);
+	switch (event.code) {
+		case "moduleOpened":
+		case "moduleClosed": return {
+			level: "info",
+			subsystem,
+			category,
+			message: formatLine(event.code === "moduleOpened" ? "module opened" : "module closed", [["screen", event.screen]])
+		};
+		case "screenOpened":
+		case "screenClosed": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine(event.code === "screenOpened" ? "screen opened" : "screen closed", [["screen", event.screen]])
+		};
+		case "errorTriggered": return {
+			level: "error",
+			subsystem,
+			category,
+			message: formatLine("errorTriggered", [
+				["errorName", stringOrUndefined(payload.errorName) ?? "unknown"],
+				["errorCode", stringOrUndefined(payload.errorCode)],
+				["reason", stringOrUndefined(payload.reason)]
+			])
+		};
+		case "captureAttemptFinished": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine("capture attempt finished", [["logs", stringOrUndefined(payload.logs)]])
+		};
+		case "background":
+		case "foreground": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: `visibility ${event.code}`
+		};
+		case "elementClicked": return {
+			level: "debug",
+			subsystem,
+			category,
+			message: formatLine("element clicked", [["element", stringOrUndefined(payload.element)], ["action", stringOrUndefined(payload.action)]])
+		};
+		case "browser": {
+			const browser = nameVersion(payload.browser);
+			const os = nameVersion(payload.os);
+			const device = typeof payload.device === "object" && payload.device !== null ? stringOrUndefined(payload.device.type) : void 0;
+			return {
+				level: "info",
+				subsystem: "session",
+				category: "other",
+				message: formatLine("browser info", [
+					["browser", browser],
+					["os", os],
+					["device", device],
+					["webrtc", typeof payload.isWebRtcSupported === "boolean" ? payload.isWebRtcSupported : void 0]
+				])
+			};
+		}
+		default: return null;
+	}
+}
+function stringOrUndefined(value) {
+	return typeof value === "string" ? value : void 0;
+}
+function nameVersion(value) {
+	if (typeof value !== "object" || value === null) return;
+	const { name, version } = value;
+	const joined = [name, version].filter((part) => typeof part === "string" && part !== "").join(" ");
+	return joined === "" ? void 0 : joined;
+}
+//#endregion
+//#region src/internal/trueSight/uploader.ts
+let cryptoProviderPromise = null;
+/**
+* Loads the browser sealer as a LAZY chunk, once — crypto stays off the host
+* page's critical path until diagnostics actually need it (first upload or
+* the service's prewarm).
+*/
+function loadDiagnosticsCryptoProvider() {
+	cryptoProviderPromise ??= import("./BrowserDiagnosticsCryptoProvider-CriIh1Gt.esm.js").then((module) => new module.BrowserDiagnosticsCryptoProvider());
+	return cryptoProviderPromise;
+}
+/**
+* Seals and posts one diagnostics record. Never rejects (fail-open). Size
+* guards per contract: warn approaching the 1 MB envelope cap; over the cap,
+* rebuild ONCE with the oldest half of the logs dropped; still over → drop
+* the upload entirely rather than send an invalid envelope.
