@incodetech/core 2.3.0-rc.9 → 2.3.0

package/dist/personhood.esm.js

@@ -1,1574 +0,0 @@
-import { b as getStoredHttpConfig, w as createApi$1, y as randomUUID } from "./trueSightService-C1JG8gAU.esm.js";
-import { r as WasmUtilProvider } from "./safeStorage-B-trhxg6.esm.js";
-import { l as BrowserStorageProvider } from "./setup-BttZ27hw.esm.js";
-import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { t as api } from "./api-Bx3gKW_y.esm.js";
-import { n as eventModuleNames } from "./events-ijlbX_Wx.esm.js";
-import { b as BrowserEnvironmentProvider, h as isBrowserSimulation, n as getFingerprintEnabled, v as getThumbmarkId, y as getDeviceFingerprintInfo } from "./sessionInitializer-DSf0jyab.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-import { i as assign, s as createActor, t as setup, u as createManager } from "./xstate.esm-BuFLFuzz.esm.js";
-import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
-import { i as requestCameraAccess, o as stopCameraStream } from "./camera-sIa9ceW2.esm.js";
-import { i as requestPermission, t as checkPermission } from "./permissionServices-Bj_fyWtv.esm.js";
-import { i as initializeDeepsightSession, o as startDetection, s as stopStream, t as FaceDetectionProvider } from "./FaceDetectionProvider-C7bUZsH9.esm.js";
-import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
-import { t as StreamCanvasCapture } from "./StreamCanvasCapture-C9jtgBdT.esm.js";
-//#region src/modules/personhood/personhoodServices.ts
-/**
-* Config used for the passive liveness pass. Deliberately stripped down from
-* selfie: no recording, no validation rituals, no headwear/mask checks — we
-* want the lowest-friction path to a single head-pose-tracked liveness shot.
-*/
-const PERSONHOOD_FACE_CAPTURE_CONFIG = {
-	showTutorial: false,
-	showPreview: false,
-	assistedOnboarding: false,
-	enableFaceRecording: false,
-	autoCaptureTimeout: 8e3,
-	captureAttempts: 2,
-	validateLenses: false,
-	validateFaceMask: false,
-	validateHeadCover: false,
-	validateClosedEyes: false,
-	validateBrightness: false,
-	deepsightLiveness: "SINGLE_FRAME",
-	ds: false
-};
-const PERSONHOOD_CAMERA_CONSTRAINTS = {
-	video: {
-		facingMode: "user",
-		height: { ideal: 480 },
-		width: { ideal: 640 }
-	},
-	audio: false
-};
-/**
-* Boots the Deepsight session used to back-stop the on-device liveness check.
-* Independent of `initializePersonhoodCamera` so the two can proceed in
-* parallel during the permission / collect-signals phase.
-*/
-async function initializePersonhoodDeepsight(params) {
-	return initializeDeepsightSession({
-		storage: params.storage,
-		ds: params.ds
-	});
-}
-/**
-* Boots the camera stream and WASM face-detection pipeline as fast as
-* possible after the user grants permission. Optimized for low latency
-* between "permission granted" and "avatar begins tracking":
-*
-*  1. WASM model loading and `getUserMedia` run **in parallel** — they're
-*     independent I/O and were previously sequential, which stacked
-*     50-500ms of avoidable latency.
-*  2. Deepsight PRC warmup (anti-spoof pipeline priming) is fired as a
-*     **background task** after the real stream is open. It's not needed
-*     for face detection or pose tracking — only for the post-capture
-*     `analyzeFrame` step. `analyzeLiveness` degrades gracefully if PRC
-*     hasn't finished in time.
-*
-* Earlier versions opened a second hidden camera stream for PRC warmup
-* BEFORE opening the real one, which on Safari/Firefox serialized the
-* two `getUserMedia` calls and added visible lag before the avatar came
-* alive.
-*/
-async function initializePersonhoodCamera(params) {
-	const provider = new FaceDetectionProvider();
-	const [initResult, streamResult] = await Promise.allSettled([provider.initialize({ autocaptureInterval: PERSONHOOD_FACE_CAPTURE_CONFIG.autoCaptureTimeout * 1e3 }), requestCameraAccess(PERSONHOOD_CAMERA_CONSTRAINTS)]);
-	if (streamResult.status === "rejected") {
-		if (initResult.status === "fulfilled") provider.dispose();
-		throw streamResult.reason;
-	}
-	const stream = streamResult.value;
-	if (initResult.status === "rejected") {
-		stopCameraStream(stream);
-		throw initResult.reason;
-	}
-	provider.setChecksEnabled({
-		lenses: false,
-		mask: false,
-		closedEyes: false,
-		headWear: false,
-		occlusion: false
-	});
-	if (params.deepsightService) params.deepsightService.performPrcCheck({ constraints: PERSONHOOD_CAMERA_CONSTRAINTS }).catch(() => {});
-	return {
-		stream,
-		provider
-	};
-}
-/**
-* Wraps the existing face-capture detection loop for the Personhood flow.
-*
-* - Drops the captured canvas (we never upload the raw frame).
-* - Forwards per-frame `onFaceData` into `onPose` so the avatar can mirror
-*   the user's head in real time.
-*/
-const AUTO_COMPLETE_DEADLINE_MS = 4e3;
-function runPersonhoodDetection(params) {
-	let forcedCaptureFired = false;
-	const timer = BrowserTimerProvider.getInstance();
-	let autoCompleteTimer = null;
-	let autoCompleteArmed = false;
-	const cancelAutoComplete = () => {
-		if (autoCompleteTimer !== null) {
-			timer.clearTimeout(autoCompleteTimer);
-			autoCompleteTimer = null;
-		}
-	};
-	const fireForceCapture = () => {
-		if (forcedCaptureFired) return;
-		forcedCaptureFired = true;
-		cancelAutoComplete();
-		params.provider.forceCapture();
-	};
-	const armAutoComplete = () => {
-		if (autoCompleteArmed) return;
-		autoCompleteArmed = true;
-		if (!params.autoComplete) return;
-		autoCompleteTimer = timer.setTimeout(() => {
-			autoCompleteTimer = null;
-			fireForceCapture();
-		}, AUTO_COMPLETE_DEADLINE_MS);
-	};
-	const innerResult = startDetection({
-		config: PERSONHOOD_FACE_CAPTURE_CONFIG,
-		capturer: params.capturer,
-		provider: params.provider,
-		onUpdate: params.onStatus,
-		onFrame: () => armAutoComplete(),
-		onPose: (face, frameSize) => {
-			let faceSizeRatio;
-			if (frameSize && frameSize.width > 0 && frameSize.height > 0 && face.rect.width > 0 && face.rect.height > 0) faceSizeRatio = Math.sqrt(face.rect.width * face.rect.height) / Math.min(frameSize.width, frameSize.height);
-			params.onPose({
-				pitch: face.pitch,
-				yaw: face.yaw,
-				roll: face.roll,
-				faceSizeRatio
-			});
-		},
-		onSuccess: (canvas) => {
-			cancelAutoComplete();
-			params.onSuccess(canvas);
-		}
-	});
-	return {
-		cleanup: () => {
-			cancelAutoComplete();
-			innerResult.cleanup();
-		},
-		reset: innerResult.reset
-	};
-}
-/**
-* Runs the Deepsight pipeline against the stream + captured frame and pairs
-* the result with the locally-observed pose motion. All work happens on the
-* device — no network round-trip.
