@incodetech/core 2.3.2 → 2.4.0-rc.0

package/dist/{trueSightService-M5VpCo96.esm.js → trueSightService-BWgRVGIT.esm.js}

@@ -1,9 +1,10 @@
-import { a as setWebApiHttpTransport, f as deriveSiblingJsPath, i as initializeWasmWebClient, o as setupWasmConnection, p as WASM_MODEL_FILES, r as executeWasmRequest, t as WasmWebClientError, v as buildModelVariantSources } from "./wasmWebClient-B7baE-Wf.esm.js";
+import { a as setWebApiHttpTransport, f as deriveSiblingJsPath, i as initializeWasmWebClient, o as setupWasmConnection, p as WASM_MODEL_FILES, r as executeWasmRequest, t as WasmWebClientError, v as buildModelVariantSources } from "./wasmWebClient-kbYZ2sxw.esm.js";
 import { t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
+import { n as eventModuleNames } from "./events-CAgFE-k3.esm.js";
 import { i as isApiConfigured, n as getApi, o as setClient, r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { n as eventModuleNames } from "./events-ijlbX_Wx.esm.js";
-import { t as SDK_VERSION } from "./sdkVersion-N1UiyFiY.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
+import { t as endpoints } from "./endpoints-DHzlkQNe.esm.js";
+import { t as SDK_VERSION } from "./sdkVersion-F5YZbjip.esm.js";
+import { n as reportHttpError, t as HttpRequestError } from "./HttpRequestError-Bh0pNGSC.esm.js";
 //#region ../infra/src/wasm/wasmDefaults.ts
 const WASM_CDN_BASE_URL = "https://cdn.incodesmile.com/ml-wasm-kit-release";
 /** The WASM version bundled and tested with this SDK release. */
@@ -131,6 +132,7 @@ function resolveWasmConfig(overrides) {
 		glueCodeSimdPath: pickPath("glueCodeSimdPath", overrides, glueCodeSimdDefault),
 		modelsBasePath: pickPath("modelsBasePath", overrides, modelsDefault),
 		useSimd: overrides.useSimd,
+		showLogs: overrides.showLogs,
 		pipelines: overrides.pipelines,
 		pipelineModels: overrides.pipelineModels,
 		modelUrls: overrides.modelUrls,
@@ -142,970 +144,961 @@ function resolveWasmConfig(overrides) {
 	validateWasmPaths(merged);
 	return merged;
 }
+/** Hard cap per log message, UTF-8 bytes (contract). */
+const MESSAGE_MAX_BYTES = 8 * 1024;
+const TRUESIGHT_SDK_ID = "IncdOnboarding";
+/** localStorage key prefix for persisted sealed snapshots (A3: one slot per session). */
+const PENDING_STORAGE_KEY_PREFIX = "incode.truesight.pending.";
 //#endregion
-//#region ../infra/src/http/createApi.ts
-var FetchHttpError = class extends Error {
-	constructor(status, statusText, url, method, headers, data) {
-		super(`HTTP ${status} ${statusText}`);
-		this.ok = false;
-		this.status = status;
-		this.statusText = statusText;
-		this.url = url;
-		this.method = method;
-		this.headers = headers;
-		this.data = data;
-		this.name = "FetchHttpError";
-	}
-};
-const buildQueryString$1 = (query) => {
-	if (!query) return "";
-	const params = new URLSearchParams();
-	Object.entries(query).forEach(([key, value]) => {
-		if (value !== void 0 && value !== null) params.append(key, String(value));
-	});
-	const str = params.toString();
-	return str ? `?${str}` : "";
-};
-const buildUrl$1 = (baseURL, url, query) => {
-	const queryString = buildQueryString$1(query);
-	if (url.startsWith("http://") || url.startsWith("https://")) return `${url}${queryString}`;
-	return `${baseURL.endsWith("/") ? baseURL.slice(0, -1) : baseURL}${url.startsWith("/") ? url : `/${url}`}${queryString}`;
-};
-const prepareBody$1 = (body) => {
-	if (body === null || body === void 0) return null;
-	if (body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer) return body;
-	if (typeof body === "object") return JSON.stringify(body);
-	return String(body);
-};
-const parseResponse = async (response, parseType) => {
-	if (parseType === "response") return response;
-	if (parseType === "blob") return await response.blob();
-	if (parseType === "arrayBuffer") return await response.arrayBuffer();
-	if (parseType === "text") return await response.text();
-	const contentType = response.headers.get("content-type") ?? "";
-	if (parseType === "json" || contentType.includes("application/json")) {
-		const raw = await response.text();
-		if (raw.length === 0) return "";
-		try {
-			return JSON.parse(raw);
-		} catch {
-			return raw;
-		}
-	}
-	return await response.text();
-};
-const requestWithXHR = (fullUrl, method, mergedHeaders, requestBody, timeout, signal, onUploadProgress) => {
-	return new Promise((resolve, reject) => {
-		const xhr = new XMLHttpRequest();
-		xhr.open(method, fullUrl, true);
-		Object.entries(mergedHeaders).forEach(([key, value]) => {
-			xhr.setRequestHeader(key, value);
-		});
-		xhr.timeout = timeout;
-		xhr.upload.onprogress = (event) => {
-			if (event.lengthComputable) {
-				const percentComplete = event.loaded / event.total * 100;
-				onUploadProgress(Math.round(percentComplete));
-			}
-		};
-		xhr.onload = () => {
-			const responseHeaders = {};
-			xhr.getAllResponseHeaders().split("\r\n").forEach((line) => {
-				const parts = line.split(": ");
-				if (parts.length === 2) responseHeaders[parts[0].toLowerCase()] = parts[1];
-			});
-			let data;
-			try {
-				if ((xhr.getResponseHeader("content-type") ?? "").includes("application/json")) data = JSON.parse(xhr.responseText);
-				else data = xhr.responseText;
-			} catch {
-				data = xhr.responseText;
-			}
-			if (xhr.status >= 200 && xhr.status < 300) resolve({
-				ok: true,
-				status: xhr.status,
-				statusText: xhr.statusText,
-				url: fullUrl,
-				headers: responseHeaders,
-				data
-			});
-			else reject(new FetchHttpError(xhr.status, xhr.statusText, fullUrl, method, responseHeaders, data));
-		};
-		xhr.onerror = () => {
-			reject(new FetchHttpError(0, "Network Error", fullUrl, method, {}, null));
-		};
-		xhr.ontimeout = () => {
-			reject(new FetchHttpError(0, "Request timeout", fullUrl, method, {}, null));
-		};
-		if (signal) signal.addEventListener("abort", () => {
-			xhr.abort();
-			reject(new FetchHttpError(0, "Request aborted", fullUrl, method, {}, null));
-		});
-		xhr.send(requestBody);
-	});
-};
-const createApi = (config) => {
-	const headers = {
-		"Content-Type": "application/json",
-		Accept: "application/json",
-		"api-version": "1.0",
-		...config.customHeaders ?? {}
-	};
-	const defaults = {
-		baseURL: config.apiURL,
-		headers
-	};
-	const client = {
-		defaults,
-		async request(requestConfig) {
-			const { method = "GET", url, headers = {}, query, params, body, signal, timeout: timeoutOverride, parse, onUploadProgress, keepalive } = requestConfig;
-			const fullUrl = buildUrl$1(defaults.baseURL, url, params ?? query);
-			const mergedHeaders = {
-				...defaults.headers,
-				...headers
-			};
-			const requestBody = prepareBody$1(body);
-			const timeout = timeoutOverride ?? config.timeout;
-			let finalHeaders = mergedHeaders;
-			if (requestBody === null && (method === "POST" || method === "PUT" || method === "PATCH")) {
-				const { "Content-Type": _, ...headersWithoutContentType } = mergedHeaders;
-				finalHeaders = headersWithoutContentType;
-			}
-			if (onUploadProgress) {
-				if (requestBody !== null && typeof ReadableStream !== "undefined" && requestBody instanceof ReadableStream) throw new Error("Upload progress tracking is not supported for ReadableStream bodies");
-				return requestWithXHR(fullUrl, method, finalHeaders, requestBody, timeout ?? 0, signal, onUploadProgress);
-			}
-			const controller = new AbortController();
-			if (signal) if (signal.aborted) controller.abort();
-			else signal.addEventListener("abort", () => controller.abort(), { once: true });
-			const abortSignal = controller.signal;
-			const timeoutId = timeout === void 0 ? void 0 : setTimeout(() => controller.abort(), timeout);
-			try {
-				const response = await fetch(fullUrl, {
-					method,
-					headers: finalHeaders,
-					body: requestBody,
-					signal: abortSignal,
-					keepalive
-				});
-				if (timeoutId) clearTimeout(timeoutId);
-				const responseHeaders = {};
-				response.headers.forEach((value, key) => {
-					responseHeaders[key] = value;
-				});
-				const data = await parseResponse(response, parse);
-				if (!response.ok) throw new FetchHttpError(response.status, response.statusText, fullUrl, method, responseHeaders, data);
-				return {
-					ok: true,
-					status: response.status,
-					statusText: response.statusText,
-					url: fullUrl,
-					headers: responseHeaders,
-					data
-				};
-			} catch (error) {
-				if (timeoutId) clearTimeout(timeoutId);
-				if (error instanceof FetchHttpError) throw error;
-				if (error instanceof Error && error.name === "AbortError") throw new FetchHttpError(0, "Request timeout", fullUrl, method, {}, null);
-				throw error;
-			}
-		},
-		get(url, config) {
-			return client.request({
-				...config,
-				url,
-				method: "GET"
-			});
-		},
-		post(url, body, config) {
-			return client.request({
-				...config,
-				url,
-				body,
-				method: "POST"
-			});
-		},
-		put(url, body, config) {
-			return client.request({
-				...config,
-				url,
-				body,
-				method: "PUT"
-			});
-		},
-		patch(url, body, config) {
-			return client.request({
-				...config,
-				url,
-				body,
-				method: "PATCH"
-			});
-		},
-		delete(url, config) {
-			return client.request({
-				...config,
-				url,
-				method: "DELETE"
-			});
-		},
-		head(url, config) {
-			return client.request({
-				...config,
-				url,
-				method: "HEAD"
-			});
-		},
-		options(url, config) {
-			return client.request({
-				...config,
-				url,
-				method: "OPTIONS"
-			});
-		},
-		setHeader(name, value) {
-			defaults.headers[name] = value;
-		}
-	};
-	return client;
-};
-//#endregion
-//#region ../infra/src/http/createWasmApi.ts
-const WASM_TIMEOUT_CEILING_MS = 36e5;
-const RSA_OAEP_SHA256_SCHEME = "RSA/NONE/OAEPWITHSHA-256ANDMGF1PADDING";
+//#region src/internal/trueSight/sanitize.ts
 /**
-* Builds the base set of HTTP headers that the WASM WebClient sends on every
-* request (including the internal `/e2ee/key/v2` and `/e2ee/key` handshake
-* calls).