+*/
+async function uploadDiagnostics(record, options) {
+	const warn = options.warn ?? defaultWarn;
+	try {
+		const sealer = await (options.loadCrypto ?? loadDiagnosticsCryptoProvider)();
+		let envelope = await sealer.seal(JSON.stringify(record));
+		let envelopeBytes = utf8ByteLength(JSON.stringify(envelope));
+		if (envelopeBytes > 1e6) {
+			const trimmed = {
+				...record,
+				logs: record.logs.slice(Math.floor(record.logs.length / 2))
+			};
+			warn(`[TrueSight] envelope ${envelopeBytes}B over the 1MB cap — rebuilt with the oldest ${record.logs.length - trimmed.logs.length} logs dropped`);
+			envelope = await sealer.seal(JSON.stringify(trimmed));
+			envelopeBytes = utf8ByteLength(JSON.stringify(envelope));
+			if (envelopeBytes > 1e6) {
+				warn("[TrueSight] envelope still over the cap after trim — upload dropped");
+				return;
+			}
+		} else if (envelopeBytes > 9e5) warn(`[TrueSight] envelope ${envelopeBytes}B is approaching the 1MB cap`);
+		const keepalive = options.keepalive === true && envelopeBytes <= 6e4;
+		if (isForwardedFalse((await options.post(endpoints.diagnosticsData, envelope, keepalive ? { keepalive: true } : {})).data)) warn("[TrueSight] proxy accepted the record but did not forward it (forwarded:false)");
+	} catch (error) {
+		warn(`[TrueSight] diagnostics upload failed (no retry): ${String(error)}`);
+	}
+}
+function isForwardedFalse(data) {
+	return typeof data === "object" && data !== null && "forwarded" in data && data.forwarded === false;
+}
+function defaultWarn() {}
+//#endregion
+//#region src/internal/trueSight/trueSightService.ts
+let active = false;
+let remoteKilled = false;
+let finalized = false;
+let cryptoUnsupported = false;
+let collectionStarted = false;
+let flagResolutionStarted = false;
+let lastError = null;
+let buffer = null;
+let unsubscribeEvents = null;
+let options = defaultOptions();
+/** First orchestrator kind observed — LOCKS the session identity (see stampOrchestratorIdentity). */
+let observedManagerKind = null;
+let orchestratorConflictLogged = false;
+let snapshotRecordId = null;
+let cachedPendingEnvelope = null;
+let snapshotDirty = false;
+let captureActive = false;
+let rebuildInFlight = false;
+let sealFailureLogged = false;
+let pendingSlotRegistered = false;
+let recoveryStarted = false;
+let bridgeFailureCount = 0;
+let envSnapshotLogged = false;
+let hintTransitionCount = 0;
+let hintSuppressedCount = 0;
+let lastHintStatus = null;
+let overflowBatchCount = 0;
+let lastFlushRecordId = null;
+let overflowDormant = false;
+let overflowFlushInFlightUpTo = null;
+let dirtyTimerHandle = null;
+let unsubscribePageHide = null;
+function defaultOptions() {
+	return {
+		fetchFeatures: fetchFeatureConfig,
+		captureTransport: captureLiveTransport,
+		upload: uploadDiagnostics,
+		loadCrypto: loadDiagnosticsCryptoProvider
+	};
+}
+/**
+* Boot-time entry, called from `setup()`. Idempotent — the first activating
+* call wins for the SDK lifecycle (like the analytics batcher and the
+* encryption lock); `reset()` → `resetTrueSight()` starts a new one.
+* `enabled:false` is a no-op by design: zero subscriptions, zero state.
+*/
+function initializeTrueSightDiagnostics(serviceOptions) {
+	if (!serviceOptions.enabled || active) return;
+	active = true;
+	options = {
+		...defaultOptions(),
+		...pickDefined(serviceOptions)
+	};
+	buffer = createLogBuffer({ onOverflow: handleBufferOverflow });
+	configureTrueSightMetadataSources({
+		getHasToken: () => getToken() !== null,
+		getE2eEncryptionEnabled: isHttpEncrypted
+	});
+	unsubscribeEvents = subscribeEvent(handleAnalyticsEvent);
+	trueSightLog("debug", "diagnostics", "other", "diagnostics initialized");
+	if (options.pageLifecycle && options.storage) unsubscribePageHide = options.pageLifecycle.onPageHide(handlePageHide);
+	if (options.timer && options.storage) dirtyTimerHandle = options.timer.setInterval(() => {
+		maybeRebuildSnapshot();
+	}, SNAPSHOT_DIRTY_INTERVAL_MS);
+}
+/**
+* Session-time entry, called from `initializeSession` once feature config is
+* known. Collection is already running by then (buffering starts at
+* initialize); this resolves the remote flag and prewarms the crypto chunk.
+* When the host's fetch failed, call with no argument — the service resolves
+* the cached `fetchFeatureConfig()` itself (a token is present at this point).