-*
-* The returned `LivenessOutcome` is fed into {@link produceLocalVerdict}:
-* - `virtualCamera: true` → hard reject (OBS/ManyCam)
-* - `analysisStatus !== 'PASS'` → reject with `spoof_suspected`
-* - `yawRange + pitchRange < MIN_POSE_MOTION_DEG` → reject with `no_motion`
-*/
-async function analyzeLiveness(params) {
-	let virtualCamera = false;
-	let analysisStatus = "";
-	let motionStatus = "";
-	let metadata = "";
-	let pipelineState = "";
-	const deepsight = params.deepsightService;
-	if (deepsight) {
-		try {
-			const videoTrack = params.stream?.getVideoTracks()[0];
-			if (videoTrack) virtualCamera = await deepsight.checkVirtualCamera(videoTrack);
-		} catch {}
-		try {
-			await deepsight.performVirtualCameraCheck(params.token ?? null, "SELFIE");
-		} catch {}
-		try {
-			const imageData = params.capturedImage?.getImageData();
-			if (imageData) await deepsight.analyzeFrame(imageData);
-		} catch {}
-		try {
-			analysisStatus = deepsight.getAnalysisStatus();
-			motionStatus = deepsight.getMotionStatus();
-			pipelineState = deepsight.getPipelineState();
-			metadata = deepsight.getMetadata();
-		} catch {}
-	}
-	return {
-		virtualCamera,
-		analysisStatus,
-		motionStatus,
-		yawRange: params.yawRange,
-		pitchRange: params.pitchRange,
-		metadata,
-		pipelineState
-	};
-}
-/**
-* Ceiling for on-device verdicts. Intentionally below 1.0 — nothing short
-* of a signed server round-trip should claim perfect confidence, and the
-* ceiling is strictly below what a server verdict would return so the two
-* paths are distinguishable to integrators.
-*/
-const LOCAL_CONFIDENCE_CEILING = .95;
-/**
-* Produces a verdict entirely on-device using an **additive** confidence
-* model. Each positive signal contributes a measurable amount to the score;
-* penalties subtract. This means clean passes vary — a user who swings
-* through a full head turn scores higher than one who barely moves — which
-* is useful for integrators that want to tune their own thresholds.
-*
-* Positive signals (contribute up to +0.95):
-* - Successful detection                      → +0.25
-* - Pose motion (linear from min to max)      → up to +0.25
-* - Clean device signals (no automation)      → +0.05
-* - Deepsight analysis: no explicit spoof     → +0.05
-* - Deepsight motion status == PASS           → +0.05
-* - Baseline presence                         → +0.30
-*
-* Penalties (hard rejects or large deductions):
-* - `navigator.webdriver` true                → -0.9
-* - Automation markers                        → -0.9
-* - Headless hints                            → -0.3
-* - Virtual camera detected                   → -0.9
-* - Explicit spoof/injection in analysis      → -0.4
-* - No head motion (below MIN_POSE_MOTION)    → -0.5
-* - Detection didn't reach 'success'          → -0.2
-*/
-function produceLocalVerdict(params) {
-	const threshold = params.threshold ?? .75;
-	const reasons = [];
-	let confidence = .4;
-	if (params.detectionOutcome === "success") confidence += .25;
-	else {
-		reasons.push(`detection:${params.detectionOutcome}`);
-		confidence -= .2;
-	}
-	if (params.liveness) {
-		const motion = params.liveness.yawRange + params.liveness.pitchRange;
-		if (motion < 4) {
-			reasons.push("no_motion");
-			confidence -= .5;
-		} else {
-			const motionRatio = Math.min(1, Math.max(0, (motion - 4) / 46));
-			confidence += .25 * motionRatio;
-		}
-		if (!hasExplicitSpoofSignal(params.liveness.analysisStatus)) confidence += .05;
-		else {
-			reasons.push("spoof_suspected");
-			confidence -= .4;
-		}
-		if (isMotionStatusPass(params.liveness.motionStatus)) confidence += .05;
-	}
-	if (!(params.signals.webdriver || params.signals.emulator || params.signals.headlessHints.length > 0)) confidence += .05;
-	if (params.signals.webdriver) {
-		reasons.push("webdriver");
-		confidence -= .9;
-	}
-	if (params.signals.emulator) {
-		reasons.push("emulator");
-		confidence -= .9;
-	}
-	const SUBSUMED_HINTS = /* @__PURE__ */ new Set(["navigator.webdriver", "automation-marker"]);
-	if (params.signals.headlessHints.filter((hint) => !SUBSUMED_HINTS.has(hint)).length > 0) {
-		reasons.push("headless");
-		confidence -= .3;
-	}
-	if (params.liveness?.virtualCamera) {
-		reasons.push("virtual_camera");
-		confidence -= .9;
-	}
-	confidence = Math.min(LOCAL_CONFIDENCE_CEILING, Math.max(0, confidence));
-	confidence = Math.round(confidence * 1e3) / 1e3;
-	if (confidence < threshold && reasons.length === 0) reasons.push("low_confidence");
-	const human = confidence >= threshold && reasons.length === 0;
-	return {
-		human,
-		confidence,
-		evidenceId: generateEvidenceId(params.siteKey),
-		reason: human ? void 0 : reasons.join(","),
-		signals: params.signals,
-		liveness: params.liveness,
-		spoofCheckResults: buildSpoofCheckResults({
-			signals: params.signals,
-			liveness: params.liveness,
-			detectionOutcome: params.detectionOutcome
-		})
-	};
-}
-function isMotionStatusPass(status) {
-	return status.trim().toUpperCase() === "PASS";
-}
-/**
-* Tests whether the Deepsight analysis status contains an explicit spoof /
-* injection / fail signal.
-*
-* The WASM's `getCheck()` returns a pipeline-state blob intended primarily
-* for backend consumption — the server is what turns the blob into a
-* pass/fail. In phase 0 (no session, no backend round-trip) we intentionally
-* only treat the output as a negative signal when it contains an explicit
-* failure token; everything else is indeterminate and we defer to the
-* other local checks (virtual camera + pose motion + device signals).
-*
-* Without this, every clean capture in a session-less dev demo was
-* erroneously flagged as spoof_suspected because the WASM didn't emit
-* literally "PASS".
-*/
-function hasExplicitSpoofSignal(status) {
-	const normalized = status.toUpperCase();
-	return normalized.includes("FAIL") || normalized.includes("SPOOF") || normalized.includes("INJECTION");
-}
-/**
-* Requests a server-side verdict when the browser can't run the on-device
-* liveness pass (no camera, blocked permission, incompatible browser). The
-* same API surface is returned to the widget so integrators see a single
-* universal `{ human, confidence, evidence_id }` shape.
-*
-* The confidence returned by this path is intentionally capped below the
-* on-device ceiling — with no camera we can only score device / behavioural
-* signals, which are weaker evidence of humanness.
