@incodetech/core 2.3.2 → 2.4.0-rc.1

package/dist/{idCaptureStateMachine-BbiZD3uf.esm.js → idCaptureStateMachine-CxwoN5ff.esm.js}

@@ -1,31 +1,32 @@
-import { c as trueSightHintTransition, l as trueSightLog, m as isTrueSightTesting, r as noteTrueSightCaptureActivity } from "./trueSightService-M5VpCo96.esm.js";
-import { r as WasmUtilProvider } from "./safeStorage-BdU9_m2E.esm.js";
-import { l as BrowserStorageProvider } from "./setup-BuPbxpwF.esm.js";
-import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { s as exposeExperimentOnce } from "./feature-management-C8CuN0os.esm.js";
 import { n as revokeObjectURL, t as getTimestamp } from "./IBrowserEnvironmentCapability-DEaRRk-R.esm.js";
-import { r as getToken, t as api } from "./api-Bx3gKW_y.esm.js";
-import { n as eventModuleNames, s as recordExperimentAssignmentOnce } from "./events-ijlbX_Wx.esm.js";
-import { t as getDisableIpify } from "./sessionInitializer-CnhAkMUN.esm.js";
-import { t as endpoints } from "./endpoints-B-3Q-LUw.esm.js";
-import { t as addDeviceStats } from "./stats-CZcy2J53.esm.js";
+import { l as isGoogleWalletSignedRequestsEnabled, u as BrowserStorageProvider } from "./setup-B7ehQ-lf.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-DtJuBdt-.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation, s as recordExperimentAssignmentOnce, y as addEvent } from "./events-Du2A4-Qr.esm.js";
+import { r as getToken, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
+import { l as trueSightHintTransition, r as noteTrueSightCaptureActivity, u as trueSightLog, y as isTrueSightTesting } from "./trueSightService-BzLdXpmJ.esm.js";
+import { t as getDisableIpify } from "./sessionInitializer-DVWMJh25.esm.js";
+import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
+import { s as exposeExperimentOnce } from "./feature-management-rTfjzdDa.esm.js";
+import { t as addDeviceStats } from "./stats-BEvexnKC.esm.js";
 import { a as isIOS, s as isIPad, t as isAndroid, u as isMacOsSafari } from "./platform-DkcRc9JV.esm.js";
-import "./session-BESZc05k.esm.js";
-import { c as not, i as assign, l as raise, n as enqueueActions, o as and, r as sendTo, t as setup } from "./xstate.esm-BuFLFuzz.esm.js";
-import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-BXeQ-Ucz.esm.js";
-import { n as getUrlSearchParam, t as buildUrlWithSearchParams } from "./urlUtils-D6phjq1-.esm.js";
+import "./session-CNNTckUS.esm.js";
+import { c as not, i as assign, l as raise, n as enqueueActions, o as and, r as sendTo, s as createActor, t as setup, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
+import { n as fromPromise, t as fromCallback } from "./xstate-actors.esm-8Gzepa_A.esm.js";
+import { n as getUrlSearchParam, t as buildUrlWithSearchParams } from "./urlUtils-6jsE6rKp.esm.js";
 import { r as getCameraReacquisitionConstraints } from "./camera-sIa9ceW2.esm.js";
-import { n as invokeRequestPermissionActor, t as checkPermission } from "./permissionServices-EY3_Vx6c.esm.js";
-import { i as imageFileToDataUrl, n as runProtectedAttempt, o as flagIdManualReview, r as cameraCycleProvider, s as PROTECTED_CAPTURE_TARGET, t as createCameraCycleOwnership } from "./createCameraCycleOwnership-DnwTl1ad.esm.js";
+import { i as requestMotionPermission, n as invokeRequestPermissionActor, o as requiresMotionPermissionUserGesture, t as checkPermission } from "./permissionServices-Ca-tSNhT.esm.js";
+import { a as flagIdManualReview, n as runProtectedAttempt, o as PROTECTED_CAPTURE_TARGET, r as cameraCycleProvider, t as createCameraCycleOwnership } from "./createCameraCycleOwnership-Dj_LHUvN.esm.js";
 import { t as IncodeCanvas } from "./canvas-BxFzWTt-.esm.js";
-import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-D6TfVop2.esm.js";
-import { o as StreamCanvasProcessingSession } from "./multipartRecordingService-mwKFTlhR.esm.js";
+import { n as needsMotionPrimeOnlyFromPermission, r as resolveStoredPermissionResult, t as isReadyForCaptureFromPermission } from "./permissionGuards-gcy3U0SL.esm.js";
+import { o as StreamCanvasProcessingSession } from "./multipartRecordingService-CLwrF5wD.esm.js";
 import { t as sleep } from "./ITimerCapability-DgdDzp8G.esm.js";
 import { t as getBrowser } from "./getBrowser-Cbe1C4Tn.esm.js";
+import { a as isBackCameraLabel } from "./backCameraStream-CMvXj4X4.esm.js";
 import { n as getWindowDimensions } from "./getDeviceClass-CeBiEayS.esm.js";
-import { n as runVirtualCameraCheck, t as frameSources } from "./virtualCameraCheck-Cjab7FTI.esm.js";
-import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider } from "./idCaptureDefaults-Dl64Trv5.esm.js";
-import { C as getIdCameraStream, S as OPTIMIZING_WATCHDOG_MARGIN_MS, _ as validateUploadResponse, a as getRealQualityValue, b as resolveIdCaptureThresholds, c as pauseRecordingForAttempt, d as resumeRecordingAfterPause, f as startRecordingSession, g as uploadManualIdFile, h as uploadIdImage, i as finalizeRecordingSession, l as prepareRecordingForCameraRetry, m as stopStream, o as initializeIdCapture, p as stopRecording, r as disposeRecordingSession, s as isSuspendableRecordingSession, t as addBarcode, u as processId, v as ID_ERROR_CODES, x as CAPTURE_OPTIMIZING } from "./idCaptureServices-dtDG2HXS.esm.js";
+import { n as frameSources, r as runVirtualCameraCheck } from "./deepsightService-tGP53cSS.esm.js";
+import { t as getDeviceClass } from "./getDeviceClass-bsWdEDxP.esm.js";
+import { n as DEFAULT_ID_CAPTURE_THRESHOLDS, r as IdCaptureProvider } from "./idCaptureDefaults-BGsG2OAs.esm.js";
+import { C as getIdCameraStream, S as OPTIMIZING_WATCHDOG_MARGIN_MS, _ as ID_ERROR_CODES, a as getRealQualityValue, b as resolveIdCaptureThresholds, c as pauseRecordingForAttempt, d as resumeRecordingAfterPause, f as startRecordingSession, g as validateUploadResponse, h as uploadIdImage, i as finalizeRecordingSession, l as prepareRecordingForCameraRetry, m as stopStream, o as initializeIdCapture, p as stopRecording, r as disposeRecordingSession, s as isSuspendableRecordingSession, t as addBarcode, u as processId, x as CAPTURE_OPTIMIZING, y as resolveCountdownStepMs } from "./idCaptureServices-D0p_RFqk.esm.js";
 import { t as StreamCanvasCapture } from "./StreamCanvasCapture-C9jtgBdT.esm.js";
 //#region src/modules/id/digitalUpload/digitalUploadErrors.ts
 const TERMINAL_FAIL_REASONS = /* @__PURE__ */ new Set(["DIGITAL_ID_REQUESTED_BUT_OTHER_PROVIDED", "ID_TYPE_UNACCEPTABLE"]);
@@ -89,7 +90,7 @@ const uploadDigitalIdActor = fromPromise(async ({ input, signal }) => {
 		extractIdFace: input.extractIdFace
 	});
 });
-const getUploadResponseFromEvent$1 = (event) => {
+const getUploadResponseFromEvent = (event) => {
 	if (!("output" in event)) return;
 	return event.output;
 };
@@ -153,10 +154,10 @@ const digitalUploadMachine = setup({
 		isSelectedFileTooLarge: ({ event }) => event.type === "FILE_PICKED" && event.file.size > 5242880,
 		isSelectedFileMimeInvalid: ({ event }) => event.type === "FILE_PICKED" && !DIGITAL_UPLOAD_ALLOWED_MIME_TYPES.includes(event.file.type),
 		hasSelectedFile: ({ context }) => context.file !== null,
-		responseHasFailReason: ({ event }) => mapDigitalIdFailReason(getUploadResponseFromEvent$1(event)) !== null,
+		responseHasFailReason: ({ event }) => mapDigitalIdFailReason(getUploadResponseFromEvent(event)) !== null,
 		hasAttemptsRemaining: ({ context }) => context.attemptsRemaining > 0,
 		isTerminalFailReason: ({ event }) => {
-			return isTerminalDigitalIdFailReason(getUploadResponseFromEvent$1(event));
+			return isTerminalDigitalIdFailReason(getUploadResponseFromEvent(event));
 		},
 		isCurrentFailReasonTerminal: ({ context }) => {
 			const terminalReasons = /* @__PURE__ */ new Set(["DIGITAL_ID_REQUESTED_BUT_OTHER_PROVIDED", "ID_TYPE_UNACCEPTABLE"]);
@@ -316,14 +317,39 @@ const digitalUploadMachine = setup({
 //#region src/modules/id/deviceWallet/deviceWalletServices.ts
 /** Both wallet endpoint families are versioned via header, not path. */
 const API_VERSION_HEADERS = { "api-version": "1.0" };
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
-* Fetches the wallet request payload for the platform and wraps it in the
-* Digital Credentials API request shape.
+* Turns the Google request payload into DC API request options without ever
+* touching the payload itself — a signed request's JWS is covered by its
+* signature, so any edit makes the wallet reject it. The backend decides the
+* protocol; the SDK never derives it.
+*
+* - `{ requests: [...] }` — full DC API envelope (signed-capable backend):
+*   passed through as-is.
+* - `{ protocol, data }` — an already-enveloped single request: not re-wrapped,
+*   only placed in the `requests` array (defensive, for rollout shape drift).
+* - anything else — legacy bare unsigned OIDC4VP/DCQL object: wrapped with
+*   `openid4vp-v1-unsigned`.
+*/
+function toGoogleRequestOptions(payload) {
+	if (isRecord(payload) && Array.isArray(payload.requests)) return payload;
+	if (isRecord(payload) && typeof payload.protocol === "string") return { requests: [payload] };
+	return { requests: [{
+		protocol: "openid4vp-v1-unsigned",
+		data: payload
+	}] };
+}
+/**
+* Fetches the wallet request payload for the platform as Digital Credentials
+* API request options.
 *
 * Apple: POST with an empty body → `{ deviceRequest, encryptionInfo }`,
 * presented with protocol `org-iso-mdoc`.
-* Google: GET → the whole backend-built OIDC4VP/DCQL object (opaque here),
-* presented with protocol `openid4vp-v1-unsigned`.
+* Google: GET with `signedSupported=true` → the backend-built DC API envelope
+* (signed or unsigned, backend's choice), passed through verbatim — see
+* {@link toGoogleRequestOptions}. With `setup({ deviceWallet: {
+* googleSignedRequests: false } })` the SDK sends `signedSupported=false` and
+* the backend answers with the legacy bare unsigned payload.
 */
 async function requestWalletData(platform, signal) {
 	if (platform === "ios") {
@@ -333,23 +359,21 @@ async function requestWalletData(platform, signal) {
 		});
 		if (!res.ok) throw new Error(`POST ${endpoints.deviceWalletAppleRequest} failed: ${res.status}`);
 		const data = res.data;
-		return {
+		return { requests: [{
 			protocol: "org-iso-mdoc",
 			data: {
 				deviceRequest: data.deviceRequest,
 				encryptionInfo: data.encryptionInfo
 			}
-		};
+		}] };
 	}
 	const res = await api.get(endpoints.deviceWalletGoogleRequest, {
 		headers: API_VERSION_HEADERS,
+		query: { signedSupported: isGoogleWalletSignedRequestsEnabled() },
 		signal
 	});
 	if (!res.ok) throw new Error(`GET ${endpoints.deviceWalletGoogleRequest} failed: ${res.status}`);
-	return {
-		protocol: "openid4vp-v1-unsigned",
-		data: res.data
-	};
+	return toGoogleRequestOptions(res.data);
 }
 /**
 * Forwards the opaque wallet response for backend decryption. The body key
@@ -529,408 +553,221 @@ function resolveWalletPlatform(provider) {
 	return isIOS() || isMacOsSafari() || isIPad() ? "ios" : "android";
 }
 //#endregion
-//#region src/modules/id/manualUpload/manualUploadErrors.ts
+//#region src/modules/id/deviceWallet/instrumentation.ts
 /**
-* i18n keys for manual-upload user-facing error copy.
-* Keep in sync with `packages/ui/src/i18n/**.json` under the `manualIdUpload.*` namespace.
+* Maps a device-wallet child-machine snapshot to a tracked screen name.
+* Family is `deviceWallet.*` — emitted cross-family under the parent
+* `idCapture` module token, same as `mapDigitalIdScreenName`. See
+* `docs/patterns/INSTRUMENTATION.md`.
