@incodetech/core 2.2.0 → 2.3.0-rc.0

package/dist/faceCaptureSetup-BSextack.esm.js

@@ -0,0 +1,2106 @@
+import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
+import { r as getToken } from "./api-Bx3gKW_y.esm.js";
+import { l as trueSightLog, m as isTrueSightTesting } from "./trueSightService-CKrrfV0Q.esm.js";
+import "./sessionInitializer-BLoK7SP9.esm.js";
+import { t as addDeviceStats } from "./stats-DkK-f8JT.esm.js";
+import { t as isAndroid } from "./platform-DkcRc9JV.esm.js";
+import { i as assign, n as enqueueActions, r as sendTo, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
+import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
+import { n as invokeRequestPermissionActor, t as checkPermission } from "./permissionServices-Bj_fyWtv.esm.js";
+import { a as sendLabelInspectionEvent, c as stopRecording, i as initializeDeepsightSession, l as stopStream, r as initializeCamera, s as startRecordingSession, t as FaceDetectionProvider } from "./FaceDetectionProvider-DTetAE8H.esm.js";
+import { t as FACE_ERROR_CODES } from "./types-BN5RPPIZ.esm.js";
+import { a as flagFaceManualReview, i as imageFileToDataUrl, n as runProtectedAttempt, r as cameraCycleProvider, s as PROTECTED_CAPTURE_TARGET, t as createCameraCycleOwnership } from "./createCameraCycleOwnership-DQ5-F2oW.esm.js";
+import { n as releaseFaceAvatarWarmup, r as warmFaceAvatar, t as createFaceAvatar } from "./createFaceAvatar-BNHdeFj8.esm.js";
+import { t as IncodeCanvas } from "./canvas-BxFzWTt-.esm.js";
+import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-uYZYFu4J.esm.js";
+import { i as uploadDeepsightVideo } from "./recordingsRepository-CCWy13M-.esm.js";
+import { t as getDeviceClass } from "./getDeviceClass-5NYZg9s6.esm.js";
+import { n as getAdaptiveMediaRecorderOptions, t as MultipartRecordingService } from "./multipartRecordingService-B3C_zlev.esm.js";
+//#region src/internal/avatar/concealment.ts
+/**
+* Maps a backend concealment option to the internal avatar flags. `OPTION_NONE`
+* — and any absent or unknown value, for forward-compat safety — yields the live
+* video (no avatar). The other three map 1:1 onto the shipped avatar catalog:
+*  - `OPTION_3D`         → `avatar-3d` (3D VRM)
+*  - `OPTION_2D`         → `avatar-2d` (stylized 2D face)
+*  - `OPTION_SILHOUETTE` → `privacy-lens` (WebGL frosted-glass conceal)
+*/
+function concealmentToAvatar(option) {
+	switch (option) {
+		case "OPTION_3D": return {
+			obfuscateWithAvatar: true,
+			avatarVariant: "avatar-3d"
+		};
+		case "OPTION_2D": return {
+			obfuscateWithAvatar: true,
+			avatarVariant: "avatar-2d"
+		};
+		case "OPTION_SILHOUETTE": return {
+			obfuscateWithAvatar: true,
+			avatarVariant: "privacy-lens"
+		};
+		default: return {
+			obfuscateWithAvatar: false,
+			avatarVariant: void 0
+		};
+	}
+}
+//#endregion
+//#region src/internal/faceCapture/manualUpload/errors.ts
+/**
+* Reuses the `notifications.*` copy that `errorModal.tsx` shows for the same
+* codes on the camera path, plus the ID manual-upload keys. Only the `title`
+* half of each notification pair is used — the inline error is one line.
+*/
+const MANUAL_FACE_UPLOAD_ERROR_KEYS = {
+	/** The one new string; ID accepts any image type so there was none to reuse. */
+	typeError: "selfiev2.manualUpload.typeError",
+	fileTooBig: "manualIdUpload.fileTooBig",
+	generic: "manualIdUpload.generic",
+	faceNotFound: "notifications.faceNotFound",
+	multipleFaces: "notifications.multiple",
+	lowQualityImage: "notifications.lowQualityImage",
+	brightness: "notifications.brightness",
+	lenses: "notifications.lenses",
+	mask: "notifications.mask",
+	removeHeadwear: "notifications.removeHeadwear",
+	closedEyes: "notifications.closedEyes",
+	spoof: "notifications.spoof",
+	accessDenied: "notifications.accessDenied",
+	nonexistentCustomer: "notifications.nonexistentCustomer",
+	hintNotProvided: "notifications.hintNotProvided",
+	selfieImageLowQuality: "notifications.selfieImageLowQuality"
+};
+/** Mirrors `errorContent` in `errorModal.tsx`; omissions resolve to `generic`. */
+const ERROR_KEY_BY_FACE_ERROR_CODE = {
+	[FACE_ERROR_CODES.FACE_NOT_FOUND]: MANUAL_FACE_UPLOAD_ERROR_KEYS.faceNotFound,
+	[FACE_ERROR_CODES.MULTIPLE_FACES]: MANUAL_FACE_UPLOAD_ERROR_KEYS.multipleFaces,
+	[FACE_ERROR_CODES.BAD_PHOTO_QUALITY]: MANUAL_FACE_UPLOAD_ERROR_KEYS.lowQualityImage,
+	[FACE_ERROR_CODES.SELFIE_IMAGE_LOW_QUALITY]: MANUAL_FACE_UPLOAD_ERROR_KEYS.selfieImageLowQuality,
+	[FACE_ERROR_CODES.BRIGHTNESS]: MANUAL_FACE_UPLOAD_ERROR_KEYS.brightness,
+	[FACE_ERROR_CODES.FACE_TOO_DARK]: MANUAL_FACE_UPLOAD_ERROR_KEYS.brightness,
+	[FACE_ERROR_CODES.LENSES]: MANUAL_FACE_UPLOAD_ERROR_KEYS.lenses,
+	[FACE_ERROR_CODES.LENSES_DETECTED]: MANUAL_FACE_UPLOAD_ERROR_KEYS.lenses,
+	[FACE_ERROR_CODES.MASK]: MANUAL_FACE_UPLOAD_ERROR_KEYS.mask,
+	[FACE_ERROR_CODES.FACE_MASK_DETECTED]: MANUAL_FACE_UPLOAD_ERROR_KEYS.mask,
+	[FACE_ERROR_CODES.HEAD_COVER]: MANUAL_FACE_UPLOAD_ERROR_KEYS.removeHeadwear,
+	[FACE_ERROR_CODES.HEAD_COVER_DETECTED]: MANUAL_FACE_UPLOAD_ERROR_KEYS.removeHeadwear,
+	[FACE_ERROR_CODES.CLOSED_EYES]: MANUAL_FACE_UPLOAD_ERROR_KEYS.closedEyes,
+	[FACE_ERROR_CODES.CLOSED_EYES_DETECTED]: MANUAL_FACE_UPLOAD_ERROR_KEYS.closedEyes,
+	[FACE_ERROR_CODES.LIVENESS]: MANUAL_FACE_UPLOAD_ERROR_KEYS.spoof,
+	[FACE_ERROR_CODES.SPOOF_ATTEMPT_DETECTED]: MANUAL_FACE_UPLOAD_ERROR_KEYS.spoof,
+	[FACE_ERROR_CODES.FACE_TOO_BLURRY]: MANUAL_FACE_UPLOAD_ERROR_KEYS.spoof,
+	[FACE_ERROR_CODES.USER_IS_NOT_RECOGNIZED]: MANUAL_FACE_UPLOAD_ERROR_KEYS.accessDenied,
+	[FACE_ERROR_CODES.NONEXISTENT_CUSTOMER]: MANUAL_FACE_UPLOAD_ERROR_KEYS.nonexistentCustomer,
+	[FACE_ERROR_CODES.HINT_NOT_PROVIDED]: MANUAL_FACE_UPLOAD_ERROR_KEYS.hintNotProvided
+};
+function mapFaceErrorCodeToErrorKey(code) {
+	if (!code) return MANUAL_FACE_UPLOAD_ERROR_KEYS.generic;
+	return ERROR_KEY_BY_FACE_ERROR_CODE[code] ?? MANUAL_FACE_UPLOAD_ERROR_KEYS.generic;
+}
+/** Enforced in core because the picker's `accept` filter is bypassable. */
+const MANUAL_FACE_UPLOAD_ACCEPTED_MIME_TYPES = ["image/png", "image/jpeg"];
+//#endregion
+//#region src/internal/faceCapture/manualUpload/prepareFile.ts
+const isAcceptedMimeType = (type) => MANUAL_FACE_UPLOAD_ACCEPTED_MIME_TYPES.includes(type);
+const stripDataUrlPrefix = (dataUrl) => {
+	const commaIndex = dataUrl.indexOf(",");
+	return commaIndex === -1 ? dataUrl : dataUrl.slice(commaIndex + 1);
+};
+/** Duplicated from the ID manual upload; consolidate if a third caller appears. */
+const getBase64PayloadByteLength = (payload) => {
+	const normalized = payload.replace(/\s/g, "");
+	let padding = 0;
+	if (normalized.endsWith("==")) padding = 2;
+	else if (normalized.endsWith("=")) padding = 1;
+	return Math.max(0, Math.floor(normalized.length * 3 / 4) - padding);
+};
+/**
+* Every client-side check, run before any network call so a rejection here
+* never costs the user a retry.