-*/
-async function requestServerFallbackVerdict(params) {
-	if (params.mockFallback) return mockServerFallback(params);
-	try {
-		const res = await api.post(endpoints.personhoodServerFallback, {
-			siteKey: params.siteKey,
-			signals: params.signals,
-			reason: params.reason
-		}, { signal: params.signal });
-		if (!res.ok) throw new Error(`POST ${endpoints.personhoodServerFallback} failed: ${res.status} ${res.statusText}`);
-		return res.data;
-	} catch (error) {
-		if (isApiNotConfigured(error)) return mockServerFallback(params);
-		throw error;
-	}
-}
-async function mockServerFallback(params) {
-	await sleep(200);
-	const blocked = params.signals.webdriver || params.signals.emulator || params.signals.headlessHints.length > 0;
-	const spoofCheckResults = buildSpoofCheckResults({
-		signals: params.signals,
-		liveness: void 0,
-		detectionOutcome: "error"
-	});
-	if (blocked) return {
-		human: false,
-		confidence: .1,
-		evidenceId: generateEvidenceId(params.siteKey),
-		reason: "automation_markers",
-		signals: params.signals,
-		spoofCheckResults
-	};
-	return {
-		human: true,
-		confidence: .72,
-		evidenceId: generateEvidenceId(params.siteKey),
-		reason: `fallback:${params.reason}`,
-		signals: params.signals,
-		spoofCheckResults
-	};
-}
-/**
-* Pulls a token string out of `/omni/personhood/token`'s response,
-* regardless of which envelope the backend uses. The Incode service
-* surface has historically returned tokens under several keys
-* (`token`, `interviewToken`, `sessionToken`, `access_token`, raw
-* `id`) and a few endpoints return the bare string in the body.
-* Trying each in order and returning the first non-empty value
-* means we don't have to second-guess the contract — when the
-* backend changes shape, the diagnostic log of `res.data` in the
-* caller still surfaces the raw response.
-*/
-function extractTokenFromResponse(data) {
-	if (typeof data === "string" && data.length > 0) return data;
-	if (data && typeof data === "object") {
-		const obj = data;
-		const candidates = [
-			obj.token,
-			obj.interviewToken,
-			obj.sessionToken,
-			obj.access_token,
-			obj.accessToken,
-			obj.id,
-			obj.data?.token,
-			obj.data?.interviewToken
-		];
-		for (const candidate of candidates) if (typeof candidate === "string" && candidate.length > 0) return candidate;
-	}
-}
-/**
-* Pulls the verify endpoint's authoritative pass/fail boolean out
-* of its response, regardless of envelope. Current backend
-* contract: `{ "isHuman": boolean }`. Older / forward-compat
-* shapes also tried so a server-side rename doesn't silently break
-* the client. Returns `undefined` only when no recognizable field
-* is present — caller treats that as "trust the local verdict".
-*/
-function extractIsHumanFromResponse(data) {
-	if (typeof data === "boolean") return data;
-	if (data && typeof data === "object") {
-		const obj = data;
-		const candidates = [
-			obj.isHuman,
-			obj.human,
-			obj.passed,
-			obj.data?.isHuman,
-			obj.data?.human,
-			obj.result?.isHuman
-		];
-		for (const candidate of candidates) if (typeof candidate === "boolean") return candidate;
-	}
-}
-/**
-* Mints the personhood `Authorization: Bearer` token via the OAuth2
-* client-credentials grant against {@link endpoints.personhoodOAuthToken}
-* (`POST /omni/oauth2/token`, `application/x-www-form-urlencoded`,
-* `grant_type=client_credentials&scope=openid`). Returns the
-* `access_token` (a signed JWT); the caller (state machine `fetchToken`
-* actor) lands it in actor context where downstream services receive it
-* as an explicit input. No module-level slot — concurrent personhood
-* instances stay isolated, and `actor.stop()` cleans up implicitly.
-*
-* Mock path returns a `mock-token-*` string after a short delay so
-* `mockVerify=true` flows complete without a configured backend.
-*
-* Replaces the removed `GET /omni/personhood/token` (ENG-45783).
-*/
-async function fetchPersonhoodAuthToken(params = {}) {
-	if (params.mockVerify) {
-		await sleep(50);
-		return `mock-token-${randomUUID()}`;
-	}
-	const form = {
-		grant_type: "client_credentials",
-		scope: "openid"
-	};
-	if (params.clientId) form.client_id = params.clientId;
-	if (params.clientSecret) form.client_secret = params.clientSecret;
-	const body = new URLSearchParams(form).toString();
-	const authPath = params.authBaseUrl ? endpoints.personhoodOAuthTokenDirect : endpoints.personhoodOAuthToken;
-	const reqConfig = {
-		signal: params.signal,
-		headers: { "Content-Type": "application/x-www-form-urlencoded" }
-	};
-	try {
-		let res;
-		if (params.authBaseUrl) res = await createApi$1({
-			apiURL: params.authBaseUrl,
-			customHeaders: getStoredHttpConfig()?.customHeaders
-		}).post(authPath, body, reqConfig);
-		else res = await api.post(authPath, body, reqConfig);
-		if (!res.ok) throw new Error(`POST ${authPath} failed: ${res.status} ${res.statusText}`);
-		const token = extractTokenFromResponse(res.data);
-		if (!token) throw new Error(`POST ${authPath} returned no access_token`);
-		return token;
-	} catch (error) {
-		if (isApiNotConfigured(error)) return fetchPersonhoodAuthToken({
-			...params,
-			mockVerify: true
-		});
-		throw error;
-	}
-}
-/**
-* Builds the full per-check breakdown that lands on
-* {@link PersonhoodVerdict.spoofCheckResults} and in the verify
-* POST body. One entry per check the SDK ran, with a stable id, a
-* `passed | failed | unknown` outcome, and (on failure) a short
-* tag the server can pattern-match on.
-*
-* This is the single source of truth for "what did the on-device
-* pipeline check?" — both {@link produceLocalVerdict} and the
-* verify POST consume it. Adding a new check here automatically
-* surfaces it to integrators and to the backend without touching
-* the state machine or the verify wire format.
-*
-* Conservative defaults: when a pipeline didn't run (no liveness
-* outcome / Deepsight not initialized), the dependent checks are
-* reported as `unknown`. This lets the server distinguish "we
-* tested and the user passed" from "we couldn't test", which is a
-* meaningful gradient for risk scoring.
-*/
-function buildSpoofCheckResults(params) {
-	const results = [];
-	const { signals, liveness, detectionOutcome } = params;
-	if (detectionOutcome === "success") results.push({
-		check: "faceDetection",
-		result: "passed"
-	});
-	else results.push({
-		check: "faceDetection",
-		result: "failed",
-		reason: `detection:${detectionOutcome}`
-	});
-	if (liveness) {
-		if (liveness.analysisStatus === "PASS") results.push({
-			check: "physicalAttack",
-			result: "passed"
-		});
-		else if (hasExplicitSpoofSignal(liveness.analysisStatus)) results.push({
-			check: "physicalAttack",
-			result: "failed",
-			reason: liveness.analysisStatus || "spoof_suspected"
-		});
-		else results.push({
-			check: "physicalAttack",
-			result: "unknown"
-		});
-		results.push({
-			check: "virtualCamera",
-			result: liveness.virtualCamera ? "failed" : "passed",
-			...liveness.virtualCamera ? { reason: "virtual_camera" } : {}
-		});
-		if (liveness.motionStatus === "PASS") results.push({
-			check: "motionLiveness",
-			result: "passed"
-		});
-		else if (liveness.motionStatus === "FAIL") results.push({
-			check: "motionLiveness",
-			result: "failed",
-			reason: "no_motion"
-		});
-		else results.push({
-			check: "motionLiveness",
-			result: "unknown"
-		});
-		if (liveness.yawRange + liveness.pitchRange >= 4) results.push({
-			check: "headMotion",
-			result: "passed"
-		});
-		else results.push({
-			check: "headMotion",
-			result: "failed",
-			reason: "no_motion"
-		});
-	} else {
-		results.push({
-			check: "physicalAttack",
-			result: "unknown"
-		});
-		results.push({
-			check: "virtualCamera",
-			result: "unknown"
-		});
-		results.push({
-			check: "motionLiveness",
-			result: "unknown"
-		});
-		results.push({
-			check: "headMotion",
-			result: "unknown"
-		});
-	}
-	results.push({
-		check: "webdriver",
-		result: signals.webdriver ? "failed" : "passed",
-		...signals.webdriver ? { reason: "webdriver" } : {}
-	});
-	results.push({
-		check: "emulator",
-		result: signals.emulator ? "failed" : "passed",
-		...signals.emulator ? { reason: "emulator" } : {}
-	});
-	const independentHeadlessHints = signals.headlessHints.filter((hint) => hint !== "navigator.webdriver" && hint !== "automation-marker");
-	results.push({
-		check: "headlessBrowser",
-		result: independentHeadlessHints.length > 0 ? "failed" : "passed",
-		...independentHeadlessHints.length > 0 ? { reason: independentHeadlessHints.join(",") } : {}
-	});
-	return results;
-}
-/**
-* Trims the rich client-side {@link SpoofCheckResult} array down to the wire
-* shape the verify POST expects: `check` + `result` only (the `reason` field is
-* dropped — not part of the contract). Entry order is preserved so the server
-* sees them in detection-pipeline order (face → physical → virtual → motion →
-* head → automation). `unknown` results are passed through as-is —
-* `SpoofCheckResultWire.result` is `'passed' | 'failed' | 'unknown'`. (Whether
-* the backend should instead receive only `passed | failed` is an open
-* server-contract question, tracked with the wider verify-contract work.)