 */
-const MANUAL_UPLOAD_ERROR_KEYS = {
-	wrongSide: "manualIdUpload.wrongSide",
-	wrongDocument: "manualIdUpload.wrongDocument",
-	fileTooBig: "manualIdUpload.fileTooBig",
-	generic: "manualIdUpload.generic",
-	lowSharpness: "manualIdUpload.lowSharpness",
-	glareDetected: "manualIdUpload.glareDetected",
-	readabilityIssue: "manualIdUpload.readabilityIssue"
+function mapDeviceWalletScreenName(value, failReason) {
+	if (value === "presenting") return "deviceWallet.wallet.default";
+	if (value === "failed") {
+		if (failReason === "NO_CREDENTIAL") return "deviceWallet.error.nocredential";
+		if (failReason === "UNSUPPORTED_PLATFORM") return "deviceWallet.error.unsupported";
+		return "deviceWallet.error.default";
+	}
+	return "deviceWallet.loading.default";
+}
+//#endregion
+//#region ../infra/src/providers/browser/BrowserDigitalCredentialsProvider.ts
+var BrowserDigitalCredentialsProvider = class {
+	isAvailable() {
+		return typeof navigator !== "undefined" && typeof navigator.credentials?.get === "function" && typeof globalThis.DigitalCredential !== "undefined";
+	}
+	async get(request, options) {
+		return { response: (await navigator.credentials.get({
+			mediation: "required",
+			signal: options?.signal,
+			digital: request
+		}))?.data?.response };
+	}
 };
+//#endregion
+//#region src/modules/id/deviceWallet/deviceWalletActor.ts
 /**
-* Map the server's `failReason` (plus client-side passport/ID tab mismatch and
-* per-image quality flags) onto an i18n key. Mirrors v1's `shouldUploadAgain`
-* branch logic in
-* `ms-incodesmile-web/packages/incode-welcome/src/manualIdUpload/manuaIdUpload.tsx`,
-* extended to also reject responses where the backend flagged a per-image
-* quality issue (`correctSharpness`, `correctGlare`, or `readability`).
-* `idQualityAttemptApproved` is intentionally ignored — v1 did not treat it
-* as a manual-upload rejection signal.
-*
-* Quality flags are checked with `=== false` so missing/undefined values
-* (older backends, partial payloads) keep the legacy "trust the server"
-* behaviour and do not produce false positives.
-*
-* Returns `null` when the response represents a successful upload — the caller
-* should treat `null` as "no error, advance to next slot".
+* Starts a device-wallet actor for headless use. The ID-Capture parent invokes
+* `deviceWalletMachine` itself (and resolves the platform through the
+* digital-ID funnel); this factory is the standalone entry point for
+* integrators driving the wallet handshake on their own.
 */
-function mapFailReasonToErrorKey(response, expectedTab) {
-	const failReason = response.failReason;
-	if (failReason === "WRONG_DOCUMENT_SIDE") return MANUAL_UPLOAD_ERROR_KEYS.wrongSide;
-	if (failReason === "WRONG_ONE_SIDED_DOCUMENT" || failReason === "UNKNOWN_DOCUMENT_TYPE") return MANUAL_UPLOAD_ERROR_KEYS.wrongDocument;
-	if (failReason === "ID_TYPE_UNACCEPTABLE") return MANUAL_UPLOAD_ERROR_KEYS.wrongDocument;
-	if (expectedTab === "passport" && response.typeOfId && response.typeOfId.toLowerCase() !== "passport") return MANUAL_UPLOAD_ERROR_KEYS.wrongDocument;
-	if (expectedTab === "id" && response.typeOfId?.toLowerCase() === "passport") return MANUAL_UPLOAD_ERROR_KEYS.wrongDocument;
-	if (response.correctSharpness === false) return MANUAL_UPLOAD_ERROR_KEYS.lowSharpness;
-	if (response.correctGlare === false) return MANUAL_UPLOAD_ERROR_KEYS.glareDetected;
-	if (response.readability === false) return MANUAL_UPLOAD_ERROR_KEYS.readabilityIssue;
-	return null;
+function createDeviceWalletActor(options = {}) {
+	return createActor(deviceWalletMachine, { input: {
+		platform: resolveWalletPlatform(options.provider),
+		credentials: options.credentials ?? new BrowserDigitalCredentialsProvider(),
+		services: options.services
+	} }).start();
 }
 //#endregion
-//#region src/modules/id/manualUpload/types.ts
-const MANUAL_UPLOAD_MAX_RETRIES = 3;
-const MANUAL_UPLOAD_MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024;
-const MANUAL_UPLOAD_EXHAUSTION_FORWARD_MS = 5e3;
-//#endregion
-//#region src/modules/id/manualUpload/manualUploadServices.ts
-const stripDataUrlPrefix = (dataUrl) => {
-	const commaIndex = dataUrl.indexOf(",");
-	return commaIndex === -1 ? dataUrl : dataUrl.slice(commaIndex + 1);
-};
-const getBase64PayloadByteLength = (payload) => {
-	const normalized = payload.replace(/\s/g, "");
-	let padding = 0;
-	if (normalized.endsWith("==")) padding = 2;
-	else if (normalized.endsWith("=")) padding = 1;
-	return Math.max(0, Math.floor(normalized.length * 3 / 4) - padding);
-};
-const isBase64PayloadWithinSize = (payload, maxBytes) => getBase64PayloadByteLength(payload) <= maxBytes;
-const fileToBase64Payload = async (file) => {
-	const dataUrl = await imageFileToDataUrl(file);
-	return stripDataUrlPrefix(dataUrl);
-};
-//#endregion
-//#region src/modules/id/manualUpload/manualUploadStateMachine.ts
-const uploadManualFileActor = fromPromise(async ({ input, signal }) => {
-	const base64Image = await fileToBase64Payload(input.file);
-	if (!isBase64PayloadWithinSize(base64Image, 5242880)) return { type: "fileTooLarge" };
+//#region src/modules/id/deviceWallet/deviceWalletManager.ts
+/**
+* Absolute tracked-screen name for a device-wallet snapshot. Emitted verbatim
+* on `event.screen` under the parent `idCapture` module token — the wallet is
+* an ID-Capture sub-flow, so it does not own an analytics module of its own
+* (see `docs/patterns/INSTRUMENTATION.md`).
+*/
+function getDeviceWalletScreenName(snapshot) {
+	return mapDeviceWalletScreenName(snapshot.value, snapshot.context?.failReason ?? null);
+}
+function mapState(snapshot) {
+	const typedSnapshot = snapshot;
+	const { context } = typedSnapshot;
+	const { platform } = context;
+	if (typedSnapshot.matches("presenting")) return {
+		status: "presenting",
+		platform
+	};
+	if (typedSnapshot.matches("decrypting")) return {
+		status: "decrypting",
+		platform
+	};
+	if (typedSnapshot.matches("finished") && context.response) return {
+		status: "finished",
+		platform,
+		decision: context.response.decision,
+		response: context.response
+	};
+	if (typedSnapshot.matches("failed")) return {
+		status: "failed",
+		platform,
+		reason: context.failReason ?? "WALLET_ERROR"
+	};
+	if (typedSnapshot.matches("closed")) return {
+		status: "closed",
+		platform
+	};
 	return {
-		type: "uploaded",
-		response: await uploadManualIdFile({
-			side: input.side,
-			base64Image,
-			retry: input.retry,
-			onlyFront: input.onlyFront,
-			isSecondId: input.isSecondId,
-			extractIdFace: input.extractIdFace,
-			signal
-		})
+		status: "requesting",
+		platform
 	};
-});
-const getUploadOutputFromEvent = (event) => {
-	if ("output" in event) return event.output;
-};
-const getUploadResponseFromEvent = (event) => {
-	const output = getUploadOutputFromEvent(event);
-	return output?.type === "uploaded" ? output.response : void 0;
-};
-const manualUploadMachine = setup({
-	types: {
-		context: {},
-		events: {},
-		input: {},
-		output: {}
-	},
-	actors: { uploadManualFile: uploadManualFileActor },
-	actions: {
-		setManualUploadActiveTab: assign(({ context, event }) => {
-			if (event.type !== "MANUAL_UPLOAD_TAB_CHANGED") return {};
-			return {
-				activeTab: event.tab,
-				errorMessage: null,
-				errorSide: null,
-				retriesLeft: context.captureAttempts
-			};
-		}),
-		resetManualUpload: assign(({ context }) => ({
-			frontFile: null,
-			backFile: null,
-			passportFile: null,
-			frontUploaded: false,
-			backUploaded: false,
-			passportUploaded: false,
-			skipBackFromServer: false,
-			errorMessage: null,
-			errorSide: null,
-			retriesLeft: context.captureAttempts
-		})),
-		storeSelectedFile: assign(({ event }) => {
-			if (event.type !== "MANUAL_UPLOAD_FILE_SELECTED") return {};
-			const updated = {
-				errorMessage: null,
-				errorSide: null
-			};
-			if (event.side === "front") updated.frontFile = event.file;
-			else if (event.side === "back") updated.backFile = event.file;
-			else updated.passportFile = event.file;
-			return updated;
-		}),
-		markFrontUploaded: assign(() => ({
-			frontUploaded: true,
-			errorMessage: null,
-			errorSide: null
-		})),
-		markBackUploaded: assign(() => ({
-			backUploaded: true,
-			errorMessage: null,
-			errorSide: null
-		})),
-		markPassportUploaded: assign(() => ({
-			passportUploaded: true,
-			errorMessage: null,
-			errorSide: null
-		})),
-		recordSkipBackFromResponse: assign(({ event }) => {
-			const response = getUploadResponseFromEvent(event);
-			if (!response) return {};
-			if (!response.skipBackIdCapture) return {};
-			return { skipBackFromServer: true };
-		}),
-		decrementManualUploadRetries: assign(({ context }) => ({ retriesLeft: Math.max(0, context.retriesLeft - 1) })),
-		setManualUploadErrorFromResponse: assign(({ context, event }) => {
-			const response = getUploadResponseFromEvent(event);
-			if (!response) return {};
-			return { errorMessage: mapFailReasonToErrorKey(response, context.activeTab) ?? "manualIdUpload.generic" };
-		}),
-		setManualUploadGenericError: assign(() => ({ errorMessage: "manualIdUpload.generic" })),
-		setManualUploadFileTooLargeError: assign(({ event }) => {
-			return {
-				errorMessage: "manualIdUpload.fileTooBig",
-				errorSide: event.type === "MANUAL_UPLOAD_FILE_SELECTED" ? event.side : null
-			};
-		}),
-		markErrorSideFront: assign(() => ({ errorSide: "front" })),
-		markErrorSideBack: assign(() => ({ errorSide: "back" })),
-		markErrorSidePassport: assign(() => ({ errorSide: "passport" })),
-		clearManualUploadError: assign(() => ({
-			errorMessage: null,
-			errorSide: null
-		}))
-	},
-	guards: {
-		isAllowedTabChange: ({ context, event }) => event.type === "MANUAL_UPLOAD_TAB_CHANGED" && (!context.onlyBack || event.tab === "id"),
-		isSelectedFileTooLarge: ({ context, event }) => {
-			if (event.type !== "MANUAL_UPLOAD_FILE_SELECTED") return false;
-			if (context.onlyBack && event.side !== "back") return false;
-			return event.file.size > MANUAL_UPLOAD_MAX_FILE_SIZE_BYTES;
-		},
-		isFrontFileSelection: ({ context, event }) => !context.onlyBack && event.type === "MANUAL_UPLOAD_FILE_SELECTED" && event.side === "front",
-		isBackFileSelection: ({ event }) => event.type === "MANUAL_UPLOAD_FILE_SELECTED" && event.side === "back",
-		isPassportFileSelection: ({ context, event }) => !context.onlyBack && event.type === "MANUAL_UPLOAD_FILE_SELECTED" && event.side === "passport",
-		manualUploadRetriesExhausted: ({ context }) => context.retriesLeft <= 0,
-		canContinueFromIdTab: ({ context }) => {
-			if (context.activeTab !== "id") return false;
-			if (context.onlyBack) return context.backUploaded;
-			if (!context.frontUploaded) return false;
-			if (context.onlyFront) return true;
-			if (context.skipBackFromServer) return true;
-			return context.backUploaded;
-		},
-		canContinueFromPassportTab: ({ context }) => !context.onlyBack && context.activeTab === "passport" && context.passportUploaded,
-		manualUploadResponseHasError: ({ context, event }) => {
-			const response = getUploadResponseFromEvent(event);
-			if (!response) return false;
-			return mapFailReasonToErrorKey(response, context.activeTab) !== null;
-		},
-		manualUploadPayloadTooLarge: ({ event }) => getUploadOutputFromEvent(event)?.type === "fileTooLarge"
-	}
-}).createMachine({
-	id: "manualUpload",
-	initial: "selecting",
-	context: ({ input }) => ({
-		onlyFront: input.onlyFront,
-		onlyBack: input.onlyBack ?? false,
-		isSecondId: input.isSecondId,
-		captureAttempts: input.captureAttempts,
-		extractIdFace: input.extractIdFace,
-		frontFile: null,
-		backFile: null,
-		passportFile: null,
-		activeTab: "id",
-		retriesLeft: input.captureAttempts,
-		errorMessage: null,
-		errorSide: null,
-		skipBackFromServer: false,
-		frontUploaded: false,
-		backUploaded: false,
-		passportUploaded: false
-	}),
-	on: {
-		MANUAL_UPLOAD_TAB_CHANGED: {
-			guard: "isAllowedTabChange",
-			target: ".selecting",
-			actions: ["setManualUploadActiveTab"]
-		},
-		MANUAL_UPLOAD_RESET: {
-			target: ".selecting",
-			actions: ["resetManualUpload"]
-		}
-	},
-	states: {
-		selecting: { on: {
-			MANUAL_UPLOAD_FILE_SELECTED: [
-				{
-					guard: "isSelectedFileTooLarge",
-					actions: ["setManualUploadFileTooLargeError"]
-				},
-				{
-					guard: "isFrontFileSelection",
-					target: "uploadingFront",
-					actions: ["storeSelectedFile"]
-				},
-				{
-					guard: "isBackFileSelection",
-					target: "uploadingBack",
-					actions: ["storeSelectedFile"]
-				},
-				{
-					guard: "isPassportFileSelection",
-					target: "uploadingPassport",
-					actions: ["storeSelectedFile"]
-				}
-			],
-			MANUAL_UPLOAD_CONTINUE: [{
-				guard: "canContinueFromIdTab",
-				target: "finished"
-			}, {
-				guard: "canContinueFromPassportTab",
-				target: "finished"
-			}]
-		} },
-		uploadingFront: { invoke: {
-			id: "uploadManualFile",
-			src: "uploadManualFile",
-			input: ({ context }) => ({
-				side: "front",
-				file: context.frontFile,
-				retry: context.retriesLeft < context.captureAttempts,
-				onlyFront: context.onlyFront,
-				isSecondId: context.isSecondId,
-				extractIdFace: context.extractIdFace
-			}),
-			onDone: [
-				{
-					guard: "manualUploadPayloadTooLarge",
-					target: "selecting",
-					actions: ["setManualUploadFileTooLargeError", "markErrorSideFront"]
-				},
-				{
-					guard: "manualUploadResponseHasError",
-					target: "checkRetries",
-					actions: [
-						"decrementManualUploadRetries",
-						"setManualUploadErrorFromResponse",
-						"markErrorSideFront"
-					]
-				},
-				{
-					target: "selecting",
-					actions: [
-						"markFrontUploaded",
-						"recordSkipBackFromResponse",
-						"clearManualUploadError"
-					]
-				}
-			],
-			onError: {
-				target: "checkRetries",
-				actions: [
-					"decrementManualUploadRetries",
-					"setManualUploadGenericError",
-					"markErrorSideFront"
-				]
-			}
-		} },
-		uploadingBack: { invoke: {
-			id: "uploadManualFile",
-			src: "uploadManualFile",
-			input: ({ context }) => ({
-				side: "back",
-				file: context.backFile,
-				retry: context.retriesLeft < context.captureAttempts,
-				onlyFront: false,
-				isSecondId: context.isSecondId
-			}),
-			onDone: [
-				{
-					guard: "manualUploadPayloadTooLarge",
-					target: "selecting",
-					actions: ["setManualUploadFileTooLargeError", "markErrorSideBack"]
-				},
-				{
-					guard: "manualUploadResponseHasError",
-					target: "checkRetries",
-					actions: [
-						"decrementManualUploadRetries",
-						"setManualUploadErrorFromResponse",
-						"markErrorSideBack"
-					]
-				},
-				{
-					target: "selecting",
-					actions: ["markBackUploaded", "clearManualUploadError"]
-				}
-			],
-			onError: {
-				target: "checkRetries",
-				actions: [
-					"decrementManualUploadRetries",
-					"setManualUploadGenericError",
-					"markErrorSideBack"
-				]
-			}
-		} },
-		uploadingPassport: { invoke: {
-			id: "uploadManualFile",
-			src: "uploadManualFile",
-			input: ({ context }) => ({
-				side: "passport",
-				file: context.passportFile,
-				retry: context.retriesLeft < context.captureAttempts,
-				onlyFront: false,
-				isSecondId: context.isSecondId,
-				extractIdFace: context.extractIdFace
-			}),
-			onDone: [
-				{
-					guard: "manualUploadPayloadTooLarge",
-					target: "selecting",
-					actions: ["setManualUploadFileTooLargeError", "markErrorSidePassport"]
-				},
-				{
-					guard: "manualUploadResponseHasError",
-					target: "checkRetries",
-					actions: [
-						"decrementManualUploadRetries",
-						"setManualUploadErrorFromResponse",
-						"markErrorSidePassport"
-					]
-				},
-				{
-					target: "selecting",
-					actions: ["markPassportUploaded", "clearManualUploadError"]
-				}
-			],
-			onError: {
-				target: "checkRetries",
-				actions: [
-					"decrementManualUploadRetries",
-					"setManualUploadGenericError",
-					"markErrorSidePassport"
-				]
-			}
-		} },
-		checkRetries: { always: [{
-			guard: "manualUploadRetriesExhausted",
-			target: "retriesExhausted"
-		}, { target: "selecting" }] },
-		retriesExhausted: { after: { [MANUAL_UPLOAD_EXHAUSTION_FORWARD_MS]: { target: "exhausted" } } },
-		exhausted: {
-			type: "final",
-			output: { result: "exhausted" }
+}
+function createApi({ actor, trackElementClicked }) {
+	return {
+		/** Restarts the handshake after a failure. Needs a fresh user gesture. */
+		retry() {
+			trackElementClicked?.("retry");
+			actor.send({ type: "RETRY" });
 		},
-		finished: {
-			type: "final",
-			output: { result: "success" }
+		/**
+		* Abandons the wallet path from a failure and moves the manager to
+		* `closed`, so the consumer can fall back to a camera ID capture.