+* Deny-by-default message scrubber — runs at INGESTION (inside the log buffer's
+* `append`), so the buffer, every persisted snapshot, and every upload are
+* already clean; there is no code path around it (ENG-48677 plan §1.2).
+*
+* Ordered pipeline. Two deliberate deviations from the plan's original rule
+* order, both from the P1-A adversarial review (2026-07-23, recorded in the
+* plan's Operating-decisions section):
+* - Inputs are pre-clamped to 2× the message cap BEFORE any regex runs — the
+*   unanchored patterns are quadratic on pathological non-matching runs
+*   (measured ~4.5 s on a 100 KB run), so regex cost must be bounded first.
+*   The final 8 KB cap still runs last.
+* - The base64-blob rule runs BEFORE the digit-run rule — a digit run inside a
+*   blob would otherwise split it into sub-64-char fragments that escape
+*   redaction.
+*
+* The regex table ships in the P1-A PR description for privacy sign-off (see
+* .agents/guides/privacy.md). Known hardening backlog (D4, Phase 4): formatted
+* phone numbers, unicode digits/emails, fuzz/property tests.
 */
-function buildWasmDefaultHeaders(customHeaders) {
-	return {
-		"Content-Type": "application/json",
-		Accept: "application/json",
-		"api-version": "1.0",
-		...customHeaders ?? {}
-	};
+/** Three dot-joined base64url segments — JWT/JWS shape. */
+const JWT_PATTERN = /\b[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g;
+/**
+* Credential-ish key with a `:`/`=` value (quoted, `Bearer …`, or bare token).
+* The key may carry prefixes (`access_token`, `x-api-key`, `sessionToken`) —
+* a plain \b boundary would miss `_token` since `_` is a word character.
+*/
+const CREDENTIAL_KV_PATTERN = /([\w-]*(?:token|api[-_]?key|authorization|auth|secret|password|passwd))\s*[:=]\s*("[^"]*"|'[^']*'|(?:Bearer\s+)?[^\s,;&]+)/gi;
+/** Userinfo credentials in an absolute URL (`https://user:pass@host/…`). */
+const URL_USERINFO_PATTERN = /(\bhttps?:\/\/)[^\s/@]*(?::[^\s/@]*)?@/gi;
+/** Query string / fragment of an absolute URL — kills signed URLs. */
+const URL_TAIL_PATTERN = /(https?:\/\/[^\s?#]+)[?#][^\s]*/g;
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+/** base64-ish blobs (media, keys) — 64+ chars of the base64/base64url alphabet. */
+const BASE64_BLOB_PATTERN = /[-A-Za-z0-9+/_]{64,}={0,2}/g;
+/** Runs of 8+ digits — phones, CURP, document numbers. */
+const DIGIT_RUN_PATTERN = /\d{8,}/g;
+const TRUNCATION_SUFFIX = "…[truncated]";
+/** Regex-cost bound: clamp raw input before any pattern runs (see header note). */
+const REGEX_INPUT_MAX_BYTES = MESSAGE_MAX_BYTES * 2;
+function sanitizeMessage(message) {
+	return truncateUtf8(truncateUtf8(message, REGEX_INPUT_MAX_BYTES).replace(JWT_PATTERN, "[jwt]").replace(CREDENTIAL_KV_PATTERN, "$1=[redacted]").replace(URL_USERINFO_PATTERN, "$1[redacted]@").replace(URL_TAIL_PATTERN, "$1").replace(EMAIL_PATTERN, "[email]").replace(BASE64_BLOB_PATTERN, (match) => `[blob:${match.length}]`).replace(DIGIT_RUN_PATTERN, "[digits]"), MESSAGE_MAX_BYTES);
 }
-var WasmHttpError = class extends Error {
-	constructor(status, statusText, url, method, headers, data) {
-		super(`HTTP ${status} ${statusText}`);
-		this.ok = false;
-		this.status = status;
-		this.statusText = statusText;
-		this.url = url;
-		this.method = method;
-		this.headers = headers;
-		this.data = data;
-		this.name = "WasmHttpError";
-	}
-};
-const HTTP_METHODS = /* @__PURE__ */ new Set([
-	"GET",
-	"POST",
-	"PUT",
-	"PATCH",
-	"DELETE"
-]);
-const buildQueryString = (query) => {
-	if (!query) return "";
-	const params = new URLSearchParams();
-	Object.entries(query).forEach(([key, value]) => {
-		if (value !== void 0 && value !== null) params.append(key, String(value));
-	});
-	const str = params.toString();
-	return str ? `?${str}` : "";
-};
-const buildUrl = (baseURL, url, query) => {
-	const queryString = buildQueryString(query);
-	if (url.startsWith("http://") || url.startsWith("https://")) return `${url}${queryString}`;
-	return `${baseURL.endsWith("/") ? baseURL.slice(0, -1) : baseURL}${url.startsWith("/") ? url : `/${url}`}${queryString}`;
-};
-const prepareBody = (body) => {
-	if (body === null || body === void 0) return void 0;
-	if (body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer || body instanceof Uint8Array || typeof body === "string") return body;
-	if (typeof body === "object") return body;
-	return String(body);
-};
-const normalizeMethod = (method) => {
-	const upper = method.toUpperCase();
-	if (!HTTP_METHODS.has(upper)) throw new Error(`Unsupported HTTP method for WASM client: ${method}`);
-	return upper;
-};
-const getErrorStatus = (error) => {
-	if (error instanceof WasmWebClientError) return error.statusCode;
-	if (typeof error === "object" && error !== null) {
-		const record = error;
-		if (typeof record.statusCode === "number") return record.statusCode;
-		if (typeof record.status === "number") return record.status;
+/**
+* UTF-8 byte length without TextEncoder (banned browser global in L1 —
+* see the no-browser-api-in-core lint rule). Counts by code point.
+*/
+function utf8ByteLength(value) {
+	let bytes = 0;
+	for (const char of value) bytes += codePointByteLength(char);
+	return bytes;
+}
+function codePointByteLength(char) {
+	const codePoint = char.codePointAt(0) ?? 0;
+	if (codePoint < 128) return 1;
+	if (codePoint < 2048) return 2;
+	if (codePoint < 65536) return 3;
+	return 4;
+}
+/** Cuts on a code-point boundary so no surrogate half ever reaches the wire. */
+function truncateUtf8(value, maxBytes) {
+	if (utf8ByteLength(value) <= maxBytes) return value;
+	const budget = maxBytes - utf8ByteLength(TRUNCATION_SUFFIX);
+	let bytes = 0;
+	let result = "";
+	for (const char of value) {
+		const charBytes = codePointByteLength(char);
+		if (bytes + charBytes > budget) break;
+		bytes += charBytes;
+		result += char;
 	}
-	return 0;
-};
-const getErrorData = (error) => {
-	if (error instanceof WasmWebClientError) return error.response?.data ?? null;
-	return null;
-};
-const getErrorMessage = (error) => {
-	if (error instanceof Error) return error.message;
-	return "WasmWebClient request failed";
-};
-const withAbortSignal = async (promise, signal, error) => {
-	if (!signal) return await promise;
-	if (signal.aborted) throw error;
-	return await new Promise((resolve, reject) => {
-		const onAbort = () => reject(error);
-		signal.addEventListener("abort", onAbort, { once: true });
-		promise.then(resolve, reject).finally(() => {
-			signal.removeEventListener("abort", onAbort);
-		});
-	});
-};
-const createWasmApi = async (config) => {
-	const headers = buildWasmDefaultHeaders(config.customHeaders);
-	const isEncryptionEnabled = config.isEncryptionEnabled ?? (() => false);
-	const useSha256 = config.mgf1 === "sha256";
-	await initializeWasmWebClient(config.wasm);
-	await setupWasmConnection(config.apiURL, "", config.encryptionEnabled ?? false, headers, useSha256);
-	const defaults = {
-		baseURL: config.apiURL,
-		headers
-	};
-	const client = {
-		defaults,
-		async request(requestConfig) {
-			const { method = "GET", url, headers: requestHeaders = {}, query, params, body, signal, timeout: timeoutOverride, onUploadProgress, ie = false } = requestConfig;
-			const upperMethod = normalizeMethod(method);
-			const requestParams = params ?? query;
-			const fullUrl = buildUrl(defaults.baseURL, url, requestParams);
-			const needsSchemeHeader = useSha256 && isEncryptionEnabled();
-			const mergedHeaders = {
-				...defaults.headers,
-				...needsSchemeHeader ? { "X-RSA-Encryption-Scheme": RSA_OAEP_SHA256_SCHEME } : {},
-				...requestHeaders
-			};
-			const requestBody = prepareBody(body);
-			const timeout = timeoutOverride ?? config.timeout ?? WASM_TIMEOUT_CEILING_MS;
-			const wasmProgress = onUploadProgress ? (progress) => {
-				if (progress.total > 0) onUploadProgress(Math.round(progress.loaded / progress.total * 100));
-			} : void 0;
-			const abortError = new WasmHttpError(0, "Request aborted", fullUrl, upperMethod, {}, null);
-			if (signal?.aborted) throw abortError;
-			try {
-				const response = await withAbortSignal(executeWasmRequest(upperMethod, url, requestBody, mergedHeaders, requestParams, timeout, wasmProgress, ie), signal, abortError);
-				if (response.status < 200 || response.status >= 300) throw new WasmHttpError(response.status, "", fullUrl, upperMethod, {}, response.data);
-				return {
-					ok: true,
-					status: response.status,
-					statusText: "",
-					url: fullUrl,
-					headers: {},
-					data: response.data
-				};
-			} catch (error) {
-				if (error instanceof WasmHttpError) throw error;
-				throw new WasmHttpError(getErrorStatus(error), getErrorMessage(error), fullUrl, upperMethod, {}, getErrorData(error));
-			}
-		},
-		get(url, requestConfig) {
-			return client.request({
-				...requestConfig,
-				url,
-				method: "GET"
-			});
-		},
-		post(url, body, requestConfig) {
-			return client.request({
-				...requestConfig,
-				url,
-				body,
-				method: "POST"
-			});
-		},
-		put(url, body, requestConfig) {
-			return client.request({
-				...requestConfig,
-				url,
-				body,
-				method: "PUT"
-			});
-		},
-		patch(url, body, requestConfig) {
-			return client.request({
-				...requestConfig,
-				url,
-				body,
-				method: "PATCH"
-			});
-		},
-		delete(url, requestConfig) {
-			return client.request({
-				...requestConfig,
-				url,
-				method: "DELETE"
-			});
-		},
-		head() {
-			return Promise.reject(/* @__PURE__ */ new Error("HEAD is not supported by the WASM HTTP client"));
-		},
-		options() {
-			return Promise.reject(/* @__PURE__ */ new Error("OPTIONS is not supported by the WASM HTTP client"));
-		},
-		setHeader(name, value) {
-			defaults.headers[name] = value;
-		}
-	};
-	return client;
-};
+	return result + TRUNCATION_SUFFIX;
+}
 //#endregion
-//#region src/internal/http/clientLifecycle.ts
+//#region ../infra/src/crypto/randomUUID.ts
 /**
-* Wraps the active HttpClient as a transport for the C++ `WebApi` host
-* adapter. Lets the on-device face-results POST flow through the same
-* `httpClient.request()` pipeline as every other endpoint — header
-* injection, encryption-state handling, default headers, timeout — instead
-* of bypassing it via `executeWasmRequest` directly.