-*/
-function toWireSpoofCheckResults(results) {
-	const wire = [];
-	for (const entry of results) wire.push({
-		check: entry.check,
-		result: entry.result
-	});
-	return wire;
-}
-/**
-* On-device verify hop — POST `/omni/personhood/verify` with the
-* Deepsight metadata + derived `spoofCheckResults`. The personhood
-* Bearer token (passed in via `params.token`, minted by the OAuth2
-* client-credentials hop and threaded through actor context) is
-* attached as `Authorization: Bearer <token>`.
-*
-* When the server returns a recognizable `isHuman` boolean, that
-* value becomes the authoritative pass/fail on the returned
-* verdict. Otherwise (HTTP error, missing field, network blip,
-* SDK not configured) we fall back to the local on-device verdict
-* the caller passed in — keeping the widget functional in flaky
-* conditions. `mockVerify: true` short-circuits to the fallback
-* verdict without hitting the network.
-*/
-async function verifyPersonhoodOnDevice(params) {
-	if (params.mockVerify) {
-		await sleep(50);
-		return params.fallbackVerdict;
-	}
-	try {
-		const personhoodToken = params.token;
-		const res = await api.post(endpoints.personhoodOnDeviceVerify, {
-			metadata: params.metadata,
-			spoofCheckResults: toWireSpoofCheckResults(params.spoofCheckResults)
-		}, {
-			signal: params.signal,
-			...personhoodToken ? { headers: { Authorization: `Bearer ${personhoodToken}` } } : {}
-		});
-		if (!res.ok) throw new Error(`POST ${endpoints.personhoodOnDeviceVerify} failed: ${res.status} ${res.statusText}`);
-		const serverData = res.data;
-		const serverIsHuman = extractIsHumanFromResponse(serverData);
-		if (typeof serverIsHuman !== "boolean") return params.fallbackVerdict;
-		const finalReason = serverIsHuman ? void 0 : params.fallbackVerdict.reason ?? "server_rejected";
-		return {
-			...params.fallbackVerdict,
-			human: serverIsHuman,
-			confidence: serverIsHuman ? .95 : .05,
-			reason: finalReason
-		};
-	} catch {
-		return params.fallbackVerdict;
-	}
-}
-function isApiNotConfigured(error) {
-	return error instanceof Error && error.message.includes("SDK not configured");
-}
-function generateEvidenceId(siteKey) {
-	return `ph_${(siteKey || "site").replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 12)}_${randomUUID().replace(/-/g, "")}`;
-}
-//#endregion
-//#region src/modules/personhood/personhoodSignals.ts
-/**
-* Returns a placeholder {@link DeviceBehavioralSignals} for the
-* narrow set of code paths that need to operate before the real
-* `collectDeviceBehavioralSignals()` has resolved (or where it
-* errored out and the parallel `signals` branch landed in `done`
-* with `context.signals` still undefined). Single source of truth
-* — every call site that previously inlined this literal now
-* imports from here.
-*/
-function emptySignals() {
-	return {
-		deviceFingerprint: "",
-		userAgentClass: "unknown",
-		emulator: false,
-		webdriver: false,
-		headlessHints: []
-	};
-}
-/**
-* Collects the device + behavioural bundle returned alongside the human
-* verdict. Intentionally offline-only (no IP geolookup) so a Personhood check
-* does not pay the latency of an external call in the hot path.
-*
-* The bundle is **opaque to the SDK** — the integrator uses these signals for
-* their own dedup/risk logic. Personhood itself does NOT re-identify the human.
-*
-* `deviceFingerprint` is gated by `setup({ fingerprint })` (default enabled)
-* — mirrors how `deepsightLoader` resolves `disableFingerprint` from the same
-* flag. When disabled, the Thumbmark call is skipped and `deviceFingerprint`
-* is `''`.
-*/
-async function collectDeviceBehavioralSignals() {
-	const browserEnv = new BrowserEnvironmentProvider();
-	const [deviceFingerprint, deviceInfo] = await Promise.all([getFingerprintEnabled() ? safeGetFingerprint() : Promise.resolve(""), safeGetDeviceInfo()]);
-	const webdriver = Boolean(browserEnv.getNavigatorProperty("webdriver"));
-	const emulator = isBrowserSimulation(browserEnv);
-	const headlessHints = [];
-	if (webdriver) headlessHints.push("navigator.webdriver");
-	if (emulator) headlessHints.push("automation-marker");
-	const plugins = browserEnv.getNavigatorProperty("plugins");
-	const userAgent = browserEnv.getNavigatorProperty("userAgent")?.toLowerCase();
-	if (plugins && typeof plugins.length === "number" && plugins.length === 0 && userAgent?.includes("headless")) headlessHints.push("headless-user-agent");
-	return {
-		deviceFingerprint,
-		userAgentClass: formatUserAgentClass(deviceInfo),
-		emulator,
-		webdriver,
-		headlessHints
-	};
-}
-function formatUserAgentClass(info) {
-	if (!info) return "unknown";
-	const parts = [
-		info.browser?.name,
-		info.browser?.version,
-		info.os?.name,
-		info.os?.version,
-		info.device?.model
-	].filter((part) => typeof part === "string" && part.length > 0);
-	return parts.length > 0 ? parts.join(" / ") : "unknown";
-}
-async function safeGetFingerprint() {
-	try {
-		return await getThumbmarkId();
-	} catch {
-		return "";
-	}
-}
-async function safeGetDeviceInfo() {
-	try {
-		return await getDeviceFingerprintInfo();
-	} catch {
-		return;
-	}
-}
-//#endregion
-//#region src/modules/personhood/types.ts
-const PERSONHOOD_ERROR_CODES = {
-	CAMERA_DENIED: "CAMERA_DENIED",
-	DETECTION_FAILED: "DETECTION_FAILED",
-	/**
-	* The OAuth2 token fetch (`POST /omni/oauth2/token`,
-	* client-credentials) failed — non-2xx, network error, or no
-	* `access_token` in the response. The flow halts before the user
-	* opens the camera so a misconfigured `clientId` / `clientSecret`
-	* surfaces immediately instead of walking them through a capture we
-	* can't authenticate the verify hop for.