+		*/
+		useAnotherMethod() {
+			trackElementClicked?.("useAnotherMethod");
+			actor.send({ type: "USE_ANOTHER_METHOD" });
 		}
-	}
-});
+	};
+}
+/**
+* Creates a headless device-wallet (mDL) manager — the V2 equivalent of V1's
+* `renderWallet`, with the intermediate states observable.
+*
+* Runs the Apple Wallet (web) / Google Wallet handshake with zero Incode UI,
+* so integrators trigger it from their own button and render their own UX.
+* Call it from a user gesture: iOS Safari requires transient user activation
+* for `navigator.credentials.get()`.
+*
+* Requires an initialized session (`setup({ apiURL, token })`) — the request
+* and decrypt calls are session-scoped.
+*
+* @example
+* ```typescript
+* import { setup } from '@incodetech/core';
+* import { createDeviceWalletManager } from '@incodetech/core/id';
+*
+* setup({ apiURL, token });
+*
+* button.addEventListener('click', () => {
+*   const manager = createDeviceWalletManager();
+*   manager.subscribe((state) => {
+*     if (state.status === 'finished') manager.stop();
+*     if (state.status === 'failed') console.error(state.reason);
+*   });
+* });
+* ```
+*/
+function createDeviceWalletManager(options = {}) {
+	return createDeviceWalletManagerFromActor(createDeviceWalletActor(options));
+}
+/**
+* Creates a device-wallet manager from a pre-built actor. Use this when
+* overriding the machine via `.provide()` for custom backends or tests.
+*/
+function createDeviceWalletManagerFromActor(actor) {
+	return createManager({
+		actor,
+		mapState,
+		createApi,
+		instrumentation: createManagerInstrumentation(eventModuleNames.idCapture, { getEventScreenName: getDeviceWalletScreenName })
+	});
+}
+//#endregion
+//#region src/modules/id/deviceWallet/renderWallet.ts
+const FAIL_MESSAGES = {
+	UNSUPPORTED_PLATFORM: "Device wallet is not supported on this platform/browser",
+	NO_CREDENTIAL: "The wallet returned no digital ID credential",
+	WALLET_ERROR: "Device wallet request failed"
+};
+/**
+* Headless device-wallet (mDL) API — the V1 `renderWallet` shape, ported.
+*
+* Runs the Apple Wallet (web) / Google Wallet handshake with zero Incode UI,
+* so integrators trigger it from their own button and render their own UX.
+* Resolves once the handshake settles; the outcome arrives through
+* `onSuccess` / `onError` exactly as in V1.
+*
+* MUST be called from a user gesture (e.g. a click handler) — iOS/Safari
+* requires transient user activation for `navigator.credentials.get()` to
+* present the wallet sheet.
+*
+* Requires an initialized session (`setup({ apiURL, token })`). The verified
+* attributes are NOT returned here: they land in the session and are read back
+* through the standard OCR / score APIs. `onSuccess` receives the submission
+* decision/status.
+*
+* Prefer {@link createDeviceWalletManager} for new integrations — it exposes
+* the intermediate `requesting` / `presenting` / `decrypting` states (and a
+* `retry()`), which this one-shot wrapper collapses.
+*
+* @example
+* ```typescript
+* button.addEventListener('click', () => {
+*   void renderWallet({
+*     onSuccess: (result) => console.log(result.decision),
+*     onError: (error) => console.error(error.code, error.message),
+*   });
+* });
+* ```
+*/
+function renderWallet({ onSuccess, onError, ...actorOptions }) {
+	return new Promise((resolve) => {
+		const manager = createDeviceWalletManager(actorOptions);
+		const subscription = {};
+		let settled = false;
+		const settle = (state) => {
+			if (state.status === "requesting" || state.status === "presenting" || state.status === "decrypting") return false;
+			settled = true;
+			subscription.unsubscribe?.();
+			manager.stop();
+			if (state.status === "finished") onSuccess(state.response);
+			else if (state.status === "failed") onError({
+				code: state.reason,
+				message: FAIL_MESSAGES[state.reason]
+			});
+			else onError({
+				code: "WALLET_ERROR",
+				message: FAIL_MESSAGES.WALLET_ERROR
+			});
+			resolve();
+			return true;
+		};
+		if (settle(manager.getState())) return;
+		subscription.unsubscribe = manager.subscribe((state) => {
+			if (settled) return;
+			settle(state);
+		});
+	});
+}
 //#endregion
 //#region src/modules/id/idCaptureGuards.ts
 function getPermissionOutput(event) {
@@ -941,7 +778,7 @@ function getPermissionOutput(event) {
 }
 const hasShowTutorialGuard = ({ context }) => context.config.showTutorial;
 const hasAgeAssuranceGuard = ({ context }) => context.config.ageAssurance === true;
-const hasShowDocumentChooserGuard = ({ context }) => (!context.config.onlyBack || context.config.manualUploadIdCapture === true) && (context.config.showDocumentChooserScreen ?? false);
+const hasShowDocumentChooserGuard = ({ context }) => !context.config.onlyBack && (context.config.showDocumentChooserScreen ?? false);
 const isPermissionGrantedGuard = ({ event }) => {
 	return getPermissionOutput(event) === "granted";
 };
@@ -959,6 +796,7 @@ const isPermissionDeniedErrorGuard = ({ event }) => {
 	return false;
 };
 const isPermissionBlockedGuard = ({ context }) => context.permissionResult === "denied" || context.permissionResult === "refresh";
+const requiresMotionPermissionUserGestureGuard = ({ context }) => requiresMotionPermissionUserGesture(context.config.ds);
 const hasAttemptsRemainingGuard = ({ context }) => context.attemptsRemaining > 0;
 const hasCapturedImageGuard = ({ context }) => {
 	return context.provider?.getCapturedCanvas() !== null;
@@ -994,11 +832,9 @@ const isFrontModeGuard = ({ context }) => context.currentMode === "front" || con
 *      server answer exists, and
 *   2. where you do, still self-correct once the answer arrives.
 *
-* Two variants qualify under (1): the captureOnly machine
-* (`idCaptureOnlyStateMachine` — no upload, so no answer ever exists) and the
-* manual-upload sub-machine (slot visibility precedes any upload, and it ORs
-* `skipBackFromServer` afterwards to satisfy (2)). This guard is on neither
-* path — the answer is already in hand by the time it runs.
+* The captureOnly machine qualifies under (1) because it has no upload and no
+* server answer. This guard is not on that path, so the answer is already in
+* hand by the time it runs.
 */
 const shouldContinueToBackGuard = ({ context }) => {
 	if (context.currentMode !== "front" && context.currentMode !== "passport") return false;
@@ -1038,10 +874,8 @@ const supportsOptimizingStatusGuard = ({ context }) => context.config.supportsOp
 const isDeepsightEnabledGuard = ({ context }) => context.dependencies !== void 0;
 const isDeepsightReadyGuard = ({ context }) => context.deepsightService !== void 0;
 const needsDeepsightInitGuard = ({ context }) => context.dependencies !== void 0 && context.deepsightService === void 0 && !context.deepsightInitAttempted;
-const hasOnlyManualUploadAvailableGuard = ({ context }) => context.availableDocumentTypes.length === 1 && context.availableDocumentTypes[0] === "manualIdUpload";
 /** No capture option is enabled — the ID module is misconfigured. */
 const hasNoDocumentTypesAvailableGuard = ({ context }) => context.availableDocumentTypes.length === 0;
-const isManualIdUploadSelectedGuard = ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "manualIdUpload";
 const isDigitalIdUploadSelectedGuard = ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "digitalIdUpload";
 const isDigitalIdRedirectSelectedGuard = ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "digitalIdRedirect";
 /** The Digital ID (device wallet) chooser tile was picked. */
@@ -1112,237 +946,25 @@ const forceFinishAfterProcessingGuard = ({ context }) => context.forceFinishAfte
 * `MAX_EXPIRED_FIRST_SIDE_ATTEMPTS` (decoupled for V1 parity — see ENG-46592).
 * The two expired caps are therefore different by design.
 */
-const isProcessingExpiredExhaustedGuard = ({ context }) => context.processingExpiredAttempts + 1 >= context.config.captureAttempts;
-/**
-* True when capturing the back side of a two-sided (front+back) ID flow.
-* Used to redirect an expired-back capture to front rather than retrying
-* the same back side (Figma Story #2.1).
-* Excludes onlyBack and usSmartCapture — those are single-side back flows
-* with no front to redirect to.
-*/
-const isBackModeInMultiSideFlowGuard = ({ context }) => context.currentMode === "back" && !context.config.onlyBack && !context.config.usSmartCapture;
-/**
-* True once the user has already been redirected from an expired second-side
-* (back) capture to the first side (front) for their one extra attempt
-* (V1's `expiredRedirected`). Used to make the expired-back→front redirect a
-* one-shot: any subsequent expired upload routes to `expiredExhausted` instead
-* of redirecting again, so total captures stay within the backend's
-* max-attempts/OCR cap (ENG-46592 / re-respects ENG-45666).
-*/
-const wasExpiredRedirectedGuard = ({ context }) => context.expiredRedirected === true;
-const hasManualCaptureTriggeredGuard = ({ context }) => context.manualCaptureTriggered;
-//#endregion
-//#region src/modules/id/digitalIdRegistry.ts
-/**
-* True when a digital-ID method uses a full-page web-redirect flow (Trinsic
-* iDIN/FTN). Accepts both the module `FlowType` value (`REDIRECT`) and the
-* backend value (`WEB_REDIRECT`). (Lives here rather than in
-* `idCaptureHelpers` to keep the registry free of circular imports; the
-* helpers re-export it.)