+*/
+async function prepareManualFaceUpload(file) {
+	if (!isAcceptedMimeType(file.type)) return {
+		ok: false,
+		errorKey: MANUAL_FACE_UPLOAD_ERROR_KEYS.typeError
+	};
+	if (file.size > 5242880) return {
+		ok: false,
+		errorKey: MANUAL_FACE_UPLOAD_ERROR_KEYS.fileTooBig
+	};
+	const base64Image = stripDataUrlPrefix(await imageFileToDataUrl(file));
+	if (getBase64PayloadByteLength(base64Image) > 5242880) return {
+		ok: false,
+		errorKey: MANUAL_FACE_UPLOAD_ERROR_KEYS.fileTooBig
+	};
+	return {
+		ok: true,
+		base64Image
+	};
+}
+//#endregion
+//#region src/internal/faceCapture/manualUpload/manualFaceUploadStateMachine.ts
+const prepareFileActor = fromPromise(async ({ input }) => prepareManualFaceUpload(input.file));
+const getPreparedFromEvent = (event) => "output" in event ? event.output : void 0;
+const getErrorMessageFromEvent = (event) => {
+	const { error } = event;
+	if (error instanceof Error) return error.message;
+	return typeof error === "string" ? error : "";
+};
+const manualFaceUploadMachine = setup({
+	types: {
+		context: {},
+		events: {},
+		input: {},
+		output: {}
+	},
+	actors: {
+		prepareFile: prepareFileActor,
+		uploadFile: fromPromise(async () => {
+			throw new Error("uploadFile must be provided by variant");
+		})
+	},
+	actions: {
+		storeSelectedFile: assign(({ event }) => {
+			if (event.type !== "MANUAL_UPLOAD_FILE_SELECTED") return {};
+			return {
+				file: event.file,
+				errorKey: null,
+				uploaded: false
+			};
+		}),
+		storePreparedImage: assign(({ event }) => {
+			const prepared = getPreparedFromEvent(event);
+			return prepared?.ok ? { base64Image: prepared.base64Image } : {};
+		}),
+		setErrorFromPrepare: assign(({ event }) => {
+			const prepared = getPreparedFromEvent(event);
+			return { errorKey: prepared && !prepared.ok ? prepared.errorKey : MANUAL_FACE_UPLOAD_ERROR_KEYS.generic };
+		}),
+		setGenericError: assign(() => ({ errorKey: MANUAL_FACE_UPLOAD_ERROR_KEYS.generic })),
+		setErrorFromUploadFailure: assign(({ event }) => ({ errorKey: mapFaceErrorCodeToErrorKey(getErrorMessageFromEvent(event)) })),
+		markUploaded: assign(() => ({
+			uploaded: true,
+			errorKey: null
+		})),
+		decrementRetries: assign(({ context }) => ({ retriesLeft: Math.max(0, context.retriesLeft - 1) })),
+		reset: assign(({ context }) => ({
+			file: null,
+			base64Image: null,
+			uploaded: false,
+			errorKey: null,
+			retriesLeft: context.captureAttempts
+		})),
+		markSucceeded: assign(() => ({ outcome: "success" })),
+		markExhausted: assign(() => ({ outcome: "exhausted" }))
+	},
+	guards: {
+		isPrepareRejected: ({ event }) => getPreparedFromEvent(event)?.ok === false,
+		retriesExhausted: ({ context }) => context.retriesLeft <= 0,
+		canContinue: ({ context }) => context.uploaded
+	}
+}).createMachine({
+	id: "manualFaceUpload",
+	initial: "selecting",
+	context: ({ input }) => ({
+		config: input.config,
+		dependencies: input.dependencies,
+		captureAttempts: input.captureAttempts,
+		retriesLeft: input.captureAttempts,
+		file: null,
+		base64Image: null,
+		uploaded: false,
+		errorKey: null,
+		outcome: null
+	}),
+	output: ({ context }) => ({ result: context.outcome === "success" ? "success" : "exhausted" }),
+	on: { MANUAL_UPLOAD_RESET: {
+		target: ".selecting",
+		actions: ["reset"]
+	} },
+	states: {
+		selecting: { on: {
+			MANUAL_UPLOAD_FILE_SELECTED: {
+				target: "preparing",
+				actions: ["storeSelectedFile"]
+			},
+			MANUAL_UPLOAD_CONTINUE: {
+				guard: "canContinue",
+				target: "finished",
+				actions: ["markSucceeded"]
+			}
+		} },
+		preparing: { invoke: {
+			id: "prepareFile",
+			src: "prepareFile",
+			input: ({ context }) => ({ file: context.file }),
+			onDone: [{
+				guard: "isPrepareRejected",
+				target: "selecting",
+				actions: ["setErrorFromPrepare"]
+			}, {
+				target: "uploading",
+				actions: ["storePreparedImage"]
+			}],
+			onError: {
+				target: "selecting",
+				actions: ["setGenericError"]
+			}
+		} },
+		uploading: { invoke: {
+			id: "uploadFile",
+			src: "uploadFile",
+			input: ({ context }) => ({
+				base64Image: context.base64Image,
+				config: context.config,
+				dependencies: context.dependencies
+			}),
+			onDone: {
+				target: "selecting",
+				actions: ["markUploaded"]
+			},
+			onError: {
+				target: "checkRetries",
+				actions: ["decrementRetries", "setErrorFromUploadFailure"]
+			}
+		} },
+		checkRetries: { always: [{
+			guard: "retriesExhausted",
+			target: "exhausted",
+			actions: ["markExhausted"]
+		}, { target: "selecting" }] },
+		exhausted: { type: "final" },
+		finished: { type: "final" }
+	}
+});
+//#endregion
+//#region ../infra/src/providers/wasm/createProtectedFaceCaptureCapabilities.ts
+/**
+* Infrastructure composition boundary for one protected still-face attempt.
+* Core receives capability interfaces and never constructs or reaches for the
+* process-wide WASM providers directly.
+*/
+function createProtectedFaceCaptureCapabilities() {
+	return {
+		cycle: cameraCycleProvider,
+		faceDetection: new FaceDetectionProvider()
+	};
+}
+//#endregion
+//#region src/internal/faceCapture/faceCaptureDiagnostics.ts
+const FACE_CAMERA_DIAGNOSTIC_PREFIX = "[Incode face camera]";
+/**
+* Emits one bounded lifecycle line only for SDK testing sessions. The payload
+* deliberately excludes media, native results, tokens, request data, and
+* errors so a browser console recording cannot retain capture data.
+*/
+function logFaceCameraDiagnostic(event, fields) {
+	if (!isTrueSightTesting()) return;
+	console.debug(`${FACE_CAMERA_DIAGNOSTIC_PREFIX} ${event} ${JSON.stringify(fields)}`);
+}
+//#endregion
+//#region ../infra/src/media/VideoTrimmer.ts
+async function getDurationBySeek(videoBlob) {
+	const video = document.createElement("video");
+	video.preload = "metadata";
+	video.src = URL.createObjectURL(videoBlob);
+	try {
+		if (!Number.isFinite(video.duration)) {
+			video.currentTime = Number.MAX_SAFE_INTEGER;
+			await new Promise((resolve) => {
+				const onDurationChange = () => {
+					if (Number.isFinite(video.duration)) {
+						video.removeEventListener("durationchange", onDurationChange);
+						video.removeEventListener("timeupdate", onTimeUpdate);
+						resolve(video.duration);
+					}
+				};
+				const onTimeUpdate = () => {
+					if (Number.isFinite(video.duration)) {
+						video.removeEventListener("timeupdate", onTimeUpdate);
+						video.removeEventListener("durationchange", onDurationChange);
+						resolve(video.duration);
+					}
+				};
+				video.addEventListener("durationchange", onDurationChange);
+				video.addEventListener("timeupdate", onTimeUpdate);
+			});
+		}
+		const duration = video.duration;
+		return Number.isFinite(duration) ? duration : null;
+	} finally {
+		URL.revokeObjectURL(video.src);
+		video.src = "";
+	}
+}
+async function trimLastNSecondsUsingPlayback(videoBlob, seconds) {
+	const video = document.createElement("video");
+	video.preload = "metadata";
+	video.playsInline = true;
+	video.muted = true;
+	const videoURL = URL.createObjectURL(videoBlob);
+	video.src = videoURL;
+	const duration = await getDurationBySeek(videoBlob);
+	if (!duration || duration < seconds) {
+		URL.revokeObjectURL(videoURL);
+		return videoBlob;
+	}
+	const startTime = Math.max(0, Math.floor(duration) - seconds);
+	await new Promise((resolve) => {
+		if (video.readyState >= 2) resolve();
+		else video.addEventListener("loadedmetadata", () => resolve(), { once: true });
+	});
+	const canvas = document.createElement("canvas");
+	canvas.width = 230;
+	canvas.height = 320;
+	const captureFps = isAndroid() ? 15 : 24;
+	const stream = canvas.captureStream(captureFps);
+	const ctx = canvas.getContext("2d");
+	video.currentTime = startTime;
+	await new Promise((resolve) => {
+		video.addEventListener("seeked", () => resolve(), { once: true });
+	});
+	ctx.drawImage(video, 0, 0, canvas.width, canvas.height);
+	const mimeType = videoBlob.type || (MediaRecorder.isTypeSupported("video/webm") ? "video/webm" : "video/mp4");
+	const mediaRecorder = new MediaRecorder(stream.clone(), {
+		mimeType,
+		videoBitsPerSecond: 5e5,
+		bitsPerSecond: 5e5
+	});
+	const chunks = [];
+	mediaRecorder.ondataavailable = (event) => {
+		if (event.data.size > 0) chunks.push(event.data);
+	};
+	const recordingPromise = new Promise((resolve) => {
+		mediaRecorder.onstop = () => {
+			const trimmedBlob = new Blob(chunks, { type: mimeType });
+			URL.revokeObjectURL(videoURL);
+			mediaRecorder.stream?.getTracks().forEach((track) => track.stop());
+			stream.getTracks().forEach((track) => track.stop());
+			video.src = "";
+			resolve(trimmedBlob);
+		};
+	});
+	video.addEventListener("play", () => {
+		function drawVideo() {
+			if (video.currentTime >= duration) {
+				mediaRecorder.stop();
+				video.pause();
+				return;
+			}
+			ctx.drawImage(video, 0, 0, canvas.width, canvas.height);
+			requestAnimationFrame(drawVideo);
+		}
+		drawVideo();
+		setTimeout(() => {
+			mediaRecorder.start(100);
+		}, 500);
+	});
+	video.play().catch(() => {
+		URL.revokeObjectURL(videoURL);
+	});
+	const trimmedBlob = await recordingPromise;
+	console.timeEnd("trimLastNSecondsUsingPlayback");
+	return trimmedBlob;
+}
+async function trimLastNSeconds(videoBlob, seconds) {
+	return await trimLastNSecondsUsingPlayback(videoBlob, seconds);
+}
+//#endregion
+//#region ../infra/src/providers/browser/LocalRecordingProvider.ts
+function toBase64(videoBlob) {
+	return new Promise((resolve, reject) => {
+		const reader = new FileReader();
+		reader.onloadend = () => {
+			const base64 = reader.result.split(",")[1];