-	*/
-	AUTH_TOKEN_FAILED: "AUTH_TOKEN_FAILED",
-	VERIFY_FAILED: "VERIFY_FAILED",
-	INJECTION_SUSPECTED: "INJECTION_SUSPECTED",
-	EMULATOR_DETECTED: "EMULATOR_DETECTED",
-	TIMEOUT: "TIMEOUT",
-	UNKNOWN: "UNKNOWN"
-};
-/**
-* Public machine value. Typed as `AnyStateMachine` for declaration file
-* portability — mirrors the convention used by `selfieMachine` and the
-* other Core modules. Type safety is enforced by the `setup()` config
-* above, not by the exported binding.
-*/
-const personhoodMachine = setup({
-	types: {
-		context: {},
-		events: {},
-		input: {}
-	},
-	actors: {
-		checkPermission: fromPromise(async () => {
-			return checkPermission();
-		}),
-		requestPermission: fromPromise(async () => {
-			return requestPermission({ requestMotion: false });
-		}),
-		initializeCamera: fromPromise(async ({ input }) => {
-			return initializePersonhoodCamera({ deepsightService: input.deepsightService });
-		}),
-		initializeDeepsight: fromPromise(async ({ input }) => {
-			return initializePersonhoodDeepsight({
-				storage: input.dependencies.storage,
-				ds: input.ds
-			});
-		}),
-		collectSignals: fromPromise(async () => {
-			return collectDeviceBehavioralSignals();
-		}),
-		analyzeLiveness: fromPromise(async ({ input }) => {
-			return analyzeLiveness(input);
-		}),
-		runDetection: fromCallback(({ input, sendBack }) => {
-			let yawMin = Infinity;
-			let yawMax = -Infinity;
-			let pitchMin = Infinity;
-			let pitchMax = -Infinity;
-			const { cleanup, reset } = runPersonhoodDetection({
-				provider: input.provider,
-				capturer: input.frameCapturer,
-				autoComplete: input.autoComplete,
-				onStatus: (status) => sendBack({
-					type: "DETECTION_UPDATE",
-					status
-				}),
-				onPose: (pose) => {
-					if (pose.yaw < yawMin) yawMin = pose.yaw;
-					if (pose.yaw > yawMax) yawMax = pose.yaw;
-					if (pose.pitch < pitchMin) pitchMin = pose.pitch;
-					if (pose.pitch > pitchMax) pitchMax = pose.pitch;
-				},
-				onSuccess: (canvas) => {
-					sendBack({
-						type: "DETECTION_SUCCESS",
-						canvas,
-						yawRange: yawMax > yawMin ? yawMax - yawMin : 0,
-						pitchRange: pitchMax > pitchMin ? pitchMax - pitchMin : 0
-					});
-				}
-			});
-			sendBack({
-				type: "DETECTION_RESET_READY",
-				reset
-			});
-			return cleanup;
-		}),
-		/**
-		* Local verdict — the PRD's primary path. Runs entirely on-device, no
-		* network round-trip. Wrapped in `fromPromise` only so the machine can
-		* `invoke` it the same way it does an async actor; the body itself is
-		* synchronous and returns immediately.
-		*/
-		produceLocalVerdict: fromPromise(async ({ input }) => {
-			return produceLocalVerdict({
-				siteKey: input.config.siteKey,
-				threshold: input.config.threshold,
-				signals: input.signals,
-				detectionOutcome: input.detectionStatus,
-				liveness: input.liveness
-			});
-		}),
-		/**
-		* Server fallback — only reached when the on-device path is impossible
-		* (no camera, permission denied, browser unsupported). Integrators see
-		* the same verdict shape either way.
-		*/
-		requestServerFallback: fromPromise(async ({ input, signal }) => {
-			return requestServerFallbackVerdict({
-				siteKey: input.config.siteKey,
-				signals: input.signals,
-				reason: input.reason,
-				mockFallback: input.config.mockVerify,
-				signal
-			});
-		}),
-		/**
-		* Mints the OAuth2 Bearer token (client-credentials grant) for the
-		* verify hop. Hits `POST /omni/oauth2/token` on the omni base, or —
-		* when `config.authBaseUrl` is set — the auth server's own
-		* `/oauth2/token` directly (see {@link fetchPersonhoodAuthToken}).
-		* Runs in parallel with the other init tasks (signals + Deepsight) so
-		* the network round-trip overlaps
-		* with the WASM and camera-permission work — token is available
-		* by the time the user finishes the capture and we need to
-		* verify. The fetched token is assigned into actor context
-		* (`context.token`) by `setTokenFromEvent` and threaded into the
-		* downstream `analyzeLiveness` and `verifyOnDevice` actors as an
-		* explicit input, isolated from the main `currentToken` other
-		* modules use and from any concurrent personhood instances.
-		*/
-		fetchToken: fromPromise(async ({ input, signal }) => {
-			return fetchPersonhoodAuthToken({
-				clientId: input.config.clientId,
-				clientSecret: input.config.clientSecret,
-				authBaseUrl: input.config.authBaseUrl,
-				mockVerify: input.config.mockVerify,
-				signal
-			});
-		}),
-		/**
-		* On-device verify — POST `/omni/personhood/verify` with the
-		* Deepsight metadata + derived `spoofCheckResults`, returns the
-		* server's authoritative verdict. The local verdict from
-		* {@link produceLocalVerdict} is used as a fallback if the
-		* network call fails. This is what becomes the final
-		* `state.verdict` the UI / integrator sees.
-		*/
-		verifyOnDevice: fromPromise(async ({ input, signal }) => {
-			return verifyPersonhoodOnDevice({
-				metadata: input.liveness?.metadata ?? "",
-				spoofCheckResults: input.localVerdict.spoofCheckResults,
-				fallbackVerdict: input.localVerdict,
-				mockVerify: input.config.mockVerify,
-				token: input.token,
-				signal
-			});
-		})
-	},
-	actions: {
-		setStreamAndProvider: assign(({ event }) => {
-			const output = event.output;
-			return {
-				stream: output.stream,
-				provider: output.provider,
-				frameCapturer: new StreamCanvasCapture(output.stream)
-			};
-		}),
-		setDetectionStatus: assign({ detectionStatus: ({ event }) => event.status }),
-		/**
-		* Commits the final head-pose ranges reported by the detection callback
-		* into context. This happens ONCE at DETECTION_SUCCESS, not per-frame —
-		* keeping pose off the hot XState path prevents React re-renders on
-		* every detector frame.
-		*/
-		setCapturedImageAndRangeFromEvent: assign(({ event }) => {
-			const e = event;
-			return {
-				capturedImage: e.canvas,
-				yawRange: e.yawRange,
-				pitchRange: e.pitchRange
-			};
-		}),
-		setDeepsightServiceFromEvent: assign({ deepsightService: ({ event }) => event.output }),
-		setLivenessOutcomeFromEvent: assign({ livenessOutcome: ({ event }) => event.output }),
-		setResetDetection: assign({ resetDetection: ({ event }) => event.reset }),
-		setSignalsFromEvent: assign({ signals: ({ event }) => event.output }),
-		setTokenFromEvent: assign({ token: ({ event }) => event.output }),
-		/**
-		* Stash the local verdict from the `processing` step's actor
-		* output so the subsequent `verifyOnServer` step can use it as a
-		* fallback if the network call fails. The same event also drives
-		* `setVerdictFromEvent` (the existing action), but that one
-		* writes to `verdict` — which we DON'T want to set yet because
-		* the final verdict comes from the server.