-*/
-function isRedirectFlowType(flowType) {
-	return flowType === "REDIRECT" || flowType === "WEB_REDIRECT";
-}
-const DIGITAL_ID_REGISTRY = {
-	mDL: [{
-		kind: "incodeWallet",
-		documentType: "digitalId",
-		configFlag: "deviceWallet"
-	}, {
-		kind: "trinsicRedirect",
-		documentType: "digitalIdRedirect",
-		providerId: "trinsic_mdl_placeholder",
-		method: "MDL"
-	}],
-	iDIN: [{
-		kind: "trinsicRedirect",
-		documentType: "digitalIdRedirect",
-		providerId: "trinsic_netherlands_idin",
-		method: "IDIN"
-	}],
-	FTN: [{
-		kind: "trinsicRedirect",
-		documentType: "digitalIdRedirect",
-		providerId: "trinsic_finnish_trust_network",
-		method: "FTN"
-	}]
-};
-const DIGITAL_ID_DOCUMENT_TYPES = Object.keys(DIGITAL_ID_REGISTRY);
-/**
-* Tolerant view over `config.digitalIds`: accepts both the mapped array
-* (`IdCaptureDigitalIdMethod[]`) and the raw backend object
-* (`{ enabled, methods: [...] }`). Extracted from the old
-* `getDigitalIdRedirectMethod` cast so every consumer parses it the same way.
-*/
-function normalizeDigitalIdMethods(config) {
-	const raw = config.digitalIds;
-	return Array.isArray(raw) ? raw : raw?.methods ?? [];
-}
-/** Whether a funnel entry is activated by config + platform capabilities. */
-function isEntryActive(entry, config, platform) {
-	if (entry.kind === "incodeWallet") return config[entry.configFlag] === true && platform.credentialsAvailable;
-	return findConfiguredMethod(entry, config) !== void 0;
-}
-/**
-* The configured `digitalIds` method matching a Trinsic funnel entry — by
-* persisted method name, or (mapped shape) by provider id on a redirect
-* flowType. Mirrors the old first-match semantics; `methods[].enabled` is
-* deliberately still not consulted (pre-existing behavior).
-*/
-function findConfiguredMethod(entry, config) {
-	return normalizeDigitalIdMethods(config).find((method) => method.method?.toUpperCase() === entry.method || method.provider === entry.providerId && !!method.flowType && isRedirectFlowType(method.flowType));
-}
-/** Normalizes a raw configured method into the mapped shape for the child input. */
-function toMappedMethod(entry, method) {
-	if (method.flowType && isRedirectFlowType(method.flowType)) return method;
-	return {
-		method: method.method,
-		provider: entry.providerId,
-		flowType: "WEB_REDIRECT",
-		country: method.country ?? method.countries?.[0],
-		displayName: method.displayName
-	};
-}
-/**
-* Resolves the implementation that should fulfil a digital-ID document type:
-* the first funnel entry that is active under the given config and platform.
-* `undefined` when nothing can run it (the chooser then shows no tile for it).
-*/
-function resolveDigitalIdImplementation(docType, config, platform) {
-	for (const entry of DIGITAL_ID_REGISTRY[docType]) {
-		if (!isEntryActive(entry, config, platform)) continue;
-		if (entry.kind === "incodeWallet") return { kind: "incodeWallet" };
-		const method = findConfiguredMethod(entry, config);
-		return {
-			kind: "trinsicRedirect",
-			providerId: entry.providerId,
-			method: method ? toMappedMethod(entry, method) : void 0
-		};
-	}
-}
-//#endregion
-//#region src/modules/id/idCaptureHelpers.ts
-/**
-* Persisted method name → catalog provider id, derived from the digital-ID
-* registry's Trinsic entries (single source of truth — was a hardcoded map
-* here before the registry existed).
-*/
-const REDIRECT_PROVIDER_BY_METHOD = (() => {
-	const map = {};
-	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) for (const entry of DIGITAL_ID_REGISTRY[docType]) if (entry.kind === "trinsicRedirect") map[entry.method] = entry.providerId;
-	return map;
-})();
-/**
-* The first enabled web-redirect digital-ID method (iDIN-only for now), or
-* `undefined` when none is configured. Drives both the `digitalIdRedirect`
-* chooser option and the provider passed to the `digitalIdRedirectMachine`.
-*
-* Accepts both the mapped array (`IdCaptureDigitalIdMethod[]`) and the raw
-* backend `configuration.digitalIds` object (`{ enabled, methods: [...] }`);
-* for the raw shape it derives `provider`/`flowType` from the persisted method
-* name via the digital-ID registry (`IDIN` → `trinsic_netherlands_idin`,
-* `WEB_REDIRECT`).
-*/
-function getDigitalIdRedirectMethod(config) {
-	for (const method of normalizeDigitalIdMethods(config)) {
-		if (method.flowType && isRedirectFlowType(method.flowType)) return method;
-		const provider = method.method ? REDIRECT_PROVIDER_BY_METHOD[method.method.toUpperCase()] : void 0;
-		if (provider) return {
-			method: method.method,
-			provider,
-			flowType: "WEB_REDIRECT",
-			country: method.country ?? method.countries?.[0],
-			displayName: method.displayName
-		};
-	}
-}
-/**
-* Map of config properties received from the backend to adjusted, internal document types.
-*/
-const DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP = [
-	["enableId", "id"],
-	["enablePassport", "passport"],
-	["manualUploadIdCapture", "manualIdUpload"],
-	["digitalIdsUpload", "digitalIdUpload"]
-];
-/**
-* Returns the list of document types enabled by config for the chooser screen, in display order.
-* Used to populate chooser state so UI and headless consumers can render the correct options.
-*
-* Digital-ID document types (device wallet, Trinsic web-redirect) come from
-* the digital-ID registry funnel: each registry document type contributes the
-* tile of its first active implementation. A `deviceWallet: true` config on a
-* platform without the Credentials API therefore shows the Trinsic fallback
-* tile when one is configured — or no tile at all, instead of a dead-end one.
-*
-* @param config - ID capture configuration (from flow or init)
-* @param platform - Platform capabilities consulted by the digital-ID funnel.
-*   Defaults to no Credentials API for pure-node callers; the machine passes
-*   the real capability check.
-* @returns Array of IdDocumentType values that should be shown in the document type chooser
-*/
-function getAvailableDocumentTypes(config, platform = { credentialsAvailable: false }) {
-	if (config.onlyBack && config.manualUploadIdCapture) return config.enableId ? ["id", "manualIdUpload"] : ["manualIdUpload"];
-	const adjustedDocumentTypes = [];
-	for (const [configProperty, adjustedType] of DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP) if (config[configProperty]) adjustedDocumentTypes.push(adjustedType);
-	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) {
-		const route = resolveDigitalIdImplementation(docType, config, platform);
-		if (!route) continue;
-		const documentType = route.kind === "incodeWallet" ? "digitalId" : "digitalIdRedirect";
-		if (!adjustedDocumentTypes.includes(documentType)) adjustedDocumentTypes.push(documentType);
-	}
-	return adjustedDocumentTypes;
-}
+const isProcessingExpiredExhaustedGuard = ({ context }) => context.processingExpiredAttempts + 1 >= context.config.captureAttempts;
 /**
-* Which manual-upload tabs to show. Falls back to both tabs when neither
-* `enableId` nor `enablePassport` is set (no accepted documents).
+* True when capturing the back side of a two-sided (front+back) ID flow.
+* Used to redirect an expired-back capture to front rather than retrying
+* the same back side (Figma Story #2.1).
+* Excludes onlyBack and usSmartCapture — those are single-side back flows
+* with no front to redirect to.
 */
-function getManualUploadTabs(config) {
-	if (config.onlyBack) return {
-		showIdTab: true,
-		showPassportTab: false
-	};
-	const showIdTab = !!config.enableId;
-	const showPassportTab = !!config.enablePassport;
-	if (!showIdTab && !showPassportTab) return {
-		showIdTab: true,
-		showPassportTab: true
-	};
-	return {
-		showIdTab,
-		showPassportTab
-	};
-}
+const isBackModeInMultiSideFlowGuard = ({ context }) => context.currentMode === "back" && !context.config.onlyBack && !context.config.usSmartCapture;
 /**
-* Computes `idCaptureMachine`'s terminal output — the downstream module-skip
-* signal read by the Flow orchestrator (via `runChildModule`'s `MODULE_COMPLETE`).
-*
-* `skipFaceMatch` is set ONLY for the US Smart Capture *camera back-only* path:
-* a back image was captured on-device (`capturedImages.back`) and no front was
-* (`!capturedImages.front`) — "no front, no ID face, no match".
-*
-* Requiring a captured back is deliberate and load-bearing: the manual-upload
-* and digital-ID-upload paths submit a full ID (front face present) but do NOT
-* populate `capturedImages` (only the camera path does). Gating on a captured
-* back excludes those upload paths so a real ID-vs-selfie match is never
-* silently skipped. `capturedImages.front`/`forceFrontIdCapture` alone are not
-* enough (a later front upload clears the request; uploads set neither field).
-*
-* Always `false` outside US Smart Capture. The selfie/face capture itself is
-* unaffected — only the ID-vs-selfie match is skipped.
-*
-* Also `true` on the Digital ID web-redirect (Trinsic iDIN/FTN) COMPLETED path
-* when the scheme returned no portrait (`isDigitalIdRedirect && !portraitPresent`,
-* FM-1/FM-2): there is no ID face to match the selfie against.
+* True once the user has already been redirected from an expired second-side
+* (back) capture to the first side (front) for their one extra attempt
+* (V1's `expiredRedirected`). Used to make the expired-back→front redirect a
+* one-shot: any subsequent expired upload routes to `expiredExhausted` instead
+* of redirecting again, so total captures stay within the backend's
+* max-attempts/OCR cap (ENG-46592 / re-respects ENG-45666).
 */
-function computeIdCaptureOutput(context) {
-	const frontIdCaptured = Boolean(context.capturedImages.front);
-	const backIdCaptured = Boolean(context.capturedImages.back);
-	return {
-		frontIdCaptured,
-		skipFaceMatch: context.isDigitalIdRedirect === true && context.portraitPresent !== true || context.config.usSmartCapture === true && backIdCaptured && !frontIdCaptured
-	};
-}
+const wasExpiredRedirectedGuard = ({ context }) => context.expiredRedirected === true;
+const hasManualCaptureTriggeredGuard = ({ context }) => context.manualCaptureTriggered;
 //#endregion
 //#region src/modules/id/idDetectionNotificationController.ts
 const NOTIFICATION_DURATION_MS = 500;
@@ -1418,9 +1040,26 @@ async function requestIdCapturePermission(input) {
 		cameraFallbackLevel: fallbackLevel
 	};
 }
+/**
+* Resolves and primes Deepsight motion without touching camera permission.
+* IDC-03 invokes this directly from the tutorial CTA's event macrostep so
+* iOS keeps the transient user activation required by DeviceMotion.
+*/
+async function requestIdCaptureMotionPermission() {
+	const result = await requestMotionPermission();
+	return result === "not-required" ? "granted" : result;
+}
 const requestPermissionActor = fromPromise(async ({ input }) => {
 	return requestIdCapturePermission(input);
 });
+/**
+* Takes no `AbortSignal` on purpose: the work it awaits is the OS-owned
+* `DeviceMotionEvent.requestPermission()` prompt, which exposes no
+* cancellation. XState still discards the settled result if the state is
+* left, and `primeWasmMotionSensor` is idempotent, so an abandoned request
+* cannot mis-drive the machine.
+*/
+const requestMotionPermissionActor = fromPromise(() => requestIdCaptureMotionPermission());
 fromPromise(async ({ input }) => {
 	return initializeIdCapture(input);
 });
@@ -1781,7 +1420,7 @@ fromPromise(async ({ input }) => {
 });
 fromPromise(async ({ input }) => {
 	if (!input.dependencies) return;
-	const { loadDeepsightSession } = await import("./deepsightLoader-v-dLejS-.esm.js");
+	const { loadDeepsightSession } = await import("./deepsightLoader-DZMdYSl-.esm.js");
 	return loadDeepsightSession({
 		ds: input.ds,
 		storage: input.dependencies.storage,
@@ -2224,7 +1863,7 @@ function cleanup(service) {
 		service.cleanup();
 	} catch {}
 }
-function createIdMetadataPreparationCoordinator(load = async (input) => (await import("./deepsightLoader-v-dLejS-.esm.js")).loadDeepsightSession(input)) {
+function createIdMetadataPreparationCoordinator(load = async (input) => (await import("./deepsightLoader-DZMdYSl-.esm.js")).loadDeepsightSession(input)) {
 	let disposed = false;
 	let preparation;
 	let service;
@@ -2257,6 +1896,46 @@ function createIdMetadataPreparationCoordinator(load = async (input) => (await i
 	};
 }
 //#endregion
+//#region src/modules/id/idCaptureOnlyConfig.ts
+/**
+* The `IdCaptureConfig` keys the captureOnly flow supports.
+*/
+const ID_CAPTURE_ONLY_CONFIG_KEYS = [
+	"showTutorial",
+	"captureAttempts",
+	"autoCaptureTimeout",
+	"deviceIdleTimeout",
+	"enableId",
+	"enablePassport",
+	"onlyFront",
+	"onlyBack",
+	"showDocumentChooserScreen"
+];
+/**
+* `onCapture` marks a config as captureOnly. It is not part of
+* `IdCaptureConfig`, but JavaScript callers (and `<incode-id>`'s `config`
+* property) can still pass it.
+*/
+function hasOnCaptureCallback(config) {
+	return typeof config.onCapture === "function";
+}
+/** Keeps the supported keys and `onCapture`, dropping backend-only options. */
+function pickIdCaptureOnlyConfig(config) {
+	return {
+		...Object.fromEntries(ID_CAPTURE_ONLY_CONFIG_KEYS.filter((key) => config[key] !== void 0).map((key) => [key, config[key]])),
+		onCapture: config.onCapture
+	};
+}
+/**
+* Whether the captureOnly flow needs the back side after this capture. There
+* is no backend answer (`skipBackIdCapture`), so `onlyFront` decides. Drives
+* both the `shouldContinueToBack` guard and the manager's `needsBackCapture`.