+			resolve(base64);
+		};
+		reader.onerror = () => reject(reader.error ?? /* @__PURE__ */ new Error("FileReader error"));
+		reader.readAsDataURL(videoBlob);
+	});
+}
+var LocalRecordingProvider = class {
+	constructor() {
+		this.mediaRecorder = null;
+		this._isRecording = false;
+		this._hasError = false;
+		this._error = null;
+		this.mimeType = "";
+		this.stream = null;
+		this.pauseRecordingBound = this.pauseRecording.bind(this);
+	}
+	get isRecording() {
+		return this._isRecording;
+	}
+	get hasError() {
+		return this._hasError;
+	}
+	get error() {
+		return this._error;
+	}
+	startRecording(stream) {
+		this.reset();
+		this.registerEventListeners();
+		this.stream = stream;
+		try {
+			const options = getAdaptiveMediaRecorderOptions();
+			this.mimeType = options.mimeType;
+			const recorder = new MediaRecorder(stream.clone(), options);
+			recorder.onerror = (event) => {
+				this._error = `Recording error: ${event}`;
+				this._isRecording = false;
+				this._hasError = true;
+			};
+			recorder.start();
+			this.mediaRecorder = recorder;
+			this._isRecording = true;
+			this._error = null;
+			this._hasError = false;
+		} catch (err) {
+			this._error = `Failed to start recording: ${err}`;
+			this._hasError = true;
+		}
+	}
+	async stopRecording(trimSeconds, encrypt, generateChecksum) {
+		const recorder = this.mediaRecorder;
+		return new Promise((resolve, reject) => {
+			this.removeEventListeners();
+			if (recorder && this._isRecording) {
+				const chunks = [];
+				recorder.ondataavailable = (event) => {
+					if (event.data.size > 0) chunks.push(event.data);
+				};
+				recorder.onstop = async () => {
+					try {
+						const trimmedVideo = await trimLastNSeconds(new Blob(chunks, { type: this.mimeType }), trimSeconds);
+						const encryptedVideoBase64 = encrypt(await toBase64(trimmedVideo));
+						generateChecksum(await trimmedVideo.arrayBuffer());
+						this._isRecording = false;
+						resolve({
+							trimmedBlob: trimmedVideo,
+							encryptedVideo: encryptedVideoBase64
+						});
+					} catch (error) {
+						this._isRecording = false;
+						this._error = `Recording stop failed: ${error}`;
+						this._hasError = true;
+						reject(error);
+					}
+				};
+				recorder.stop();
+				this._isRecording = false;
+			} else resolve({
+				trimmedBlob: new Blob([], { type: this.mimeType }),
+				encryptedVideo: ""
+			});
+			recorder?.stream?.getTracks().forEach((track) => track.stop());
+		});
+	}
+	reset() {
+		this._isRecording = false;
+		this._error = null;
+		this._hasError = false;
+	}
+	pauseRecording() {
+		if (!this._isRecording) return;
+		if (this.mediaRecorder?.state === "recording") try {
+			this.mediaRecorder.pause();
+		} catch {}
+	}
+	registerEventListeners() {
+		document.addEventListener("visibilitychange", this.pauseRecordingBound);
+	}
+	removeEventListeners() {
+		document.removeEventListener("visibilitychange", this.pauseRecordingBound);
+	}
+};
+//#endregion
+//#region src/internal/faceCapture/recordingService.ts
+/**
+* Records on-device and uploads encrypted video for liveness.
+*/
+var LocalRecordingService = class {
+	constructor(wasmUtil, sessionToken) {
+		this.recorder = new LocalRecordingProvider();
+		this.sessionToken = sessionToken;
+		this.wasmUtil = wasmUtil;
+	}
+	async start(stream) {
+		this.recorder.startRecording(stream);
+		this.wasmUtil.osv();
+	}
+	async stop() {
+		if (!this.recorder.isRecording) return { recordingId: null };
+		this.wasmUtil.oev();
+		const result = await this.recorder.stopRecording(10, (base64) => this.wasmUtil.encryptImage(base64), (buffer) => this.wasmUtil.ckvcks(buffer));
+		if (!this.sessionToken) return { recordingId: null };
+		return { recordingId: await uploadDeepsightVideo(result.encryptedVideo, this.sessionToken) };
+	}
+	prepareUpload() {
+		return this.stop();
+	}
+	async stopAndGetVideo() {
+		if (!this.recorder.isRecording) return { videoBase64: void 0 };
+		try {
+			this.wasmUtil.oev();
+			const videoBase64 = (await this.recorder.stopRecording(10, (base64) => base64, () => {})).encryptedVideo;
+			return { videoBase64: videoBase64 ? videoBase64 : void 0 };
+		} catch {
+			return { videoBase64: void 0 };
+		}
+	}
+	cleanup() {
+		this.recorder.reset();
+	}
+};
+/**
+* Records a regular Selfie capture locally and streams it through the scoped
+* video-selfie-service multipart protocol. The recording is associated with
+* the interview asynchronously by the backend's `selfie` scope consumer, so
+* its upload id must not be forwarded to `/omni/add/face` as a legacy
+* `recordingId`.
+*/
+var MultipartFaceRecordingService = class {
+	constructor() {
+		this.service = new MultipartRecordingService("selfie");
+		this.pausedForAttempt = false;
+	}
+	async start(stream) {
+		if (this.pausedForAttempt) {
+			if (!this.service.resume()) throw new Error("Face recording did not resume");
+			this.pausedForAttempt = false;
+			return;
+		}
+		await this.service.start(stream);
+	}
+	async prepareUpload() {
+		this.pausedForAttempt = this.service.pause();
+		return { recordingId: null };
+	}
+	async stop() {
+		try {
+			await this.service.stop();
+		} finally {
+			this.pausedForAttempt = false;
+		}
+		return { recordingId: null };
+	}
+	pauseForBackground() {
+		this.service.pause();
+	}
+	async resumeFromBackground() {
+		this.service.resume();
+	}
+	async stopAndGetVideo() {
+		try {
+			await this.service.stop();
+		} finally {
+			this.pausedForAttempt = false;
+		}
+		return { videoBase64: void 0 };
+	}
+	cleanup() {
+		this.pausedForAttempt = false;
+		this.service.cleanup();
+	}
+};
+/**
+* Records through a consumer-injected remote provider and manages its session.
+*/
+var InjectedRecordingService = class {
+	constructor(config) {
+		this.config = config;
+	}
+	async start(stream) {
+		if (this.session) return;
+		this.session = await startRecordingSession({
+			config: this.config,
+			clonedStream: stream.clone()
+		});
+	}
+	async prepareUpload() {
+		return { recordingId: null };
+	}
+	async stop() {
+		if (this.session) {
+			stopRecording(this.session);
+			this.session = void 0;
+		}
+		return { recordingId: null };
+	}
+	async stopAndGetVideo() {
+		if (this.session) {
+			stopRecording(this.session);
+			this.session = void 0;
+		}
+		return { videoBase64: void 0 };
+	}
+	cleanup() {
+		if (this.session) stopRecording(this.session);
+	}
+};
+/**
+* Creates the recording service for the current configuration.
+*
+* Order of precedence:
+* 1. `onDeviceFaceResultsSubmissionEnabled === true` → no recording. The
+*    on-device workflow never uploads media, only the staged face-results
+*    JSON via `WebApi.postFaceResults`. Mirrors V1's
+*    `FaceFlowManager.setRecorders()` early return.
+* 2. `deepsightLiveness === 'VIDEOLIVENESS'` → local Deepsight recorder.
+* 3. `enableFaceRecording === true` → scoped multipart recorder. A custom
+*    injected recording capability remains supported for backwards-compatible
+*    dependency injection.
+* 4. otherwise → no recording.
+*/
+function createRecordingService(params) {
+	if (params.config.onDeviceFaceResultsSubmissionEnabled === true) return;
+	if (params.localDelivery === true) return params.config.enableFaceRecording === true || params.config.deepsightLiveness === "VIDEOLIVENESS" ? new LocalRecordingService(params.wasmUtil, null) : void 0;
+	if (params.config.deepsightLiveness === "VIDEOLIVENESS") return new LocalRecordingService(params.wasmUtil, params.sessionToken);
+	if (params.config.enableFaceRecording === true) return params.config.recording?.capability ? new InjectedRecordingService(params.config) : new MultipartFaceRecordingService();
+}
+//#endregion
+//#region src/internal/faceCapture/protectedFaceAttempt.ts
+const ON_DEVICE_MANUAL_CAPTURE_TIMEOUT_MS = 2147483647;
+var ProtectedFaceRecorderHooks = class {
+	constructor(config, dependencies, delivery) {
+		this.config = config;
+		this.dependencies = dependencies;
+		this.delivery = delivery;
+		this.mode = config.onDeviceFaceResultsSubmissionEnabled === true || config.enableFaceRecording !== true && config.deepsightLiveness !== "VIDEOLIVENESS" ? "none" : "finalizeBeforePoc";
+	}
+	async start(unprotectedStream) {
+		if (this.mode === "none") return;
+		const wasmUtil = await this.dependencies.getWasmUtil();
+		this.service = createRecordingService({
+			config: this.config,
+			wasmUtil,
+			sessionToken: getToken(),
+			localDelivery: this.delivery === "local"
+		});
+		await this.service?.start(unprotectedStream);
+	}
+	async prepareForPoc() {
+		if (!this.service) return {};
+		if (this.delivery === "local") {
+			try {
+				const result = await this.service.stopAndGetVideo();
+				this.captureOnlyVideoBase64 = result.videoBase64;
+			} catch {
+				this.captureOnlyVideoBase64 = void 0;
+			}
+			return {};
+		}
+		return this.service.stop();
+	}
+	async resumeAfterPoc() {}
+	pauseForBackground() {
+		this.service?.pauseForBackground?.();
+	}
+	async resumeFromBackground(unprotectedStream) {
+		await this.service?.resumeFromBackground?.(unprotectedStream);
+	}
+	dispose() {
+		try {
+			this.service?.cleanup();
+		} finally {
+			this.service = void 0;
+		}
+	}
+	takeCaptureOnlyVideo() {
+		const video = this.captureOnlyVideoBase64;
+		this.captureOnlyVideoBase64 = void 0;
+		return video;
+	}
+};
+let nextAttemptNumber = 1;
+/**
+* Private composition object for one still-face attempt. It owns provider
+* callbacks and raw-stream handoff outside XState; the machine sees only the
+* presentation stream/canvas and allowlisted semantic results.