+*/
+function startTrueSightCollection(features) {
+	if (!active || remoteKilled || finalized) return;
+	if (!collectionStarted) {
+		collectionStarted = true;
+		prewarmCrypto();
+	}
+	if (features) {
+		noteFeatureConfig(features);
+		if (!flagResolutionStarted) {
+			flagResolutionStarted = true;
+			applyFeatureResolution(features, false);
+		}
+	} else if (!flagResolutionStarted) {
+		flagResolutionStarted = true;
+		options.fetchFeatures().then((fetched) => {
+			noteFeatureConfig(fetched);
+			applyFeatureResolution(fetched, false);
+		}, () => {
+			applyFeatureResolution(null, true);
+		});
+	}
+	kickRecoveryOnce();
+}
+/**
+* P1-E capture taps call this around detection loops (C7): while active,
+* snapshot rebuilds are suppressed — the collector must never compete with
+* 30 fps capture. Deactivation flushes the deferred rebuild.
+*/
+function noteTrueSightCaptureActivity(activityActive) {
+	captureActive = activityActive;
+	if (!activityActive) maybeRebuildSnapshot();
+}
+/**
+* Seals and uploads the one final record per session. The upload-relevant
+* state — transport, metadata (live token/E2EE getters read NOW), buffered
+* logs — is captured SYNCHRONOUSLY before the first await, because `reset()`
+* calls `resetApi()` immediately after this returns. Finalize-once: later
+* terminals and late events are no-ops. Never rejects.
+*/
+function finalizeTrueSight(outcome, failureReason) {
+	if (!active || remoteKilled || finalized) return Promise.resolve();
+	finalized = true;
+	trueSightLog("info", "session", "orchestration", `finalizing outcome=${outcome}${failureReason !== void 0 ? ` reason=${failureReason}` : ""}`);
+	const metadata = buildSessionMetadata();
+	const logs = (buffer?.snapshot() ?? []).filter((entry) => overflowFlushInFlightUpTo === null || entry.index > overflowFlushInFlightUpTo);
+	const transport = safeCaptureTransport();
+	if (transport === null || cryptoUnsupported) return Promise.resolve();
+	const record = buildDiagnosticsRecord(metadata, logs, outcome, failureReason);
+	if (record === null) return Promise.resolve();
+	cachedPendingEnvelope = null;
+	if (options.storage && metadata.sessionId) clearPending(metadata.sessionId, { storage: options.storage });
+	return options.upload(record, {
+		post: transport,
+		keepalive: true,
+		loadCrypto: options.loadCrypto,
+		warn: selfHealthWarn
+	});
+}
+/**
+* Capture guidance-hint transition tap (event map 19b/19c): the moment the
+* hint the user sees CHANGES, as the status CODE — never the localized text.
+* Consecutive dedupe on top of the source dedupe, plus a per-attempt budget
+* (~60, then suppress-with-counter) so a struggling capture can never flood
+* the buffer. The budget resets when a capture attempt finishes. Level is
+* debug so the eviction fallback drops hints before warnings/errors.
+*/
+function trueSightHintTransition(subsystem, category, status) {
+	if (buffer === null || finalized) return;
+	if (status === lastHintStatus) return;
+	lastHintStatus = status;
+	hintTransitionCount += 1;
+	if (hintTransitionCount > 60) {
+		hintSuppressedCount += 1;
+		return;
+	}
+	if (hintTransitionCount === 60) {
+		trueSightLog("debug", subsystem, category, "hint transition budget reached suppressing=true");
+		return;
+	}
+	trueSightLog("debug", subsystem, category, `hint changed status=${status}`);
+}
+function resetHintBudget() {
+	if (hintSuppressedCount > 0) trueSightLog("debug", "diagnostics", "other", `hint transitions suppressed count=${hintSuppressedCount}`);
+	hintTransitionCount = 0;
+	hintSuppressedCount = 0;
+	lastHintStatus = null;
+}
+/** Buffer tap for wiring points and self-health lines. No-op when inactive. */
+function trueSightLog(level, subsystem, category, message) {
+	if (buffer === null) return;
+	buffer.append(level, subsystem, category, message);
+	snapshotDirty = true;
+}
+/**
+* Minimal P1-B bridge, invoked by `attachFlowEventEmitter` for every curated
+* flow event. Terminal mapping (repo conventions): `flow.completed` →
+* success, `flow.closed` → cancelled, `flow.error` → records `lastError`
+* only — error state is recoverable, not terminal. Fail-open.