+* Cryptographically-strong UUID v4 (RFC 4122).
 *
-* Protected captures arrive with `ie === true`: the C++ `WebApi` already
-* encrypted the body inline, and only the WASM `WebClient` can unwrap it. A
-* plain fetch client would post the ciphertext as JSON and the backend
-* answers 406. If the plain client is still installed at that point (the
-* host called `setup()` without `wasm` and warmed WASM separately), swap to
-* the WASM client first. The module is already loaded — the payload came
-* out of it — so the swap only creates the `WebClient`.
+* Lives in infra (L0) so Core (L1) can mint secure identifiers without touching
+* the `crypto` browser API directly — Core delegates here, keeping it free of
+* browser globals (enforced by the `no-browser-api-in-core` lint rule). Backed
+* by `crypto.randomUUID`, available in every browser the SDK targets.
 */
-function bindWebApiTransport(client) {
-	return async (url, body, config) => {
-		const response = await (config.ie === true && storedHttpConfig && !storedHttpConfig.isWasm ? await ensureWasmHttpClient() : client).request({
-			method: "POST",
-			url,
-			body,
-			headers: config.headers,
-			params: config.params,
-			timeout: config.timeout,
-			ie: config.ie
-		});
-		return {
-			data: response.data,
-			status: response.status
-		};
-	};
+function randomUUID() {
+	return crypto.randomUUID();
 }
-function installClient(client) {
-	setClient(client);
-	setWebApiHttpTransport(bindWebApiTransport(client));
+//#endregion
+//#region ../infra/src/time/epochMsToIsoString.ts
+/**
+* Converts an epoch-milliseconds timestamp to a full ISO-8601 UTC string
+* (e.g. `2026-07-23T09:41:00.000Z`).
+*
+* Lives in Infra (L0) so Core can format wire timestamps without touching the
+* `Date` global directly — banned in Core by the `no-browser-api-in-core` lint
+* rule — mirroring the `crypto/randomUUID.ts` free-function precedent.
+* (`DateFormattingProvider.utcToIsoDateString` is date-only and not suitable.)
+*/
+function epochMsToIsoString(epochMs) {
+	return new Date(epochMs).toISOString();
 }
-async function ensureWasmHttpClient() {
-	await upgradeToWasmHttpClient(resolveWasmConfig());
-	return getApi();
+//#endregion
+//#region src/internal/trueSight/recordBuilder.ts
+/**
+* Assembles the exact plaintext contract record — the ONLY place a diagnostics
+* payload is shaped. Pure: same function serves final records, interrupted
+* snapshots, and future incremental slices (ENG-48677 plan §1.1).
+*
+* Deny-by-default is structural here: every field is an explicit literal —
+* nothing is spread from internal state, so no unexpected field can ever leak
+* into an upload.
+*
+* Hard gates enforced:
+* - empty/missing `sessionId` or `startedAt` → returns `null` (upload skipped —
+*   expected for sessions that die before `/omni/start`).
+* - `failureReason` present if-and-only-if `outcome === 'failure'` (defaults to
+*   `'unknown'` when a failure arrives without one, rather than dropping the record).
+* - fresh record `id` per build; `endedAt` stamped at build time.
+*/
+function buildDiagnosticsRecord(meta, logs, outcome, failureReason, recordId) {
+	if (!meta.sessionId || meta.startedAtMs === null) return null;
+	const flowType = meta.flowType ?? deriveFlowTypeFromSurface(meta.integrationType);
+	if (flowType === null) return null;
+	return {
+		schemaVersion: "1.0",
+		id: recordId ?? randomUUID(),
+		session: {
+			sessionId: meta.sessionId,
+			sdkId: TRUESIGHT_SDK_ID,
+			sdkVersion: SDK_VERSION,
+			platform: "web",
+			sdkMode: null,
+			browser: meta.browser,
+			osVersion: meta.osVersion,
+			osLanguage: meta.osLanguage,
+			sdkLanguage: meta.sdkLanguage,
+			integrationType: meta.integrationType,
+			flowType,
+			flowId: meta.flowId,
+			workflowId: meta.workflowId,
+			outcome,
+			...outcome === "failure" ? { failureReason: failureReason ?? "unknown" } : {},
+			startedAt: epochMsToIsoString(meta.startedAtMs),
+			endedAt: epochMsToIsoString(getTimestamp()),
+			testing: meta.testing,
+			e2eEncryptionEnabled: meta.e2eEncryptionEnabled,
+			configurationId: meta.hasConfigurationId,
+			externalCustomerId: meta.hasExternalCustomerId,
+			hasProvidedSessionId: meta.hasProvidedSessionId,
+			token: meta.hasToken,
+			externalToken: meta.hasExternalToken
+		},
+		logs: logs.map(toContractEntry)
+	};
 }
-let storedHttpConfig;
-let pendingUpgrade;
-/** Reads the current HTTP-client config (or `undefined` if none installed). */
-function getStoredHttpConfig() {
-	return storedHttpConfig;
+/**
+* Wire `flowType` when no orchestrator was OBSERVED (an observed one — set by
+* the bridge on any flow event — always wins). Stage ingest requires a
+* non-null enum (probe 2026-07-23: null/omitted/off-enum all 400), so the
+* entry surface decides, and the mapping is deliberately exhaustive:
+*
+* - `startWorkflow`  → 'workflow'  (Webflows engine entered, died pre-ready)
+* - `startFlow`      → 'flow'      (flow/orchestrated manager, died pre-ready)
+* - `startOnboarding`→ 'flow'      (self-loading UI wraps the flow engine)
+* - `startOnboardingSection` → null → the BUILD ABORTS (record withheld):
+*   a standalone session has no truthful flowType, and mislabeling it as a
+*   flow session is worse than skipping the upload. Withheld until the
+*   DECIDED BE ask ships (`flowType:"standalone"`, not nullable) — then this
+*   branch returns 'standalone' and standalone diagnostics start flowing,
+*   coordinated with the BE deploy since off-enum values 400 today.
+*/
+function deriveFlowTypeFromSurface(integrationType) {
+	switch (integrationType) {
+		case "startWorkflow": return "workflow";
+		case "startFlow":
+		case "startOnboarding": return "flow";
+		case "startOnboardingSection": return null;
+	}
 }
-/** Whether encryption is currently active on the installed HTTP client. */
-function isHttpEncrypted() {
-	return storedHttpConfig?.encryption.enabled ?? false;
+function toContractEntry(entry) {
+	return {
+		index: entry.index,
+		timestamp: epochMsToIsoString(entry.timestampMs),
+		level: entry.level,
+		thread: "main",
+		message: entry.message,
+		subsystem: entry.subsystem,
+		category: entry.category
+	};
 }
-/** Clears all HTTP-client state. Called by `reset()`. */
-function resetHttpClientState() {
-	storedHttpConfig = void 0;
-	setWebApiHttpTransport(null);
+function createInitialState() {
+	return {
+		sessionId: null,
+		startedAtMs: null,
+		browser: null,
+		osVersion: null,
+		osLanguage: null,
+		sdkLanguage: "en-US",
+		integrationType: "startOnboardingSection",
+		flowType: null,
+		flowId: null,
+		workflowId: null,
+		testing: false,
+		devModeSignal: void 0,
+		apiUrlSignal: void 0,
+		hasConfigurationId: false,
+		hasExternalCustomerId: false,
+		hasProvidedSessionId: false,
+		hasExternalToken: false
+	};
 }
+let state = createInitialState();
+let sources = {};
+/** Tap for `createSession` — sessionId comes from the returned `interviewId`. */
+function noteSessionCreated(session, options = {}) {}
+function noteEnvironment(environment) {}
 /**
-* Builds (or replaces) the HTTP client when `setup()` receives an `apiURL`.
-* Picks `createWasmApi` when `effectiveWasm` is set, otherwise plain
-* `createApi`. Wraps the call in handshake-failure context when encryption
-* is requested.
+* `testing` heuristic: devMode OR non-prod API host pattern. Always a boolean —
+* the contract requires the field present on every record. Signals MERGE across
+* calls (a later apiUrl-only call must not erase an earlier devMode signal);
+* `testing` is recomputed from the merged pair.