+*/
+var ProtectedFaceAttemptRuntime = class ProtectedFaceAttemptRuntime {
+	constructor(options) {
+		this.options = options;
+		this.attemptId = `face-${nextAttemptNumber++}`;
+		this.acquiredUsingBackCamera = false;
+		this.rawHandedOff = false;
+		this.rawStreamReleased = false;
+		this.released = false;
+		this.recorderTransferred = false;
+		this.pendingSignals = [];
+		this.provider = options.faceDetection;
+		this.recorder = new ProtectedFaceRecorderHooks(options.config, options.dependencies, options.delivery);
+		this.cycleOwnership = createCameraCycleOwnership(options.cycle);
+	}
+	get delivery() {
+		return this.options.delivery;
+	}
+	get usingBackCamera() {
+		return this.acquiredUsingBackCamera;
+	}
+	setDeepsightService(service) {
+		if (this.released || this.deepsightService) return;
+		this.deepsightService = service;
+	}
+	async preAcquire() {
+		await this.acquireRawStream();
+	}
+	subscribeSignals(listener) {
+		if (this.released) return () => void 0;
+		this.signalListener = listener;
+		const queued = this.pendingSignals;
+		this.pendingSignals = [];
+		queued.forEach(listener);
+		return () => {
+			if (this.signalListener === listener) this.signalListener = void 0;
+		};
+	}
+	toActorInput(onStartupTiming) {
+		this.recorderTransferred = true;
+		return {
+			attemptId: this.attemptId,
+			target: this.options.target,
+			workflow: this.options.config.onDeviceFaceResultsSubmissionEnabled === true ? 5 : 4,
+			streamSource: {
+				kind: "acquire",
+				acquire: async () => {
+					const result = await this.acquireRawStream();
+					this.rawHandedOff = true;
+					return {
+						stream: result.stream,
+						constraints: result.constraints
+					};
+				}
+			},
+			cycle: this.options.cycle,
+			cycleOwnership: this.cycleOwnership,
+			recorder: this.recorder,
+			releaseUnadoptedStream: (stream) => stopStream(stream),
+			configureWorkflow: () => this.configureWorkflow(),
+			runPrc: () => this.runPrc(),
+			runPoc: () => this.runPoc(),
+			onStartupTiming,
+			faceResults: this.provider
+		};
+	}
+	createUploadCommand(recordingId) {
+		const token = getToken();
+		const config = {
+			headers: token ? { "X-Incode-Hardware-Id": token } : void 0,
+			timeout: 3e4
+		};
+		if (this.options.config.onDeviceFaceResultsSubmissionEnabled === true) return {
+			type: "UPLOAD_FACE_RESULTS",
+			config
+		};
+		const validRecordingId = recordingId && recordingId.trim().length > 0 ? recordingId : void 0;
+		if (this.options.target === PROTECTED_CAPTURE_TARGET.authentication) return {
+			type: "UPLOAD_PROTECTED",
+			request: {
+				target: PROTECTED_CAPTURE_TARGET.authentication,
+				extras: {
+					deviceClass: getDeviceClass(),
+					hint: this.options.authHint,
+					...validRecordingId ? { recordingId: validRecordingId } : {}
+				},
+				config
+			}
+		};
+		return {
+			type: "UPLOAD_PROTECTED",
+			request: {
+				target: PROTECTED_CAPTURE_TARGET.selfie,
+				extras: { deviceClass: getDeviceClass() },
+				config: {
+					...config,
+					params: {
+						imageType: "selfie",
+						...validRecordingId ? { recordingId: validRecordingId } : {}
+					}
+				}
+			}
+		};
+	}
+	mapProtectedResult(result) {
+		if (result.kind === "onDeviceFace") return {};
+		if (result.kind === "authentication") return {
+			overallStatus: result.overallStatus,
+			captureAttemptsLimit: {
+				max: this.options.config.captureAttempts ?? this.options.config.numberOfAttempts ?? 3,
+				remaining: result.attemptsRemaining ?? 0
+			},
+			candidate: "",
+			error: {
+				name: result.errorName ?? "",
+				message: result.errorName ?? ""
+			}
+		};
+		return result;
+	}
+	takeCaptureOnlyVideo() {
+		return this.recorder.takeCaptureOnlyVideo();
+	}
+	next() {
+		return new ProtectedFaceAttemptRuntime(this.options);
+	}
+	release() {
+		if (this.released) return;
+		this.released = true;
+		this.signalListener = void 0;
+		this.pendingSignals = [];
+		if (!this.recorderTransferred) try {
+			this.recorder.dispose();
+		} catch {}
+		try {
+			Promise.resolve(this.provider.dispose()).catch(() => void 0);
+		} catch {}
+		this.cycleOwnership.releaseByController();
+		if (!this.rawHandedOff) this.acquired?.then(({ stream }) => this.releaseRawStream(stream), () => void 0);
+	}
+	async acquireRawStream() {
+		if (!this.acquired) this.acquired = this.options.acquireCamera(this.provider);
+		const result = await this.acquired;
+		this.acquiredUsingBackCamera = result.usingBackCamera;
+		if (this.released) {
+			this.releaseRawStream(result.stream);
+			throw new Error("Protected face attempt was released");
+		}
+		return result;
+	}
+	async configureWorkflow() {
+		await this.provider.initialize({
+			autocaptureInterval: this.options.config.onDeviceFaceResultsSubmissionEnabled === true ? ON_DEVICE_MANUAL_CAPTURE_TIMEOUT_MS : this.options.config.autoCaptureTimeout * 1e3,
+			useOnDeviceWorkflow: this.options.config.onDeviceFaceResultsSubmissionEnabled === true
+		});
+		if (this.released) return;
+		this.provider.setChecksEnabled({
+			lenses: this.options.config.validateLenses ?? false,
+			mask: this.options.config.validateFaceMask ?? false,
+			closedEyes: this.options.config.validateClosedEyes ?? false,
+			headWear: this.options.config.validateHeadCover ?? false,
+			occlusion: false
+		});
+		this.provider.setCallbacks({
+			onFarAway: () => this.emitDetection("tooFar"),
+			onTooClose: () => this.emitDetection("tooClose"),
+			onTooManyFaces: () => this.emitDetection("tooManyFaces"),
+			onNoFace: () => this.emitDetection("idle"),
+			onCenterFace: () => this.emitDetection("centerFace"),
+			onGetReady: () => this.emitDetection("getReady"),
+			onGetReadyFinished: () => this.emitDetection("getReadyFinished"),
+			onDark: () => {
+				if (this.options.config.validateBrightness) this.emitDetection("dark");
+			},
+			onBlur: () => this.emitDetection("blur"),
+			onFaceAngle: () => this.emitDetection("faceAngle"),
+			onLenses: () => {
+				if (this.options.config.validateLenses) this.emitDetection("lenses");
+			},
+			onMask: () => {
+				if (this.options.config.validateFaceMask) this.emitDetection("faceMask");
+			},
+			onEyesClosed: () => {
+				if (this.options.config.validateClosedEyes) this.emitDetection("eyesClosed");
+			},
+			onHeadWear: () => {
+				if (this.options.config.validateHeadCover) this.emitDetection("headWear");
+			},
+			onFaceOccluded: () => this.emitDetection("faceOcclusion"),
+			onSwitchToManualCapture: () => {
+				if (this.options.config.onDeviceFaceResultsSubmissionEnabled !== true) this.emitDetection("manualCapture");
+			},
+			onCapture: (canvas) => {
+				this.emit({
+					type: "autoCapture",
+					preview: canvas.canvas
+				});
+			}
+		});
+		this.emitDetection("detecting");
+	}
+	async runPrc() {
+		if (this.options.delivery === "protected") await this.attachProtectedCameraMetadata();
+		if (this.released) return;
+		const wasmUtil = await this.options.dependencies.getWasmUtil();
+		if (this.released) return;
+		await wasmUtil.prc();
+	}
+	async runPoc() {
+		if (this.options.delivery === "local") return;
+		const deepsight = this.deepsightService;
+		if (!deepsight) throw new Error("Protected face Deepsight is not ready");
+		await deepsight.performVirtualCameraCheck(getToken(), "SELFIE");
+		if (this.released) return;
+		try {
+			await deepsight.finalizeProtectedCaptureMetadata();
+		} catch {
+			trueSightLog("warning", "deepsight", "faceScan", "protected capture metadata finalization failed");
+		}
+		if (this.released) return;
+		try {
+			addDeviceStats({
+				frontIdStatsAnalysisStatus: "",
+				backIdStatsAnalysisStatus: "",
+				selfieStatsAnalysisStatus: deepsight.getAnalysisStatus(),
+				motionStatus: deepsight.getMotionStatus()
+			});
+		} catch {}
+		const logs = deepsight.getPipelineState();
+		this.options.dependencies.trackCaptureAttemptFinished?.({ logs });
+	}
+	async attachProtectedCameraMetadata() {
+		const deepsight = this.deepsightService;
+		if (!deepsight) return;
+		try {
+			const { stream } = await this.acquireRawStream();
+			const [videoTrack] = stream.getVideoTracks();
+			if (videoTrack) await deepsight.checkVirtualCamera(videoTrack);
+		} catch {
+			trueSightLog("warning", "deepsight", "faceScan", "protected camera metadata attachment failed");
+		}
+	}
+	emitDetection(status) {
+		this.emit({
+			type: "detection",
+			status
+		});
+	}
+	emit(signal) {
+		if (this.released) return;
+		if (this.signalListener) this.signalListener(signal);
+		else this.pendingSignals.push(signal);
+	}
+	releaseRawStream(stream) {
+		if (this.rawHandedOff || this.rawStreamReleased) return;
+		this.rawStreamReleased = true;
+		try {
+			stopStream(stream);
+		} catch {}
+	}
+};
+//#endregion
+//#region src/internal/faceCapture/protectedFaceController.ts
+/**
+* Binds one face-machine variant to a fixed native target and delivery mode.