+*/
+function notifyTrueSightFlowEvent(event, managerKind) {
+	if (!active || remoteKilled) return;
+	try {
+		const identityAccepted = stampOrchestratorIdentity(managerKind);
+		snapshotDirty = true;
+		switch (event.type) {
+			case "flow.started":
+				trueSightLog("info", managerKind, "orchestration", "flow.started");
+				break;
+			case "flow.ready":
+				if (identityAccepted) noteFlowContext({
+					flowType: managerKind,
+					flowId: managerKind === "flow" ? event.flowId ?? null : null,
+					workflowId: managerKind === "workflow" ? event.flowId ?? null : null
+				});
+				trueSightLog("info", managerKind, "orchestration", `flow.ready ${managerKind === "workflow" ? "workflowId" : "flowId"}=${event.flowId ?? "unknown"}`);
+				break;
+			case "flow.module.started":
+			case "flow.module.completed": {
+				const position = modulePosition(event.payload);
+				trueSightLog("info", managerKind, "orchestration", `module ${event.type === "flow.module.started" ? "started" : "completed"} module=${event.module ?? "unknown"}${position}`);
+				maybeRebuildSnapshot();
+				break;
+			}
+			case "flow.error":
+				lastError = sanitizeMessage(event.error ?? "unknown");
+				trueSightLog("error", managerKind, "orchestration", `flow.error message=${event.error ?? "unknown"}`);
+				break;
+			case "flow.completed":
+				trueSightLog("info", managerKind, "orchestration", "flow.completed");
+				finalizeTrueSight("success");
+				break;
+			case "flow.closed":
+				trueSightLog("info", managerKind, "orchestration", "flow.closed");
+				finalizeTrueSight("cancelled");
+				break;
+			default: break;
+		}
+	} catch {}
+}
+/**
+* `manager.stop()` while unfinalized = the session ended without a terminal —
+* the sanctioned interrupted marker until BE ships `inProgress`.
+*/
+function notifyTrueSightManagerStopped(managerKind) {
+	if (!active || remoteKilled || finalized) return;
+	try {
+		stampOrchestratorIdentity(managerKind);
+		finalizeTrueSight("failure", lastError ?? "stopped_before_completion");
+	} catch {}
+}
+/**
+* DETERMINISTIC session identity: the FIRST orchestrator kind observed locks
+* `flowType`/`integrationType` for the whole session — a record labeled
+* `flow` must always point at a real flow, never flip mid-session and send
+* the debugger to the wrong dashboard. A conflicting kind (host misuse: two
+* orchestrators on one session) is ignored for identity purposes and leaves
+* exactly one self-health breadcrumb; its terminals still finalize
+* (finalize-once — session closure with a caveat beats no record).
+*
+* @returns whether this kind owns the session identity (callers gate
+*   identity-derived writes like flowId/workflowId on it).
+*/
+function stampOrchestratorIdentity(managerKind) {
+	if (observedManagerKind === null) observedManagerKind = managerKind;
+	else if (observedManagerKind !== managerKind) {
+		if (!orchestratorConflictLogged) {
+			orchestratorConflictLogged = true;
+			trueSightLog("warning", "diagnostics", "other", `orchestratorConflict ignored=${managerKind} locked=${observedManagerKind}`);
+		}
+		return false;
+	}
+	noteIntegrationSurface(managerKind === "workflow" ? "startWorkflow" : "startFlow");
+	noteFlowContext({ flowType: managerKind });
+	return true;
+}