+*/
+function captureOnlyNeedsBack({ currentMode, config }) {
+	if (currentMode !== "front" && currentMode !== "passport") return false;
+	return !config.onlyFront && !config.onlyBack && !config.usSmartCapture;
+}
+//#endregion
 //#region src/modules/id/idProtectedCapture.ts
 const ID_PROTECTED_CAPTURE_CONTROLLER = Symbol("idProtectedCaptureController");
 function attachIdProtectedCaptureController(owner, controller) {
@@ -2294,12 +1973,12 @@ function streamUsesBackCamera(stream) {
 	const track = stream.getVideoTracks()[0];
 	if (!track) return;
 	const settings = typeof track.getSettings === "function" ? track.getSettings() : {};
-	const constrainedFacingMode = typeof track.getConstraints === "function" ? track.getConstraints().facingMode : void 0;
+	const constrainedFacingMode = getDeviceClass() !== "desktop" && typeof track.getConstraints === "function" ? track.getConstraints().facingMode : void 0;
 	const facingMode = settings.facingMode ?? (typeof constrainedFacingMode === "string" ? constrainedFacingMode : void 0);
 	if (facingMode === "environment") return true;
 	if (facingMode === "user") return false;
 	const label = typeof track.label === "string" ? track.label.toLowerCase() : "";
-	if (label.includes("back") || label.includes("rear")) return true;
+	if (isBackCameraLabel(label)) return true;
 	if (label.includes("front") || label.includes("user")) return false;
 }
 function createIdProtectedCaptureController(dependencies = {}) {
@@ -2400,6 +2079,7 @@ function createIdProtectedCaptureController(dependencies = {}) {
 	};
 	const clearAttempt = () => {
 		if (diagnosticAttempt) logDiagnostic("attempt-release", { committed });
+		noteTrueSightCaptureActivity(false);
 		attemptGeneration += 1;
 		frameCapturer?.dispose();
 		frameCapturer = void 0;
@@ -2480,6 +2160,7 @@ function createIdProtectedCaptureController(dependencies = {}) {
 			provider = (dependencies.createProvider ?? createProtectedIdProvider)(context.config, context.currentMode);
 			cycleOwnership = createCameraCycleOwnership(cameraCycleProvider);
 			logDiagnostic("attempt-start", { aggregationMs: context.config?.thresholds?.framesAggregationInterval ?? DEFAULT_ID_CAPTURE_THRESHOLDS.framesAggregationInterval });
+			noteTrueSightCaptureActivity(true);
 		},
 		startMetadataPreparation(context) {
 			const storage = context.dependencies?.storage;
@@ -2654,6 +2335,7 @@ function createIdProtectedCaptureController(dependencies = {}) {
 			autoCommitted: storeCommit,
 			manualCommitted: storeCommit,
 			finalized(_recording, stream) {
+				noteTrueSightCaptureActivity(false);
 				if (!stream || disposed) {
 					logDiagnostic("attempt-finalized");
 					return;
@@ -2896,6 +2578,8 @@ function createProtectedIdCallbackSession(input) {
 	let countdownTimers = [];
 	let qualityElements;
 	let isCapturing = false;
+	let active = true;
+	let paused = false;
 	let lastReportedSide = null;
 	let blurSignals = 0;
 	let bestFrameSignals = 0;
@@ -2922,7 +2606,7 @@ function createProtectedIdCallbackSession(input) {
 	};
 	const startCountdown = () => {
 		clearCountdown();
-		const stepMs = (input.context.config.thresholds?.framesAggregationInterval ?? DEFAULT_ID_CAPTURE_THRESHOLDS.framesAggregationInterval) / 3;
+		const stepMs = resolveCountdownStepMs(input.context.config);
 		input.send({
 			type: "COUNTER_VALUE_CHANGE",
 			value: 3
@@ -2937,6 +2621,7 @@ function createProtectedIdCallbackSession(input) {
 		}), stepMs * (index + 1)));
 	};
 	const setDetectionStatus = (status) => {
+		trueSightHintTransition("module.id-capture", "idScan", status);
 		input.send({
 			type: "DETECTION_UPDATE",
 			status
@@ -2946,114 +2631,139 @@ function createProtectedIdCallbackSession(input) {
 		send: setDetectionStatus,
 		isSuppressed: () => isReportedIdSideWrong(input.context.currentMode, lastReportedSide)
 	});
-	return {
-		callbacks: {
-			onFarAway: () => {
-				if (!isCapturing) notifications.show("farAway");
-			},
-			onDetectionStarted: () => {},
-			onMaskChange: (_show, _mask, _top, orientation) => {
-				input.send({
-					type: "ORIENTATION_CHANGE",
-					orientation
-				});
-			},
-			onBlur: () => {
-				blurSignals += 1;
-				if (!isCapturing) notifications.show("blur");
-			},
-			onGlare: () => {
-				if (!isCapturing) notifications.show("glare");
-			},
-			onIdNotDetected: () => {
-				if (!isCapturing) setDetectionStatus("idNotDetected");
-			},
-			onSwitchToManualCapture: () => {
-				isCapturing = false;
-				notifications.clear();
-				clearOptimizingBoundary();
-				clearCountdown();
-				input.send({ type: input.controller.hasCommit() ? "PROTECTED_RELEASE_STASHED_COMMIT" : "SWITCH_TO_MANUAL_CAPTURE" });
-			},
-			onCapturing: () => {
-				const wasCapturing = isCapturing;
-				notifications.clear();
-				lastReportedSide = null;
-				isCapturing = true;
-				setDetectionStatus("capturing");
-				if (!wasCapturing) logDiagnostic("capture-window", {
-					aggregationMs: input.context.config.thresholds?.framesAggregationInterval ?? DEFAULT_ID_CAPTURE_THRESHOLDS.framesAggregationInterval,
-					blurSignals
-				});
-				if (!wasCapturing && input.context.captureFeedbackMode === "countdown") startCountdown();
-				if (input.context.captureFeedbackMode === "optimizing" && input.context.config.supportsOptimizingStatus === true && input.context.captureWindowMs != null) {
-					clearOptimizingBoundary();
-					optimizingBoundary = timer.setTimeout(() => {
-						optimizingBoundary = null;
-						const presentation = input.controller.getPresentationCanvas();
-						if (presentation) {
-							presentation.release();
-							input.send({ type: "PROTECTED_OPTIMIZING" });
-						}
-					}, input.context.captureWindowMs);
-				}
-			},
-			onBestFrame: (blur, glare, orientation) => {
-				bestFrameSignals += 1;
-				bestBlur = bestBlur === void 0 ? blur : Math.min(bestBlur, blur);
-				qualityElements = {
-					glare,
-					sharpness: blur
-				};
-				if (orientation === "horizontal" || orientation === "vertical") input.send({
-					type: "ORIENTATION_CHANGE",
-					orientation
-				});
-			},
-			onCapture: (canvas) => {
-				isCapturing = false;
+	const callbacks = {
+		onFarAway: () => {
+			if (!active || paused) return;
+			if (!isCapturing) notifications.show("farAway");
+		},
+		onDetectionStarted: () => {},
+		onMaskChange: (_show, _mask, _top, orientation) => {
+			if (!active || paused) return;
+			input.send({
+				type: "ORIENTATION_CHANGE",
+				orientation
+			});
+		},
+		onBlur: () => {
+			if (!active || paused) return;
+			blurSignals += 1;
+			if (!isCapturing) notifications.show("blur");
+		},
+		onGlare: () => {
+			if (!active || paused) return;
+			if (!isCapturing) notifications.show("glare");
+		},
+		onIdNotDetected: () => {
+			if (!active || paused) return;
+			if (!isCapturing) setDetectionStatus("idNotDetected");
+		},
+		onSwitchToManualCapture: () => {
+			if (!active || paused) return;
+			isCapturing = false;
+			notifications.clear();
+			clearOptimizingBoundary();
+			clearCountdown();
+			input.send({ type: input.controller.hasCommit() ? "PROTECTED_RELEASE_STASHED_COMMIT" : "SWITCH_TO_MANUAL_CAPTURE" });
+		},
+		onCapturing: () => {
+			if (!active || paused) return;
+			const wasCapturing = isCapturing;
+			notifications.clear();
+			lastReportedSide = null;
+			isCapturing = true;
+			setDetectionStatus("capturing");
+			if (!wasCapturing) logDiagnostic("capture-window", {
+				aggregationMs: input.context.config.thresholds?.framesAggregationInterval ?? DEFAULT_ID_CAPTURE_THRESHOLDS.framesAggregationInterval,
+				blurSignals
+			});
+			if (!wasCapturing && input.context.captureFeedbackMode === "countdown") startCountdown();
+			if (input.context.captureFeedbackMode === "optimizing" && input.context.config.supportsOptimizingStatus === true && input.context.captureWindowMs != null) {
 				clearOptimizingBoundary();
-				clearCountdown();
-				logDiagnostic("capture-selected", {
-					blurSignals,
-					bestFrameSignals,
-					bestBlur,
-					selectedBlur: qualityElements?.sharpness,
-					selectedGlare: qualityElements?.glare
-				});
-				input.controller.storeAutoCaptureFrame(canvas);
-				input.send({
-					type: "PROTECTED_AUTO_CAPTURE",
-					qualityElements
-				});
-			},
-			onIdTypeChange: (idType) => {
-				input.send({
-					type: "ID_TYPE_CHANGE",
-					idType
-				});
-			},
-			onIdSideChange: (side) => {
-				if (isCapturing) return;
-				lastReportedSide = side;
-				if (isReportedIdSideWrong(input.context.currentMode, lastReportedSide)) notifications.clear();
-				input.send({
-					type: "ID_SIDE_CHANGE",
-					side
-				});
-			},
-			onCapturingCounterValueChange: () => {},
-			onBarcodeDecoded: (decoded) => {
-				input.send({
-					type: "BARCODE_DECODED",
-					decoded
-				});
+				optimizingBoundary = timer.setTimeout(() => {
+					optimizingBoundary = null;
+					const presentation = input.controller.getPresentationCanvas();
+					if (presentation) {
+						presentation.release();
+						input.send({ type: "PROTECTED_OPTIMIZING" });
+					}
+				}, input.context.captureWindowMs);
 			}
 		},
-		dispose: () => {
-			notifications.clear();
+		onBestFrame: (blur, glare, orientation) => {
+			if (!active || paused) return;
+			bestFrameSignals += 1;
+			bestBlur = bestBlur === void 0 ? blur : Math.min(bestBlur, blur);
+			qualityElements = {
+				glare,
+				sharpness: blur
+			};
+			if (orientation === "horizontal" || orientation === "vertical") input.send({
+				type: "ORIENTATION_CHANGE",
+				orientation
+			});
+		},
+		onCapture: (canvas) => {
+			if (!active || paused) return;
+			isCapturing = false;
 			clearOptimizingBoundary();
 			clearCountdown();
+			logDiagnostic("capture-selected", {
+				blurSignals,
+				bestFrameSignals,
+				bestBlur,
+				selectedBlur: qualityElements?.sharpness,
+				selectedGlare: qualityElements?.glare
+			});
+			input.controller.storeAutoCaptureFrame(canvas);
+			input.send({
+				type: "PROTECTED_AUTO_CAPTURE",
+				qualityElements
+			});
+		},
+		onIdTypeChange: (idType) => {
+			if (!active || paused) return;
+			input.send({
+				type: "ID_TYPE_CHANGE",
+				idType
+			});
+		},
+		onIdSideChange: (side) => {
+			if (!active || paused) return;
+			if (isCapturing) return;
+			lastReportedSide = side;
+			if (isReportedIdSideWrong(input.context.currentMode, lastReportedSide)) notifications.clear();
+			input.send({
+				type: "ID_SIDE_CHANGE",
+				side
+			});
+		},
+		onCapturingCounterValueChange: () => {},
+		onBarcodeDecoded: (decoded) => {
+			if (!active || paused) return;
+			input.send({
+				type: "BARCODE_DECODED",
+				decoded
+			});
+		}
+	};
+	const pause = () => {
+		paused = true;
+		notifications.clear();
+		clearOptimizingBoundary();
+		clearCountdown();
+		isCapturing = false;
+		qualityElements = void 0;
+		lastReportedSide = null;
+	};
+	return {
+		callbacks,
+		pause,
+		resume: () => {
+			paused = false;
+		},
+		dispose: () => {
+			active = false;
+			pause();
 		}
 	};
 }
@@ -3068,7 +2778,7 @@ function createProtectedIdAttemptInput(input) {
 	const preAcquired = controller.takePreAcquiredStream();
 	let selectedVideoTrack = preAcquired?.stream.getVideoTracks()[0];
 	const constraints = getCameraReacquisitionConstraints(selectedVideoTrack, preAcquired?.constraints);
-	const captureOnly = "onCapture" in context.config && typeof context.config.onCapture === "function";
+	const captureOnly = hasOnCaptureCallback(context.config);
 	const diagnosticAttempt = controller.getDiagnosticAttempt();
 	const isAttemptActive = () => !controller.disposed && controller.getProvider() === provider && controller.getDiagnosticAttempt() === diagnosticAttempt;
 	const logSelectedCamera = (stream, fallbackLevel, reacquisitionConstraints, preAcquiredStream) => {
@@ -3137,6 +2847,11 @@ function createProtectedIdAttemptInput(input) {
 				...timing
 			});
 		},
+		pauseDetection: callbackSession.pause,
+		resumeDetection(reset) {
+			if (reset) provider.resetDetectionState();
+			callbackSession.resume();
+		},
 		async configureWorkflow() {
 			await provider.initialize({});
 			configureIdCaptureProvider({
@@ -3199,52 +2914,383 @@ function createProtectedIdAttemptInput(input) {
 		}
 	};
 }
-function protectedIdResultToCaptureResponse(result) {
-	const regulationType = result.regulationType === "US" || result.regulationType === "Worldwide" || result.regulationType === "Other" || result.regulationType === "US_Illinois" || result.regulationType === "US_Texas" || result.regulationType === "US_California" || result.regulationType === "US_Washington" ? result.regulationType : void 0;
+function protectedIdResultToCaptureResponse(result) {
+	const regulationType = result.regulationType === "US" || result.regulationType === "Worldwide" || result.regulationType === "Other" || result.regulationType === "US_Illinois" || result.regulationType === "US_Texas" || result.regulationType === "US_California" || result.regulationType === "US_Washington" ? result.regulationType : void 0;
+	return {
+		sharpness: result.sharpness ?? 0,
+		correctSharpness: result.sharpness != null && result.sharpness >= 10,
+		glare: result.glare ?? 0,
+		correctGlare: result.glare != null && result.glare >= 10,
+		horizontalResolution: 0,
+		classification: result.classification === true,
+		readability: result.readability === true,
+		typeOfId: result.typeOfId ?? "",
+		issueYear: 0,
+		issueName: "",
+		sessionStatus: result.sessionStatus ?? "",
+		countryCode: result.countryCode ?? "",
+		skipBackIdCapture: result.skipBackIdCapture,
+		skipGlareFront: result.skipGlareFront,
+		skipGlareBack: result.skipGlareBack,
+		acceptedDocuments: result.acceptedDocuments ? [...result.acceptedDocuments] : void 0,
+		forceFrontIdCapture: result.forceFrontIdCapture,
+		idValidationCompleted: result.idValidationCompleted,
+		showMandatoryConsent: result.showMandatoryConsent,
+		regulationType,
+		failReason: result.failReason,
+		side: result.side,
+		idQualityAttemptApproved: result.idQualityAttemptApproved,
+		isDocumentExpired: result.isDocumentExpired,
+		success: result.success
+	};
+}
+function getProtectedIdUploadRequest(context, sessionToken = getToken()) {
+	const target = resolveProtectedIdTarget(context.config, context.currentMode);
+	const front = context.currentMode !== "back";
+	const params = { captureType: context.manualCaptureTriggered ? "MANUAL" : "AUTO" };
+	if (front && context.config.onlyFront === true) params.onlyFront = true;
+	if (front && context.config.extractIdFace === false) params.extractIdFace = false;
+	const sharpness = context.qualityElements?.sharpness;
+	if (sharpness !== void 0 && sharpness !== 0 && Number.isFinite(sharpness)) params.sharpness = getRealQualityValue(sharpness);
+	return {
+		target,
+		config: {
+			...sessionToken ? { headers: { "X-Incode-Hardware-Id": sessionToken } } : {},
+			params
+		}
+	};
+}
+//#endregion
+//#region src/modules/id/digitalIdRegistry.ts
+/**
+* True when a digital-ID method uses a full-page web-redirect flow (Trinsic
+* iDIN/FTN). Accepts both the module `FlowType` value (`REDIRECT`) and the
+* backend value (`WEB_REDIRECT`). (Lives here rather than in
+* `idCaptureHelpers` to keep the registry free of circular imports; the
+* helpers re-export it.)