 */
-async function installFreshHttpClient(apiURL, options, effectiveWasm, encryption) {
-	installClient(effectiveWasm ? await withHandshakeFailureContext(encryption.enabled, () => createWasmApi({
-		apiURL,
-		customHeaders: options.customHeaders,
-		timeout: options.timeout,
-		wasm: effectiveWasm,
-		encryptionEnabled: encryption.enabled,
-		mgf1: encryption.mgf1,
-		isEncryptionEnabled: isHttpEncrypted
-	})) : createApi({
-		apiURL,
-		customHeaders: options.customHeaders,
-		timeout: options.timeout
-	}));
-	storedHttpConfig = {
-		apiURL,
-		customHeaders: options.customHeaders,
-		timeout: options.timeout,
-		isWasm: Boolean(effectiveWasm),
-		encryption
-	};
+function noteTestingSignals(signals) {}
+/**
+* Live read of the merged testing signal (devMode OR non-prod host). Used to
+* gate host-console self-health noise so production host pages stay quiet while
+* staging/dev keeps the console signal (the record always captures it either
+* way via `trueSightLog`). Same signal the overflow-flush staging gate uses.
+*/
+function isTrueSightTesting() {
+	return state.testing;
 }
 /**
-* Replaces the active HTTP client with the WASM-backed one. Used internally
-* by lazy-loading UI components (`<incode-flow>`, `<incode-workflow>`) when
-* WASM finishes warming up.
-*
-* No-op when no apiURL was previously configured, or when the active client
-* is already WASM-backed. The encryption state (enabled + MGF1 scheme) is
-* preserved across the swap — this is *not* a user-facing encryption change.
-*
-* @internal NOT a public API. Application code should use
-*   `setup({ wasm: {...} })` instead.
+* Wiring tap for every `initializeSession({ token })`: a token activated
+* before any `createSession` was observed on this page is host-minted, i.e.
+* external. (The exact `token`/`externalToken` web-semantics are a pending
+* Phase 0 contract ask — this inference is the interim mapping.)
 */
-async function upgradeToWasmHttpClient(resolved) {
-	const stored = storedHttpConfig;
-	if (!stored || stored.isWasm) return;
-	pendingUpgrade ??= (async () => {
-		installClient(await createWasmApi({
-			apiURL: stored.apiURL,
-			customHeaders: stored.customHeaders,
-			timeout: stored.timeout,
-			wasm: resolved,
-			encryptionEnabled: stored.encryption.enabled,
-			mgf1: stored.encryption.mgf1,
-			isEncryptionEnabled: isHttpEncrypted
-		}));
-		storedHttpConfig = {
-			...stored,
-			isWasm: true
-		};
-	})().finally(() => {
-		pendingUpgrade = void 0;
-	});
-	return pendingUpgrade;
+function noteTokenActivated() {}
+/** Explicit literal — the metadata half handed to the record builder. */
+function buildSessionMetadata() {
+	return {
+		sessionId: state.sessionId,
+		startedAtMs: state.startedAtMs,
+		browser: state.browser,
+		osVersion: state.osVersion,
+		osLanguage: state.osLanguage,
+		sdkLanguage: state.sdkLanguage,
+		integrationType: state.integrationType,
+		flowType: state.flowType,
+		flowId: state.flowId,
+		workflowId: state.workflowId,
+		testing: state.testing,
+		e2eEncryptionEnabled: readE2eEncryptionEnabled(),
+		hasConfigurationId: state.hasConfigurationId,
+		hasExternalCustomerId: state.hasExternalCustomerId,
+		hasProvidedSessionId: state.hasProvidedSessionId,
+		hasToken: readHasToken(),
+		hasExternalToken: state.hasExternalToken
+	};
 }
-/**
-* When `wantsEncryption` is true, wraps a call that triggers the in-binary
-* RSA/AES handshake so its rejection surfaces as a single, descriptive error
-* with the original error preserved as `cause`. Pass-through otherwise.
-*/
-async function withHandshakeFailureContext(wantsEncryption, fn) {
-	if (!wantsEncryption) return fn();
+/** Fail-open: diagnostics must never throw into the host flow. */
+function readE2eEncryptionEnabled() {
 	try {
-		return await fn();
-	} catch (cause) {
-		const error = /* @__PURE__ */ new Error("Failed to establish encrypted transport. The /e2ee/key handshake did not complete. Verify the apiURL is reachable and that the environment supports E2EE.");
-		error.cause = cause;
-		throw error;
+		return sources.getE2eEncryptionEnabled?.() ?? false;
+	} catch {
+		return false;
 	}
 }
-/** Hard cap per log message, UTF-8 bytes (contract). */
-const MESSAGE_MAX_BYTES = 8 * 1024;
-const TRUESIGHT_SDK_ID = "IncdOnboarding";
-/** localStorage key prefix for persisted sealed snapshots (A3: one slot per session). */
-const PENDING_STORAGE_KEY_PREFIX = "incode.truesight.pending.";
+/** Fail-open, like readE2eEncryptionEnabled. */
+function readHasToken() {
+	try {
+		return sources.getHasToken?.() ?? false;
+	} catch {
+		return false;
+	}
+}
+function resetTrueSightMetadata() {
+	state = createInitialState();
+	sources = {};
+}
 //#endregion
-//#region src/internal/trueSight/sanitize.ts
+//#region src/internal/trueSight/pendingEnvelopeStore.ts
+/** Index slot listing sessionIds with pending entries (no enumeration API). */
+const PENDING_INDEX_KEY = `${PENDING_STORAGE_KEY_PREFIX}index`;
+function slotKey(sessionId) {
+	return `${PENDING_STORAGE_KEY_PREFIX}${sessionId}`;
+}
 /**
-* Deny-by-default message scrubber — runs at INGESTION (inside the log buffer's
-* `append`), so the buffer, every persisted snapshot, and every upload are
-* already clean; there is no code path around it (ENG-48677 plan §1.2).
-*
-* Ordered pipeline. Two deliberate deviations from the plan's original rule
-* order, both from the P1-A adversarial review (2026-07-23, recorded in the
-* plan's Operating-decisions section):
-* - Inputs are pre-clamped to 2× the message cap BEFORE any regex runs — the
-*   unanchored patterns are quadratic on pathological non-matching runs
-*   (measured ~4.5 s on a 100 KB run), so regex cost must be bounded first.
-*   The final 8 KB cap still runs last.
-* - The base64-blob rule runs BEFORE the digit-run rule — a digit run inside a
-*   blob would otherwise split it into sub-64-char fragments that escape
-*   redaction.
-*
-* The regex table ships in the P1-A PR description for privacy sign-off (see
-* .agents/guides/privacy.md). Known hardening backlog (D4, Phase 4): formatted
-* phone numbers, unicode digits/emails, fuzz/property tests.
+* Adds the session to the pending index. Called once at collection start —
+* long before any page-hide — so the hide path never needs the index
+* read-modify-write and stays a single synchronous-effective write.
 */
-/** Three dot-joined base64url segments — JWT/JWS shape. */
-const JWT_PATTERN = /\b[\w-]{8,}\.[\w-]{8,}\.[\w-]{8,}\b/g;
+async function registerPendingSlot(sessionId, deps) {
+	try {
+		const index = await readIndex(deps.storage);
+		if (index.includes(sessionId)) return;
+		await deps.storage.set(PENDING_INDEX_KEY, [...index, sessionId]);
+	} catch {}
+}
 /**
-* Credential-ish key with a `:`/`=` value (quoted, `Bearer …`, or bare token).
-* The key may carry prefixes (`access_token`, `x-api-key`, `sessionToken`) —
-* a plain \b boundary would miss `_token` since `_` is a word character.
+* Writes the sealed snapshot into the session's slot. `BrowserStorageProvider`
+* executes the underlying `localStorage.setItem` synchronously in the first
+* slice of the async call, which is what makes this safe to fire (void) from
+* a page-hide handler.
 */
-const CREDENTIAL_KV_PATTERN = /([\w-]*(?:token|api[-_]?key|authorization|auth|secret|password|passwd))\s*[:=]\s*("[^"]*"|'[^']*'|(?:Bearer\s+)?[^\s,;&]+)/gi;
-/** Userinfo credentials in an absolute URL (`https://user:pass@host/…`). */
-const URL_USERINFO_PATTERN = /(\bhttps?:\/\/)[^\s/@]*(?::[^\s/@]*)?@/gi;
-/** Query string / fragment of an absolute URL — kills signed URLs. */
-const URL_TAIL_PATTERN = /(https?:\/\/[^\s?#]+)[?#][^\s]*/g;
-const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
-/** base64-ish blobs (media, keys) — 64+ chars of the base64/base64url alphabet. */
-const BASE64_BLOB_PATTERN = /[-A-Za-z0-9+/_]{64,}={0,2}/g;
-/** Runs of 8+ digits — phones, CURP, document numbers. */
-const DIGIT_RUN_PATTERN = /\d{8,}/g;
-const TRUNCATION_SUFFIX = "…[truncated]";
-/** Regex-cost bound: clamp raw input before any pattern runs (see header note). */
-const REGEX_INPUT_MAX_BYTES = MESSAGE_MAX_BYTES * 2;
-function sanitizeMessage(message) {
-	return truncateUtf8(truncateUtf8(message, REGEX_INPUT_MAX_BYTES).replace(JWT_PATTERN, "[jwt]").replace(CREDENTIAL_KV_PATTERN, "$1=[redacted]").replace(URL_USERINFO_PATTERN, "$1[redacted]@").replace(URL_TAIL_PATTERN, "$1").replace(EMAIL_PATTERN, "[email]").replace(BASE64_BLOB_PATTERN, (match) => `[blob:${match.length}]`).replace(DIGIT_RUN_PATTERN, "[digits]"), MESSAGE_MAX_BYTES);
+async function writePendingEnvelope(sessionId, entry, deps) {
+	try {
+		await deps.storage.set(slotKey(sessionId), entry);
+	} catch {}
+}
+/** Removes the entry and its index membership (terminal upload dispatched). */
+async function clearPending(sessionId, deps) {
+	try {
+		await deps.storage.remove(slotKey(sessionId));
+		const index = await readIndex(deps.storage);
+		if (index.includes(sessionId)) await deps.storage.set(PENDING_INDEX_KEY, index.filter((candidate) => candidate !== sessionId));
+	} catch {}
 }
 /**
-* UTF-8 byte length without TextEncoder (banned browser global in L1 —
-* see the no-browser-api-in-core lint rule). Counts by code point.