-		*/
-		setLocalVerdictFromEvent: assign({ localVerdict: ({ event }) => event.output }),
-		setVerdictFromEvent: assign({ verdict: ({ event }) => event.output }),
-		setPermissionResultFromEvent: assign({ permissionResult: ({ event }) => event.output }),
-		setPermissionDenied: assign({
-			permissionResult: () => "denied",
-			error: () => ({ code: PERSONHOOD_ERROR_CODES.CAMERA_DENIED })
-		}),
-		setDetectionError: assign({ error: () => ({ code: PERSONHOOD_ERROR_CODES.DETECTION_FAILED }) }),
-		/**
-		* Records that the server-fallback path is being taken because the camera
-		* could not be initialized (no device / OS block), so the fallback verdict
-		* reports `no_camera` rather than the default `permission_denied`.
-		*/
-		setFallbackReasonNoCamera: assign({ fallbackReason: () => "no_camera" }),
-		setTokenError: assign({ error: ({ event }) => ({
-			code: PERSONHOOD_ERROR_CODES.AUTH_TOKEN_FAILED,
-			message: String(event.error ?? "auth token fetch failed")
-		}) }),
-		setVerifyError: assign({ error: ({ event }) => ({
-			code: PERSONHOOD_ERROR_CODES.VERIFY_FAILED,
-			message: String(event.error ?? "verify failed")
-		}) }),
-		/**
-		* Local-synthesis failure — the deterministic on-device verdict
-		* computation threw. Distinct from `setVerifyError` which is for
-		* the server verify hop; the verify hop never even ran here.
-		*/
-		setLocalVerdictError: assign({ error: ({ event }) => ({
-			code: PERSONHOOD_ERROR_CODES.UNKNOWN,
-			message: String(event.error ?? "local verdict synthesis failed")
-		}) }),
-		/**
-		* Server verify hop failed unrecoverably — fall back to the local
-		* verdict the integrator can still trust. Named (vs. an inline
-		* `assign`) so the machine config stays consistent with
-		* `setup({ actions: { ... } })`'s typed-action contract.
-		*/
-		setVerdictToLocal: assign({ verdict: ({ context }) => context.localVerdict }),
-		stopMediaStream: assign(({ context }) => {
-			context.frameCapturer?.dispose();
-			if (context.stream) stopStream(context.stream);
-			context.provider?.dispose();
-			context.deepsightService?.cleanup();
-			return {
-				stream: void 0,
-				provider: void 0,
-				frameCapturer: void 0
-			};
-		}),
-		resetContext: assign({
-			permissionResult: () => void 0,
-			stream: () => void 0,
-			provider: () => void 0,
-			frameCapturer: () => void 0,
-			deepsightService: () => void 0,
-			detectionStatus: () => "idle",
-			yawRange: () => 0,
-			pitchRange: () => 0,
-			capturedImage: () => void 0,
-			livenessOutcome: () => void 0,
-			signals: () => void 0,
-			fallbackReason: () => void 0,
-			token: () => void 0,
-			localVerdict: () => void 0,
-			verdict: () => void 0,
-			error: () => void 0,
-			resetDetection: () => void 0
-		}),
-		emitSignal: ({ context, event }) => {
-			const listener = context.config.onSignal;
-			if (!listener) return;
-			if (event.type === "DETECTION_UPDATE") listener({
-				type: "detection",
-				payload: event.status
-			});
-		}
-	},
-	guards: {
-		hasShowTutorial: ({ context }) => context.config.showTutorial === true,
-		isPermissionGranted: ({ event }) => {
-			if ("output" in event) return event.output === "granted";
-			return false;
-		},
-		isPermissionDenied: ({ event }) => {
-			if ("output" in event) return event.output === "denied";
-			return false;
-		},
-		hasTokenError: ({ context }) => context.error?.code === PERSONHOOD_ERROR_CODES.AUTH_TOKEN_FAILED,
-		isDetectionError: ({ event }) => event.status === "error"
-	}
-}).createMachine({
-	id: "personhood",
-	initial: "idle",
-	context: ({ input }) => ({
-		config: input.config,
-		dependencies: input.dependencies,
-		permissionResult: void 0,
-		fallbackReason: void 0,
-		stream: void 0,
-		provider: void 0,
-		frameCapturer: void 0,
-		deepsightService: void 0,
-		detectionStatus: "idle",
-		yawRange: 0,
-		pitchRange: 0,
-		capturedImage: void 0,
-		livenessOutcome: void 0,
-		signals: void 0,
-		token: void 0,
-		localVerdict: void 0,
-		verdict: void 0,
-		error: void 0,
-		resetDetection: void 0
-	}),
-	on: { QUIT: { target: "#personhood.closed" } },
-	states: {
-		idle: { on: { LOAD: [{
-			target: "tutorial",
-			guard: "hasShowTutorial"
-		}, { target: "collectingSignals" }] } },
-		tutorial: { on: { NEXT_STEP: { target: "collectingSignals" } } },
-		/**
-		* Two prep tasks run in parallel: collect device/behavioral signals and
-		* boot the Deepsight session (PRC warmup). Both are needed before we
-		* touch the camera; running them concurrently keeps the pre-capture
-		* latency budget under the PRD's 1.5s p50 target.
-		*/
-		collectingSignals: {
-			type: "parallel",
-			states: {
-				signals: {
-					initial: "running",
-					states: {
-						running: { invoke: {
-							id: "collectSignals",
-							src: "collectSignals",
-							onDone: {
-								target: "done",
-								actions: "setSignalsFromEvent"
-							},
-							onError: { target: "done" }
-						} },
-						done: { type: "final" }
-					}
-				},
-				deepsight: {
-					initial: "running",
-					states: {
-						running: { invoke: {
-							id: "initializeDeepsight",
-							src: "initializeDeepsight",
-							input: ({ context }) => ({
-								dependencies: context.dependencies,
-								ds: context.config.ds
-							}),
-							onDone: {
-								target: "done",
-								actions: "setDeepsightServiceFromEvent"
-							},
-							onError: { target: "done" }
-						} },
-						done: { type: "final" }
-					}
-				},
-				/**
-				* Third parallel branch — fetches the personhood session
-				* token. Latency-overlap with signals + Deepsight init so
-				* the network round-trip is "free" by the time the user
-				* finishes capturing. The mock-verify path returns a
-				* synthetic token without hitting the network, so this
-				* branch only fails when a real backend was configured AND
-				* the call genuinely failed (non-2xx, network error,
-				* missing token in the response). In that case we record
-				* the error and let the parallel `onDone` route the flow
-				* to the terminal `error` state — there's no point opening
-				* the camera if we know we can't authenticate the verify
-				* hop afterwards.