+* The capability-bearing runtime and lifecycle input never leave this callback
+* actor's closure, so parent snapshots contain only presentation/output data.
+*/
+function createProtectedFaceControllerActor(options) {
+	return fromCallback(({ sendBack, receive }) => {
+		let controllerInput;
+		let runtime;
+		let deepsightService;
+		let deepsightState = "idle";
+		let signalCleanup;
+		let lifecycleCleanup;
+		let sendLifecycle;
+		let committedPreview;
+		let pendingAutoPreview;
+		let recording = {};
+		let generation = 0;
+		let active = true;
+		let diagnosticAttempt = 0;
+		let diagnosticStartedAt;
+		const logDiagnostic = (event, fields = {}) => {
+			if (diagnosticStartedAt === void 0) return;
+			logFaceCameraDiagnostic(event, {
+				attempt: diagnosticAttempt,
+				target: options.target === PROTECTED_CAPTURE_TARGET.authentication ? "authentication" : "selfie",
+				delivery: options.delivery,
+				elapsedMs: Math.round(getTimestamp() - diagnosticStartedAt),
+				...fields
+			});
+		};
+		const getControllerInput = () => {
+			if (!controllerInput) throw new Error("Protected face controller is not bound");
+			return controllerInput;
+		};
+		const ensureRuntime = () => {
+			if (!runtime) {
+				const input = getControllerInput();
+				const capabilities = options.createCapabilities();
+				runtime = new ProtectedFaceAttemptRuntime({
+					config: input.config,
+					dependencies: input.dependencies,
+					target: options.target,
+					delivery: options.delivery,
+					authHint: input.authHint,
+					faceDetection: capabilities.faceDetection,
+					cycle: capabilities.cycle,
+					acquireCamera: (provider) => initializeCamera({
+						config: input.config,
+						provider
+					})
+				});
+				if (deepsightService) runtime.setDeepsightService(deepsightService);
+			}
+			return runtime;
+		};
+		const releaseCurrent = (reason) => {
+			logDiagnostic("attempt-release", { releaseReason: reason });
+			diagnosticStartedAt = void 0;
+			generation += 1;
+			signalCleanup?.();
+			signalCleanup = void 0;
+			sendLifecycle?.({
+				type: "RELEASE",
+				reason
+			});
+			sendLifecycle = void 0;
+			lifecycleCleanup?.();
+			lifecycleCleanup = void 0;
+			runtime?.release();
+			runtime = void 0;
+			try {
+				deepsightService?.cleanup();
+			} catch {}
+			deepsightService = void 0;
+			deepsightState = "idle";
+			committedPreview = void 0;
+			pendingAutoPreview = void 0;
+			recording = {};
+		};
+		const initializeDeepsight = () => {
+			if (deepsightState === "ready") {
+				sendBack({ type: "PROTECTED_DEEPSIGHT_READY" });
+				return;
+			}
+			if (deepsightState === "initializing") return;
+			deepsightState = "initializing";
+			const input = getControllerInput();
+			const ownerGeneration = generation;
+			options.initializeDeepsight({
+				ds: input.config.ds,
+				storage: input.dependencies.storage
+			}).then((service) => {
+				if (!active || generation !== ownerGeneration) {
+					try {
+						service.cleanup();
+					} catch {}
+					return;
+				}
+				deepsightService = service;
+				deepsightState = "ready";
+				runtime?.setDeepsightService(service);
+				sendBack({ type: "PROTECTED_DEEPSIGHT_READY" });
+				const preview = pendingAutoPreview;
+				pendingAutoPreview = void 0;
+				if (preview) queueMicrotask(() => {
+					if (active && generation === ownerGeneration) sendBack({
+						type: "PROTECTED_NATIVE_AUTO_CAPTURE",
+						preview
+					});
+				});
+			}, () => {
+				if (!active || generation !== ownerGeneration) return;
+				deepsightState = "failed";
+				sendBack({ type: "PROTECTED_DEEPSIGHT_FAILED" });
+			}).finally(() => {
+				if (generation === ownerGeneration) {}
+			});
+		};
+		const finalizeLocalCapture = async (owner, ownerGeneration) => {
+			const preview = committedPreview;
+			if (!preview) throw new Error("selfieCaptureOnly: no captured image");
+			let metadata = "";
+			try {
+				metadata = deepsightService?.getMetadata() ?? "";
+			} catch {
+				metadata = "";
+			}
+			const canvas = new IncodeCanvas(preview);
+			const blobData = canvas.getBlobData();
+			if (!blobData) throw new Error("selfieCaptureOnly: failed to build image blob");
+			const result = {
+				imageBase64: canvas.getBase64Image() ?? "",
+				blob: blobData.blob,
+				url: blobData.url,
+				metadata,
+				videoBase64: owner.takeCaptureOnlyVideo()
+			};
+			if (active && runtime === owner && generation === ownerGeneration) {
+				sendBack({
+					type: "PROTECTED_LOCAL_DONE",
+					attemptId: owner.attemptId,
+					result
+				});
+				logDiagnostic("upload-complete");
+			}
+		};
+		const forwardLifecycleEvent = (event, owner, ownerGeneration) => {
+			if (!active || runtime !== owner || generation !== ownerGeneration) return;
+			switch (event.type) {
+				case "PROTECTED_ATTEMPT_READY":
+					logDiagnostic("camera-ready");
+					sendBack({
+						...event,
+						usingBackCamera: owner.usingBackCamera
+					});
+					return;
+				case "PROTECTED_AUTO_COMMITTED":
+				case "PROTECTED_MANUAL_COMMITTED":
+					logDiagnostic("capture-selected", { captureKind: event.type === "PROTECTED_AUTO_COMMITTED" ? "auto" : "manual" });
+					committedPreview = event.preview;
+					sendBack(event);
+					return;
+				case "PROTECTED_ATTEMPT_FINALIZED":
+					logDiagnostic("attempt-finalized");
+					recording = event.recording;
+					sendBack(event);
+					return;
+				case "PROTECTED_UPLOAD_DONE":
+					if (event.result.kind === "id") {
+						sendBack({
+							type: "PROTECTED_ATTEMPT_FAILED",
+							attemptId: event.attemptId,
+							failure: {
+								stage: "upload",
+								code: "protected-attempt-unexpected-result"
+							}
+						});
+						return;
+					}
+					sendBack({
+						type: "PROTECTED_UPLOAD_MAPPED",
+						attemptId: event.attemptId,
+						response: owner.mapProtectedResult(event.result)
+					});
+					logDiagnostic("upload-complete");
+					return;
+				case "PROTECTED_ATTEMPT_FAILED":
+					logDiagnostic("attempt-failed", {
+						failureStage: event.failure.stage,
+						failureCode: event.failure.code
+					});
+					sendBack(event);
+					return;
+				default: sendBack(event);
+			}
+		};
+		const start = (visible) => {
+			if (lifecycleCleanup) {
+				sendLifecycle?.({ type: visible ? "FOREGROUND" : "BACKGROUND" });
+				return;
+			}
+			const owner = ensureRuntime();
+			diagnosticAttempt += 1;
+			diagnosticStartedAt = getTimestamp();
+			logDiagnostic("attempt-start");
+			const ownerGeneration = generation;
+			signalCleanup = owner.subscribeSignals((signal) => {
+				if (!active || runtime !== owner || generation !== ownerGeneration) return;
+				if (signal.type === "detection") {
+					sendBack({
+						type: "DETECTION_UPDATE",
+						status: signal.status
+					});
+					return;
+				}
+				if (deepsightState === "ready") sendBack({
+					type: "PROTECTED_NATIVE_AUTO_CAPTURE",
+					preview: signal.preview
+				});
+				else pendingAutoPreview ??= signal.preview;
+			});
+			lifecycleCleanup = runProtectedAttempt({
+				input: owner.toActorInput((timing) => {
+					logDiagnostic("camera-startup", timing);
+				}),
+				sendBack: (event) => forwardLifecycleEvent(event, owner, ownerGeneration),
+				receive: (listener) => {
+					sendLifecycle = listener;
+				}
+			});
+			sendLifecycle?.({ type: visible ? "FOREGROUND" : "BACKGROUND" });
+		};
+		receive((command) => {
+			if (command.type === "BIND_PROTECTED_FACE_CONTROLLER") {
+				controllerInput ??= command.input;
+				return;
+			}
+			switch (command.type) {
+				case "INITIALIZE_DEEPSIGHT":
+					initializeDeepsight();
+					return;
+				case "PRE_ACQUIRE": {
+					const owner = ensureRuntime();
+					const ownerGeneration = generation;
+					owner.preAcquire().then(() => {
+						if (active && runtime === owner && generation === ownerGeneration) sendBack({
+							type: "PROTECTED_PRE_ACQUIRE_DONE",
+							usingBackCamera: owner.usingBackCamera
+						});
+					}, (error) => {
+						if (active && runtime === owner && generation === ownerGeneration) sendBack({
+							type: "PROTECTED_PRE_ACQUIRE_FAILED",
+							error
+						});
+					});
+					return;
+				}
+				case "START":
+					start(command.visible);
+					return;
+				case "AUTO_CAPTURED":
+				case "MANUAL_CAPTURE":
+				case "FINALIZE":
+					if (deepsightState !== "ready") return;
+					sendLifecycle?.(command);
+					return;
+				case "BACKGROUND":
+				case "FOREGROUND":
+					sendLifecycle?.(command);
+					return;
+				case "UPLOAD": {
+					const owner = runtime;
+					if (!owner) return;
+					logDiagnostic("upload-start");
+					if (options.delivery === "protected") {
+						sendLifecycle?.(owner.createUploadCommand(recording.recordingId));
+						return;
+					}
+					finalizeLocalCapture(owner, generation).catch(() => {
+						if (active && runtime === owner) sendBack({
+							type: "PROTECTED_ATTEMPT_FAILED",
+							attemptId: owner.attemptId,
+							failure: {
+								stage: "upload",
+								code: "protected-attempt-local-finalize-failed"
+							}
+						});
+					});
+					return;
+				}
+				case "RESET":
+					releaseCurrent("retry");
+					return;
+				case "RELEASE": releaseCurrent(command.reason);
+			}
+		});
+		return () => {
+			active = false;
+			releaseCurrent("externalStop");
+		};
+	});
+}
+//#endregion
+//#region src/internal/faceCapture/protectedFaceComposition.ts
+/**
+* Private composition root for protected still-face variants. Provider
+* construction remains in Infra; the controller receives only capability
+* interfaces/factories and owns them in its callback closure.