+* Next-load recovery, invoked from the first-token-observed hook (A1 — never
+* at `setup()`, which has no auth). For each foreign, old-enough entry: the
+* slot is cleared AT DISPATCH, then the envelope is posted fire-and-forget —
+* no 200-tracking, no retries (A2; a crash between clear and fire loses that
+* record, consistent with no-retry). Entries at/past the retention ceiling
+* are deleted unsent (A4). Never rejects; returns the A5 loss counters.
 */
-function utf8ByteLength(value) {
-	let bytes = 0;
-	for (const char of value) bytes += codePointByteLength(char);
-	return bytes;
+async function recoverPendingEnvelopes(options) {
+	const { storage, post, currentSessionId } = options;
+	const now = options.now ?? getTimestamp;
+	const counters = {
+		recovered: 0,
+		gcExpired: 0
+	};
+	try {
+		const index = await readIndex(storage);
+		if (index.length === 0) return counters;
+		const keptInIndex = [];
+		for (const sessionId of index) {
+			if (sessionId === currentSessionId) {
+				keptInIndex.push(sessionId);
+				continue;
+			}
+			const entry = await readEntry(storage, sessionId);
+			if (entry === "missing") continue;
+			if (entry === "corrupt") {
+				counters.gcExpired += 1;
+				continue;
+			}
+			const age = now() - entry.persistedAt;
+			if (age >= 6048e5) {
+				counters.gcExpired += 1;
+				await storage.remove(slotKey(sessionId));
+				continue;
+			}
+			if (age < 12e4) {
+				keptInIndex.push(sessionId);
+				continue;
+			}
+			await storage.remove(slotKey(sessionId));
+			counters.recovered += 1;
+			post(endpoints.diagnosticsData, entry.envelope, {}).catch(() => {});
+		}
+		await storage.set(PENDING_INDEX_KEY, keptInIndex);
+	} catch {}
+	return counters;
 }
-function codePointByteLength(char) {
-	const codePoint = char.codePointAt(0) ?? 0;
-	if (codePoint < 128) return 1;
-	if (codePoint < 2048) return 2;
-	if (codePoint < 65536) return 3;
-	return 4;
+async function readIndex(storage) {
+	const index = await storage.get(PENDING_INDEX_KEY);
+	if (!Array.isArray(index)) return [];
+	return index.filter((value) => typeof value === "string");
 }
-/** Cuts on a code-point boundary so no surrogate half ever reaches the wire. */
-function truncateUtf8(value, maxBytes) {
-	if (utf8ByteLength(value) <= maxBytes) return value;
-	const budget = maxBytes - utf8ByteLength(TRUNCATION_SUFFIX);
-	let bytes = 0;
-	let result = "";
-	for (const char of value) {
-		const charBytes = codePointByteLength(char);
-		if (bytes + charBytes > budget) break;
-		bytes += charBytes;
-		result += char;
+/** Reads one entry; malformed slots are pruned and reported as corrupt. */
+async function readEntry(storage, sessionId) {
+	try {
+		const value = await storage.get(slotKey(sessionId));
+		if (value === null) return "missing";
+		if (typeof value === "object" && value.v === 1 && typeof value.persistedAt === "number" && typeof value.envelope === "object") return value;
+		await storage.remove(slotKey(sessionId));
+		return "corrupt";
+	} catch {
+		try {
+			await storage.remove(slotKey(sessionId));
+		} catch {}
+		return "corrupt";
 	}
-	return result + TRUNCATION_SUFFIX;
 }
 //#endregion
-//#region ../infra/src/crypto/randomUUID.ts
+//#region src/internal/featureConfig/featureConfigService.ts
+let cachedFeatures = null;
 /**
-* Cryptographically-strong UUID v4 (RFC 4122).
-*
-* Lives in infra (L0) so Core (L1) can mint secure identifiers without touching
-* the `crypto` browser API directly — Core delegates here, keeping it free of
-* browser globals (enforced by the `no-browser-api-in-core` lint rule). Backed
-* by `crypto.randomUUID`, available in every browser the SDK targets.
+* Checks if a feature is enabled in the feature config.
 */
-function randomUUID() {
-	return crypto.randomUUID();
+function isFeatureEnabled(feature, features) {
+	return features?.find((f) => f.feature === feature)?.enabled ?? false;
 }
-//#endregion
-//#region ../infra/src/time/epochMsToIsoString.ts
 /**
-* Converts an epoch-milliseconds timestamp to a full ISO-8601 UTC string
-* (e.g. `2026-07-23T09:41:00.000Z`).
-*
-* Lives in Infra (L0) so Core can format wire timestamps without touching the
-* `Date` global directly — banned in Core by the `no-browser-api-in-core` lint
-* rule — mirroring the `crypto/randomUUID.ts` free-function precedent.
-* (`DateFormattingProvider.utcToIsoDateString` is date-only and not suitable.)
+* Fetches feature configuration from the backend.
+* Results are cached for the session lifetime.
 */
-function epochMsToIsoString(epochMs) {
-	return new Date(epochMs).toISOString();
-}
-//#endregion
-//#region src/internal/trueSight/recordBuilder.ts
-/**
-* Assembles the exact plaintext contract record — the ONLY place a diagnostics
-* payload is shaped. Pure: same function serves final records, interrupted
-* snapshots, and future incremental slices (ENG-48677 plan §1.1).
-*
-* Deny-by-default is structural here: every field is an explicit literal —
-* nothing is spread from internal state, so no unexpected field can ever leak
-* into an upload.
-*
-* Hard gates enforced:
-* - empty/missing `sessionId` or `startedAt` → returns `null` (upload skipped —
-*   expected for sessions that die before `/omni/start`).
-* - `failureReason` present if-and-only-if `outcome === 'failure'` (defaults to
-*   `'unknown'` when a failure arrives without one, rather than dropping the record).
-* - fresh record `id` per build; `endedAt` stamped at build time.
+async function fetchFeatureConfig(signal) {
+	if (cachedFeatures) return cachedFeatures;
+	const response = await api.get(endpoints.featureConfig, { signal });
+	if (!response.ok) throw new Error(`Failed to fetch feature config: ${response.status} ${response.statusText}`);
+	cachedFeatures = response.data;
+	return cachedFeatures;
+}
+/**
+* Resets the cached feature config (useful for testing).
 */
-function buildDiagnosticsRecord(meta, logs, outcome, failureReason, recordId) {
-	if (!meta.sessionId || meta.startedAtMs === null) return null;
-	const flowType = meta.flowType ?? deriveFlowTypeFromSurface(meta.integrationType);
-	if (flowType === null) return null;
-	return {
-		schemaVersion: "1.0",
-		id: recordId ?? randomUUID(),
-		session: {
-			sessionId: meta.sessionId,
-			sdkId: TRUESIGHT_SDK_ID,
-			sdkVersion: SDK_VERSION,
-			platform: "web",
-			sdkMode: null,
-			browser: meta.browser,
-			osVersion: meta.osVersion,
-			osLanguage: meta.osLanguage,
-			sdkLanguage: meta.sdkLanguage,
-			integrationType: meta.integrationType,
-			flowType,
-			flowId: meta.flowId,
-			workflowId: meta.workflowId,
-			outcome,
-			...outcome === "failure" ? { failureReason: failureReason ?? "unknown" } : {},
-			startedAt: epochMsToIsoString(meta.startedAtMs),
-			endedAt: epochMsToIsoString(getTimestamp()),
-			testing: meta.testing,
-			e2eEncryptionEnabled: meta.e2eEncryptionEnabled,
-			configurationId: meta.hasConfigurationId,
-			externalCustomerId: meta.hasExternalCustomerId,
-			hasProvidedSessionId: meta.hasProvidedSessionId,
-			token: meta.hasToken,
-			externalToken: meta.hasExternalToken
+function resetFeatureConfigCache() {
+	cachedFeatures = null;
+}
+//#endregion
+//#region ../infra/src/http/createApi.ts
+var FetchHttpError = class extends HttpRequestError {
+	constructor(..._args) {
+		super(..._args);
+		this.name = "FetchHttpError";
+	}
+};
+const buildQueryString$1 = (query) => {
+	if (!query) return "";
+	const params = new URLSearchParams();
+	Object.entries(query).forEach(([key, value]) => {
+		if (value !== void 0 && value !== null) params.append(key, String(value));
+	});
+	const str = params.toString();
+	return str ? `?${str}` : "";
+};
+const buildUrl$1 = (baseURL, url, query) => {
+	const queryString = buildQueryString$1(query);
+	if (url.startsWith("http://") || url.startsWith("https://")) return `${url}${queryString}`;
+	return `${baseURL.endsWith("/") ? baseURL.slice(0, -1) : baseURL}${url.startsWith("/") ? url : `/${url}`}${queryString}`;
+};
+const prepareBody$1 = (body) => {
+	if (body === null || body === void 0) return null;
+	if (body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer) return body;
+	if (typeof body === "object") return JSON.stringify(body);
+	return String(body);
+};
+const parseResponse = async (response, parseType) => {
+	if (parseType === "response") return response;
+	if (parseType === "blob") return await response.blob();
+	if (parseType === "arrayBuffer") return await response.arrayBuffer();
+	if (parseType === "text") return await response.text();
+	const contentType = response.headers.get("content-type") ?? "";
+	if (parseType === "json" || contentType.includes("application/json")) {
+		const raw = await response.text();
+		if (raw.length === 0) return "";
+		try {
+			return JSON.parse(raw);
+		} catch {
+			return raw;
+		}
+	}
+	return await response.text();
+};
+const requestWithXHR = (fullUrl, method, mergedHeaders, requestBody, timeout, signal, onUploadProgress) => {
+	return new Promise((resolve, reject) => {
+		const xhr = new XMLHttpRequest();
+		xhr.open(method, fullUrl, true);
+		Object.entries(mergedHeaders).forEach(([key, value]) => {
+			xhr.setRequestHeader(key, value);
+		});
+		xhr.timeout = timeout;
+		xhr.upload.onprogress = (event) => {
+			if (event.lengthComputable) {
+				const percentComplete = event.loaded / event.total * 100;
+				onUploadProgress(Math.round(percentComplete));
+			}
+		};
+		xhr.onload = () => {
+			const responseHeaders = {};
+			xhr.getAllResponseHeaders().split("\r\n").forEach((line) => {
+				const parts = line.split(": ");
+				if (parts.length === 2) responseHeaders[parts[0].toLowerCase()] = parts[1];
+			});
+			let data;
+			try {
+				if ((xhr.getResponseHeader("content-type") ?? "").includes("application/json")) data = JSON.parse(xhr.responseText);
+				else data = xhr.responseText;
+			} catch {
+				data = xhr.responseText;
+			}
+			if (xhr.status >= 200 && xhr.status < 300) resolve({
+				ok: true,
+				status: xhr.status,
+				statusText: xhr.statusText,
+				url: fullUrl,
+				headers: responseHeaders,
+				data
+			});