+/** Full teardown, called from `reset()` AFTER finalize captured its snapshot. */
+function resetTrueSight() {
+	unsubscribeEvents?.();
+	unsubscribeEvents = null;
+	unsubscribePageHide?.();
+	unsubscribePageHide = null;
+	if (dirtyTimerHandle !== null) {
+		options.timer?.clearInterval(dirtyTimerHandle);
+		dirtyTimerHandle = null;
+	}
+	buffer = null;
+	active = false;
+	remoteKilled = false;
+	finalized = false;
+	cryptoUnsupported = false;
+	collectionStarted = false;
+	flagResolutionStarted = false;
+	lastError = null;
+	observedManagerKind = null;
+	orchestratorConflictLogged = false;
+	snapshotRecordId = null;
+	cachedPendingEnvelope = null;
+	snapshotDirty = false;
+	captureActive = false;
+	rebuildInFlight = false;
+	sealFailureLogged = false;
+	pendingSlotRegistered = false;
+	recoveryStarted = false;
+	bridgeFailureCount = 0;
+	envSnapshotLogged = false;
+	hintTransitionCount = 0;
+	hintSuppressedCount = 0;
+	lastHintStatus = null;
+	overflowBatchCount = 0;
+	lastFlushRecordId = null;
+	overflowDormant = false;
+	overflowFlushInFlightUpTo = null;
+	options = defaultOptions();
+	resetTrueSightMetadata();
+}
+function handleAnalyticsEvent(event) {
+	if (finalized) return;
+	try {
+		const mapped = mapAnalyticsEventToLog(event);
+		if (mapped === null) return;
+		trueSightLog(mapped.level, mapped.subsystem, mapped.category, mapped.message);
+		if (mapped.level === "error" || mapped.level === "severe") logEnvironmentSnapshotOnce();
+		if (event.code === "captureAttemptFinished") resetHintBudget();
+	} catch {
+		bridgeFailureCount += 1;
+		if (bridgeFailureCount === 1) trueSightLog("warning", "diagnostics", "other", "bridge mapping failed");
+	}
+}
+/**
+* Environment-snapshot-on-first-error (event map 19d): the "conditions at
+* the moment of failure" line — logged once per session, right after the
+* first error-level entry. The snapshot closure is injected (navigator
+* facts live behind the L0 environment provider).
+*/
+function logEnvironmentSnapshotOnce() {
+	if (envSnapshotLogged || options.getEnvironmentSnapshot === void 0) return;
+	envSnapshotLogged = true;
+	try {
+		trueSightLog("info", "session", "other", `environment at first error ${options.getEnvironmentSnapshot()}`);
+	} catch {}
+}
+function applyFeatureResolution(features, unresolvable) {
+	if (!active || remoteKilled || finalized) return;
+	const entry = features?.features?.find((candidate) => candidate.feature === "TRUESIGHT_DIAGNOSTICS");
+	if (entry?.enabled === false) {
+		remoteKill();
+		return;
+	}
+	trueSightLog("info", "diagnostics", "other", `featureFlag resolution=${unresolvable ? "unresolvable" : entry ? "true" : "absent"}`);
+}
+function remoteKill() {
+	remoteKilled = true;
+	buffer = null;
+	unsubscribeEvents?.();
+	unsubscribeEvents = null;
+}
+/**
+* Size-limit overflow flush (plan §1.3, event map 10b): the buffer crossed
+* ~600 KB mid-session — ship the slice as its OWN contract-valid record
+* (fresh id, same sessionId, index continuity ties the records together)
+* and keep logging. **STAGING-ONLY until BE ships `inProgress`/`flushReason`
+* (hard gate B2)**: outside staging (`testing !== true`) the machinery goes
+* dormant and the buffer falls back to eviction. Interim outcome marker is
+* the sanctioned `failure/interrupted` pair; the terminal record supersedes.