-				*/
-				token: {
-					initial: "running",
-					states: {
-						running: { invoke: {
-							id: "fetchToken",
-							src: "fetchToken",
-							input: ({ context }) => ({ config: context.config }),
-							onDone: {
-								target: "done",
-								actions: "setTokenFromEvent"
-							},
-							onError: {
-								target: "done",
-								actions: "setTokenError"
-							}
-						} },
-						done: { type: "final" }
-					}
-				}
-			},
-			onDone: [{
-				target: "error",
-				guard: "hasTokenError"
-			}, { target: "checkingPermission" }]
-		},
-		checkingPermission: { invoke: {
-			id: "checkPermission",
-			src: "checkPermission",
-			onDone: [
-				{
-					target: "capture",
-					guard: "isPermissionGranted",
-					actions: "setPermissionResultFromEvent"
-				},
-				{
-					target: "permissions.denied",
-					guard: "isPermissionDenied",
-					actions: "setPermissionResultFromEvent"
-				},
-				{
-					target: "permissions",
-					actions: "setPermissionResultFromEvent"
-				}
-			]
-		} },
-		permissions: {
-			initial: "idle",
-			states: {
-				idle: { on: {
-					REQUEST_PERMISSION: "requesting",
-					GO_TO_LEARN_MORE: "learnMore"
-				} },
-				learnMore: { on: {
-					BACK: "idle",
-					REQUEST_PERMISSION: "requesting"
-				} },
-				requesting: { invoke: {
-					id: "requestPermission",
-					src: "requestPermission",
-					onDone: [
-						{
-							target: "#personhood.capture",
-							guard: "isPermissionGranted",
-							actions: "setPermissionResultFromEvent"
-						},
-						{
-							target: "denied",
-							guard: "isPermissionDenied",
-							actions: "setPermissionResultFromEvent"
-						},
-						{
-							target: "idle",
-							actions: "setPermissionResultFromEvent"
-						}
-					],
-					onError: {
-						target: "denied",
-						actions: "setPermissionDenied"
-					}
-				} },
-				denied: {
-					entry: "setPermissionDenied",
-					on: { USE_FALLBACK: { target: "#personhood.serverFallback" } }
-				}
-			},
-			on: { USE_FALLBACK: { target: "#personhood.serverFallback" } }
-		},
-		capture: {
-			initial: "initializing",
-			states: {
-				initializing: { invoke: {
-					id: "initializeCamera",
-					src: "initializeCamera",
-					input: ({ context }) => ({ deepsightService: context.deepsightService }),
-					onDone: {
-						target: "detecting",
-						actions: "setStreamAndProvider"
-					},
-					onError: {
-						target: "#personhood.serverFallback",
-						actions: "setFallbackReasonNoCamera"
-					}
-				} },
-				detecting: {
-					invoke: {
-						id: "runDetection",
-						src: "runDetection",
-						input: ({ context }) => ({
-							provider: context.provider,
-							frameCapturer: context.frameCapturer,
-							autoComplete: context.config.autoComplete
-						}),
-						onError: {
-							target: "#personhood.error",
-							actions: "setDetectionError"
-						}
-					},
-					on: {
-						DETECTION_UPDATE: [{
-							guard: "isDetectionError",
-							target: "#personhood.error",
-							actions: [
-								"setDetectionStatus",
-								"setDetectionError",
-								"emitSignal"
-							]
-						}, { actions: ["setDetectionStatus", "emitSignal"] }],
-						DETECTION_RESET_READY: { actions: "setResetDetection" },
-						DETECTION_SUCCESS: {
-							target: "#personhood.analyzing",
-							actions: "setCapturedImageAndRangeFromEvent"
-						}
-					}
-				}
-			}
-		},
-		/**
-		* On-device liveness analysis — Deepsight virtual-camera check + pipeline
-		* analysis + pose-motion range. Runs after a good capture but before we
-		* synthesize the verdict, so {@link produceLocalVerdict} can fold these
-		* signals in. This is the actual "local liveness" step per PRD #4.
-		*/
-		analyzing: {
-			exit: "stopMediaStream",
-			invoke: {
-				id: "analyzeLiveness",
-				src: "analyzeLiveness",
-				input: ({ context }) => ({
-					deepsightService: context.deepsightService,
-					stream: context.stream,
-					capturedImage: context.capturedImage,
-					yawRange: context.yawRange,
-					pitchRange: context.pitchRange,
-					token: context.token
-				}),
-				onDone: {
-					target: "processing",
-					actions: "setLivenessOutcomeFromEvent"
-				},
-				onError: { target: "processing" }
-			}
-		},
-		processing: { invoke: {
-			id: "produceLocalVerdict",
-			src: "produceLocalVerdict",
-			input: ({ context }) => ({
-				config: context.config,
-				signals: context.signals ?? emptySignals(),
-				detectionStatus: context.detectionStatus,
-				liveness: context.livenessOutcome
-			}),
-			onDone: {
-				target: "verifyingOnServer",
-				actions: "setLocalVerdictFromEvent"
-			},
-			onError: {
-				target: "error",
-				actions: "setLocalVerdictError"
-			}
-		} },
-		/**
-		* On-device verify hop. Sends the Deepsight metadata + derived
-		* `spoofCheckResults` to `/omni/personhood/verify` (authenticated
-		* with `Authorization: Bearer <token>`) and uses the server's
-		* response as the final verdict. Falls back to the local
-		* verdict if the network call fails — better to deliver SOMETHING
-		* than nothing, but a reachable backend always wins.
-		*/
-		verifyingOnServer: { invoke: {
-			id: "verifyOnDevice",
-			src: "verifyOnDevice",
-			input: ({ context }) => ({
-				config: context.config,
-				liveness: context.livenessOutcome,
-				localVerdict: context.localVerdict,
-				token: context.token
-			}),
-			onDone: {
-				target: "finished",
-				actions: "setVerdictFromEvent"
-			},
-			onError: {
-				target: "finished",
-				actions: "setVerdictToLocal"
-			}
-		} },
-		/**
-		* Server fallback path — only reached when on-device liveness can't run
-		* (currently: after the user explicitly denies camera permission). The
-		* network call is gated by `config.mockVerify` the same as the primary
-		* path, so the dev demo works offline.
-		*/
-		serverFallback: { invoke: {
-			id: "requestServerFallback",
-			src: "requestServerFallback",
-			input: ({ context }) => ({
-				config: context.config,
-				signals: context.signals ?? emptySignals(),
-				reason: context.fallbackReason ?? "permission_denied"
-			}),
-			onDone: {
-				target: "finished",
-				actions: "setVerdictFromEvent"
-			},
-			onError: {
-				target: "error",
-				actions: "setVerifyError"
-			}
-		} },
-		finished: { type: "final" },
-		closed: {
-			entry: "stopMediaStream",
-			type: "final"
-		},
-		error: {
-			entry: "stopMediaStream",
-			on: { RESET: {
-				target: "idle",
-				actions: "resetContext"
-			} }
-		}
-	}
-});
-//#endregion
-//#region src/modules/personhood/personhoodActor.ts
-/**
-* Production-default {@link PersonhoodDependencies}. Browser storage +
-* the singleton WASM util. Single source of truth for what the actor
-* and the manager wire up when the caller doesn't provide their own;
-* tests and the extensibility layer pass `dependencies` explicitly.
-*/
-function getDefaultPersonhoodDependencies() {
-	return {
-		storage: new BrowserStorageProvider(),
-		getWasmUtil: () => WasmUtilProvider.getInstance()
-	};
-}
-/**
-* Creates and starts a Personhood XState actor. Defaults to the production
-* browser storage + WASM providers; passing `dependencies` lets tests and the
-* extensibility layer swap them for fakes.