+			else reject(reportHttpError(new FetchHttpError(xhr.status, xhr.statusText, fullUrl, method, responseHeaders, data), mergedHeaders));
+		};
+		xhr.onerror = () => {
+			reject(new FetchHttpError(0, "Network Error", fullUrl, method, {}, null));
+		};
+		xhr.ontimeout = () => {
+			reject(new FetchHttpError(0, "Request timeout", fullUrl, method, {}, null));
+		};
+		if (signal) signal.addEventListener("abort", () => {
+			xhr.abort();
+			reject(new FetchHttpError(0, "Request aborted", fullUrl, method, {}, null));
+		});
+		xhr.send(requestBody);
+	});
+};
+const createApi = (config) => {
+	const headers = {
+		"Content-Type": "application/json",
+		Accept: "application/json",
+		"api-version": "1.0",
+		...config.customHeaders ?? {}
+	};
+	const defaults = {
+		baseURL: config.apiURL,
+		headers
+	};
+	const client = {
+		defaults,
+		async request(requestConfig) {
+			const { method = "GET", url, headers = {}, query, params, body, signal, timeout: timeoutOverride, parse, onUploadProgress, keepalive } = requestConfig;
+			const fullUrl = buildUrl$1(defaults.baseURL, url, params ?? query);
+			const mergedHeaders = {
+				...defaults.headers,
+				...headers
+			};
+			const requestBody = prepareBody$1(body);
+			const timeout = timeoutOverride ?? config.timeout;
+			let finalHeaders = mergedHeaders;
+			if (requestBody === null && (method === "POST" || method === "PUT" || method === "PATCH")) {
+				const { "Content-Type": _, ...headersWithoutContentType } = mergedHeaders;
+				finalHeaders = headersWithoutContentType;
+			}
+			if (onUploadProgress) {
+				if (requestBody !== null && typeof ReadableStream !== "undefined" && requestBody instanceof ReadableStream) throw new Error("Upload progress tracking is not supported for ReadableStream bodies");
+				return requestWithXHR(fullUrl, method, finalHeaders, requestBody, timeout ?? 0, signal, onUploadProgress);
+			}
+			const controller = new AbortController();
+			if (signal) if (signal.aborted) controller.abort();
+			else signal.addEventListener("abort", () => controller.abort(), { once: true });
+			const abortSignal = controller.signal;
+			const timeoutId = timeout === void 0 ? void 0 : setTimeout(() => controller.abort(), timeout);
+			try {
+				const response = await fetch(fullUrl, {
+					method,
+					headers: finalHeaders,
+					body: requestBody,
+					signal: abortSignal,
+					keepalive
+				});
+				if (timeoutId) clearTimeout(timeoutId);
+				const responseHeaders = {};
+				response.headers.forEach((value, key) => {
+					responseHeaders[key] = value;
+				});
+				const data = await parseResponse(response, parse);
+				if (!response.ok) throw reportHttpError(new FetchHttpError(response.status, response.statusText, fullUrl, method, responseHeaders, data), mergedHeaders);
+				return {
+					ok: true,
+					status: response.status,
+					statusText: response.statusText,
+					url: fullUrl,
+					headers: responseHeaders,
+					data
+				};
+			} catch (error) {
+				if (timeoutId) clearTimeout(timeoutId);
+				if (error instanceof FetchHttpError) throw error;
+				if (error instanceof Error && error.name === "AbortError") throw new FetchHttpError(0, "Request timeout", fullUrl, method, {}, null);
+				throw error;
+			}
 		},
-		logs: logs.map(toContractEntry)
+		get(url, config) {
+			return client.request({
+				...config,
+				url,
+				method: "GET"
+			});
+		},
+		post(url, body, config) {
+			return client.request({
+				...config,
+				url,
+				body,
+				method: "POST"
+			});
+		},
+		put(url, body, config) {
+			return client.request({
+				...config,
+				url,
+				body,
+				method: "PUT"
+			});
+		},
+		patch(url, body, config) {
+			return client.request({
+				...config,
+				url,
+				body,
+				method: "PATCH"
+			});
+		},
+		delete(url, config) {
+			return client.request({
+				...config,
+				url,
+				method: "DELETE"
+			});
+		},
+		head(url, config) {
+			return client.request({
+				...config,
+				url,
+				method: "HEAD"
+			});
+		},
+		options(url, config) {
+			return client.request({
+				...config,
+				url,
+				method: "OPTIONS"
+			});
+		},
+		setHeader(name, value) {
+			defaults.headers[name] = value;
+		}
 	};
-}
+	return client;
+};
+//#endregion
+//#region ../infra/src/http/createWasmApi.ts
+const WASM_TIMEOUT_CEILING_MS = 36e5;
+const RSA_OAEP_SHA256_SCHEME = "RSA/NONE/OAEPWITHSHA-256ANDMGF1PADDING";
 /**
-* Wire `flowType` when no orchestrator was OBSERVED (an observed one — set by
-* the bridge on any flow event — always wins). Stage ingest requires a
-* non-null enum (probe 2026-07-23: null/omitted/off-enum all 400), so the
-* entry surface decides, and the mapping is deliberately exhaustive:
-*
-* - `startWorkflow`  → 'workflow'  (Webflows engine entered, died pre-ready)
-* - `startFlow`      → 'flow'      (flow/orchestrated manager, died pre-ready)
-* - `startOnboarding`→ 'flow'      (self-loading UI wraps the flow engine)
-* - `startOnboardingSection` → null → the BUILD ABORTS (record withheld):
-*   a standalone session has no truthful flowType, and mislabeling it as a
-*   flow session is worse than skipping the upload. Withheld until the
-*   DECIDED BE ask ships (`flowType:"standalone"`, not nullable) — then this
-*   branch returns 'standalone' and standalone diagnostics start flowing,
-*   coordinated with the BE deploy since off-enum values 400 today.
+* Builds the base set of HTTP headers that the WASM WebClient sends on every
+* request (including the internal `/e2ee/key/v2` and `/e2ee/key` handshake
+* calls).
 */
-function deriveFlowTypeFromSurface(integrationType) {
-	switch (integrationType) {
-		case "startWorkflow": return "workflow";
-		case "startFlow":
-		case "startOnboarding": return "flow";
-		case "startOnboardingSection": return null;
-	}
-}
-function toContractEntry(entry) {
+function buildWasmDefaultHeaders(customHeaders) {
 	return {
-		index: entry.index,
-		timestamp: epochMsToIsoString(entry.timestampMs),
-		level: entry.level,
-		thread: "main",
-		message: entry.message,
-		subsystem: entry.subsystem,
-		category: entry.category
+		"Content-Type": "application/json",
+		Accept: "application/json",
+		"api-version": "1.0",
+		...customHeaders ?? {}
 	};
 }
-function createInitialState() {
-	return {
-		sessionId: null,
-		startedAtMs: null,
-		browser: null,
-		osVersion: null,
-		osLanguage: null,
-		sdkLanguage: "en-US",
-		integrationType: "startOnboardingSection",
-		flowType: null,
-		flowId: null,
-		workflowId: null,
-		testing: false,
-		devModeSignal: void 0,
-		apiUrlSignal: void 0,
-		hasConfigurationId: false,
-		hasExternalCustomerId: false,
-		hasProvidedSessionId: false,
-		hasExternalToken: false
+var WasmHttpError = class extends HttpRequestError {
+	constructor(..._args) {
+		super(..._args);
+		this.name = "WasmHttpError";
+	}
+};
+const HTTP_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+const buildQueryString = (query) => {
+	if (!query) return "";
+	const params = new URLSearchParams();
+	Object.entries(query).forEach(([key, value]) => {
+		if (value !== void 0 && value !== null) params.append(key, String(value));
+	});
+	const str = params.toString();
+	return str ? `?${str}` : "";
+};
+const buildUrl = (baseURL, url, query) => {
+	const queryString = buildQueryString(query);
+	if (url.startsWith("http://") || url.startsWith("https://")) return `${url}${queryString}`;
+	return `${baseURL.endsWith("/") ? baseURL.slice(0, -1) : baseURL}${url.startsWith("/") ? url : `/${url}`}${queryString}`;
+};
+const prepareBody = (body) => {
+	if (body === null || body === void 0) return void 0;
+	if (body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer || body instanceof Uint8Array || typeof body === "string") return body;
+	if (typeof body === "object") return body;
+	return String(body);
+};
+const normalizeMethod = (method) => {
+	const upper = method.toUpperCase();
+	if (!HTTP_METHODS.has(upper)) throw new Error(`Unsupported HTTP method for WASM client: ${method}`);
+	return upper;
+};
+const getErrorStatus = (error) => {
+	if (error instanceof WasmWebClientError) return error.statusCode;
+	if (typeof error === "object" && error !== null) {
+		const record = error;
+		if (typeof record.statusCode === "number") return record.statusCode;
+		if (typeof record.status === "number") return record.status;
+	}
+	return 0;
+};
+const getErrorData = (error) => {
+	if (error instanceof WasmWebClientError) return error.response?.data ?? null;
+	return null;
+};
+const getErrorMessage = (error) => {
+	if (error instanceof Error) return error.message;
+	return "WasmWebClient request failed";
+};
+const withAbortSignal = async (promise, signal, error) => {
+	if (!signal) return await promise;
+	if (signal.aborted) throw error();
+	return await new Promise((resolve, reject) => {
+		const onAbort = () => reject(error());
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then(resolve, reject).finally(() => {
+			signal.removeEventListener("abort", onAbort);
+		});
+	});
+};
+const createWasmApi = async (config) => {
+	const headers = buildWasmDefaultHeaders(config.customHeaders);
+	const isEncryptionEnabled = config.isEncryptionEnabled ?? (() => false);
+	const useSha256 = config.mgf1 === "sha256";
+	await initializeWasmWebClient(config.wasm);
+	try {
+		await setupWasmConnection(config.apiURL, "", config.encryptionEnabled ?? false, headers, useSha256);
+	} catch (error) {
+		if (!(error instanceof WasmWebClientError)) throw error;
+		throw reportHttpError(new WasmHttpError(error.statusCode, "", config.apiURL, "POST", {}, getErrorData(error)), headers);
+	}
+	const defaults = {
+		baseURL: config.apiURL,
+		headers
 	};
-}
-let state = createInitialState();
-let sources = {};
-/** Tap for `createSession` — sessionId comes from the returned `interviewId`. */
-function noteSessionCreated(session, options = {}) {}
-function noteEnvironment(environment) {}
-/**
-* `testing` heuristic: devMode OR non-prod API host pattern. Always a boolean —
-* the contract requires the field present on every record. Signals MERGE across
-* calls (a later apiUrl-only call must not erase an earlier devMode signal);
-* `testing` is recomputed from the merged pair.