+*/
+function handleBufferOverflow(slice) {
+	dispatchOverflowSlice(slice);
+}
+async function dispatchOverflowSlice(slice) {
+	if (!active || remoteKilled || finalized || overflowDormant || slice.length === 0) return;
+	const metadata = buildSessionMetadata();
+	if (metadata.testing !== true) {
+		goOverflowDormant("overflowFlush dormant reason=prod");
+		return;
+	}
+	if (cryptoUnsupported) {
+		goOverflowDormant("overflowFlush dormant reason=cryptoUnsupported");
+		return;
+	}
+	const transport = safeCaptureTransport();
+	if (transport === null) {
+		goOverflowDormant("overflowFlush dormant reason=noTransport");
+		return;
+	}
+	overflowBatchCount += 1;
+	const record = buildDiagnosticsRecord(metadata, [{
+		index: slice[0].index,
+		timestampMs: getTimestamp(),
+		level: "info",
+		subsystem: "diagnostics",
+		category: "other",
+		message: `sizeLimitFlush batch=${overflowBatchCount} prevRecordId=${lastFlushRecordId ?? "none"}`
+	}, ...slice], "failure", "interrupted");
+	if (record === null) {
+		goOverflowDormant("overflowFlush dormant reason=unbuildable");
+		return;
+	}
+	lastFlushRecordId = record.id;
+	const upToIndex = slice[slice.length - 1].index;
+	overflowFlushInFlightUpTo = upToIndex;
+	await options.upload(record, {
+		post: transport,
+		loadCrypto: options.loadCrypto,
+		warn: selfHealthWarn
+	});
+	buffer?.markFlushed(upToIndex);
+	overflowFlushInFlightUpTo = null;
+	snapshotDirty = true;
+	trueSightLog("info", "diagnostics", "other", `sizeLimitFlush dispatched batch=${overflowBatchCount} recordId=${record.id} entries=${slice.length}`);
+}
+/** B2 fallback: machinery dormant, eviction takes over — logged exactly once. */
+function goOverflowDormant(message) {
+	if (overflowDormant) return;
+	overflowDormant = true;
+	trueSightLog("warning", "diagnostics", "other", message);
+	buffer?.setOverflowMode("evict");
+}
+/**
+* Debounced interrupted-snapshot rebuild (plan §1.8): triggered by module
+* boundaries and the dirty-interval tick, suppressed while a capture loop is
+* active (C7). Seals the CURRENT state as a `failure/interrupted` record
+* under the session's stable snapshot id, caches the envelope (the page-hide
+* handler writes only the cache — it never builds), and persists it.
+*/
+function maybeRebuildSnapshot() {
+	if (!active || remoteKilled || finalized || cryptoUnsupported || captureActive || rebuildInFlight || !snapshotDirty || options.storage === void 0) return;
+	const metadata = buildSessionMetadata();
+	if (!metadata.sessionId) return;
+	const storage = options.storage;
+	const sessionId = metadata.sessionId;
+	snapshotRecordId ??= randomUUID();
+	const record = buildDiagnosticsRecord(metadata, buffer?.snapshot() ?? [], "failure", "interrupted", snapshotRecordId);
+	if (record === null) return;
+	snapshotDirty = false;
+	rebuildInFlight = true;
+	options.loadCrypto().then((sealer) => sealer.seal(JSON.stringify(record))).then(async (envelope) => {
+		cachedPendingEnvelope = envelope;
+		if (!pendingSlotRegistered) {
+			pendingSlotRegistered = true;
+			await registerPendingSlot(sessionId, { storage });
+		}
+		await writePendingEnvelope(sessionId, {
+			v: 1,
+			persistedAt: getTimestamp(),
+			envelope
+		}, { storage });
+	}).catch(() => {
+		snapshotDirty = true;
+		if (!sealFailureLogged) {
+			sealFailureLogged = true;
+			trueSightLog("warning", "diagnostics", "other", "snapshot seal failed persistDisabled=false");
+		}
+	}).finally(() => {
+		rebuildInFlight = false;
+	});
+}
+/**
+* Page-hide = persist only, NEVER send (locked decision): one synchronous-
+* effective write of the freshest pre-sealed snapshot. Building or posting
+* here is forbidden — a hidden tab is frequently a user who returns.
+*/
+function handlePageHide() {
+	if (!active || remoteKilled || finalized || cachedPendingEnvelope === null || options.storage === void 0) return;
+	const sessionId = buildSessionMetadata().sessionId;
+	if (!sessionId) return;
+	writePendingEnvelope(sessionId, {
+		v: 1,
+		persistedAt: getTimestamp(),
+		envelope: cachedPendingEnvelope
+	}, { storage: options.storage });
+	trueSightLog("debug", "diagnostics", "other", "snapshot persisted on pagehide");
+}
+/**
+* Next-load recovery off the first-token-observed hook (A1) — runs once per
+* lifecycle, fire-and-forget, and reports the A5 loss counters as a
+* self-health line when there was anything to report.