+*/
+function createDefaultProtectedFaceControllerActor(options) {
+	return createProtectedFaceControllerActor({
+		...options,
+		createCapabilities: createProtectedFaceCaptureCapabilities,
+		initializeDeepsight: initializeDeepsightSession
+	});
+}
+//#endregion
+//#region src/internal/faceCapture/faceCaptureSetup.ts
+const getAttemptsFromConfig = (config) => {
+	return config.captureAttempts ?? config.numberOfAttempts ?? 3;
+};
+/**
+* The protected face controller is invoked at the machine root, so a started
+* machine has it for its whole lifetime and every guarded send below behaves
+* like a plain `sendTo`. Harnesses that start the machine from a resolved
+* snapshot carry no children (the Storybook state stories seed managers that
+* way), and XState throws on a send to a missing actor, so each send checks
+* for the controller first.
+*
+* Only sends that run after the machine has started may use this guard. A
+* root `entry` action runs inside the initial transition, before the actor
+* has a committed snapshot; XState delivers a plain `sendTo` from there
+* through its deferred-actor path, whereas this check cannot see the child
+* yet and would skip the send.
+*/
+function isProtectedFaceControllerRunning(self) {
+	return self.getSnapshot()?.children?.["protectedFaceController"] !== void 0;
+}
+const faceCaptureMachine = setup({
+	types: {
+		context: {},
+		events: {},
+		input: {}
+	},
+	actors: {
+		checkPermission: fromPromise(async () => {
+			return checkPermission();
+		}),
+		requestPermission: fromPromise(async ({ input }) => {
+			return invokeRequestPermissionActor(input);
+		}),
+		protectedFaceController: createDefaultProtectedFaceControllerActor({
+			target: PROTECTED_CAPTURE_TARGET.selfie,
+			delivery: "protected"
+		}),
+		runAvatar: fromCallback(({ input, sendBack }) => {
+			const { obfuscateWithAvatar, avatarVariant } = concealmentToAvatar(input.config.selfieConcealmentOption);
+			if (!obfuscateWithAvatar || !input.stream) return () => {};
+			const stream = input.stream;
+			const variant = avatarVariant ?? "avatar-3d";
+			let handle = null;
+			let cancelled = false;
+			(async () => {
+				try {
+					const created = await createFaceAvatar({
+						variant,
+						stream,
+						assets: input.config.avatarAssets
+					});
+					if (cancelled) {
+						created.stop();
+						return;
+					}
+					handle = created;
+					sendBack({
+						type: "AVATAR_READY",
+						canvas: created.canvas
+					});
+				} catch (err) {
+					console.warn("[face-avatar] failed to start avatar overlay", err);
+				}
+			})();
+			return () => {
+				cancelled = true;
+				handle?.stop();
+			};
+		}),
+		manualUploadMachine: manualFaceUploadMachine,
+		prepareFaceUpload: fromPromise(async () => {
+			throw new Error("prepareFaceUpload must be provided by variant");
+		}),
+		uploadFace: fromPromise(async () => new Promise(() => {})),
+		processFace: fromPromise(async () => {
+			throw new Error("processFace must be provided by variant");
+		})
+	},
+	actions: {
+		bindProtectedFaceController: sendTo("protectedFaceController", ({ context }) => ({
+			type: "BIND_PROTECTED_FACE_CONTROLLER",
+			input: {
+				config: context.config,
+				dependencies: context.dependencies,
+				authHint: context.authHint
+			}
+		})),
+		stopMediaStream: assign(() => {
+			return {
+				stream: void 0,
+				avatarCanvas: void 0,
+				usingBackCamera: false
+			};
+		}),
+		setCameraPreAcquired: assign({ usingBackCamera: ({ event }) => event.usingBackCamera }),
+		trackTutorial: () => void 0,
+		trackContinue: () => {},
+		resetContext: assign(({ context }) => {
+			return {
+				stream: void 0,
+				usingBackCamera: false,
+				error: void 0,
+				detectionStatus: "idle",
+				capturedImage: void 0,
+				faceCoordinates: void 0,
+				uploadResponse: void 0,
+				processResponse: void 0,
+				attemptsRemaining: getAttemptsFromConfig(context.config),
+				uploadError: void 0,
+				permissionResult: void 0,
+				deepsightReady: false,
+				manualCaptureTriggered: false,
+				captureOnlyResult: void 0,
+				avatarCanvas: void 0
+			};
+		}),
+		clearUploadFailure: assign({
+			uploadError: () => void 0,
+			detectionStatus: () => "idle",
+			capturedImage: () => void 0
+		}),
+		clearProtectedAttempt: assign(() => {
+			return {
+				stream: void 0,
+				avatarCanvas: void 0,
+				usingBackCamera: false
+			};
+		}),
+		decrementAttemptsRemaining: assign(({ context }) => ({ attemptsRemaining: context.attemptsRemaining - 1 })),
+		setUploadErrorFromUploadValidation: assign({ uploadError: () => FACE_ERROR_CODES.SERVER }),
+		setTerminalError: assign({ error: () => "Authentication failed" }),
+		cleanup: () => void 0,
+		setPermissionResultFromEvent: assign({ permissionResult: ({ event }) => event.output }),
+		setPermissionDenied: assign({ permissionResult: () => "denied" }),
+		setPermissionPrompt: assign({ permissionResult: () => "prompt" }),
+		setPermissionRefresh: assign({ permissionResult: () => "refresh" }),
+		setDeepsightReady: assign({ deepsightReady: () => true }),
+		setDeepsightNotReady: assign({ deepsightReady: () => false }),
+		setErrorFromEvent: assign({ error: ({ event }) => String(event.error) }),
+		setDetectionStatusDetecting: assign({ detectionStatus: ({ context }) => context.manualCaptureTriggered ? "manualCapture" : "detecting" }),
+		setDetectionStatusFromEvent: assign({ detectionStatus: ({ event }) => event.status }),
+		setManualCaptureTriggered: assign({ manualCaptureTriggered: ({ context, event }) => {
+			const status = event.status;
+			return context.manualCaptureTriggered || status === "manualCapture";
+		} }),
+		setAvatarCanvas: assign({ avatarCanvas: ({ event }) => event.canvas }),
+		clearAvatarCanvas: assign({ avatarCanvas: () => void 0 }),
+		setCapturedImageFromEvent: assign({
+			capturedImage: ({ event }) => event.canvas,
+			faceCoordinates: ({ event }) => event.faceCoordinates
+		}),
+		setProtectedAttemptReady: assign({
+			stream: ({ event }) => event.displayStream,
+			usingBackCamera: ({ event }) => event.usingBackCamera
+		}),
+		setProtectedCommittedPreview: assign({
+			capturedImage: ({ event }) => new IncodeCanvas(event.preview),
+			faceCoordinates: () => void 0,
+			detectionStatus: () => "success"
+		}),
+		setProtectedFinalization: assign({
+			uploadRecordingId: ({ event }) => event.recording.recordingId ?? null,
+			stream: ({ context, event }) => event.displayStream ?? context.stream
+		}),
+		setProtectedUploadResponse: assign({ uploadResponse: ({ event }) => event.response }),
+		setProtectedLocalResult: assign({ captureOnlyResult: ({ event }) => event.result }),
+		setProtectedFailure: assign({ error: ({ event }) => event.failure.code }),
+		setProtectedVisibility: assign({ protectedVisible: ({ event }) => event.visible }),
+		setUploadPreparationFromEvent: assign({
+			encryptedBase64Image: ({ event }) => event.output.encryptedBase64Image,
+			uploadRecordingId: ({ event }) => event.output.recordingId
+		}),
+		setUploadResponseFromEvent: assign({ uploadResponse: ({ event }) => event.output }),
+		setProcessResponseFromEvent: assign({ processResponse: ({ event }) => event.output }),
+		setServerErrorAndDecrement: assign(({ context }) => ({
+			uploadError: FACE_ERROR_CODES.SERVER,
+			attemptsRemaining: context.attemptsRemaining - 1
+		})),
+		sendLabelInspection: () => {
+			sendLabelInspectionEvent();
+		},
+		flagFaceManualReview: () => {
+			flagFaceManualReview();
+		},
+		preloadRecordingProvider: () => void 0,
+		warmAvatarProvider: ({ context }) => {
+			const { obfuscateWithAvatar, avatarVariant } = concealmentToAvatar(context.config.selfieConcealmentOption);
+			if (!obfuscateWithAvatar || !avatarVariant) return;
+			warmFaceAvatar({
+				variant: avatarVariant,
+				assets: context.config.avatarAssets
+			});
+		},
+		releaseAvatarWarmup: () => {
+			releaseFaceAvatarWarmup();
+		},
+		noOp: () => void 0,
+		forwardToManualUpload: sendTo("manualUpload", ({ event }) => event),
+		sendProtectedPreAcquire: enqueueActions(({ enqueue, self }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", { type: "PRE_ACQUIRE" });
+		}),
+		startProtectedAttempt: enqueueActions(({ enqueue, self, context }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", {
+				type: "START",
+				visible: context.protectedVisible
+			});
+		}),
+		initializeProtectedDeepsight: enqueueActions(({ enqueue, self }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", { type: "INITIALIZE_DEEPSIGHT" });
+		}),