+*/
+function isRedirectFlowType(flowType) {
+	return flowType === "REDIRECT" || flowType === "WEB_REDIRECT";
+}
+const DIGITAL_ID_REGISTRY = {
+	mDL: [{
+		kind: "incodeWallet",
+		documentType: "digitalId"
+	}, {
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_mdl_placeholder",
+		method: "MDL"
+	}],
+	iDIN: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_netherlands_idin",
+		method: "IDIN"
+	}],
+	FTN: [{
+		kind: "trinsicRedirect",
+		documentType: "digitalIdRedirect",
+		providerId: "trinsic_finnish_trust_network",
+		method: "FTN"
+	}]
+};
+const DIGITAL_ID_DOCUMENT_TYPES = Object.keys(DIGITAL_ID_REGISTRY);
+/**
+* Single place that widens `config.digitalIds` to the shapes the backend
+* actually sends — the mapped array or the raw `{ enabled, methods }` object.
+* Shared so the cast is written once.
+*/
+function asDigitalIdsConfig(config) {
+	return config.digitalIds;
+}
+/**
+* Persisted method name → catalog provider id, derived from the registry's
+* Trinsic entries (single source of truth). Lets the SDK launch iDIN / FTN
+* from a backend that does not yet send `providerId` on each method.
+* TODO(roadmap: fully-catalog-driven): remove once every backend enriches
+* `digitalIds.methods[]` with `providerId` + `flowType`.
+*/
+const REDIRECT_PROVIDER_BY_METHOD = (() => {
+	const map = {};
+	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) for (const entry of DIGITAL_ID_REGISTRY[docType]) if (entry.kind === "trinsicRedirect") map[entry.method] = entry.providerId;
+	return map;
+})();
+/**
+* Redirect providers that are the fallback leg of a wallet-first funnel
+* (mDL): they are reached through the `digitalId` tile's funnel resolution,
+* not offered as a standalone chooser card.
+*/
+const WALLET_FUNNEL_REDIRECT_PROVIDER_IDS = new Set(DIGITAL_ID_DOCUMENT_TYPES.flatMap((docType) => {
+	const entries = DIGITAL_ID_REGISTRY[docType];
+	if (!entries.some((entry) => entry.kind === "incodeWallet")) return [];
+	return entries.flatMap((entry) => entry.kind === "trinsicRedirect" ? [entry.providerId] : []);
+}));
+/**
+* True for a redirect provider that gets its own chooser card (iDIN, FTN, any
+* catalog-enriched redirect method) — as opposed to the mDL wallet fallback,
+* which only surfaces through the Digital ID tile.
+*/
+function isStandaloneRedirectProvider(providerId) {
+	return !WALLET_FUNNEL_REDIRECT_PROVIDER_IDS.has(providerId);
+}
+/**
+* The provider id a configured method launches with, when it is a
+* web-redirect method; `undefined` for wallets / other flow shapes.
+*
+* Resolution order:
+* 1. an explicit redirect `flowType` with a `provider` (mapped shape) or
+*    `providerId` (catalog-enriched raw shape) — backend-authoritative;
+* 2. otherwise the persisted method name via the registry (legacy raw shape).
+*/
+function resolveRedirectProviderId(method) {
+	if (method.flowType) {
+		if (!isRedirectFlowType(method.flowType)) return;
+		const explicit = method.provider ?? method.providerId;
+		if (explicit) return explicit;
+	}
+	return method.method ? REDIRECT_PROVIDER_BY_METHOD[method.method.toUpperCase()] : void 0;
+}
+/**
+* Tolerant view over `config.digitalIds`: accepts both the mapped array
+* (`IdCaptureDigitalIdMethod[]`) and the raw backend object
+* (`{ enabled, methods: [...] }`). Extracted from the old
+* `getDigitalIdRedirectMethod` cast so every consumer parses it the same way.
+*
+* Honors both dashboard toggles: a raw object with `enabled: false` yields no
+* methods, and individual methods with `enabled: false` are dropped (absent
+* `enabled` counts as on). This is what "enabled for the flow / workflow"
+* means — for the redirect chooser cards as much as for the wallet tile.
+*/
+function normalizeDigitalIdMethods(config) {
+	const raw = asDigitalIdsConfig(config);
+	if (!Array.isArray(raw) && raw?.enabled === false) return [];
+	return (Array.isArray(raw) ? raw : raw?.methods ?? []).filter((method) => method.enabled !== false);
+}
+/**
+* Persisted method names of the Incode-native device wallets — the backend
+* `DigitalIdMethodCatalog` entries of type `MDL`. A catalog-enriched method
+* carries `type: 'MDL'` instead of relying on the name; both are honoured.
+*/
+const DEVICE_WALLET_METHODS = /* @__PURE__ */ new Set([
+	"APPLE_WALLET",
+	"GOOGLE_WALLET",
+	"CA_DMV_WALLET"
+]);
+/**
+* True for a configured method the native device-wallet handshake can fulfil.
+* Redirect methods (iDIN, FTN) never count, whatever their name or type — they
+* must not surface a wallet tile with no wallet behind it.
+*
+* Classifies by *kind* only. Whether a method is switched on is already
+* settled by `normalizeDigitalIdMethods`, which drops disabled methods before
+* any caller walks the list.
+*/
+function isDeviceWalletMethod(method) {
+	if (method.flowType && isRedirectFlowType(method.flowType)) return false;
+	if (method.type?.toUpperCase() === "MDL") return true;
+	return method.method !== void 0 && DEVICE_WALLET_METHODS.has(method.method.toUpperCase());
+}
+/**
+* Whether a device wallet is enabled for this ID-capture config: the coarse
+* `deviceWallet` flag, or an enabled wallet method in `config.digitalIds`.
+*
+* The dashboard persists a wallet only in `digitalIds.methods` and leaves the
+* legacy `deviceWallet` / `appleWallet` booleans at their stored `false`. The
+* backend derives the booleans from `digitalIds` for the flow response, but
+* the workflow-node response historically shipped them raw — so a workflow
+* with Apple Wallet enabled arrived here as `deviceWallet: false`, and the
+* tile was dropped while SDK 1 (which reads `digitalIds` itself) showed it.
+* Mirrors the backend's own `deriveDeviceWalletFlag`, minus its "unknown
+* method counts as a wallet" fallback: an unrecognised method must not
+* launch a handshake that cannot know what to request.
+*/
+function isDeviceWalletEnabled(config) {
+	if (config.deviceWallet === true) return true;
+	return hasEnabledDeviceWalletMethod(config);
+}
+/** Whether a funnel entry is activated by config + platform capabilities. */
+function isEntryActive(entry, config, platform) {
+	if (entry.kind === "incodeWallet") return isDeviceWalletEnabled(config) && platform.credentialsAvailable;
+	return findConfiguredMethod(entry, config) !== void 0;
+}
+/**
+* The configured `digitalIds` method matching a Trinsic funnel entry — by
+* persisted method name, or (mapped shape) by provider id on a redirect
+* flowType. First match wins; disabled methods are already dropped by
+* `normalizeDigitalIdMethods`.
+*/
+function findConfiguredMethod(entry, config) {
+	return normalizeDigitalIdMethods(config).find((method) => method.method?.toUpperCase() === entry.method || method.provider === entry.providerId && !!method.flowType && isRedirectFlowType(method.flowType));
+}
+/** Normalizes a raw configured method into the mapped shape for the child input. */
+function toMappedMethod(entry, method) {
+	if (method.flowType && isRedirectFlowType(method.flowType)) return method;
+	return {
+		method: method.method,
+		provider: entry.providerId,
+		flowType: "WEB_REDIRECT",
+		country: method.country ?? method.countries?.[0],
+		displayName: method.displayName,
+		logoUrl: method.logoUrl
+	};
+}
+/**
+* True when `config.digitalIds` carries a device-wallet method that is switched
+* on, honouring both dashboard toggles: the `digitalIds.enabled` master switch
+* and each method's own `enabled` flag. An absent `enabled` counts as on, the
+* tolerant reading the rest of this module uses.
+*
+* Both toggles are applied by `normalizeDigitalIdMethods`, so this only has to
+* ask whether any surviving method is a wallet.
+*/
+function hasEnabledDeviceWalletMethod(config) {
+	return normalizeDigitalIdMethods(config).some(isDeviceWalletMethod);
+}
+/**
+* Resolves the implementation that should fulfil a digital-ID document type:
+* the first funnel entry that is active under the given config and platform.
+* `undefined` when nothing can run it (the chooser then shows no tile for it).
+*/
+function resolveDigitalIdImplementation(docType, config, platform) {
+	for (const entry of DIGITAL_ID_REGISTRY[docType]) {
+		if (!isEntryActive(entry, config, platform)) continue;
+		if (entry.kind === "incodeWallet") return { kind: "incodeWallet" };
+		const method = findConfiguredMethod(entry, config);
+		return {
+			kind: "trinsicRedirect",
+			providerId: entry.providerId,
+			method: method ? toMappedMethod(entry, method) : void 0
+		};
+	}
+}
+//#endregion
+//#region src/modules/id/idCaptureHelpers.ts
+/**
+* Normalizes a configured method into the mapped redirect shape for a
+* resolved provider. The already-mapped shape is returned as-is; the raw
+* backend shape gets `provider` + `WEB_REDIRECT` filled in.
+*/
+function toRedirectMethod(method, provider) {
+	if (method.provider && method.flowType) return method;
 	return {
-		sharpness: result.sharpness ?? 0,
-		correctSharpness: result.sharpness != null && result.sharpness >= 10,
-		glare: result.glare ?? 0,
-		correctGlare: result.glare != null && result.glare >= 10,
-		horizontalResolution: 0,
-		classification: result.classification === true,
-		readability: result.readability === true,
-		typeOfId: result.typeOfId ?? "",
-		issueYear: 0,
-		issueName: "",
-		sessionStatus: result.sessionStatus ?? "",
-		countryCode: result.countryCode ?? "",
-		skipBackIdCapture: result.skipBackIdCapture,
-		skipGlareFront: result.skipGlareFront,
-		skipGlareBack: result.skipGlareBack,
-		acceptedDocuments: result.acceptedDocuments ? [...result.acceptedDocuments] : void 0,
-		forceFrontIdCapture: result.forceFrontIdCapture,
-		idValidationCompleted: result.idValidationCompleted,
-		showMandatoryConsent: result.showMandatoryConsent,
-		regulationType,
-		failReason: result.failReason,
-		side: result.side,
-		idQualityAttemptApproved: result.idQualityAttemptApproved,
-		isDocumentExpired: result.isDocumentExpired,
-		success: result.success
+		method: method.method,
+		provider,
+		flowType: "WEB_REDIRECT",
+		country: method.country ?? method.countries?.[0],
+		displayName: method.displayName,
+		logoUrl: method.logoUrl
 	};
 }
-function getProtectedIdUploadRequest(context, sessionToken = getToken()) {
-	const target = resolveProtectedIdTarget(context.config, context.currentMode);
-	const front = context.currentMode !== "back";
-	const params = {};
-	if (front && context.config.onlyFront === true) params.onlyFront = true;
-	if (front && context.config.extractIdFace === false) params.extractIdFace = false;
-	const sharpness = context.qualityElements?.sharpness;
-	if (sharpness !== void 0 && sharpness !== 0 && Number.isFinite(sharpness)) params.sharpness = getRealQualityValue(sharpness);
-	const config = {
-		...sessionToken ? { headers: { "X-Incode-Hardware-Id": sessionToken } } : {},
-		...Object.keys(params).length > 0 ? { params } : {}
+/**
+* The enabled web-redirect digital-ID method to launch — the one matching
+* `providerId` when given (a chooser card was picked), else the first
+* configured redirect method — or `undefined` when none is configured.