-*/
-function noteTestingSignals(signals) {}
-/**
-* Live read of the merged testing signal (devMode OR non-prod host). Used to
-* gate host-console self-health noise so production host pages stay quiet while
-* staging/dev keeps the console signal (the record always captures it either
-* way via `trueSightLog`). Same signal the overflow-flush staging gate uses.
-*/
-function isTrueSightTesting() {
-	return state.testing;
-}
-/**
-* Wiring tap for every `initializeSession({ token })`: a token activated
-* before any `createSession` was observed on this page is host-minted, i.e.
-* external. (The exact `token`/`externalToken` web-semantics are a pending
-* Phase 0 contract ask — this inference is the interim mapping.)
-*/
-function noteTokenActivated() {}
-/** Explicit literal — the metadata half handed to the record builder. */
-function buildSessionMetadata() {
-	return {
-		sessionId: state.sessionId,
-		startedAtMs: state.startedAtMs,
-		browser: state.browser,
-		osVersion: state.osVersion,
-		osLanguage: state.osLanguage,
-		sdkLanguage: state.sdkLanguage,
-		integrationType: state.integrationType,
-		flowType: state.flowType,
-		flowId: state.flowId,
-		workflowId: state.workflowId,
-		testing: state.testing,
-		e2eEncryptionEnabled: readE2eEncryptionEnabled(),
-		hasConfigurationId: state.hasConfigurationId,
-		hasExternalCustomerId: state.hasExternalCustomerId,
-		hasProvidedSessionId: state.hasProvidedSessionId,
-		hasToken: readHasToken(),
-		hasExternalToken: state.hasExternalToken
+	const client = {
+		defaults,
+		async request(requestConfig) {
+			const { method = "GET", url, headers: requestHeaders = {}, query, params, body, signal, timeout: timeoutOverride, onUploadProgress, ie = false } = requestConfig;
+			const upperMethod = normalizeMethod(method);
+			const requestParams = params ?? query;
+			const fullUrl = buildUrl(defaults.baseURL, url, requestParams);
+			const needsSchemeHeader = useSha256 && isEncryptionEnabled();
+			const mergedHeaders = {
+				...defaults.headers,
+				...needsSchemeHeader ? { "X-RSA-Encryption-Scheme": RSA_OAEP_SHA256_SCHEME } : {},
+				...requestHeaders
+			};
+			const requestBody = prepareBody(body);
+			const timeout = timeoutOverride ?? config.timeout ?? WASM_TIMEOUT_CEILING_MS;
+			const wasmProgress = onUploadProgress ? (progress) => {
+				if (progress.total > 0) onUploadProgress(Math.round(progress.loaded / progress.total * 100));
+			} : void 0;
+			const abortError = () => new WasmHttpError(0, "Request aborted", fullUrl, upperMethod, {}, null);
+			if (signal?.aborted) throw abortError();
+			try {
+				const response = await withAbortSignal(executeWasmRequest(upperMethod, url, requestBody, mergedHeaders, requestParams, timeout, wasmProgress, ie), signal, abortError);
+				if (response.status < 200 || response.status >= 300) throw reportHttpError(new WasmHttpError(response.status, "", fullUrl, upperMethod, {}, response.data), mergedHeaders);
+				return {
+					ok: true,
+					status: response.status,
+					statusText: "",
+					url: fullUrl,
+					headers: {},
+					data: response.data
+				};
+			} catch (error) {
+				if (error instanceof WasmHttpError) throw error;
+				throw reportHttpError(new WasmHttpError(getErrorStatus(error), getErrorMessage(error), fullUrl, upperMethod, {}, getErrorData(error)), mergedHeaders);
+			}
+		},
+		get(url, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				method: "GET"
+			});
+		},
+		post(url, body, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				body,
+				method: "POST"
+			});
+		},
+		put(url, body, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				body,
+				method: "PUT"
+			});
+		},
+		patch(url, body, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				body,
+				method: "PATCH"
+			});
+		},
+		delete(url, requestConfig) {
+			return client.request({
+				...requestConfig,
+				url,
+				method: "DELETE"
+			});
+		},
+		head() {
+			return Promise.reject(/* @__PURE__ */ new Error("HEAD is not supported by the WASM HTTP client"));
+		},
+		options() {
+			return Promise.reject(/* @__PURE__ */ new Error("OPTIONS is not supported by the WASM HTTP client"));
+		},
+		setHeader(name, value) {
+			defaults.headers[name] = value;
+		}
 	};
-}
-/** Fail-open: diagnostics must never throw into the host flow. */
-function readE2eEncryptionEnabled() {
-	try {
-		return sources.getE2eEncryptionEnabled?.() ?? false;
-	} catch {
-		return false;
-	}
-}
-/** Fail-open, like readE2eEncryptionEnabled. */
-function readHasToken() {
-	try {
-		return sources.getHasToken?.() ?? false;
-	} catch {
-		return false;
-	}
-}
-function resetTrueSightMetadata() {
-	state = createInitialState();
-	sources = {};
-}
+	return client;
+};
 //#endregion
-//#region src/internal/trueSight/pendingEnvelopeStore.ts
-/** Index slot listing sessionIds with pending entries (no enumeration API). */
-const PENDING_INDEX_KEY = `${PENDING_STORAGE_KEY_PREFIX}index`;
-function slotKey(sessionId) {
-	return `${PENDING_STORAGE_KEY_PREFIX}${sessionId}`;
-}
+//#region src/internal/http/clientLifecycle.ts
 /**
-* Adds the session to the pending index. Called once at collection start —
-* long before any page-hide — so the hide path never needs the index
-* read-modify-write and stays a single synchronous-effective write.
+* Wraps the active HttpClient as a transport for the C++ `WebApi` host
+* adapter. Lets the on-device face-results POST flow through the same
+* `httpClient.request()` pipeline as every other endpoint — header
+* injection, encryption-state handling, default headers, timeout — instead
+* of bypassing it via `executeWasmRequest` directly.
+*
+* Protected captures arrive with `ie === true`: the C++ `WebApi` already
+* encrypted the body inline, and only the WASM `WebClient` can unwrap it. A
+* plain fetch client would post the ciphertext as JSON and the backend
+* answers 406. If the plain client is still installed at that point (the
+* host called `setup()` without `wasm` and warmed WASM separately), swap to
+* the WASM client first. The module is already loaded — the payload came
+* out of it — so the swap only creates the `WebClient`.
 */
-async function registerPendingSlot(sessionId, deps) {
-	try {
-		const index = await readIndex(deps.storage);
-		if (index.includes(sessionId)) return;
-		await deps.storage.set(PENDING_INDEX_KEY, [...index, sessionId]);
-	} catch {}
+function bindWebApiTransport(client) {
+	return async (url, body, config) => {
+		const response = await (config.ie === true && storedHttpConfig && !storedHttpConfig.isWasm ? await ensureWasmHttpClient() : client).request({
+			method: "POST",
+			url,
+			body,
+			headers: config.headers,
+			params: config.params,
+			timeout: config.timeout,
+			ie: config.ie
+		});
+		return {
+			data: response.data,
+			status: response.status
+		};
+	};
 }
-/**
-* Writes the sealed snapshot into the session's slot. `BrowserStorageProvider`
-* executes the underlying `localStorage.setItem` synchronously in the first
-* slice of the async call, which is what makes this safe to fire (void) from
-* a page-hide handler.
-*/
-async function writePendingEnvelope(sessionId, entry, deps) {
-	try {
-		await deps.storage.set(slotKey(sessionId), entry);
-	} catch {}
+function installClient(client) {
+	setClient(client);
+	setWebApiHttpTransport(bindWebApiTransport(client));
 }
-/** Removes the entry and its index membership (terminal upload dispatched). */
-async function clearPending(sessionId, deps) {
-	try {
-		await deps.storage.remove(slotKey(sessionId));
-		const index = await readIndex(deps.storage);
-		if (index.includes(sessionId)) await deps.storage.set(PENDING_INDEX_KEY, index.filter((candidate) => candidate !== sessionId));
-	} catch {}
+async function ensureWasmHttpClient() {
+	await upgradeToWasmHttpClient(resolveWasmConfig());
+	return getApi();
 }
-/**
-* Next-load recovery, invoked from the first-token-observed hook (A1 — never
-* at `setup()`, which has no auth). For each foreign, old-enough entry: the
-* slot is cleared AT DISPATCH, then the envelope is posted fire-and-forget —
-* no 200-tracking, no retries (A2; a crash between clear and fire loses that
-* record, consistent with no-retry). Entries at/past the retention ceiling
-* are deleted unsent (A4). Never rejects; returns the A5 loss counters.