+		resetProtectedController: enqueueActions(({ enqueue, self }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", { type: "RESET" });
+		}),
+		sendProtectedAutoCapture: enqueueActions(({ enqueue, self, event }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", {
+				type: "AUTO_CAPTURED",
+				preview: event.preview
+			});
+		}),
+		sendProtectedManualCapture: enqueueActions(({ enqueue, self }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", { type: "MANUAL_CAPTURE" });
+		}),
+		sendProtectedFinalize: enqueueActions(({ enqueue, self }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", { type: "FINALIZE" });
+		}),
+		sendProtectedUploadIfNeeded: enqueueActions(({ enqueue, self }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", { type: "UPLOAD" });
+		}),
+		sendProtectedVisibility: enqueueActions(({ enqueue, self, event }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", { type: event.visible ? "FOREGROUND" : "BACKGROUND" });
+		}),
+		releaseProtectedAttempt: enqueueActions(({ enqueue, self, event }) => {
+			if (!isProtectedFaceControllerRunning(self)) return;
+			enqueue.sendTo("protectedFaceController", {
+				type: "RELEASE",
+				reason: event.reason ?? "externalStop"
+			});
+		})
+	},
+	guards: {
+		hasShowTutorial: ({ context }) => context.config.showTutorial,
+		hasAgeAssurance: ({ context }) => context.config.ageAssurance === true,
+		hasManualUploadEnabled: () => false,
+		isManualUploadExhausted: ({ event }) => event.output?.result === "exhausted",
+		isPermissionGranted: ({ event }) => {
+			if ("output" in event) return event.output === "granted";
+			return false;
+		},
+		isReadyForCapture: ({ context, event }) => {
+			return isReadyForCaptureFromPermission(resolveStoredPermissionResult("output" in event ? event.output : void 0, context.permissionResult), context.config.ds);
+		},
+		needsMotionPrimeOnly: ({ context, event }) => {
+			return needsMotionPrimeOnlyFromPermission(resolveStoredPermissionResult("output" in event ? event.output : void 0, context.permissionResult), context.config.ds);
+		},
+		isPermissionDeniedError: ({ event }) => {
+			if ("error" in event) {
+				const error = event.error;
+				return error?.name === "NotAllowedError" || error?.name === "PermissionDeniedError";
+			}
+			return false;
+		},
+		hasStream: ({ context }) => context.stream !== void 0,
+		isCameraAndDeepsightReady: ({ context }) => context.stream !== void 0 && context.deepsightReady,
+		hasAttemptsRemaining: ({ context }) => context.attemptsRemaining > 0,
+		hasCapturedImage: ({ context }) => context.capturedImage !== void 0,
+		canCommitProtectedManual: ({ context }) => context.manualCaptureTriggered && context.config.onDeviceFaceResultsSubmissionEnabled !== true,
+		isProtectedManualRefusal: ({ event }) => event.failure.stage === "manualCommit",
+		isProtectedUploadFailure: ({ event }) => event.failure.stage === "upload",
+		hasUploadValidationError: () => false,
+		isTerminalUploadError: () => false,
+		isNoAttemptsTerminal: () => false
+	}
+}).createMachine({
+	id: "faceCapture",
+	initial: "idle",
+	entry: "bindProtectedFaceController",
+	context: ({ input }) => ({
+		config: input.config,
+		dependencies: input.dependencies,
+		authHint: input.authHint,
+		stream: void 0,
+		usingBackCamera: false,
+		error: void 0,
+		detectionStatus: "idle",
+		capturedImage: void 0,
+		faceCoordinates: void 0,
+		uploadResponse: void 0,
+		processResponse: void 0,
+		attemptsRemaining: getAttemptsFromConfig(input.config),
+		uploadError: void 0,
+		permissionResult: void 0,
+		deepsightReady: false,
+		encryptedBase64Image: void 0,
+		uploadRecordingId: void 0,
+		manualCaptureTriggered: false,
+		captureOnlyResult: void 0,
+		avatarCanvas: void 0,
+		faceFeed: void 0,
+		protectedVisible: true
+	}),
+	invoke: {
+		id: "protectedFaceController",
+		src: "protectedFaceController"
+	},
+	on: {
+		QUIT: { target: "#faceCapture.closed" },
+		PROTECTED_VISIBILITY: { actions: "setProtectedVisibility" },
+		PROTECTED_DEEPSIGHT_READY: { actions: "setDeepsightReady" },
+		PROTECTED_DEEPSIGHT_FAILED: { actions: "setDeepsightNotReady" }
+	},
+	states: {
+		idle: { on: { LOAD: [
+			{
+				target: "tutorial",
+				guard: "hasShowTutorial"
+			},
+			{
+				target: "tutorial",
+				guard: "hasAgeAssurance"
+			},
+			{ target: "loading" }
+		] } },
+		loading: {
+			entry: [
+				"preloadRecordingProvider",
+				"warmAvatarProvider",
+				"initializeProtectedDeepsight"
+			],
+			invoke: {
+				id: "checkPermissionLoading",
+				src: "checkPermission",
+				onDone: [{
+					target: "capture",
+					guard: "isReadyForCapture",
+					actions: "setPermissionResultFromEvent"
+				}, {
+					target: "permissions",
+					actions: "setPermissionResultFromEvent"
+				}]
+			}
+		},
+		tutorial: {
+			initial: "checkingPermission",
+			entry: [
+				"trackTutorial",
+				"preloadRecordingProvider",
+				"warmAvatarProvider"
+			],
+			on: { GO_TO_MANUAL_UPLOAD: {
+				guard: "hasManualUploadEnabled",
+				target: "#faceCapture.manualUpload"
+			} },
+			states: {
+				checkingPermission: { invoke: {
+					id: "checkPermissionTutorial",
+					src: "checkPermission",
+					onDone: [{
+						target: "initializingCamera",
+						guard: "isReadyForCapture",
+						actions: "setPermissionResultFromEvent"
+					}, {
+						target: "ready",
+						actions: "setPermissionResultFromEvent"
+					}]
+				} },
+				initializingCamera: {
+					type: "parallel",
+					states: {
+						cameraInit: {
+							initial: "initializingDeepsight",
+							states: {
+								initializingDeepsight: {
+									entry: "initializeProtectedDeepsight",
+									on: {
+										PROTECTED_DEEPSIGHT_READY: {
+											target: "initializingStream",
+											actions: "setDeepsightReady"
+										},
+										PROTECTED_DEEPSIGHT_FAILED: {
+											target: "#faceCapture.tutorial.ready",
+											actions: "setDeepsightNotReady"
+										}
+									}
+								},
+								initializingStream: {
+									entry: "sendProtectedPreAcquire",
+									on: {
+										PROTECTED_PRE_ACQUIRE_DONE: {
+											target: "ready",
+											actions: "setCameraPreAcquired"
+										},
+										PROTECTED_PRE_ACQUIRE_FAILED: [{
+											target: "#faceCapture.tutorial.ready",
+											guard: "isPermissionDeniedError",
+											actions: "setPermissionDenied"
+										}, {
+											target: "#faceCapture.tutorial.ready",
+											actions: "setErrorFromEvent"
+										}]
+									}
+								},
+								ready: { type: "final" }
+							}
+						},
+						userIntent: {
+							initial: "waiting",
+							states: {
+								waiting: { on: { NEXT_STEP: {
+									target: "clicked",
+									actions: "trackContinue"
+								} } },
+								clicked: { type: "final" }
+							}
+						}
+					},
+					onDone: { target: "#faceCapture.capture" }
+				},
+				ready: {
+					initial: "idle",
+					states: {
+						idle: { always: [{
+							target: "initializingDeepsight",
+							guard: ({ context }) => !context.deepsightReady
+						}, { target: "readyForNext" }] },
+						initializingDeepsight: {
+							entry: "initializeProtectedDeepsight",
+							on: {
+								PROTECTED_DEEPSIGHT_READY: {
+									target: "readyForNext",
+									actions: "setDeepsightReady"
+								},
+								PROTECTED_DEEPSIGHT_FAILED: {
+									target: "readyForNext",
+									actions: "setDeepsightNotReady"
+								}
+							}
+						},
+						readyForNext: { on: { NEXT_STEP: {
+							target: "#faceCapture.tutorial.waitingForPermission",
+							actions: "trackContinue"
+						} } }
+					}
+				},
+				waitingForPermission: { invoke: {
+					id: "checkPermissionWaiting",
+					src: "checkPermission",
+					onDone: [
+						{
+							target: "#faceCapture.capture",
+							guard: "isReadyForCapture",
+							actions: "setPermissionResultFromEvent"
+						},
+						{
+							target: "#faceCapture.permissions.requesting",
+							guard: "needsMotionPrimeOnly",
+							actions: "setPermissionResultFromEvent"
+						},
+						{
+							target: "#faceCapture.permissions",
+							actions: "setPermissionResultFromEvent"
+						}
+					]
+				} }
+			}
+		},
+		permissions: {
+			entry: [
+				"preloadRecordingProvider",
+				"warmAvatarProvider",
+				"initializeProtectedDeepsight"
+			],
+			initial: "checkingDeepsight",
+			states: {
+				checkingDeepsight: { always: [{
+					target: "initializingDeepsight",
+					guard: ({ context }) => !context.deepsightReady
+				}, { target: "idle" }] },
+				initializingDeepsight: {
+					entry: "initializeProtectedDeepsight",
+					on: {
+						PROTECTED_DEEPSIGHT_READY: {