+* Drives the provider and country passed to the `digitalIdRedirectMachine`.
+*
+* Accepts both the mapped array (`IdCaptureDigitalIdMethod[]`) and the raw
+* backend `configuration.digitalIds` object (`{ enabled, methods: [...] }`);
+* for the raw shape the provider comes from the backend-enriched
+* `providerId`/`flowType` when present, else from the persisted method name
+* via the digital-ID registry (`IDIN` → `trinsic_netherlands_idin`).
+*/
+function getDigitalIdRedirectMethod(config, providerId) {
+	for (const method of normalizeDigitalIdMethods(config)) {
+		const provider = resolveRedirectProviderId(method);
+		if (!provider || providerId !== void 0 && provider !== providerId) continue;
+		return toRedirectMethod(method, provider);
+	}
+}
+/**
+* The digital-ID web-redirect providers that get their own chooser card: one
+* per enabled redirect method in `config.digitalIds`, in backend (dashboard)
+* order, deduped by provider. Wallet-funnel fallbacks (the Trinsic mDL leg)
+* are excluded — they surface through the Digital ID tile instead.
+*
+* Card display data (`displayName`, `logoUrl`, `country`) is whatever the
+* backend enriched the method with; the UI falls back to generic copy / icon
+* when absent.
+*/
+function getAvailableDigitalIdRedirectOptions(config) {
+	const options = [];
+	for (const method of normalizeDigitalIdMethods(config)) {
+		const providerId = resolveRedirectProviderId(method);
+		if (!providerId || !isStandaloneRedirectProvider(providerId) || options.some((option) => option.providerId === providerId)) continue;
+		options.push({
+			providerId,
+			method: method.method,
+			displayName: method.displayName,
+			logoUrl: method.logoUrl,
+			country: method.country ?? method.countries?.[0]
+		});
+	}
+	return options;
+}
+/**
+* Map of config properties received from the backend to adjusted, internal document types.
+*/
+const DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP = [
+	["enableId", "id"],
+	["enablePassport", "passport"],
+	["digitalIdsUpload", "digitalIdUpload"]
+];
+/**
+* Returns the list of document types enabled by config for the chooser screen, in display order.
+* Used to populate chooser state so UI and headless consumers can render the correct options.
+*
+* Digital-ID document types (device wallet, Trinsic web-redirect) come from
+* the digital-ID registry funnel: each registry document type contributes the
+* tile of its first active implementation. A `deviceWallet: true` config on a
+* platform without the Credentials API therefore shows the Trinsic fallback
+* tile when one is configured — or no tile at all, instead of a dead-end one.
+*
+* @param config - ID capture configuration (from flow or init)
+* @param platform - Platform capabilities consulted by the digital-ID funnel.
+*   Defaults to no Credentials API for pure-node callers; the machine passes
+*   the real capability check.
+* @returns Array of IdDocumentType values that should be shown in the document type chooser
+*/
+function getAvailableDocumentTypes(config, platform = { credentialsAvailable: false }) {
+	const adjustedDocumentTypes = [];
+	for (const [configProperty, adjustedType] of DOCUMENT_TYPES_CONFIG_TO_ADJUSTED_MAP) if (config[configProperty]) adjustedDocumentTypes.push(adjustedType);
+	for (const docType of DIGITAL_ID_DOCUMENT_TYPES) {
+		const route = resolveDigitalIdImplementation(docType, config, platform);
+		if (!route) continue;
+		const documentType = route.kind === "incodeWallet" ? "digitalId" : "digitalIdRedirect";
+		if (!adjustedDocumentTypes.includes(documentType)) adjustedDocumentTypes.push(documentType);
+	}
+	if (!adjustedDocumentTypes.includes("digitalIdRedirect") && getAvailableDigitalIdRedirectOptions(config).length > 0) adjustedDocumentTypes.push("digitalIdRedirect");
+	return adjustedDocumentTypes;
+}
+/**
+* Computes `idCaptureMachine`'s terminal output — the downstream module-skip
+* signal read by the Flow orchestrator (via `runChildModule`'s `MODULE_COMPLETE`).
+*
+* `skipFaceMatch` is set ONLY for the US Smart Capture *camera back-only* path:
+* a back image was captured on-device (`capturedImages.back`) and no front was
+* (`!capturedImages.front`) — "no front, no ID face, no match".
+*
+* Requiring a captured back is deliberate and load-bearing: the digital-ID
+* upload path submits a full ID (front face present) but does NOT
+* populate `capturedImages` (only the camera path does). Gating on a captured
+* back excludes those upload paths so a real ID-vs-selfie match is never
+* silently skipped. `capturedImages.front`/`forceFrontIdCapture` alone are not
+* enough (a later front upload clears the request; uploads set neither field).
+*
+* Always `false` outside US Smart Capture. The selfie/face capture itself is
+* unaffected — only the ID-vs-selfie match is skipped.
+*
+* Also `true` on the Digital ID web-redirect (Trinsic iDIN/FTN) COMPLETED path
+* when the scheme returned no portrait (`isDigitalIdRedirect && !portraitPresent`,
+* FM-1/FM-2): there is no ID face to match the selfie against.
+*/
+function computeIdCaptureOutput(context) {
+	const frontIdCaptured = Boolean(context.capturedImages.front);
+	const backIdCaptured = Boolean(context.capturedImages.back);
+	return {
+		frontIdCaptured,
+		skipFaceMatch: context.isDigitalIdRedirect === true && context.portraitPresent !== true || context.config.usSmartCapture === true && backIdCaptured && !frontIdCaptured
 	};
-	return Object.keys(config).length > 0 ? {
-		target,
-		config
-	} : { target };
 }
 //#endregion
 //#region src/modules/digital-id-redirect/pollCadence.ts
@@ -3765,9 +3811,6 @@ function getIdErrorCodeFromUnknown(error) {
 function asPublicIdEvent(event) {
 	return event;
 }
-function isCaptureOnlyConfig(config) {
-	return "onCapture" in config && typeof config.onCapture === "function";
-}
 function protectedFailure(event) {
 	return event.type === "PROTECTED_ATTEMPT_FAILED" ? event : null;
 }
@@ -3781,13 +3824,13 @@ const idCaptureMachine = setup({
 	actors: {
 		checkPermission: checkPermissionActor,
 		requestPermission: requestPermissionActor,
+		requestMotionPermission: requestMotionPermissionActor,
 		protectedAttempt: createProtectedIdAttemptActor(),
 		protectedControllerLifetime: createProtectedIdControllerLifetimeActor(),
 		captureOnlyDelivery: createIdCaptureOnlyDeliveryActor(),
 		uploadProgressTicker: uploadProgressTickerActor,
 		processId: processIdActor,
 		submitBarcode: submitBarcodeActor,
-		manualUploadMachine,
 		digitalUploadMachine,
 		digitalIdRedirectMachine,
 		deviceWalletMachine,
@@ -3804,7 +3847,7 @@ const idCaptureMachine = setup({
 			return {};
 		}),
 		startProtectedMetadataPreparation: ({ context, self }) => {
-			if (!isCaptureOnlyConfig(context.config)) getIdProtectedCaptureController(self).startMetadataPreparation(context);
+			if (!hasOnCaptureCallback(context.config)) getIdProtectedCaptureController(self).startMetadataPreparation(context);
 		},
 		bindProtectedControllerLifetime: sendTo("protectedControllerLifetime", ({ self }) => ({
 			type: "BIND_PROTECTED_ID_CONTROLLER",
@@ -3845,7 +3888,7 @@ const idCaptureMachine = setup({
 		requestProtectedManualCommit: sendTo("protectedAttempt", { type: "MANUAL_CAPTURE" }),
 		finalizeProtectedAttempt: sendTo("protectedAttempt", { type: "FINALIZE" }),
 		requestProtectedUpload: enqueueActions(({ context, enqueue }) => {
-			if (isCaptureOnlyConfig(context.config)) return;
+			if (hasOnCaptureCallback(context.config)) return;
 			enqueue(sendTo("protectedAttempt", {
 				type: "UPLOAD_PROTECTED",
 				request: getProtectedIdUploadRequest(context)
@@ -3863,6 +3906,25 @@ const idCaptureMachine = setup({
 			type: "RELEASE",
 			reason: "retry"
 		}),
+		pauseProtectedDetection: sendTo("protectedAttempt", { type: "PAUSE_DETECTION" }),
+		resumeProtectedDetection: sendTo("protectedAttempt", ({ context }) => ({
+			type: "RESUME_DETECTION",
+			reset: !context.manualCaptureTriggered
+		})),
+		resetAutomaticCapture: assign({
+			manualCaptureTriggered: false,
+			detectionStatus: "idle",
+			counterValue: 0,
+			decodedBarcode: null,
+			barcodeFastPathAttempted: false,
+			qualityElements: void 0
+		}),
+		trackSwitchToAutoCapture: ({ context }) => {
+			addEvent({
+				code: context.currentMode === "back" ? "switchToAutoCaptureBackId" : "switchToAutoCaptureFrontId",
+				module: eventModuleNames.idCapture
+			});
+		},
 		forwardProtectedBackground: sendTo("protectedAttempt", { type: "BACKGROUND" }),
 		forwardProtectedForeground: sendTo("protectedAttempt", { type: "FOREGROUND" }),
 		storeProtectedAutoQuality: assign(({ event }) => event.type === "PROTECTED_AUTO_CAPTURE" ? { qualityElements: event.qualityElements } : {}),
@@ -4047,9 +4109,12 @@ const idCaptureMachine = setup({
 			performStopMediaRecording(context);
 		},
 		clearRecordingSession: assign({ recordingSession: () => void 0 }),
-		setSelectedDocument: assign({ selectedDocumentType: ({ event }) => {
-			if ("documentType" in event) return event.documentType;
-		} }),
+		setSelectedDocument: assign({
+			selectedDocumentType: ({ event }) => {
+				if ("documentType" in event) return event.documentType;
+			},
+			selectedDigitalIdProviderId: ({ event }) => event.type === "SELECT_DOCUMENT" && event.documentType === "digitalIdRedirect" ? event.providerId : void 0
+		}),
 		setCurrentMode: assign({ currentMode: ({ event, context }) => getCurrentModeFromEvent(context, asPublicIdEvent(event)) }),
 		storeCapturedImage: assign(({ context, event }) => getStoreCapturedImageValues(context, asPublicIdEvent(event))),
 		setCandidateFrame: assign(({ context, event }) => getCandidateFrameValues(context, asPublicIdEvent(event))),
@@ -4190,6 +4255,22 @@ const idCaptureMachine = setup({
 				digitalIdResumeProviderId: pending?.providerId
 			};
 		}),
+		/**
+		* Drops the inputs that belong to one digital-ID attempt: the return-leg
+		* params and the recovered verificationId/providerId, plus the funnel
+		* route. The `digitalIdRedirect` child copies what it needs on entry, so
+		* once it exits nothing reads them — but left in place they are replayed
+		* on the next redirect selection. The return leg would re-submit the
+		* previous provider's result (the user picks iDIN and gets FTN's
+		* cancelled screen back), and a stale route would override the card the
+		* user just picked.