-*/
-async function recoverPendingEnvelopes(options) {
-	const { storage, post, currentSessionId } = options;
-	const now = options.now ?? getTimestamp;
-	const counters = {
-		recovered: 0,
-		gcExpired: 0
-	};
-	try {
-		const index = await readIndex(storage);
-		if (index.length === 0) return counters;
-		const keptInIndex = [];
-		for (const sessionId of index) {
-			if (sessionId === currentSessionId) {
-				keptInIndex.push(sessionId);
-				continue;
-			}
-			const entry = await readEntry(storage, sessionId);
-			if (entry === "missing") continue;
-			if (entry === "corrupt") {
-				counters.gcExpired += 1;
-				continue;
-			}
-			const age = now() - entry.persistedAt;
-			if (age >= 6048e5) {
-				counters.gcExpired += 1;
-				await storage.remove(slotKey(sessionId));
-				continue;
-			}
-			if (age < 12e4) {
-				keptInIndex.push(sessionId);
-				continue;
-			}
-			await storage.remove(slotKey(sessionId));
-			counters.recovered += 1;
-			post(endpoints.diagnosticsData, entry.envelope, {}).catch(() => {});
-		}
-		await storage.set(PENDING_INDEX_KEY, keptInIndex);
-	} catch {}
-	return counters;
+let storedHttpConfig;
+let pendingUpgrade;
+/** Reads the current HTTP-client config (or `undefined` if none installed). */
+function getStoredHttpConfig() {
+	return storedHttpConfig;
 }
-async function readIndex(storage) {
-	const index = await storage.get(PENDING_INDEX_KEY);
-	if (!Array.isArray(index)) return [];
-	return index.filter((value) => typeof value === "string");
+/** Whether encryption is currently active on the installed HTTP client. */
+function isHttpEncrypted() {
+	return storedHttpConfig?.encryption.enabled ?? false;
 }
-/** Reads one entry; malformed slots are pruned and reported as corrupt. */
-async function readEntry(storage, sessionId) {
-	try {
-		const value = await storage.get(slotKey(sessionId));
-		if (value === null) return "missing";
-		if (typeof value === "object" && value.v === 1 && typeof value.persistedAt === "number" && typeof value.envelope === "object") return value;
-		await storage.remove(slotKey(sessionId));
-		return "corrupt";
-	} catch {
-		try {
-			await storage.remove(slotKey(sessionId));
-		} catch {}
-		return "corrupt";
-	}
+/** Clears all HTTP-client state. Called by `reset()`. */
+function resetHttpClientState() {
+	storedHttpConfig = void 0;
+	setWebApiHttpTransport(null);
 }
-//#endregion
-//#region src/internal/featureConfig/featureConfigService.ts
-let cachedFeatures = null;
 /**
-* Checks if a feature is enabled in the feature config.
+* Builds (or replaces) the HTTP client when `setup()` receives an `apiURL`.
+* Picks `createWasmApi` when `effectiveWasm` is set, otherwise plain
+* `createApi`. Wraps the call in handshake-failure context when encryption
+* is requested.
 */
-function isFeatureEnabled(feature, features) {
-	return features?.find((f) => f.feature === feature)?.enabled ?? false;
+async function installFreshHttpClient(apiURL, options, effectiveWasm, encryption) {
+	installClient(effectiveWasm ? await withHandshakeFailureContext(encryption.enabled, () => createWasmApi({
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout,
+		wasm: effectiveWasm,
+		encryptionEnabled: encryption.enabled,
+		mgf1: encryption.mgf1,
+		isEncryptionEnabled: isHttpEncrypted
+	})) : createApi({
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout
+	}));
+	storedHttpConfig = {
+		apiURL,
+		customHeaders: options.customHeaders,
+		timeout: options.timeout,
+		isWasm: Boolean(effectiveWasm),
+		encryption
+	};
 }
 /**
-* Fetches feature configuration from the backend.
-* Results are cached for the session lifetime.
+* Replaces the active HTTP client with the WASM-backed one. Used internally
+* by lazy-loading UI components (`<incode-flow>`, `<incode-workflow>`) when
+* WASM finishes warming up.
+*
+* No-op when no apiURL was previously configured, or when the active client
+* is already WASM-backed. The encryption state (enabled + MGF1 scheme) is
+* preserved across the swap — this is *not* a user-facing encryption change.
+*
+* @internal NOT a public API. Application code should use
+*   `setup({ wasm: {...} })` instead.
 */
-async function fetchFeatureConfig(signal) {
-	if (cachedFeatures) return cachedFeatures;
-	const response = await api.get(endpoints.featureConfig, { signal });
-	if (!response.ok) throw new Error(`Failed to fetch feature config: ${response.status} ${response.statusText}`);
-	cachedFeatures = response.data;
-	return cachedFeatures;
+async function upgradeToWasmHttpClient(resolved) {
+	const stored = storedHttpConfig;
+	if (!stored || stored.isWasm) return;
+	pendingUpgrade ??= (async () => {
+		installClient(await createWasmApi({
+			apiURL: stored.apiURL,
+			customHeaders: stored.customHeaders,
+			timeout: stored.timeout,
+			wasm: resolved,
+			encryptionEnabled: stored.encryption.enabled,
+			mgf1: stored.encryption.mgf1,
+			isEncryptionEnabled: isHttpEncrypted
+		}));
+		storedHttpConfig = {
+			...stored,
+			isWasm: true
+		};
+	})().finally(() => {
+		pendingUpgrade = void 0;
+	});
+	return pendingUpgrade;
 }
 /**
-* Resets the cached feature config (useful for testing).
+* When `wantsEncryption` is true, wraps a call that triggers the in-binary
+* RSA/AES handshake so its rejection surfaces as a single, descriptive error
+* with the original error preserved as `cause`. Pass-through otherwise.
 */
-function resetFeatureConfigCache() {
-	cachedFeatures = null;
+async function withHandshakeFailureContext(wantsEncryption, fn) {
+	if (!wantsEncryption) return fn();
+	try {
+		return await fn();
+	} catch (cause) {
+		const error = /* @__PURE__ */ new Error("Failed to establish encrypted transport. The /e2ee/key handshake did not complete. Verify the apiURL is reachable and that the environment supports E2EE.");
+		error.cause = cause;
+		throw error;
+	}
 }
 eventModuleNames.selfie, eventModuleNames.faceCapture, eventModuleNames.authentication, eventModuleNames.authFace, eventModuleNames.mlConsent, eventModuleNames.combinedConsent, eventModuleNames.curpValidation, eventModuleNames.faceMatch, eventModuleNames.qr, eventModuleNames.videoSelfie, eventModuleNames.id, eventModuleNames.idCapture, eventModuleNames.idVerification, eventModuleNames.idOcr, eventModuleNames.document, eventModuleNames.creditCard, eventModuleNames.creditCardBack, eventModuleNames.conference, eventModuleNames.otp, eventModuleNames.signature, eventModuleNames.ekyc, eventModuleNames.watchlist, eventModuleNames.globalWatchList, eventModuleNames.customWatchList, eventModuleNames.email, eventModuleNames.phone, eventModuleNames.instantVerifyEmail, eventModuleNames.instantVerifyConsent, eventModuleNames.forms, eventModuleNames.customModule, eventModuleNames.geolocation, eventModuleNames.ekyb, eventModuleNames.identityReuse, eventModuleNames.antifraud, eventModuleNames.aeSignature, eventModuleNames.qeSignature, eventModuleNames.crossDocumentDataMatch, eventModuleNames.customFields, eventModuleNames.fieldComparison, eventModuleNames.personhood, eventModuleNames.watchlistForBusiness, eventModuleNames.trustGraph, eventModuleNames.certificateIssuance, eventModuleNames.governmentValidation, eventModuleNames.documentUpload, eventModuleNames.home, eventModuleNames.workflow, eventModuleNames.fiscalQr;
 eventModuleNames.id, eventModuleNames.idCapture, eventModuleNames.idVerification, eventModuleNames.idOcr, eventModuleNames.document, eventModuleNames.documentUpload, eventModuleNames.creditCard, eventModuleNames.creditCardBack, eventModuleNames.curpValidation;
@@ -1508,4 +1501,4 @@ function modulePosition(payload) {
 	return `${typeof moduleIndex === "number" ? ` index=${moduleIndex}` : ""}${typeof totalModules === "number" ? ` total=${totalModules}` : ""}`;
 }
 //#endregion
-export { DEFAULT_WASM_VERSION as C, resolveWasmConfig as D, getBarcodeEnhanceModelUrl as E, upgradeToWasmHttpClient as S, buildWasmConfigFromBasePath as T, noteTestingSignals as _, notifyTrueSightManagerStopped as a, installFreshHttpClient as b, trueSightHintTransition as c, fetchFeatureConfig as d, isFeatureEnabled as f, noteSessionCreated as g, noteEnvironment as h, notifyTrueSightFlowEvent as i, trueSightLog as l, isTrueSightTesting as m, initializeTrueSightDiagnostics as n, resetTrueSight as o, resetFeatureConfigCache as p, noteTrueSightCaptureActivity as r, startTrueSightCollection as s, finalizeTrueSight as t, categoryForEndpoint as u, noteTokenActivated as v, buildDefaultWasmConfig as w, resetHttpClientState as x, getStoredHttpConfig as y };
+export { DEFAULT_WASM_VERSION as C, resolveWasmConfig as D, getBarcodeEnhanceModelUrl as E, noteTokenActivated as S, buildWasmConfigFromBasePath as T, resetFeatureConfigCache as _, notifyTrueSightManagerStopped as a, noteSessionCreated as b, trueSightHintTransition as c, getStoredHttpConfig as d, installFreshHttpClient as f, isFeatureEnabled as g, fetchFeatureConfig as h, notifyTrueSightFlowEvent as i, trueSightLog as l, upgradeToWasmHttpClient as m, initializeTrueSightDiagnostics as n, resetTrueSight as o, resetHttpClientState as p, noteTrueSightCaptureActivity as r, startTrueSightCollection as s, finalizeTrueSight as t, categoryForEndpoint as u, isTrueSightTesting as v, buildDefaultWasmConfig as w, noteTestingSignals as x, noteEnvironment as y };