+*/
+function kickRecoveryOnce() {
+	if (recoveryStarted || options.storage === void 0) return;
+	recoveryStarted = true;
+	const transport = safeCaptureTransport();
+	if (transport === null) return;
+	recoverPendingEnvelopes({
+		storage: options.storage,
+		post: transport,
+		currentSessionId: buildSessionMetadata().sessionId
+	}).then((counters) => {
+		if (counters.recovered > 0 || counters.gcExpired > 0) trueSightLog("info", "diagnostics", "other", `recovery recovered=${counters.recovered} gcExpired=${counters.gcExpired}`);
+	});
+}
+/**
+* Resolves crypto support ahead of finalize (and warms the lazy chunk so the
+* terminal path never pays the import). Unsupported → collect-only mode with
+* exactly one self-health warning.
+*/
+function prewarmCrypto() {
+	options.loadCrypto().then((provider) => {
+		if (!provider.isSupported()) markCryptoUnsupported();
+	}, () => {
+		markCryptoUnsupported();
+	});
+}
+function markCryptoUnsupported() {
+	if (cryptoUnsupported) return;
+	cryptoUnsupported = true;
+	trueSightLog("warning", "diagnostics", "other", "crypto unsupported collectOnly=true");
+}
+/**
+* Default transport capture: a closure over the live client + token AS OF
+* NOW. `reset()` may null the singletons immediately after — the returned
+* closure keeps working against the captured references.
+*/
+function captureLiveTransport() {
+	try {
+		if (!isApiConfigured()) return null;
+		const client = getApi();
+		const token = getToken();
+		if (token === null) return null;
+		return (url, body, config) => client.post(url, body, {
+			...config,
+			headers: { "X-Incode-Hardware-Id": token }
+		});
+	} catch {
+		return null;
+	}
+}
+function safeCaptureTransport() {
+	try {
+		return options.captureTransport();
+	} catch {
+		return null;
+	}
+}
+function selfHealthWarn(message) {
+	if (isTrueSightTesting()) console.warn(message);
+	trueSightLog("warning", "diagnostics", "other", message);
+}
+/** Spread-safe subset: injected seams only, `undefined` values dropped. */
+function pickDefined(serviceOptions) {
+	const picked = {};
+	if (serviceOptions.fetchFeatures) picked.fetchFeatures = serviceOptions.fetchFeatures;
+	if (serviceOptions.captureTransport) picked.captureTransport = serviceOptions.captureTransport;
+	if (serviceOptions.upload) picked.upload = serviceOptions.upload;
+	if (serviceOptions.loadCrypto) picked.loadCrypto = serviceOptions.loadCrypto;
+	if (serviceOptions.pageLifecycle) picked.pageLifecycle = serviceOptions.pageLifecycle;
+	if (serviceOptions.timer) picked.timer = serviceOptions.timer;
+	if (serviceOptions.storage) picked.storage = serviceOptions.storage;
+	if (serviceOptions.getEnvironmentSnapshot) picked.getEnvironmentSnapshot = serviceOptions.getEnvironmentSnapshot;
+	return picked;
+}
+/** ` index=i total=n` suffix when the flow event carries module positioning. */
+function modulePosition(payload) {
+	if (typeof payload !== "object" || payload === null) return "";
+	const { moduleIndex, totalModules } = payload;
+	return `${typeof moduleIndex === "number" ? ` index=${moduleIndex}` : ""}${typeof totalModules === "number" ? ` total=${totalModules}` : ""}`;
+}
+//#endregion
+export { upgradeToWasmHttpClient as C, resetHttpClientState as S, noteTokenActivated as _, notifyTrueSightManagerStopped as a, getStoredHttpConfig as b, trueSightHintTransition as c, fetchFeatureConfig as d, isFeatureEnabled as f, noteTestingSignals as g, noteSessionCreated as h, notifyTrueSightFlowEvent as i, trueSightLog as l, noteEnvironment as m, initializeTrueSightDiagnostics as n, resetTrueSight as o, resetFeatureConfigCache as p, noteTrueSightCaptureActivity as r, startTrueSightCollection as s, finalizeTrueSight as t, categoryForEndpoint as u, SDK_VERSION as v, createApi as w, installFreshHttpClient as x, randomUUID as y };