+							target: "idle",
+							actions: "setDeepsightReady"
+						},
+						PROTECTED_DEEPSIGHT_FAILED: {
+							target: "idle",
+							actions: "setDeepsightNotReady"
+						}
+					}
+				},
+				idle: {
+					invoke: {
+						id: "checkPermissionIdle",
+						src: "checkPermission",
+						onDone: [
+							{
+								target: "#faceCapture.capture",
+								guard: "isReadyForCapture",
+								actions: "setPermissionResultFromEvent"
+							},
+							{
+								target: "denied",
+								guard: ({ event }) => event.output === "denied",
+								actions: "setPermissionResultFromEvent"
+							},
+							{
+								target: "motionOnly",
+								guard: "needsMotionPrimeOnly",
+								actions: "setPermissionResultFromEvent"
+							},
+							{
+								target: "waitingForUser",
+								actions: "setPermissionResultFromEvent"
+							}
+						],
+						onError: {
+							target: "waitingForUser",
+							actions: "setPermissionPrompt"
+						}
+					},
+					on: {
+						REQUEST_PERMISSION: "requesting",
+						GO_TO_LEARN_MORE: "learnMore"
+					}
+				},
+				waitingForUser: { on: {
+					REQUEST_PERMISSION: "requesting",
+					GO_TO_LEARN_MORE: "learnMore"
+				} },
+				motionOnly: { on: { REQUEST_PERMISSION: "requesting" } },
+				learnMore: { on: {
+					BACK: "idle",
+					REQUEST_PERMISSION: "requesting"
+				} },
+				requesting: { invoke: {
+					id: "requestPermission",
+					src: "requestPermission",
+					input: ({ context }) => ({
+						permissionResult: context.permissionResult === "refresh" ? void 0 : context.permissionResult,
+						requestMotionPermission: context.config.ds === true
+					}),
+					onDone: [
+						{
+							target: "#faceCapture.capture",
+							guard: "isReadyForCapture",
+							actions: "setPermissionResultFromEvent"
+						},
+						{
+							target: "denied",
+							guard: ({ event }) => event.output === "denied",
+							actions: "setPermissionResultFromEvent"
+						},
+						{
+							target: "waitingForUser",
+							actions: "setPermissionResultFromEvent"
+						}
+					],
+					onError: { target: "denied" }
+				} },
+				denied: { entry: "setPermissionRefresh" }
+			}
+		},
+		capture: {
+			entry: [
+				"preloadRecordingProvider",
+				"warmAvatarProvider",
+				"initializeProtectedDeepsight",
+				"startProtectedAttempt"
+			],
+			initial: "checkingDeepsight",
+			exit: [
+				"releaseProtectedAttempt",
+				"stopMediaStream",
+				"cleanup"
+			],
+			on: {
+				PROTECTED_ATTEMPT_READY: { actions: "setProtectedAttemptReady" },
+				PROTECTED_VISIBILITY: { actions: ["setProtectedVisibility", "sendProtectedVisibility"] },
+				PROTECTED_APPLY_VISIBILITY: { actions: "sendProtectedVisibility" },
+				PROTECTED_ATTEMPT_FAILED: [
+					{
+						target: ".detecting",
+						guard: "isProtectedManualRefusal"
+					},
+					{
+						target: ".uploadError",
+						guard: "isProtectedUploadFailure",
+						actions: "setServerErrorAndDecrement"
+					},
+					{
+						target: "#faceCapture.error",
+						actions: "setProtectedFailure"
+					}
+				],
+				PROTECTED_ATTEMPT_RELEASED: { actions: "noOp" }
+			},
+			states: {
+				checkingDeepsight: { always: [{
+					target: "initializingDeepsight",
+					guard: ({ context }) => !context.deepsightReady
+				}, { target: "initializing" }] },
+				initializingDeepsight: {
+					entry: "initializeProtectedDeepsight",
+					on: {
+						PROTECTED_DEEPSIGHT_READY: {
+							target: "initializing",
+							actions: "setDeepsightReady"
+						},
+						PROTECTED_DEEPSIGHT_FAILED: {
+							target: "#faceCapture.permissions",
+							actions: "setDeepsightNotReady"
+						}
+					}
+				},
+				checkingStream: { always: "initializing" },
+				initializing: { always: {
+					target: "detecting",
+					guard: "isCameraAndDeepsightReady"
+				} },
+				detecting: {
+					entry: ["setDetectionStatusDetecting"],
+					invoke: {
+						id: "runAvatar",
+						src: "runAvatar",
+						input: ({ context }) => ({
+							stream: context.stream,
+							config: context.config,
+							faceFeed: context.faceFeed
+						})
+					},
+					exit: ["clearAvatarCanvas"],
+					on: {
+						DETECTION_UPDATE: { actions: ["setDetectionStatusFromEvent", "setManualCaptureTriggered"] },
+						AVATAR_READY: { actions: "setAvatarCanvas" },
+						PROTECTED_NATIVE_AUTO_CAPTURE: { actions: "sendProtectedAutoCapture" },
+						PROTECTED_AUTO_COMMITTED: {
+							target: "capturing",
+							actions: "setProtectedCommittedPreview"
+						},
+						MANUAL_CAPTURE: {
+							target: "capturingManual",
+							guard: "canCommitProtectedManual",
+							actions: "sendProtectedManualCapture"
+						}
+					}
+				},
+				capturing: {
+					entry: ["sendProtectedFinalize"],
+					on: { PROTECTED_ATTEMPT_FINALIZED: {
+						target: "preparingUpload",
+						actions: "setProtectedFinalization"
+					} }
+				},
+				capturingManual: { on: {
+					PROTECTED_MANUAL_COMMITTED: { actions: ["setProtectedCommittedPreview", "sendProtectedFinalize"] },
+					PROTECTED_ATTEMPT_FINALIZED: {
+						target: "preparingUpload",
+						actions: "setProtectedFinalization"
+					}
+				} },
+				preparingUpload: { always: "uploading" },
+				uploading: {
+					entry: "sendProtectedUploadIfNeeded",
+					on: {
+						PROTECTED_UPLOAD_MAPPED: {
+							target: "validatingUpload",
+							actions: "setProtectedUploadResponse"
+						},
+						PROTECTED_LOCAL_DONE: {
+							target: "validatingUpload",
+							actions: "setProtectedLocalResult"
+						}
+					}
+				},
+				validatingUpload: { always: [
+					{
+						target: "#faceCapture.error",
+						guard: "isTerminalUploadError",
+						actions: "setTerminalError"
+					},
+					{
+						target: "uploadError",
+						guard: "hasUploadValidationError",
+						actions: ["setUploadErrorFromUploadValidation", "decrementAttemptsRemaining"]
+					},
+					{ target: "success" }
+				] },
+				uploadError: { on: { RETRY_CAPTURE: [
+					{
+						target: "#faceCapture.capture",
+						reenter: true,
+						guard: "hasAttemptsRemaining",
+						actions: [
+							"clearUploadFailure",
+							"setDeepsightNotReady",
+							"resetProtectedController",
+							"clearProtectedAttempt"
+						]
+					},
+					{
+						target: "#faceCapture.error",
+						guard: "isNoAttemptsTerminal",
+						actions: ["setTerminalError"]
+					},
+					{
+						target: "#faceCapture.terminalProcessing",
+						actions: ["flagFaceManualReview"]
+					}
+				] } },
+				success: {
+					entry: "cleanup",
+					after: { 3e3: { target: "#faceCapture.processing" } }
+				}
+			}
+		},
+		manualUpload: {
+			entry: [
+				"releaseProtectedAttempt",
+				"stopMediaStream",
+				"releaseAvatarWarmup"
+			],
+			invoke: {
+				id: "manualUpload",
+				src: "manualUploadMachine",
+				input: ({ context }) => ({
+					config: context.config,
+					dependencies: context.dependencies,
+					captureAttempts: getAttemptsFromConfig(context.config)
+				}),
+				onSnapshot: { actions: "noOp" },
+				onDone: [{
+					guard: "isManualUploadExhausted",
+					target: "terminalProcessing"
+				}, { target: "processing" }],
+				onError: {
+					target: "error",
+					actions: "setErrorFromEvent"
+				}
+			},
+			on: {
+				MANUAL_UPLOAD_FILE_SELECTED: { actions: "forwardToManualUpload" },
+				MANUAL_UPLOAD_CONTINUE: { actions: "forwardToManualUpload" },
+				MANUAL_UPLOAD_RESET: { actions: "forwardToManualUpload" }
+			}
+		},
+		processing: { invoke: {
+			id: "processFace",
+			src: "processFace",
+			input: ({ context }) => context,
+			onDone: {
+				target: "finished",
+				actions: "setProcessResponseFromEvent"
+			},
+			onError: { target: "finished" }
+		} },
+		terminalProcessing: {
+			entry: "cleanup",
+			invoke: {
+				id: "processFace",
+				src: "processFace",
+				input: ({ context }) => context,
+				onDone: {
+					target: "finished",
+					actions: "setProcessResponseFromEvent"
+				},
+				onError: { target: "finished" }
+			}
+		},
+		finished: {
+			entry: [
+				"releaseProtectedAttempt",
+				"stopMediaStream",
+				"releaseAvatarWarmup"
+			],
+			type: "final"
+		},
+		closed: {
+			entry: [
+				"releaseProtectedAttempt",
+				"stopMediaStream",
+				"releaseAvatarWarmup"
+			],
+			type: "final"
+		},
+		error: {
+			entry: ["stopMediaStream", "releaseAvatarWarmup"],
+			on: { RESET: {
+				target: "idle",
+				actions: ["resetProtectedController", "resetContext"]
+			} }
+		}
+	}
+});
+//#endregion
+export { concealmentToAvatar as i, createDefaultProtectedFaceControllerActor as n, manualFaceUploadMachine as r, faceCaptureMachine as t };