+		*/
+		clearDigitalIdAttempt: assign({
+			digitalIdReturnParams: () => void 0,
+			digitalIdResumeVerificationId: () => void 0,
+			digitalIdResumeProviderId: () => void 0,
+			digitalIdRoute: () => void 0
+		}),
 		incrementProcessingExpiredAttempts: assign(({ context }) => ({ processingExpiredAttempts: context.processingExpiredAttempts + 1 })),
 		setSkipProcessId: assign({ skipProcessId: () => true }),
 		setExpiredFromUpload: assign({ expiredFromUpload: () => true }),
@@ -4199,7 +4280,7 @@ const idCaptureMachine = setup({
 		clearExpiredFromUpload: assign({ expiredFromUpload: () => false })
 	},
 	guards: {
-		isCaptureOnlyDelivery: ({ context }) => isCaptureOnlyConfig(context.config),
+		isCaptureOnlyDelivery: ({ context }) => hasOnCaptureCallback(context.config),
 		isProtectedUploadFailure: ({ event }) => protectedFailure(event)?.failure.stage === "upload",
 		isProtectedManualRefusal: ({ event }) => protectedFailure(event)?.failure.stage === "manualCommit",
 		hasShowTutorial: hasShowTutorialGuard,
@@ -4216,6 +4297,7 @@ const idCaptureMachine = setup({
 		}),
 		isPermissionDeniedError: ({ event }) => isPermissionDeniedErrorGuard({ event: asPublicIdEvent(event) }),
 		isPermissionBlocked: isPermissionBlockedGuard,
+		requiresMotionPermissionUserGesture: requiresMotionPermissionUserGestureGuard,
 		hasAttemptsRemaining: hasAttemptsRemainingGuard,
 		hasCapturedImage: hasCapturedImageGuard,
 		hasCandidateFrame: ({ event }) => hasCandidateFrameGuard({ event: asPublicIdEvent(event) }),
@@ -4229,9 +4311,7 @@ const idCaptureMachine = setup({
 		isDeepsightEnabled: isDeepsightEnabledGuard,
 		isDeepsightReady: isDeepsightReadyGuard,
 		needsDeepsightInit: needsDeepsightInitGuard,
-		hasOnlyManualUploadAvailable: hasOnlyManualUploadAvailableGuard,
 		hasNoDocumentTypesAvailable: hasNoDocumentTypesAvailableGuard,
-		isManualIdUploadSelected: ({ event }) => isManualIdUploadSelectedGuard({ event: asPublicIdEvent(event) }),
 		isDigitalIdUploadSelected: ({ event }) => isDigitalIdUploadSelectedGuard({ event: asPublicIdEvent(event) }),
 		isDigitalIdRedirectSelected: ({ event }) => isDigitalIdRedirectSelectedGuard({ event: asPublicIdEvent(event) }),
 		isDigitalIdSelected: ({ event }) => isDigitalIdSelectedGuard({ event: asPublicIdEvent(event) }),
@@ -4254,7 +4334,6 @@ const idCaptureMachine = setup({
 		forceFinishAfterProcessing: forceFinishAfterProcessingGuard,
 		isBackModeInMultiSideFlow: isBackModeInMultiSideFlowGuard,
 		wasExpiredRedirected: wasExpiredRedirectedGuard,
-		isManualUploadExhausted: ({ event }) => event.output?.result === "exhausted",
 		isDigitalUploadExhausted: ({ event }) => event.output?.result === "exhausted",
 		isDigitalUploadSuccessful: ({ event }) => event.output?.result === "success",
 		isDigitalIdRedirectCompleted: ({ event }) => event.output?.status === "COMPLETED",
@@ -4303,9 +4382,13 @@ const idCaptureMachine = setup({
 	},
 	context: ({ input, self }) => {
 		attachIdProtectedCaptureController(self, createIdProtectedCaptureController());
+		const config = {
+			...input.config,
+			captureAttempts: input.config.captureAttempts ?? 1
+		};
 		const currentMode = input.config.onlyBack ? "back" : !input.config.enableId && input.config.enablePassport ? "passport" : input.config.usSmartCapture ? "back" : "front";
 		return {
-			config: input.config,
+			config,
 			captureFeedbackMode: input.captureFeedbackMode ?? "countdown",
 			captureWindowMs: input.captureWindowMs,
 			optimizingDwellMs: input.optimizingDwellMs,
@@ -4325,7 +4408,7 @@ const idCaptureMachine = setup({
 			barcodeFastPathAttempted: false,
 			barcodeFastPathCaptured: false,
 			recordingSession: void 0,
-			attemptsRemaining: input.config.captureAttempts,
+			attemptsRemaining: config.captureAttempts,
 			expiredAttempts: 0,
 			expiredRedirected: false,
 			processingExpiredAttempts: 0,
@@ -4359,6 +4442,8 @@ const idCaptureMachine = setup({
 			disableIpify: getDisableIpify(),
 			deepsightInitAttempted: false,
 			availableDocumentTypes: getAvailableDocumentTypes(input.config, { credentialsAvailable: input.dependencies?.credentials?.isAvailable() ?? false }),
+			digitalIdRedirectOptions: getAvailableDigitalIdRedirectOptions(input.config),
+			selectedDigitalIdProviderId: void 0,
 			captureResolution: void 0,
 			cameraFallbackLevel: void 0,
 			usingBackCamera: void 0
@@ -4379,10 +4464,6 @@ const idCaptureMachine = setup({
 				guard: "hasNoDocumentTypesAvailable",
 				actions: [() => console.error(ID_CAPTURE_NO_DOCUMENT_TYPES_ERROR), assign({ error: () => ID_CAPTURE_NO_DOCUMENT_TYPES_ERROR })]
 			},
-			{
-				target: "manualIdUpload",
-				guard: "hasOnlyManualUploadAvailable"
-			},
 			{
 				target: "chooser",
 				guard: "hasShowDocumentChooser"
@@ -4413,11 +4494,6 @@ const idCaptureMachine = setup({
 				guard: "isDigitalIdUploadSelected",
 				actions: ["setSelectedDocument"]
 			},
-			{
-				target: "manualIdUpload",
-				guard: "isManualIdUploadSelected",
-				actions: ["setSelectedDocument"]
-			},
 			{
 				target: "ageVerification",
 				guard: "hasAgeAssurance",
@@ -4494,6 +4570,14 @@ const idCaptureMachine = setup({
 						}]
 					},
 					on: {
+						CONTINUE_TO_PERMISSION: [{
+							target: "requestingMotionPermission",
+							guard: "requiresMotionPermissionUserGesture",
+							actions: "trackContinue"
+						}, {
+							target: "#idCapture.permissions",
+							actions: "trackContinue"
+						}],
 						NEXT_STEP: {
 							target: "#idCapture.capture",
 							actions: "trackContinue"
@@ -4506,6 +4590,14 @@ const idCaptureMachine = setup({
 				},
 				initializingCamera: {
 					type: "parallel",
+					on: { CONTINUE_TO_PERMISSION: [{
+						target: "requestingMotionPermission",
+						guard: "requiresMotionPermissionUserGesture",
+						actions: "trackContinue"
+					}, {
+						target: "#idCapture.permissions",
+						actions: "trackContinue"
+					}] },
 					states: {
 						cameraInit: {
 							initial: "initializingStream",
@@ -4547,6 +4639,14 @@ const idCaptureMachine = setup({
 					onDone: { target: "#idCapture.capture" }
 				},
 				ready: { on: {
+					CONTINUE_TO_PERMISSION: [{
+						target: "requestingMotionPermission",
+						guard: "requiresMotionPermissionUserGesture",
+						actions: "trackContinue"
+					}, {
+						target: "#idCapture.permissions",
+						actions: "trackContinue"
+					}],
 					NEXT_STEP: {
 						target: "waitingForPermission",
 						actions: "trackContinue"
@@ -4587,6 +4687,15 @@ const idCaptureMachine = setup({
 							actions: assign({ permissionResult: ({ event }) => event.output })
 						}
 					]
+				} },
+				requestingMotionPermission: { invoke: {
+					id: "requestTutorialMotionPermission",
+					src: "requestMotionPermission",
+					onDone: [{
+						target: "#idCapture.permissions.denied",
+						guard: ({ event }) => event.output === "denied"
+					}, { target: "#idCapture.permissions" }],
+					onError: { target: "#idCapture.permissions.denied" }
 				} }
 			}
 		},
@@ -4642,6 +4751,7 @@ const idCaptureMachine = setup({
 				} },
 				motionOnly: { on: {
 					REQUEST_PERMISSION: "requesting",
+					GO_TO_LEARN_MORE: "learnMore",
 					BACK: {
 						target: "#idCapture.tutorial.ready",
 						guard: "hasShowTutorial"
@@ -4755,6 +4865,7 @@ const idCaptureMachine = setup({
 					}],
 					entry: [assign({ detectionStatus: () => "detecting" })],
 					on: {
+						OPEN_HELP: { target: "help" },
 						DETECTION_UPDATE: { actions: "setDetectionStatus" },
 						PROTECTED_AUTO_CAPTURE: { actions: ["storeProtectedAutoQuality", "requestProtectedAutoCommit"] },
 						PROTECTED_AUTO_COMMITTED_SIGNAL: {
@@ -4819,6 +4930,7 @@ const idCaptureMachine = setup({
 					initial: "searching",
 					states: {
 						searching: { on: {
+							OPEN_HELP: { target: "#idCapture.capture.help" },
 							DETECTION_UPDATE: { actions: "setDetectionStatus" },
 							ID_SIDE_CHANGE: { actions: assign({ detectionStatus: ({ context, event }) => getDetectionStatusFromSideChange(context, event.side) }) },
 							BARCODE_DECODED: [{
@@ -4856,7 +4968,34 @@ const idCaptureMachine = setup({
 						}
 					}
 				},
+				help: {
+					entry: "pauseProtectedDetection",
+					on: {
+						CLOSE_HELP: [{
+							guard: "hasManualCaptureTriggered",
+							target: "manualCaptureWaiting",
+							actions: "resumeProtectedDetection"
+						}, {
+							target: "choosingDetectionStrategy",
+							actions: ["resetAutomaticCapture", "resumeProtectedDetection"]
+						}],
+						SWITCH_TO_MANUAL_CAPTURE: { actions: assign({
+							manualCaptureTriggered: true,
+							detectionStatus: "manualCapture"
+						}) },
+						SWITCH_TO_AUTO_CAPTURE: {
+							guard: "hasManualCaptureTriggered",
+							target: "releasingForRetry",
+							actions: ["trackSwitchToAutoCapture", "resetAutomaticCapture"]
+						}
+					}
+				},
 				manualCaptureWaiting: { on: {
+					OPEN_HELP: { target: "help" },
+					SWITCH_TO_AUTO_CAPTURE: {
+						target: "releasingForRetry",
+						actions: ["trackSwitchToAutoCapture", "resetAutomaticCapture"]
+					},
 					MANUAL_CAPTURE: { actions: "requestProtectedManualCommit" },
 					PROTECTED_MANUAL_COMMITTED_SIGNAL: {
 						target: "capturingManual",
@@ -4962,7 +5101,7 @@ const idCaptureMachine = setup({
 						id: "captureOnlyDelivery",
 						src: "captureOnlyDelivery",
 						input: ({ context }) => {
-							if (!isCaptureOnlyConfig(context.config)) return { mode: "protected" };
+							if (!hasOnCaptureCallback(context.config)) return { mode: "protected" };
 							return { mode: "captureOnly" };
 						}
 					}],
@@ -5264,35 +5403,6 @@ const idCaptureMachine = setup({
 				actions: "resetContext"
 			} }
 		},
-		manualIdUpload: {
-			invoke: {
-				id: "manualIdUpload",
-				src: "manualUploadMachine",
-				input: ({ context }) => ({
-					isSecondId: context.config.isSecondId ?? false,
-					onlyFront: context.config.onlyFront ?? false,
-					onlyBack: context.config.onlyBack ?? false,
-					captureAttempts: context.config.captureAttempts,
-					extractIdFace: context.config.extractIdFace
-				}),
-				onSnapshot: { actions: () => {} },
-				onDone: [{
-					guard: "isManualUploadExhausted",
-					target: "#idCapture.finished"
-				}, { target: "#idCapture.processing" }],
-				onError: {
-					target: "#idCapture.error",
-					actions: assign({ error: ({ event }) => String(event.error) })
-				}
-			},
-			on: {
-				QUIT: { target: "closed" },
-				MANUAL_UPLOAD_TAB_CHANGED: { actions: sendTo("manualIdUpload", ({ event }) => event) },
-				MANUAL_UPLOAD_FILE_SELECTED: { actions: sendTo("manualIdUpload", ({ event }) => event) },
-				MANUAL_UPLOAD_CONTINUE: { actions: sendTo("manualIdUpload", ({ event }) => event) },
-				MANUAL_UPLOAD_RESET: { actions: sendTo("manualIdUpload", ({ event }) => event) }
-			}
-		},
 		digitalIdUpload: {
 			invoke: {
 				id: "digitalIdUpload",
@@ -5351,28 +5461,38 @@ const idCaptureMachine = setup({
 					},
 					{
 						target: "chooser",
-						guard: "hasShowDocumentChooser"
+						guard: "hasShowDocumentChooser",
+						actions: ["clearDigitalIdAttempt"]
 					},
-					{ target: "loading" }
+					{
+						target: "loading",
+						actions: ["clearDigitalIdAttempt"]
+					}
 				],
 				onError: [{
 					target: "chooser",
-					guard: "hasShowDocumentChooser"
-				}, { target: "loading" }]
+					guard: "hasShowDocumentChooser",
+					actions: ["clearDigitalIdAttempt"]
+				}, {
+					target: "loading",
+					actions: ["clearDigitalIdAttempt"]
+				}]
 			},
 			on: { QUIT: { target: "closed" } }
 		},
 		digitalIdRedirect: {
+			exit: "clearDigitalIdAttempt",
 			invoke: {
 				id: "digitalIdRedirect",
 				src: "digitalIdRedirectMachine",
 				input: ({ context }) => {
-					const method = getDigitalIdRedirectMethod(context.config);
 					const resuming = context.digitalIdReturnParams !== void 0 && context.digitalIdResumeVerificationId !== void 0;
 					const routedProvider = context.digitalIdRoute?.kind === "trinsicRedirect" ? context.digitalIdRoute.providerId : void 0;
+					const presetProvider = (resuming ? context.digitalIdResumeProviderId : void 0) ?? routedProvider ?? context.selectedDigitalIdProviderId;
+					const method = presetProvider !== void 0 ? getDigitalIdRedirectMethod(context.config, presetProvider) : getDigitalIdRedirectMethod(context.config);
 					return {
 						config: {
-							provider: context.digitalIdResumeProviderId ?? routedProvider ?? method?.provider,
+							provider: presetProvider ?? method?.provider,
 							returnUrl: context.config.digitalIdReturnUrl,
 							country: method?.country
 						},
@@ -5479,4 +5599,4 @@ function provideIdProtectedCaptureController(machine, controller) {
 	});
 }
 //#endregion
-export { createIdProtectedCaptureController as a, DIGITAL_ID_DOCUMENT_TYPES as c, resolveDigitalIdImplementation as d, MANUAL_UPLOAD_EXHAUSTION_FORWARD_MS as f, resolveWalletPlatform as h, createIdCaptureOnlyDeliveryActor as i, DIGITAL_ID_REGISTRY as l, MANUAL_UPLOAD_MAX_RETRIES as m, provideIdProtectedCaptureController as n, findIdProtectedCaptureController as o, MANUAL_UPLOAD_MAX_FILE_SIZE_BYTES as p, attachIdProtectedCaptureController as r, getManualUploadTabs as s, idCaptureMachine as t, isRedirectFlowType as u };
+export { mapDeviceWalletScreenName as _, isRedirectFlowType as a, createIdCaptureOnlyDeliveryActor as c, captureOnlyNeedsBack as d, hasOnCaptureCallback as f, BrowserDigitalCredentialsProvider as g, createDeviceWalletManager as h, DIGITAL_ID_REGISTRY as i, createIdProtectedCaptureController as l, renderWallet as m, provideIdProtectedCaptureController as n, resolveDigitalIdImplementation as o, pickIdCaptureOnlyConfig as p, DIGITAL_ID_DOCUMENT_TYPES as r, attachIdProtectedCaptureController as s, idCaptureMachine as t, findIdProtectedCaptureController as u, resolveWalletPlatform as v };