-*/
-function createPersonhoodActor(options) {
-	const dependencies = options.dependencies ?? getDefaultPersonhoodDependencies();
-	return createActor(personhoodMachine, { input: {
-		config: options.config,
-		dependencies
-	} }).start();
-}
-//#endregion
-//#region src/modules/personhood/personhoodManager.ts
-/**
-* Personhood deliberately opts out of the SDK's manager-instrumentation
-* analytics pipeline. The widget runs as a self-contained modal/inline
-* captcha replacement, not as part of the broader onboarding funnel —
-* it doesn't share an onboarding session token (`/omni/start`) with
-* the rest of an integrator's flow, so the per-transition events the
-* default instrumentation would emit can't authenticate against
-* `/omni/interview-events`. Wiring them up only produced a cascade of
-* 403s in integrators' devtools (one preflight + one POST per
-* `screenOpened` / `elementClicked` / `captureAttemptFinished` /
-* `errorTriggered` transition), with no usable analytics signal on
-* the receiving end.
-*
-* `createManager()` requires the `instrumentation` option to be
-* present, so we pass a no-op that satisfies the contract without
-* firing any of the helpers. If a future use case calls for
-* personhood analytics (integrator opt-in, internal QA dashboard,
-* etc.) the right move is to re-enable `createManagerInstrumentation`
-* here gated on a config flag — not to remove this no-op.
-*/
-function createNoopInstrumentation() {
-	return {
-		moduleName: eventModuleNames.personhood,
-		onModuleOpened: () => void 0,
-		onModuleClosed: () => void 0,
-		getScreenName: () => void 0,
-		onScreenOpened: () => void 0,
-		onScreenClosed: () => void 0,
-		getErrorName: () => void 0,
-		getErrorPayload: () => void 0,
-		onErrorTriggered: () => void 0,
-		onElementClicked: () => void 0,
-		onCaptureAttemptFinished: () => void 0
-	};
-}
-function getPermissionSubState(snapshot) {
-	if (snapshot.matches({ permissions: "learnMore" })) return "learnMore";
-	if (snapshot.matches({ permissions: "requesting" })) return "requesting";
-	if (snapshot.matches({ permissions: "denied" })) return "denied";
-	return "idle";
-}
-function mapState(snapshot) {
-	const context = snapshot.context;
-	if (snapshot.matches("idle")) return { status: "idle" };
-	if (snapshot.matches("tutorial")) return { status: "tutorial" };
-	if (snapshot.matches("collectingSignals")) return {
-		status: "loading",
-		phase: "collectingSignals"
-	};
-	if (snapshot.matches("checkingPermission")) return {
-		status: "loading",
-		phase: "checkingPermission"
-	};
-	if (snapshot.matches("permissions")) return {
-		status: "permissions",
-		permissionStatus: getPermissionSubState(snapshot)
-	};
-	if (snapshot.matches({ capture: "initializing" })) return {
-		status: "capture",
-		captureStatus: "initializing",
-		detectionStatus: context.detectionStatus,
-		stream: context.stream
-	};
-	if (snapshot.matches("capture")) return {
-		status: "capture",
-		captureStatus: "detecting",
-		detectionStatus: context.detectionStatus,
-		stream: context.stream
-	};
-	if (snapshot.matches("analyzing")) return {
-		status: "processing",
-		source: "analyzing"
-	};
-	if (snapshot.matches("processing")) return {
-		status: "processing",
-		source: "local"
-	};
-	if (snapshot.matches("serverFallback")) return {
-		status: "processing",
-		source: "fallback"
-	};
-	if (snapshot.matches("verifyingOnServer")) return {
-		status: "processing",
-		source: "local"
-	};
-	if (snapshot.matches("finished")) return {
-		status: "finished",
-		verdict: context.verdict ?? {
-			human: false,
-			confidence: 0,
-			evidenceId: "missing",
-			signals: emptySignals(),
-			spoofCheckResults: []
-		}
-	};
-	if (snapshot.matches("closed")) return { status: "closed" };
-	if (snapshot.matches("error")) return {
-		status: "error",
-		error: context.error ?? { code: "UNKNOWN" }
-	};
-	return { status: "idle" };
-}
-function createApi({ actor, trackElementClicked }) {
-	return {
-		/** Starts the flow (goes to tutorial or capture depending on config). */
-		load() {
-			actor.send({ type: "LOAD" });
-		},
-		/** Advances from tutorial → capture. */
-		nextStep() {
-			trackElementClicked?.("nextStep");
-			actor.send({ type: "NEXT_STEP" });
-		},
-		/** Triggers `getUserMedia` when in `permissions.idle`. */
-		requestPermission() {
-			trackElementClicked?.("requestPermission");
-			actor.send({ type: "REQUEST_PERMISSION" });
-		},
-		/** Shows the permission rationale view. */
-		goToLearnMore() {
-			trackElementClicked?.("goToLearnMore");
-			actor.send({ type: "GO_TO_LEARN_MORE" });
-		},
-		/** Returns from learn-more → permission prompt. */
-		back() {
-			trackElementClicked?.("back");
-			actor.send({ type: "BACK" });
-		},
-		/** Dismisses the widget into the terminal `closed` state. */
-		close() {
-			trackElementClicked?.("close");
-			actor.send({ type: "QUIT" });
-		},
-		/** Resets from the (non-final) `error` state back to `idle`. */
-		reset() {
-			actor.send({ type: "RESET" });
-		},
-		/**
-		* Skip the on-device path and hit the server fallback. Wired to the
-		* "Continue without camera" button on the permission-denied screen; also
-		* dispatched automatically when the device has no camera at all.
-		*/
-		useFallback() {
-			trackElementClicked?.("useFallback");
-			actor.send({ type: "USE_FALLBACK" });
-		}
-	};
-}
-/**
-* Wraps a pre-built personhood actor in a manager. Internal helper
-* shared by {@link createPersonhoodManager} (drop-in widget path) and
-* {@link createPersonhoodManagerFromActor} (extensibility surface).
-* Centralizing the `createManager(...)` + instrumentation call avoids
-* two near-identical wrap blocks drifting apart.
-*/
-function wrapActor(actor) {
-	return createManager({
-		actor,
-		mapState,
-		createApi,
-		instrumentation: createNoopInstrumentation()
-	});
-}
-/**
-* Manager built from an externally-owned actor (extensibility path).
-*/
-function createPersonhoodManagerFromActor(actor) {
-	return wrapActor(actor);
-}
-/**
-* Creates a Personhood manager for the drop-in widget.
-*
-* The manager exposes:
-* - `state: PersonhoodState` via `getState()` / `subscribe()`
-* - Lifecycle controls: `load`, `nextStep`, `requestPermission`,
-*   `goToLearnMore`, `back`, `close`, `reset`, `useFallback`, `stop`
-*
-* Head-pose is intentionally **not** exposed as a stream. The SDK
-* extracts pose internally for the server-side `headMotion` spoof
-* check; UI consumers that need a frame-rate pose signal (avatar
-* mirroring, etc.) should run their own face-tracking pipeline
-* (e.g. MediaPipe FaceLandmarker) against `state.stream` instead.
-*
-* @example
-* ```ts
-* const manager = createPersonhoodManager({
-*   config: { siteKey: 'demo', mockVerify: true },
-* });
-* manager.subscribe((state) => {
-*   if (state.status === 'finished') {
-*     console.log('human?', state.verdict.human);
-*   }
-* });
-* manager.load();
-* ```
-*/
-function createPersonhoodManager(options) {
-	return wrapActor(createPersonhoodActor(options));
-}
-//#endregion
-export { PERSONHOOD_ERROR_CODES, createPersonhoodActor, createPersonhoodManager, createPersonhoodManagerFromActor, personhoodMachine };